Merge pull request #310 from OktopUSP/add_tls_deploy

Add TLS config to local deploy compose

deploy/compose/.env.acs

@@ -1 +1,5 @@
-NATS_URL=nats://msg_broker:4222
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.adapter

@@ -1,2 +1,6 @@
-NATS_URL=nats://msg_broker:4222
 MONGO_URI=mongodb://mongo_usp:27017
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.controller

@@ -1,2 +1,7 @@
-NATS_URL=nats://msg_broker:4222
 MONGO_URI=mongodb://mongo_usp:27017
+ENTERPRISE="true"
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.mqtt

@@ -1,3 +1,7 @@
 REDIS_ENABLE=false
 REDIS_ADDR=redis_usp:6379
-NATS_URL=nats://msg_broker:4222
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.mqtt-adapter

@@ -1,2 +1,6 @@
-NATS_URL=nats://msg_broker:4222
 MQTT_URL=tcp://mqtt:1883
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.nats

@@ -0,0 +1,3 @@
+NATS_NAME=oktopus
+NATS_USER=oktopususer
+NATS_PW=oktopuspw

deploy/compose/.env.socketio

@@ -1 +1,5 @@
-NATS_URL=nats://msg_broker:4222
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.stomp-adapter

@@ -1,2 +1,6 @@
-NATS_URL=nats://msg_broker:4222
 STOMP_SERVER=stomp:61613
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.ws

@@ -1 +1,5 @@
-NATS_URL=nats://msg_broker:4222
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/.env.ws-adapter

@@ -1,2 +1,6 @@
-NATS_URL=nats://msg_broker:4222
 WS_ADDR=ws
+NATS_URL=nats://oktopususer:oktopuspw@msg_broker:4222
+NATS_ENABLE_TLS="true"
+CLIENT_CRT=/tmp/nats/config/cert.pem
+CLIENT_KEY=/tmp/nats/config/key.pem
+SERVER_CA=/tmp/nats/config/rootCA.pem

deploy/compose/docker-compose.yaml

@@ -1,24 +1,26 @@
 services:
-
+  #/* ----------------------------- Message Broker ----------------------------- */
-#/* ----------------------------- Message Broker ----------------------------- */
   msg_broker:
-    image: 'nats:latest'
+    image: "nats:latest"
     container_name: nats
     ports:
       - 4222:4222
       - 8222:8222
-    command: -n oktopus -m 8222 -js
+    command: -c /tmp/nats/config/nats.cfg
+    env_file:
+      - .env.nats
     volumes:
       - ./nats_data:/tmp/nats/jetstream
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.2
     profiles: [nats]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* ------------------------ API REST / USP Controller ----------------------- */
+  #/* ------------------------ API REST / USP Controller ----------------------- */
   controller:
-    image: 'oktopusp/controller'
+    image: "oktopusp/controller"
     container_name: controller
     ports:
       - 8000:8000
@@ -26,13 +28,15 @@ services:
       - mongo_usp
     env_file:
       - .env.controller
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.3
     profiles: [controller]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* ---------------------------- Databases / Cache --------------------------- */
+  #/* ---------------------------- Databases / Cache --------------------------- */
   mongo_usp:
     image: mongo
     container_name: mongo_usp
@@ -43,38 +47,42 @@ services:
         ipv4_address: 172.16.235.4
     volumes:
       - ./mongo_data:/data/db
-    profiles: [controller,adapter]
+    profiles: [controller, adapter]
 
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* ----------------------- Message Transfer Protocols ----------------------- */
+  #/* ----------------------- Message Transfer Protocols ----------------------- */
   mqtt:
-    image: 'oktopusp/mqtt'
+    image: "oktopusp/mqtt"
     container_name: mqtt
     ports:
       - 1883:1883
       - 8883:8883
     env_file:
       - .env.mqtt
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.6
     profiles: [mqtt]
 
   ws:
-    image: 'oktopusp/ws'
+    image: "oktopusp/ws"
     container_name: websockets
     ports:
       - 8080:8080
     env_file:
       - .env.ws
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.7
     profiles: [ws]
 
   stomp:
-    image: 'oktopusp/stomp'
+    image: "oktopusp/stomp"
     container_name: stomp
     ports:
       - 61613:61613
@@ -82,76 +90,85 @@ services:
       usp_network:
         ipv4_address: 172.16.235.8
     profiles: [stomp]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* --------------- Message transfer Protocols Adapters to NATS -------------- */
+  #/* --------------- Message transfer Protocols Adapters to NATS -------------- */
   mqtt-adapter:
-    image: 'oktopusp/mqtt-adapter'
+    image: "oktopusp/mqtt-adapter"
     container_name: mqtt-adapter
     depends_on:
       - mqtt
     env_file:
       - .env.mqtt-adapter
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.9
     profiles: [mqtt]
 
-
   ws-adapter:
-    image: 'oktopusp/ws-adapter'
+    image: "oktopusp/ws-adapter"
     container_name: ws-adapter
     depends_on:
       - ws
     env_file:
       - .env.ws-adapter
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.10
     profiles: [ws]
 
   stomp-adapter:
-    image: 'oktopusp/stomp-adapter'
+    image: "oktopusp/stomp-adapter"
     container_name: stomp-adapter
     depends_on:
       - stomp
     env_file:
       - .env.stomp-adapter
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.11
     profiles: [stomp]
 
   adapter:
-    image: 'oktopusp/adapter'
+    image: "oktopusp/adapter"
     container_name: adapter
     depends_on:
       - mongo_usp
     env_file:
       - .env.adapter
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.12
     profiles: [adapter]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* ------------- SocketIO Real Time Communication With Frontend ------------- */
+  #/* ------------- SocketIO Real Time Communication With Frontend ------------- */
   socketio:
-    image: 'oktopusp/socketio'
+    image: "oktopusp/socketio"
     container_name: socketio
     ports:
       - 5000:5000
     env_file:
       - .env.socketio
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.13
     profiles: [frontend]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
-#/* -------------------------------- Frontend -------------------------------- */
+  #/* -------------------------------- Frontend -------------------------------- */
   frontend:
-    image: 'oktopusp/frontend-ce'
+    image: "oktopusp/frontend-ce"
     container_name: frontend
     ports:
       - 3000:3000
@@ -159,7 +176,7 @@ services:
       usp_network:
         ipv4_address: 172.16.235.14
     profiles: [frontend]
-#/* -------------------------------------------------------------------------- */
+  #/* -------------------------------------------------------------------------- */
 
   portainer:
     image: portainer/portainer-ce:latest
@@ -175,12 +192,14 @@ services:
       - ./portainer_data:/data
 
   acs:
-    image: oktopusp/acs
+    image: "oktopusp/acs"
     container_name: acs
     ports:
       - 9292:9292
     env_file:
       - .env.acs
+    volumes:
+      - ./nats_config:/tmp/nats/config
     networks:
       usp_network:
         ipv4_address: 172.16.235.16

deploy/compose/nats_config/cert.pem

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEeTCCAuGgAwIBAgIRAJenDys60PD3Cjh9VXeAzsowDQYJKoZIhvcNAQELBQAw
+gY0xHjAcBgNVBAoTFW1rY2VydCBkZXZlbG9wbWVudCBDQTExMC8GA1UECwwoY2hp
+ZXNhQEFkcmlhbm9NYWMubG9jYWwgKEFkcmlhbm8gQ2hpZXNhKTE4MDYGA1UEAwwv
+bWtjZXJ0IGNoaWVzYUBBZHJpYW5vTWFjLmxvY2FsIChBZHJpYW5vIENoaWVzYSkw
+HhcNMjQwNzA2MTQzODQ2WhcNMjYxMDA2MTQzODQ2WjBcMScwJQYDVQQKEx5ta2Nl
+cnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUxMTAvBgNVBAsMKGNoaWVzYUBBZHJp
+YW5vTWFjLmxvY2FsIChBZHJpYW5vIENoaWVzYSkwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCdQCgwn7M5jtkNzYv/yUelUV84ehsYjPTQspCXCjDdUltO
+E6jafRM/2SopUWwzPTorIZkerIpqq/avi77e6wSdCKJZBA5DsrMSOmFjjMqG4H2b
+euzr5b+ZKzKnw4nF/CuB2cmWkz/qAiluqVdRl+Gef/Ouyuer/NuhJhK6Mgy1VuAd
+ynwizGsAgQ/oAGDuHWmcMhGw/2NVTnXqHei5ntr+F4r08YOgXnRsGId+16nJU5xd
+Xs80sw2dFl+1zQiFJxWjVQk65CyZfLDcwC7e3PAMsT+8obzuBKCn6fW3JiIZ68tc
+o8GZClHSkeS7IMp+/wtjMXf1iipE0bRWzzdl1xQnAgMBAAGjgYMwgYAwDgYDVR0P
+AQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaAFH2KEsMw
+S7/Qu1eE1DxRhZTI0Z7RMDgGA1UdEQQxMC+CCm1zZ19icm9rZXKCCWxvY2FsaG9z
+dIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAYEAVr06
+Kg/FaWxUbD6Q+e5OLzckeeFZOKcb/2mmEH+e99HebnCuydiiGebZVWcLsoOw+gmb
+WG/4rFyp9D/ZYFiQxWNRm/nCcxiHIV+JHDxhBn3vKENxYNNbr+WTMBTqmaYqPARK
+SelnX+XDRTZUnoRBo03wZFYwOYwHUFWrlMFz+o6jOo2KZa4J+pcEDbttkJEoVhiV
+C8EKIxSsG9TuW4lh5UySfB62ZfQBNd8SyhD4LF5JHFbBV9ysnylg/8gVvavjHWtM
+FleOk/lNi9oj2n8uQEGbBT6FpTaKKJDiF85E3J4fuv8iNiFy2nWhCpJFF9K5/hu6
+s41Y2ZRb7luBoUj+CQWlTpGjCJPzzWmSkZUjf5kRP6b01bAXoLBzBBn50KWf8DWw
+Rx7VaHtzbBRxfzESQxslGRgZvz2KxjY/x2jH6xdW+bzt93aHkgeGkDrjpY9q/uQF
+SyEJYHIDt+FZupcc3KjvTY2p+icbckOrwQAtVWXzEjCsnDjf33+O7VGdACDm
+-----END CERTIFICATE-----

deploy/compose/nats_config/key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCdQCgwn7M5jtkN
+zYv/yUelUV84ehsYjPTQspCXCjDdUltOE6jafRM/2SopUWwzPTorIZkerIpqq/av
+i77e6wSdCKJZBA5DsrMSOmFjjMqG4H2beuzr5b+ZKzKnw4nF/CuB2cmWkz/qAilu
+qVdRl+Gef/Ouyuer/NuhJhK6Mgy1VuAdynwizGsAgQ/oAGDuHWmcMhGw/2NVTnXq
+Hei5ntr+F4r08YOgXnRsGId+16nJU5xdXs80sw2dFl+1zQiFJxWjVQk65CyZfLDc
+wC7e3PAMsT+8obzuBKCn6fW3JiIZ68tco8GZClHSkeS7IMp+/wtjMXf1iipE0bRW
+zzdl1xQnAgMBAAECggEAMRDQuYNLJ/2DioQFV/WVDmdaf8PR6pIo3WmqJga/An/t
+D2qg+DOoqvZ26leGnGJRYR3lqiWKNwibO2EuWF4anWkRRxc14DfFGj3vH2HR2832
+Q2pSvLR+WSuabbBcr9MkPCsZdItTmQ+9n9Lk9QegFZW1Emgra4XFff3kQAbX4kjR
+ATyEsvZsgnkK5jHi5bzVHEKY730MKyhYzmHmUgxH1ibD5x+tnFtRiBGK+qY24erW
+rw+wu0YKu1ESp62orYDnaA8MH7aWlFZLniPB4liA0h0bElrgHA8Zndx+cEtXqF4m
+5+igR3MjXbg2at80ah++z6EGUTtEPccRSpcA7qFqMQKBgQDFVp1msdn45Xwquw+8
+CSZ45KAurvQEPNxtK/GMHtR5LjRZlKQEpNy3AVjz56azv72kqUfhNsP+ZNokMQTH
+NTMvdkLzcwKe3qCnsfBRlSkRBVCwan266oCJW8SSX8pdaoME9lzc2BfMVAxJ1n+Y
+289ZHXyyPYdNd+L4FxjreJDkKQKBgQDL/uD+kCSKZ/dYVZqwF06DIzYiBv1Xjne3
+3H90J0h/2iU9/yX9UsCS7D5RWbVROUyMh64fpH0f2lVFT8Xo3SjBWISrMovOxEzl
+C2wZwM2VQmrfhiUg9h46drJSl/JL9/V/QOnpuQe35bVWjROtFStaZagUK/3vx1hh
+xCV4iVS/zwKBgQC2Ea3zvA/x9jlTa3ee84pNbBLmP4DgEA8Hos2fjCpZC+o85ElY
+B4ukRVf+4TILEdM1AwJQpii6o+4oChnwegMZvTEUUH6QebMcRa4Gd2qGS7MgsYAD
+XqztDoAU1NBu1ADCKVOQZse+O6WC0qazL8rk27Ha+a3GKeB9KUJSrtBv0QKBgCi5
+IftPlSvYI2WL+Uxr6q19KwJR+OMwuq+Goh7y9KMpTkP5GoFesrjh1nLxAKRNVv26
+3ETO1ne0Y09p5G1fMRKf9CQk/Anz4BHdXOArQB8q2iDzK5hP6arsJR8d3C3UOzsD
+H28cE/FfNvsnQKVN05DBOHOGcLQcTIV/3acZa0S7AoGBAJqSujzhVkewH7wJWOOh
+92F66vMnCsE4Qn10h84GQQWORgjr8z8d8UbW7VrobVfZP74IBqo3ZUBYm85+lUFu
+FWHjTkXoZzwP8IvMW0gE2iC3W4QSr2Z96a6RlRJdxC70LB+Pm6FFwLTloKBGK8Bf
+Kp53gUDjsvJcQGv6nOty0uHQ
+-----END PRIVATE KEY-----

deploy/compose/nats_config/nats.cfg

@@ -0,0 +1,18 @@
+server_name: $NATS_NAME
+port: 4222
+http_port: 8222
+authorization: {
+    users: [
+        {user: $NATS_USER, password: $NATS_PW}
+    ]
+}
+tls: {
+  cert_file: "/tmp/nats/config/cert.pem"
+  key_file: "/tmp/nats/config/key.pem"
+  ca_file: "/tmp/nats/config/rootCA.pem"
+}
+// enables jetstream, an empty block will enable and use defaults
+jetstream {
+    // jetstream data will be in /data/nats-server/jetstream
+    store_dir: "/tmp/nats/jetstream"
+}

deploy/compose/nats_config/rootCA.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE6zCCA1OgAwIBAgIQcw3hWvi1nfQFSkUzrcdrhTANBgkqhkiG9w0BAQsFADCB
+jTEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMTEwLwYDVQQLDChjaGll
+c2FAQWRyaWFub01hYy5sb2NhbCAoQWRyaWFubyBDaGllc2EpMTgwNgYDVQQDDC9t
+a2NlcnQgY2hpZXNhQEFkcmlhbm9NYWMubG9jYWwgKEFkcmlhbm8gQ2hpZXNhKTAe
+Fw0yMjA4MTIxNTM1NDdaFw0zMjA4MTIxNTM1NDdaMIGNMR4wHAYDVQQKExVta2Nl
+cnQgZGV2ZWxvcG1lbnQgQ0ExMTAvBgNVBAsMKGNoaWVzYUBBZHJpYW5vTWFjLmxv
+Y2FsIChBZHJpYW5vIENoaWVzYSkxODA2BgNVBAMML21rY2VydCBjaGllc2FAQWRy
+aWFub01hYy5sb2NhbCAoQWRyaWFubyBDaGllc2EpMIIBojANBgkqhkiG9w0BAQEF
+AAOCAY8AMIIBigKCAYEA4HBEZqDbKPB0StZX/ILPU1q2Tm/U4j32/HvaWOGt528q
+15y5eqa4OqpYQ7waVhkSR+M6258yAk9BCCOGrI+oXcllO7LKv4bg/y+HVhfEg4E0
+fnZS583+VWrIcIKOENQQX1cbFnIqLldBL/ph6YNMDT8wOoLqtQ2vp1EiXFA3ghQs
+fK3iqDL31SQ7cZhdw7hnNACgvIM6MipwFLYbMsm27eMa9fCL4ZB3xokhbYVBmEcT
+RTdhGvcRBs+QF8fcP/Y6uC9y7q2ddeIYEAf5xCVc15QepPqVskuAM3rktzVpBKEl
+lzJGtW3EWu3kojrrW8dYZkZFJkHy9ymZVNUPjpAGiIIylp1Rik/o9VttXi+BQmrV
+l1tpkrU1JfhLcktjBtRxtvRJTARpSkMM8gVc1rA2KgNsULzF4Zaas12wUh7r/VzW
+4lwKiV3vgAM0wE5Fo4NLmv53/j3w7yX9GtSq0Ck/cKu2k0cOe+PTlG9aQ5MdhLCx
++BwMij/ohBfh0qtgPVPdAgMBAAGjRTBDMA4GA1UdDwEB/wQEAwICBDASBgNVHRMB
+Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBR9ihLDMEu/0LtXhNQ8UYWUyNGe0TANBgkq
+hkiG9w0BAQsFAAOCAYEAyGNw197jniIGfCpcArC2lHbzNIQCq97BXsOj4h+CaUB+
+ZfTpTOdtS5DK2fSQ4jwH6nzm7VQvrnHcbP2pCgVDWW9da+Acnh1U6dYXI1VPDDVA
+KZGDiK63M6PneX3IDl2N2fubRDP1ALkZQ6zwjtJLC2nT6IVjAJdRNt8egbCUAyMb
+nOb4F+Zrr0L2SILM0jHq9diJVpX4Lxqggldmd+5HdVGHoR8BGzw4MReuoRWOZtf/
+H+opFtJ2f8GNTWsWtmN7FsjrGOOBgREB/Tz7WCWgGEeXQveJEfkOIddVVgb/n9Ly
+mEOTbtJj36o4JJzv0v42SdT1WUkdvc6AmLVmYFn0uaLohNLVelJmU+aGavuVFpFb
+08uVsSl8JMBWwVO23CpuvZFbI/1BFVix85UZgDj8BnpAWlsJxPYV1HqxS2oJJJbn
+zRf8/0xzFPrLirXzebIr4jiCRVBRamacQTxlvPUz6c6FLTQLaqQdUV/IZaXsXX38
+byH1ABmJPGjXLm1r2RWD
+-----END CERTIFICATE-----