14660: Proxy keep-web for https. Install root cert inside the container.

Now services inside the container can talk to each other without the
"insecure" flag.

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <pamstutz@veritasgenetics.com>

diff --git a/tools/arvbox/lib/arvbox/docker/api-setup.sh b/tools/arvbox/lib/arvbox/docker/api-setup.sh
index ca706ea811ddc4fd6a91e139dd5ea7bc91841de3..0f283830f5b4e62fec3f59d761bdfb6704163e4e 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/api-setup.sh
+++ b/tools/arvbox/lib/arvbox/docker/api-setup.sh
@@ -55,7 +55,7 @@ $RAILS_ENV:
   sso_app_secret: $sso_app_secret
   sso_app_id: arvados-server
   sso_provider_url: "https://$localip:${services[sso]}"
-  sso_insecure: true
+  sso_insecure: false
   workbench_address: "https://$localip/"
   websocket_address: "wss://$localip:${services[websockets-ssl]}/websocket"
   git_repo_ssh_base: "git@$localip:"
@@ -67,7 +67,7 @@ $RAILS_ENV:
   auto_setup_new_users_with_repository: true
   default_collection_replication: 1
   docker_image_formats: ["v2"]
-  keep_web_service_url: http://$localip:${services[keep-web]}/
+  keep_web_service_url: https://$localip:${services[keep-web-ssl]}/
   ManagementToken: $management_token
 EOF
 

diff --git a/tools/arvbox/lib/arvbox/docker/common.sh b/tools/arvbox/lib/arvbox/docker/common.sh
index d14e45d0b2ae343bfc7d29a8775c3ab34babc20a..56d0fa01351c20e02039ca0d801dcf3e8ca10cbd 100644 (file)
--- a/tools/arvbox/lib/arvbox/docker/common.sh
+++ b/tools/arvbox/lib/arvbox/docker/common.sh
@@ -28,7 +28,8 @@ services=(
   [sso]=8900
   [composer]=4200
   [arv-git-httpd]=9001
-  [keep-web]=9002
+  [keep-web]=9003
+  [keep-web-ssl]=9002
   [keepproxy]=25100
   [keepstore0]=25107
   [keepstore1]=25108

diff --git a/tools/arvbox/lib/arvbox/docker/service/certificate/log/main/.gitstub b/tools/arvbox/lib/arvbox/docker/service/certificate/log/main/.gitstub
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/tools/arvbox/lib/arvbox/docker/service/certificate/log/run b/tools/arvbox/lib/arvbox/docker/service/certificate/log/run
new file mode 120000 (symlink)
index 0000000..d6aef4a
--- /dev/null
+++ b/tools/arvbox/lib/arvbox/docker/service/certificate/log/run
@@ -0,0 +1 @@
+/usr/local/lib/arvbox/logger
\ No newline at end of file

diff --git a/tools/arvbox/lib/arvbox/docker/service/certificate/run b/tools/arvbox/lib/arvbox/docker/service/certificate/run
new file mode 100755 (executable)
index 0000000..2b802f2
--- /dev/null
+++ b/tools/arvbox/lib/arvbox/docker/service/certificate/run
@@ -0,0 +1,81 @@
+#!/bin/bash
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: AGPL-3.0
+
+exec 2>&1
+set -ex -o pipefail
+
+. /usr/local/lib/arvbox/common.sh
+
+if test ! -s /var/lib/arvados/root-cert.pem ; then
+    # req           signing request sub-command
+    # -new          new certificate request
+    # -nodes        "no des" don't encrypt key
+    # -sha256       include sha256 fingerprint
+    # -x509         generate self-signed certificate
+    # -subj         certificate subject
+    # -reqexts      certificate request extension for subjectAltName
+    # -extensions   certificate request extension for subjectAltName
+    # -config       certificate generation configuration plus subjectAltName
+    # -out          certificate output
+    # -keyout       private key output
+    # -days         certificate lifetime
+    openssl req \
+           -new \
+           -nodes \
+           -sha256 \
+           -x509 \
+           -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=arvbox testing root CA for ${uuid_prefix}" \
+           -extensions x509_ext \
+           -config <(cat /etc/ssl/openssl.cnf \
+                         <(printf "\n[x509_ext]\nbasicConstraints=critical,CA:true,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign")) \
+            -out /var/lib/arvados/root-cert.pem \
+            -keyout /var/lib/arvados/root-cert.key \
+            -days 365
+    chown arvbox:arvbox /var/lib/arvados/root-cert.*
+fi
+
+if test ! -s /var/lib/arvados/server-cert-${localip}.pem ; then
+    # req           signing request sub-command
+    # -new          new certificate request
+    # -nodes        "no des" don't encrypt key
+    # -sha256       include sha256 fingerprint
+    # -subj         certificate subject
+    # -reqexts      certificate request extension for subjectAltName
+    # -extensions   certificate request extension for subjectAltName
+    # -config       certificate generation configuration plus subjectAltName
+    # -out          certificate output
+    # -keyout       private key output
+    # -days         certificate lifetime
+    openssl req \
+           -new \
+           -nodes \
+           -sha256 \
+           -subj "/C=US/ST=MA/O=Arvados testing for ${uuid_prefix}/OU=arvbox/CN=localhost" \
+           -reqexts x509_ext \
+           -extensions x509_ext \
+           -config <(cat /etc/ssl/openssl.cnf \
+                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
+            -out /var/lib/arvados/server-cert-${localip}.csr \
+            -keyout /var/lib/arvados/server-cert-${localip}.key \
+            -days 365
+
+    openssl x509 \
+           -req \
+           -in /var/lib/arvados/server-cert-${localip}.csr \
+           -CA /var/lib/arvados/root-cert.pem \
+           -CAkey /var/lib/arvados/root-cert.key \
+           -out /var/lib/arvados/server-cert-${localip}.pem \
+           -set_serial $RANDOM$RANDOM \
+           -extfile <(cat /etc/ssl/openssl.cnf \
+                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
+           -extensions x509_ext
+
+    chown arvbox:arvbox /var/lib/arvados/server-cert-${localip}.*
+fi
+
+cp /var/lib/arvados/root-cert.pem /usr/local/share/ca-certificates/arvados-testing-cert.crt
+update-ca-certificates
+
+sv stop certificate
\ No newline at end of file

diff --git a/tools/arvbox/lib/arvbox/docker/service/gitolite/run-service b/tools/arvbox/lib/arvbox/docker/service/gitolite/run-service
index eea0e120b29917d31f25016da47e94394804a8c5..6055efc4791e93978ac806f2f3111d7e15c758bb 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/gitolite/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/gitolite/run-service
@@ -114,7 +114,7 @@ $RAILS_ENV:
   gitolite_tmp: /var/lib/arvados/git
   arvados_api_host: $localip:${services[controller-ssl]}
   arvados_api_token: "$ARVADOS_API_TOKEN"
-  arvados_api_host_insecure: true
+  arvados_api_host_insecure: false
   gitolite_arvados_git_user_key: "$git_user_key"
 EOF
 

diff --git a/tools/arvbox/lib/arvbox/docker/service/nginx/run-service b/tools/arvbox/lib/arvbox/docker/service/nginx/run-service
index f2b0a89d2c2077cdaec3dd4d07f4cac8c365202c..0893069706cdb7f3ab553c38c701abb8bb6adbf4 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/nginx/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/nginx/run-service
@@ -88,6 +88,23 @@ server {
     }
   }
 
+  upstream keep-web {
+    server localhost:${services[keep-web]};
+  }
+  server {
+    listen *:${services[keep-web-ssl]} ssl default_server;
+    server_name keep-web;
+    ssl_certificate "/var/lib/arvados/server-cert-${localip}.pem";
+    ssl_certificate_key "/var/lib/arvados/server-cert-${localip}.key";
+    location  / {
+      proxy_pass http://keep-web;
+      proxy_set_header Host \$http_host;
+      proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_redirect off;
+    }
+  }
+
 }
 
 EOF

diff --git a/tools/arvbox/lib/arvbox/docker/service/sso/run-service b/tools/arvbox/lib/arvbox/docker/service/sso/run-service
index 278d94e82ec9c2f42065755c066f07f3f78baf09..af49d4b3c0f829618f6572b800b5eb85597fc779 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/sso/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/sso/run-service
@@ -35,69 +35,7 @@ if ! test -s /var/lib/arvados/sso_secret_token ; then
 fi
 secret_token=$(cat /var/lib/arvados/sso_secret_token)
 
-if test ! -s /var/lib/arvados/root-cert.pem ; then
-    # req           signing request sub-command
-    # -new          new certificate request
-    # -nodes        "no des" don't encrypt key
-    # -sha256       include sha256 fingerprint
-    # -x509         generate self-signed certificate
-    # -subj         certificate subject
-    # -reqexts      certificate request extension for subjectAltName
-    # -extensions   certificate request extension for subjectAltName
-    # -config       certificate generation configuration plus subjectAltName
-    # -out          certificate output
-    # -keyout       private key output
-    # -days         certificate lifetime
-    openssl req \
-           -new \
-           -nodes \
-           -sha256 \
-           -x509 \
-           -subj "/C=US/ST=MA/O=Arvados testing/OU=arvbox/CN=arvbox testing root CA for ${uuid_prefix}" \
-           -extensions x509_ext \
-           -config <(cat /etc/ssl/openssl.cnf \
-                         <(printf "\n[x509_ext]\nbasicConstraints=critical,CA:true,pathlen:0\nkeyUsage=critical,keyCertSign,cRLSign")) \
-            -out /var/lib/arvados/root-cert.pem \
-            -keyout /var/lib/arvados/root-cert.key \
-            -days 365
-fi
-
-if test ! -s /var/lib/arvados/server-cert-${localip}.pem ; then
-    # req           signing request sub-command
-    # -new          new certificate request
-    # -nodes        "no des" don't encrypt key
-    # -sha256       include sha256 fingerprint
-    # -subj         certificate subject
-    # -reqexts      certificate request extension for subjectAltName
-    # -extensions   certificate request extension for subjectAltName
-    # -config       certificate generation configuration plus subjectAltName
-    # -out          certificate output
-    # -keyout       private key output
-    # -days         certificate lifetime
-    openssl req \
-           -new \
-           -nodes \
-           -sha256 \
-           -subj "/C=US/ST=MA/O=Arvados testing for ${uuid_prefix}/OU=arvbox/CN=localhost" \
-           -reqexts x509_ext \
-           -extensions x509_ext \
-           -config <(cat /etc/ssl/openssl.cnf \
-                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
-            -out /var/lib/arvados/server-cert-${localip}.csr \
-            -keyout /var/lib/arvados/server-cert-${localip}.key \
-            -days 365
-
-    openssl x509 \
-           -req \
-           -in /var/lib/arvados/server-cert-${localip}.csr \
-           -CA /var/lib/arvados/root-cert.pem \
-           -CAkey /var/lib/arvados/root-cert.key \
-           -out /var/lib/arvados/server-cert-${localip}.pem \
-           -set_serial $RANDOM$RANDOM \
-           -extfile <(cat /etc/ssl/openssl.cnf \
-                         <(printf "\n[x509_ext]\nkeyUsage=critical,digitalSignature,keyEncipherment\nsubjectAltName=DNS:localhost,IP:$localip")) \
-           -extensions x509_ext
-fi
+test -s /var/lib/arvados/server-cert-${localip}.pem
 
 cat >config/application.yml <<EOF
 $RAILS_ENV:

diff --git a/tools/arvbox/lib/arvbox/docker/service/websockets/run-service b/tools/arvbox/lib/arvbox/docker/service/websockets/run-service
index 417130852625e32ca164250a2d4762a45ee83cfe..cc330324743a4814bb4c9fee4e4a22e7b1a287de 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/websockets/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/websockets/run-service
@@ -28,7 +28,7 @@ database_pw=$(cat /var/lib/arvados/api_database_pw)
 cat >/var/lib/arvados/arvados-ws.yml <<EOF
 Client:
   APIHost: $localip:${services[controller-ssl]}
-  Insecure: true
+  Insecure: false
 Postgres:
   dbname: arvados_$RAILS_ENV
   user: arvados

diff --git a/tools/arvbox/lib/arvbox/docker/service/workbench/run-service b/tools/arvbox/lib/arvbox/docker/service/workbench/run-service
index 5d375775557087254ef8ecea3d1c52f5a8cb1323..68c87233f0001b25a05e38917a3b1356fa49822c 100755 (executable)
--- a/tools/arvbox/lib/arvbox/docker/service/workbench/run-service
+++ b/tools/arvbox/lib/arvbox/docker/service/workbench/run-service
@@ -38,9 +38,9 @@ $RAILS_ENV:
   secret_token: $secret_token
   arvados_login_base: https://$localip:${services[controller-ssl]}/login
   arvados_v1_base: https://$localip:${services[controller-ssl]}/arvados/v1
-  arvados_insecure_https: true
-  keep_web_download_url: http://$localip:${services[keep-web]}/c=%{uuid_or_pdh}
-  keep_web_url: http://$localip:${services[keep-web]}/c=%{uuid_or_pdh}
+  arvados_insecure_https: false
+  keep_web_download_url: https://$localip:${services[keep-web-ssl]}/c=%{uuid_or_pdh}
+  keep_web_url: https://$localip:${services[keep-web-ssl]}/c=%{uuid_or_pdh}
   arvados_docsite: http://$localip:${services[doc]}/
   force_ssl: false
   composer_url: http://$localip:${services[composer]}