deep-stack/testnet-ops
3
0
Fork 0
forked from cerc-io/testnet-ops
Code Pull Requests Activity

Add steps to clean up service provider setup (#14)

Browse Source 
Part of [Service Provider Setup](https://www.notion.so/Service-provider-setup-a09e2207e1f34f3a847f7ce9713b7ac5)
- Move user setup playbook to separate directory
- Remove unneeded variables

Co-authored-by: Adw8 <adwaitgharpure@gmail.com>
Reviewed-on: cerc-io/testnet-ops#14
This commit is contained in:
nabarun
2024-10-23 06:53:07 +00:00
co-authored by Adw8
parent 2e0fbd82f1
commit 65be098ce9
19 changed files with 287 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files
service-provider-setup/README.md
+108 -89
View File
@@ -1,76 +1,16 @@
# service-provider-setup
## Setup Ansible
To get started, follow the [installation](../README.md#installation) guide to setup ansible on your machine
## Prerequisites
- Setup Ansible: follow the [installation](../README.md#installation) guide to setup ansible on your machine
- Set up a DigitalOcean Droplet with passwordless SSH access
- Buy a domain and configure [nameservers pointing to DigitalOcean](https://docs.digitalocean.com/products/networking/dns/getting-started/dns-registrars/)
- Generate a DigitalOcean access token, used for API authentication and managing cloud resources
## Setup a new User
- Create a new `hosts.ini` file:
```bash
cp ../hosts.example.ini hosts.ini
```
- Edit the [`hosts.ini`](./hosts.ini) file to run the playbook on a remote machine:
```ini
[root_host]
<host_name> ansible_host=<target_ip> ansible_user=<ssh_user> ansible_ssh_common_args='-o ForwardAgent=yes'
```
- Replace `<host_name>` with the desired `hostname` of the remote machine
- Replace `<target_ip>` with the IP address or hostname of the target machine
- Replace `<ssh_user>` with `root`
- Verify that you are able to connect to the host using the following command:
```bash
ansible all -m ping -i hosts.ini
# Expected output:
# <host_name> | SUCCESS => {
# "ansible_facts": {
# "discovered_interpreter_python": "/usr/bin/python3.10"
# },
# "changed": false,
# "ping": "pong"
# }
```
- Setup `user-vars.yml` using the example file
```bash
cp vars/user-vars.example.yml vars/user-vars.yml
```
- Edit the `user-vars.yml` file:
```bash
# name of the user you want to setup on the target host
username: ""
# password of the user you want to setup on the target host
password: ""
# path to the ssh key on your machine, eg: "/home/user/.ssh/id_rsa.pub"
path_to_ssh_key: ""
```
- Execute the `setup-user.yml` Ansible playbook to create a user with passwordless sudo permissions:
```bash
LANG=en_US.utf8 ansible-playbook setup-user.yml -i hosts.ini --extra-vars='{ "target_host": "deployment_host" }'
```
- Setup a user: Follow steps from [Setup a user](../user-setup/README.md#setup-a-user) to setup a new user with passwordless sudo
## Become a Service Provider
@@ -93,47 +33,47 @@ To get started, follow the [installation](../README.md#installation) guide to se
```bash
# vars/dns-vars.yml
full_domain: "" # eg: laconic.com
subdomain_prefix: "" # eg: lcn-cad
service_provider_ip: "" # eg: 23.111.78.179
do_api_token: "" # DigitalOcean access token that you generated, eg: dop_v1...
full_domain: "" # eg: laconic.com
service_provider_ip: "" # eg: 23.111.78.179
do_api_token: "" # DigitalOcean access token that you generated, eg: dop_v1...
# vars/gpg-vars.yml
gpg_user_name: "" # full name of the user for the GPG key
gpg_user_email: "" # email address associated with the GPG key
gpg_passphrase: "" # passphrase for securing the GPG key
gpg_user_name: "" # full name of the user for the GPG key
gpg_user_email: "" # email address associated with the GPG key
gpg_passphrase: "" # passphrase for securing the GPG key
# vars/k8s-vars.yml
target_host: "deployment_host"
org_id: "" # eg: lcn
location_id: "" # eg: cad
base_domain: "" # eg: laconic
support_email: "" # eg: support@laconic.com
org_id: "" # eg: lcn
location_id: "" # eg: cad
support_email: "" # eg: support@laconic.com
# vars/container-vars.yml
container_registry_username: "" # username to login to the container registry
container_registry_password: "" # password to login to the container registry
container_registry_username: "" # username to login to the container registry
container_registry_password: "" # password to login to the container registry
# vars/laconicd-vars.yml
chain_id: "" # chain id to use for the Laconic chain
# vars/webapp-vars.yml
authority_name: "" # eg: my-org-name
cpu_reservation: "" # minimum number of cpu cores to be used, eg: 2
memory_reservation: "" # minimum amount of memory in GB to be used, eg: 4G
cpu_limit: "" # maximum number of cpu cores to be used, eg: 6
memory_limit: "" # maximum amount of memory in GB to be used, eg: 8G
deployer_gpg_passphrase: "" # passphrase for creating GPG key used by webapp-deployer, eg: SECRET
handle_auction_requests: "" # whether the webapp deployer should handle deployment auction requests, eg: true
auction_bid_amount: "" # bid amount for deployment auctions in alnt, eg: 500000
authority_name: "" # eg: laconic-authority
cpu_reservation: "1" # minimum number of cpu cores to be used, eg: 2
memory_reservation: "2G" # minimum amount of memory in GB to be used, eg: 4G
cpu_limit: "6" # maximum number of cpu cores to be used, eg: 6
memory_limit: "8G" # maximum amount of memory in GB to be used, eg: 8G
deployer_gpg_passphrase: "" # passphrase for creating GPG key used by webapp-deployer, eg: SECRET
handle_auction_requests: "true" # whether the webapp deployer should handle deployment auction requests, eg: true
auction_bid_amount: "500000" # bid amount for deployment auctions in alnt, eg: 500000
```
- Update the [`hosts.ini`](./hosts.ini) file:
- Create a new `hosts.ini` file:
```bash
cp ../hosts.example.ini hosts.ini
```
- Edit the [`hosts.ini`](./hosts.ini) file:
```ini
[root_host]
<host_name> ansible_host=<target_ip> ansible_user=root ansible_ssh_common_args='-o ForwardAgent=yes'
[deployment_host]
<host_name> ansible_host=<target_ip> ansible_user=<new_username> ansible_ssh_common_args='-o ForwardAgent=yes'
```
@@ -178,3 +118,82 @@ After the playbook finishes executing, the following services will be deployed (
- laconic console: <http://lcn-console.laconic.com:8080/registry>
- webapp deployer API: <https://webapp-deployer-api.pwa.laconic.com>
- webapp deployer UI: <https://webapp-deployer-ui.pwa.laconic.com>
## Cleanup
Run the following steps on the target machine to stop the webapp-deployer, container-registry, fixturenet-laconicd and laconic-console-deployment, undeploy k8s, remove GPG keys and DNS records
- Stop deployments
```
$ laconic-so deployment --dir webapp-ui stop
$ laconic-so deployment --dir webapp-deployer
$ laconic-so deployment --dir container-registry stop
$ laconic-so deployment --dir laconic-console-deployment stop --delete-volumes
$ laconic-so deployment --dir fixturenet-laconicd-deployment stop --delete-volumes
```
- Remove deployment directories
```
sudo rm -rf webapp-ui
sudo rm -rf webapp-deployer
sudo rm -rf container-registry
sudo rm -rf laconic-console-deployment
sudo rm -rf fixturenet-laconicd-deployment
```
- Remove spec files
```
rm webapp-deployer.spec
rm container-registry.spec
rm laconic-console-spec.yml
rm fixturenet-laconicd-spec.yml
```
- Undeploy the k8s
```
$ cd service-provider-template
$ export VAULT_KEY=<gpg_passphrase>
$ bash .vault/vault-rekey.sh
$ ansible-playbook -i hosts site.yml --tags=k8s --limit=<org_id>_<location_id> --user <user> --extra-vars 'k8s_action=destroy'
```
- Remove service-provider-template repo
```
$ rm -rf service-provider-template
```
- Remove any existing GPG keys
```
$ rm -rf gpg-keys/
$ gpg --list-secret-keys --keyid-format=long
/home/dev/.gnupg/pubring.kbx
----------------------------
sec rsa4096/DA9E3D638930A699 2024-10-15 [SCEA]
69A3200727091E72B773BBEBDA9E3D638930A699
uid [ultimate] deepstack <support@deepstacksoft.com>
ssb rsa3072/2B5D80CF44753EFD 2024-10-15 [SEA]
sec rsa3072/2449A62C838440AB 2024-10-15 [SC]
646A42164F978DC1415C11F12449A62C838440AB
uid [ultimate] webapp-deployer-api.deepstack.com
ssb rsa3072/67576558A2F2FE91 2024-10-15 [E]
$ gpg --delete-secret-key 69A3200727091E72B773BBEBDA9E3D638930A699
$ gpg --delete-key 69A3200727091E72B773BBEBDA9E3D638930A699
$ gpg --delete-secret-key 646A42164F978DC1415C11F12449A62C838440AB
$ gpg --delete-key 646A42164F978DC1415C11F12449A62C838440AB
```
- Remove the user if required
```bash
$ userdel <user>
# If required, kill process that is using the user
# userdel: user <user> is currently used by process 1639
# $ kill -9 1639
```
- Remove DNS records using DigitalOcean's API:
- <https://docs.digitalocean.com/reference/api/api-try-it-now/#/Domain%20Records/domains_delete_record>
service-provider-setup/setup-k8s.yml
+3 -2
View File
@@ -66,6 +66,7 @@
command: gpg-agent --daemon
ignore_errors: yes
# Cache GPG passphrase by signing a dummy string to avoid passphrase prompts in later steps
- name: Sign a dummy string using gpg-key
shell: echo "This is a dummy string." | gpg --batch --yes --local-user "{{ gpg_key_id }}" --passphrase "{{ vault_passphrase }}" --pinentry-mode loopback --sign -
@@ -124,10 +125,10 @@
src: ./templates/k8s.yml.j2
dest: "{{ ansible_env.HOME }}/service-provider-template/group_vars/{{ org_id }}_{{ location_id }}/k8s.yml"
- name: Copy wildcard-pwa-{{ base_domain }}.yaml to the remote VM
- name: Copy wildcard template to the remote VM
template:
src: ./templates/wildcard-pwa-example.yml.j2
dest: "{{ ansible_env.HOME }}/service-provider-template/files/manifests/wildcard-pwa-{{ base_domain }}.yaml"
dest: "{{ ansible_env.HOME }}/service-provider-template/files/manifests/wildcard-pwa-{{ full_domain | replace('.', '-') }}.yaml"
- name: Delete old wildcard-pwa file
file:
service-provider-setup/setup-user.yml
-46
View File
@@ -1,46 +0,0 @@
- name: Configure system
hosts: root_host
become: yes
vars_files:
- vars/user-vars.yml
tasks:
- name: Create a user
user:
name: "{{ username }}"
password: "{{ '{{ password }}' | password_hash('sha512') }}"
shell: /bin/bash
state: present
- name: Add user to sudoers group
user:
name: "{{ username }}"
groups: sudo
append: yes
- name: Ensure .ssh directory exists for user
file:
path: /home/{{ username }}/.ssh
state: directory
owner: "{{ username }}"
group: "{{ username }}"
mode: '0700'
- name: Append SSH public key to authorized_keys
lineinfile:
path: /home/{{ username }}/.ssh/authorized_keys
line: "{{ lookup('file', path_to_ssh_key) }}"
create: yes
owner: "{{ username }}"
group: "{{ username }}"
mode: '0600'
state: present
- name: Add user to sudoers for passwordless sudo
lineinfile:
path: /etc/sudoers
state: present
regexp: '^{{ username }} ALL=\(ALL\) NOPASSWD:ALL'
line: '{{ username }} ALL=(ALL) NOPASSWD:ALL'
validate: 'visudo -cf %s'
service-provider-setup/templates/k8s.yml.j2
+1 -1
View File
@@ -52,4 +52,4 @@ k8s_manifests:
# initiate wildcard cert
- name: pwa.{{ full_domain }}
type: file
source: wildcard-pwa-{{ base_domain }}.yaml
source: wildcard-pwa-{{ full_domain | replace('.', '-') }}.yaml
service-provider-setup/vars/dns-vars.example.yml
+1 -1
View File
@@ -1,5 +1,5 @@
full_domain: ""
subdomain_prefix: ""
subdomain_prefix: "{{ org_id }}-{{ location_id }}"
subdomain_cluster_control: "{{ subdomain_prefix }}-cluster-control"
service_provider_ip: ""
do_api_token: ""
service-provider-setup/vars/k8s-vars.example.yml
-1
View File
@@ -2,6 +2,5 @@ gpg_key_id: "{{ sec_key_id }}"
vault_passphrase: "{{ gpg_passphrase }}"
org_id: ""
location_id: ""
base_domain: ""
support_email: ""
ansible_ssh_extra_args: '-o StrictHostKeyChecking=no'
service-provider-setup/vars/user-vars.example.yml
-3
View File
@@ -1,3 +0,0 @@
username: ""
password: ""
path_to_ssh_key: ""
service-provider-setup/vars/webapp-vars.example.yml
+4 -4
View File
@@ -1,10 +1,10 @@
ALICE_PK: "{{ ALICE_PK }}"
BOND_ID: "{{ BOND_ID }}"
authority_name: ""
cpu_reservation: ""
memory_reservation: ""
cpu_reservation: "1"
memory_reservation: "2G"
cpu_limit: "6"
memory_limit: "8G"
deployer_gpg_passphrase: ""
handle_auction_requests: "false"
auction_bid_amount: "0"
handle_auction_requests: "true"
auction_bid_amount: "500000"