From 1064d4179c00eee05103b98adad3e41c596478b9 Mon Sep 17 00:00:00 2001 From: sljeff Date: Thu, 18 Aug 2022 15:34:03 +0800 Subject: [PATCH 1/5] feat: caddy for tls --- deploy/prod/cm.yaml | 64 ++++++++++++++++++++++++++++++++++++++++ deploy/prod/deploy.yaml | 41 ++++++++++++++++++++++--- deploy/prod/secrets.yaml | 13 ++++++++ deploy/prod/svc.yaml | 6 +++- 4 files changed, 119 insertions(+), 5 deletions(-) create mode 100644 deploy/prod/cm.yaml diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml new file mode 100644 index 00000000..04cc257b --- /dev/null +++ b/deploy/prod/cm.yaml @@ -0,0 +1,64 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: xlog-caddy + namespace: crossbell +data: + Caddyfile: | + { + storage redis { + } + + on_demand_tls { + ask http://localhost:5000/ + } + } + + :80, :443 { + tls { + on_demand + } + } +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: xlog-caddy-validator + namespace: crossbell +data: + app.py: | + import requests + from flask import Flask, request, Response + + app = Flask(__name__) + + + @app.route("/") + def check_domain(): + domain = request.args.get("domain") + if not domain: + return Response(status=404) + + # get TXT + res = requests.get("https://cloudflare-dns.com/dns-query", params={ + "name": f"_xlog-challenge.{domain}", + "type": "TXT", + }, headers={"Accept": "application/dns-json"}) + if res.status_code != 200: + return Response(status=res.status_code) + answer = res.json().get("Answer") or [{}] + tenant = answer[0].get("data", "").replace('"', "") + if not tenant: + return Response(status=404) + + # check crossbell + res = requests.get(f"https://indexer.crossbell.io/v1/handles/{tenant}/character") + if res.status_code != 200: + return Response(status=404) + attributes = res.json().get("metadata", {}).get("content", {}).get("attributes", []) + for d in attributes: + print(d) + if d.get("trait_type") == "xlog_custom_domain" and d.get("value") == domain: + return Response(status=200) + + return Response(status=404) diff --git a/deploy/prod/deploy.yaml b/deploy/prod/deploy.yaml index 76f9535a..f691b1d8 100644 --- a/deploy/prod/deploy.yaml +++ b/deploy/prod/deploy.yaml @@ -33,11 +33,11 @@ spec: protocol: TCP resources: requests: - memory: '200Mi' - cpu: '150m' + memory: "200Mi" + cpu: "150m" limits: - memory: '500Mi' - cpu: '500m' + memory: "500Mi" + cpu: "500m" terminationMessagePath: /dev/termination-log terminationMessagePolicy: File readinessProbe: @@ -50,8 +50,41 @@ spec: port: 3000 initialDelaySeconds: 40 periodSeconds: 20 + - name: caddy + image: kindjeff/caddy-tlsredis-docker + imagePullPolicy: Always + command: ["caddy", "run", "-config", "/app/Caddyfile"] + envFrom: + - secretRef: + name: xlog-caddy + ports: + - containerPort: 80 + name: http + - containerPort: 443 + name: https + volumeMounts: + - name: caddyfile + mountPath: /app + - name: caddy-validator + image: python + command: ["/bin/sh", "-c"] + args: ["pip install flask requests; flask --app=app run"] + ports: + - containerPort: 5000 + name: http + volumeMounts: + - name: validator + mountPath: /app.py + subPath: app.py dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: {} terminationGracePeriodSeconds: 30 + volumes: + - name: caddyfile + configMap: + name: xlog-caddy + - name: validator + configMap: + name: xlog-caddy-validator diff --git a/deploy/prod/secrets.yaml b/deploy/prod/secrets.yaml index 7966fbb4..64526ae5 100644 --- a/deploy/prod/secrets.yaml +++ b/deploy/prod/secrets.yaml @@ -14,3 +14,16 @@ metadata: name: xlog namespace: crossbell type: Opaque +--- +apiVersion: v1 +stringData: + CADDY_CLUSTERING_REDIS_HOST: ${CADDY_CLUSTERING_REDIS_HOST} + CADDY_CLUSTERING_REDIS_PORT: "6379" + CADDY_CLUSTERING_REDIS_USERNAME: "" + CADDY_CLUSTERING_REDIS_PASSWORD: ${CADDY_CLUSTERING_REDIS_PASSWORD} + CADDY_CLUSTERING_REDIS_DB: "0" +kind: Secret +metadata: + name: xlog-caddy + namespace: crossbell +type: Opaque diff --git a/deploy/prod/svc.yaml b/deploy/prod/svc.yaml index af9652e3..2418cb2a 100644 --- a/deploy/prod/svc.yaml +++ b/deploy/prod/svc.yaml @@ -11,4 +11,8 @@ spec: - name: http protocol: TCP port: 80 - targetPort: 3000 + targetPort: 80 + - name: https + protocol: TCP + port: 443 + targetPort: 443 From b6f67a7d73c0a18f85486c127f50112f5d1aaf19 Mon Sep 17 00:00:00 2001 From: sljeff Date: Thu, 18 Aug 2022 15:43:24 +0800 Subject: [PATCH 2/5] fix: caddy reverse proxy --- deploy/prod/cm.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml index 04cc257b..9780e542 100644 --- a/deploy/prod/cm.yaml +++ b/deploy/prod/cm.yaml @@ -18,6 +18,8 @@ data: tls { on_demand } + + reverse_proxy 127.0.0.1:3000 } --- apiVersion: v1 From 1376786cf3713a329f16b8a7aac2966fc00ef576 Mon Sep 17 00:00:00 2001 From: sljeff Date: Thu, 18 Aug 2022 16:29:02 +0800 Subject: [PATCH 3/5] fix: xlog.app sign --- deploy/prod/cm.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml index 9780e542..43f4a961 100644 --- a/deploy/prod/cm.yaml +++ b/deploy/prod/cm.yaml @@ -40,6 +40,8 @@ data: domain = request.args.get("domain") if not domain: return Response(status=404) + if domain.endswith('xlog.app'): + return Response(status=200) # get TXT res = requests.get("https://cloudflare-dns.com/dns-query", params={ From d4d3704028f11dda04adb6d2d7d086405c6011a5 Mon Sep 17 00:00:00 2001 From: sljeff Date: Thu, 18 Aug 2022 16:32:25 +0800 Subject: [PATCH 4/5] fix: more precise match for xlog.app --- deploy/prod/cm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml index 43f4a961..9c1ecbf0 100644 --- a/deploy/prod/cm.yaml +++ b/deploy/prod/cm.yaml @@ -40,7 +40,7 @@ data: domain = request.args.get("domain") if not domain: return Response(status=404) - if domain.endswith('xlog.app'): + if domain.endswith('.xlog.app') or domain == "xlog.app": return Response(status=200) # get TXT From 121d6bb8135f532b62674484dc8203b801ee446a Mon Sep 17 00:00:00 2001 From: sljeff Date: Thu, 18 Aug 2022 17:05:59 +0800 Subject: [PATCH 5/5] feat: PAN domain certificate for xlog.app --- deploy/prod/cm.yaml | 26 +++++++++++++++++--------- deploy/prod/secrets.yaml | 1 + 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/deploy/prod/cm.yaml b/deploy/prod/cm.yaml index 9c1ecbf0..587e6ed9 100644 --- a/deploy/prod/cm.yaml +++ b/deploy/prod/cm.yaml @@ -6,20 +6,28 @@ metadata: data: Caddyfile: | { - storage redis { - } + storage redis { + } - on_demand_tls { - ask http://localhost:5000/ - } + on_demand_tls { + ask http://localhost:5000/ + } + } + + xlog.app, *.xlog.app { + tls jeff@rss3.io { + dns cloudflare {env.CF_API_TOKEN} + } + + reverse_proxy 127.0.0.1:3000 } :80, :443 { - tls { - on_demand - } + tls jeff@rss3.io { + on_demand + } - reverse_proxy 127.0.0.1:3000 + reverse_proxy 127.0.0.1:3000 } --- apiVersion: v1 diff --git a/deploy/prod/secrets.yaml b/deploy/prod/secrets.yaml index 64526ae5..2fa1d12c 100644 --- a/deploy/prod/secrets.yaml +++ b/deploy/prod/secrets.yaml @@ -22,6 +22,7 @@ stringData: CADDY_CLUSTERING_REDIS_USERNAME: "" CADDY_CLUSTERING_REDIS_PASSWORD: ${CADDY_CLUSTERING_REDIS_PASSWORD} CADDY_CLUSTERING_REDIS_DB: "0" + CF_API_TOKEN: ${CF_API_TOKEN} kind: Secret metadata: name: xlog-caddy