Merge pull request #516 from CodeNow/SAN-4693-ingress-proxy

anandkumarpatel · web-flow · commit bc2cfe3a1a27 · 2016-07-20T16:37:38.000-07:00
San 4693 ingress proxy
diff --git a/ansible/api-core.yml b/ansible/api-core.yml
@@ -16,9 +16,18 @@
   - role: notify
     rollbar_token: "{{ api_rollbar_key }}"
     tags: [ notify ]
-  - { role: redis_key, tags: [ setup, redis_key ] }
-  - { role: builder, tags: [ build ] }
-  - { role: docker_client }
-  - { role: tls-client, tls_service: mongodb, tags: [ tls ] }
-  - { role: datadog, tags: [ datadog ] }
-  - { role: container_start }
+
+  - role: builder
+    tags: [ build ]
+
+  - role: docker_client
+
+  - role: tls-client
+    tags: [ tls ]
+    tls_service: mongodb
+
+  - role: datadog
+    tags: [ datadog ]
+
+  - role: container_start
+    number_of_containers: "{{ ansible_processor_cores }}"
diff --git a/ansible/consul-template-updater.yml b/ansible/consul-template-updater.yml
@@ -1,7 +1,7 @@
 ---
 - hosts: consul
 
-- hosts: userland
+- hosts: "{{ host }}"
   vars_files:
   - group_vars/{{ var_file }}
   - group_vars/alpha-consul-template-updater.yml
diff --git a/ansible/delta-hosts/hosts b/ansible/delta-hosts/hosts
@@ -15,6 +15,9 @@ delta-mongo-c
 [neo4j]
 delta-neo4j
 
+[ingress]
+delta-ingress
+
 [api_group:children]
 worker
 api
@@ -127,6 +130,7 @@ drake
 eru
 github-varnish
 hipache
+ingress
 khronos
 mavis
 metis
diff --git a/ansible/gamma-hosts/hosts b/ansible/gamma-hosts/hosts
@@ -45,6 +45,9 @@ gamma-app-services
 [navi]
 gamma-navi
 
+[ingress]
+gamma-ingress
+
 [link]
 gamma-navi
 
@@ -127,6 +130,7 @@ drake
 eru
 github-varnish
 hipache
+ingress
 khronos
 mavis
 metis
diff --git a/ansible/group_vars/alpha-api-base.yml b/ansible/group_vars/alpha-api-base.yml
@@ -4,6 +4,7 @@ node_version: 0.10.38
 npm_version: 2.8.3
 
 repo: git@github.com:CodeNow/api.git
+restart_policy: always
 
 # for sendGrid
 sendgrid_key: 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
@@ -42,6 +43,7 @@ api_base_container_envs: >-
   {% if api_new_relic_app_name is defined %} -e NEW_RELIC_LOG_LEVEL=fatal {% endif %}
   {% if api_new_relic_app_name is defined %} -e NEW_RELIC_NO_CONFIG_FILE=true {% endif %}
   -e NODE_ENV={{ node_env }}
+  -e NUM_WORKERS=1
   -e OPTIMUS_HOST=http://{{ optimus_hostname }}
   -e RABBITMQ_HOSTNAME={{ rabbit_host_address }}
   -e RABBITMQ_PASSWORD={{ rabbit_password }}
diff --git a/ansible/group_vars/alpha-ingress-proxy.yml b/ansible/group_vars/alpha-ingress-proxy.yml
@@ -0,0 +1,25 @@
+---
+name: nginx
+
+# used by consul template updater
+proxy_service_name: api
+target_container_name: nginx
+target_updater_file_path: /etc/nginx/sites-enabled
+template_command: /bin/docker kill -s HUP {{ target_container_name }}
+template_path: /etc/nginx/template/api.tmpl
+
+# used by container_kill_start
+container_image: "{{ name }}"
+container_tag: "1.10"
+
+restart_policy: always
+
+container_run_opts: >
+  -d
+  --name {{ name }}
+  -p 0.0.0.0:443:443
+  -p 0.0.0.0:80:80
+  -v /etc/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+  -v {{ target_updater_file_path }}
+  -v /etc/ssl/certs/{{ domain }}:/etc/ssl/certs/{{ domain }}:ro
+  -v /var/log/nginx:/var/log/nginx
diff --git a/ansible/group_vars/alpha-workers.yml b/ansible/group_vars/alpha-workers.yml
@@ -6,7 +6,6 @@ container_image: registry.runnable.com/runnable/{{ name }}
 container_envs: >
   {{ api_base_container_envs }}
   -e IS_QUEUE_WORKER=true
-  -e NUM_WORKERS=1
   -e ROLLBAR_KEY={{ api_workers_rollbar_key }}
 
 container_run_opts: >
diff --git a/ansible/ingress-proxy.yml b/ansible/ingress-proxy.yml
@@ -0,0 +1,16 @@
+---
+- hosts: ingress
+  vars_files:
+  - group_vars/alpha-ingress-proxy.yml
+  roles:
+  - role: datadog
+    has_dd_integration: yes
+
+  - role: runnable-domain-proxy
+
+  - role: container_kill_start
+
+- include: consul-template-updater.yml
+  vars:
+    host: ingress
+    var_file: alpha-ingress-proxy.yml
diff --git a/ansible/navi-proxy.yml b/ansible/navi-proxy.yml
@@ -12,4 +12,5 @@
 
 - include: consul-template-updater.yml
   vars:
+    host: userland
     var_file: alpha-navi-proxy.yml
diff --git a/ansible/registrator-api.yml b/ansible/registrator-api.yml
@@ -0,0 +1,11 @@
+---
+- hosts: consul
+
+- hosts: api
+  vars_files:
+  - group_vars/alpha-registrator.yml
+  roles:
+  - role: notify
+    tags: notify
+
+  - role: container_kill_start
diff --git a/ansible/registrator-navi.yml b/ansible/registrator-navi.yml
diff --git a/ansible/roles/container_kill_start/files/findTagRunning.sh b/ansible/roles/container_kill_start/files/findTagRunning.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 
 IMAGE_NAME="$1"
-CONTAINERS=`docker ps | grep -v '^CONTAINER' | awk '{print $1}'`
+CONTAINERS=`docker ps -a | grep -v '^CONTAINER' | awk '{print $1}'`
 
 if [ "" = "${CONTAINERS}" ] ; then
     exit 0
 else
     for container in ${CONTAINERS} ; do
-        docker inspect "${container}" | grep -q '"Image": "'"${IMAGE_NAME}":
+        docker inspect "${container}" 2>/dev/null| grep -q '"Image": "'"${IMAGE_NAME}": > /dev/null 2>&1
         if [ ${?} -eq 0 ] ; then
             if [ -z "${RUNNING_CONTAINERS}" ] ; then
                 RUNNING_CONTAINERS="${container}"
@@ -19,5 +19,5 @@ else
 fi
 
 if [ ! -z "${RUNNING_CONTAINERS}" ] ; then
-    echo "${RUNNING_CONTAINERS}"
+    echo "${RUNNING_CONTAINERS//['\t\r\n']}"
 fi
diff --git a/ansible/roles/container_kill_start/tasks/main.yml b/ansible/roles/container_kill_start/tasks/main.yml
@@ -22,7 +22,7 @@
   become: true
   script: findTagRunning.sh {{ container_image }}
   register: old_containers_id
-  changed_when: old_containers_id.stdout != ''
+  changed_when: old_containers_id.stdout | length > 4
 
 # get latest image
 # tag will default to latest
@@ -48,16 +48,14 @@
   tags: deploy
   when: old_containers_id.changed
   become: yes
-  command: docker stop -t {{ stop_time }} {{ item }}
-  with_items: "{{ old_containers_id.stdout_lines }}"
+  command: docker stop -t {{ stop_time }} {{ old_containers_id.stdout }}
 
 # remove the old containers that were running previously
 - name: remove old containers
   tags: deploy
   when: old_containers_id.changed
   become: yes
-  command: docker rm {{ item }}
-  with_items: "{{ old_containers_id.stdout_lines }}"
+  command: docker rm {{ old_containers_id.stdout }}
 
 - name: pause to allow for any odd conditions in system caching tables
   tags: deploy
diff --git a/ansible/roles/runnable-domain-proxy/tasks/main.yml b/ansible/roles/runnable-domain-proxy/tasks/main.yml
@@ -0,0 +1,67 @@
+---
+- name: make sure cert directory is in place
+  tags: [ configure_proxy, certs ]
+  become: true
+  file:
+    dest: /etc/ssl/certs/{{ domain }}
+    state: directory
+
+- name: put certs in place
+  tags: [ configure_proxy, certs ]
+  become: true
+  register: add_certs
+  copy:
+    src: "{{ domain }}/{{ item }}"
+    dest: /etc/ssl/certs/{{ domain }}/{{ item }}
+    mode: 0400
+    owner: root
+    group: root
+  with_items:
+  - ca.pem
+  - key.pem
+  - cert.pem
+
+- name: create chained cert
+  tags: [ configure_proxy, certs ]
+  become: true
+  when: add_certs.changed
+  shell: >
+    cat
+    /etc/ssl/certs/{{ domain }}/cert.pem
+    /etc/ssl/certs/{{ domain }}/ca.pem
+    >
+    /etc/ssl/certs/{{ domain }}/chained.pem
+
+- name: create dhparam.pem
+  tags: [ configure_proxy, certs ]
+  when: add_certs.changed
+  become: yes
+  command: openssl dhparam -out /etc/ssl/certs/{{ domain }}/dhparam.pem 2048
+
+- name: make sure nginx directory is in place
+  tags: [ configure_proxy ]
+  become: true
+  file:
+    dest: /etc/nginx
+    state: directory
+
+- name: put nginx configuration in place
+  tags: [ configure_proxy ]
+  become: yes
+  template:
+    src: proxy-nginx.conf
+    dest: /etc/nginx/nginx.conf
+
+- name: assert nginx template directory
+  tags: [ configure_proxy ]
+  become: yes
+  file:
+    state: directory
+    dest: /etc/nginx/template
+
+- name: put api template in place
+  tags: [ configure_proxy ]
+  become: yes
+  template:
+    src: api.tmpl
+    dest: /etc/nginx/template/api.tmpl
diff --git a/ansible/roles/runnable-domain-proxy/templates/api.tmpl b/ansible/roles/runnable-domain-proxy/templates/api.tmpl
@@ -0,0 +1,70 @@
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  '' close;
+}
+
+upstream {{ proxy_service_name }} {
+ {{ '{{' }}range service "{{ proxy_service_name }}"{{ '}}' }} server {{ '{{' }}.Address{{ '}}' }}:{{ '{{' }}.Port{{ '}}' }} max_fails=0 fail_timeout=1s;
+ {{ '{{' }}end{{ '}}' }}
+}
+
+server {
+  listen 80;
+  client_max_body_size 200m;
+  server_name {{ domain }};
+  access_log /var/log/nginx/{{ proxy_service_name }}.access.log;
+
+  location / {
+    proxy_pass http://{{ proxy_service_name }};
+    proxy_http_version 1.1;
+    proxy_set_header upgrade $http_upgrade;
+    proxy_set_header connection $connection_upgrade;
+
+    proxy_set_header Host $http_host;
+    proxy_set_header x-forwarded-host $http_host;
+    proxy_set_header x-real-ip $remote_addr;
+    proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
+    proxy_set_header x-forwarded-protocol $scheme;
+    proxy_set_header x-forwarded-proto $scheme;
+  }
+}
+
+server {
+  listen 443 ssl;
+  client_max_body_size 200m;
+  server_name {{ domain }};
+  access_log /var/log/nginx/{{ proxy_service_name }}.ssl.access.log;
+
+  ssl on;
+  ssl_certificate /etc/ssl/certs/{{ domain }}/chained.pem;
+  ssl_certificate_key /etc/ssl/certs/{{ domain }}/key.pem;
+  ssl_trusted_certificate /etc/ssl/certs/{{ domain }}/ca.pem;
+  ssl_dhparam /etc/ssl/certs/{{ domain }}/dhparam.pem;
+
+  ssl_session_cache shared:SSL:10m;
+  ssl_session_timeout 10m;
+
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+  ssl_prefer_server_ciphers on;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  resolver 8.8.8.8 8.8.4.4 valid=300s;
+  resolver_timeout 5s;
+
+  location / {
+    proxy_pass http://{{ proxy_service_name }};
+    proxy_http_version 1.1;
+    proxy_set_header upgrade $http_upgrade;
+    proxy_set_header connection $connection_upgrade;
+
+
+    proxy_set_header Host $http_host;
+    proxy_set_header x-forwarded-host $http_host;
+    proxy_set_header x-real-ip $remote_addr;
+    proxy_set_header x-forwarded-for $proxy_add_x_forwarded_for;
+    proxy_set_header x-forwarded-protocol $scheme;
+    proxy_set_header x-forwarded-proto $scheme;
+  }
+}
diff --git a/ansible/roles/runnable-domain-proxy/templates/proxy-nginx.conf b/ansible/roles/runnable-domain-proxy/templates/proxy-nginx.conf
@@ -0,0 +1,29 @@
+user www-data;
+worker_processes 4;
+pid /run/nginx.pid;
+
+events {
+  worker_connections 5000;
+}
+
+http {
+  ##
+  # Basic Settings
+  ##
+  tcp_nodelay on;
+  keepalive_timeout 65;
+  server_tokens off;
+
+  ##
+  # Logging Settings
+  ##
+
+  access_log /var/log/nginx/access.log;
+  error_log /var/log/nginx/error.log;
+
+  ##
+  # Virtual Host Configs
+  ##
+
+  include /etc/nginx/sites-enabled/*;
+}
diff --git a/ssh/config b/ssh/config
@@ -53,6 +53,10 @@ Host 10.4.*.*
   ProxyCommand ssh -o StrictHostKeyChecking=no -q ubuntu@gamma-bastion nc %h %p
   IdentityFile ~/.ssh/gamma.pem
 
+## Gamma Ingress
+Host gamma-ingress
+  ProxyCommand ssh -q ubuntu@gamma-bastion nc 10.4.0.236 22
+
 ## Gamma Userland Hipache
 Host gamma-userland
   ProxyCommand ssh -q ubuntu@gamma-bastion nc 10.4.2.208 22
@@ -170,6 +174,9 @@ Host delta-consul-b
 Host delta-consul-c
   ProxyCommand ssh -q ubuntu@delta-bastion nc 10.8.14.86 22
 
+Host delta-ingress
+  ProxyCommand ssh -q ubuntu@delta-bastion nc 10.8.0.219 22
+
 Host delta-registry
   ProxyCommand ssh -q ubuntu@delta-bastion nc 10.8.4.126 22
 
