From 689bf0860e9371a735ec0c4685e740e1bb618ccc Mon Sep 17 00:00:00 2001 From: Joschka Seydell Date: Sat, 12 Dec 2020 11:13:01 -0800 Subject: [PATCH] Added documentation and examples for multitenancy setups. --- README.md | 17 +++++++++ examples/multitenancy/group_vars/all.yml | 8 +++++ .../host_vars/server1/firewall.yml | 16 +++++++++ .../host_vars/server1/server1.yml | 6 ++++ .../host_vars/server1/traefik.yml | 8 +++++ .../server1_tenant_a/jitsi_docker.yml | 26 ++++++++++++++ .../server1_tenant_a/server1_tenant_a.yml | 3 ++ .../server1_tenant_b/jitsi_docker.yml | 26 ++++++++++++++ .../server1_tenant_b/server1_tenant_b.yml | 3 ++ examples/multitenancy/inventory.ini.sample | 35 +++++++++++++++++++ .../simple/inventory.ini.sample | 0 11 files changed, 148 insertions(+) create mode 100644 examples/multitenancy/group_vars/all.yml create mode 100644 examples/multitenancy/host_vars/server1/firewall.yml create mode 100644 examples/multitenancy/host_vars/server1/server1.yml create mode 100644 examples/multitenancy/host_vars/server1/traefik.yml create mode 100644 examples/multitenancy/host_vars/server1_tenant_a/jitsi_docker.yml create mode 100644 examples/multitenancy/host_vars/server1_tenant_a/server1_tenant_a.yml create mode 100644 examples/multitenancy/host_vars/server1_tenant_b/jitsi_docker.yml create mode 100644 examples/multitenancy/host_vars/server1_tenant_b/server1_tenant_b.yml create mode 100644 examples/multitenancy/inventory.ini.sample rename inventory.ini.sample => examples/simple/inventory.ini.sample (100%) diff --git a/README.md b/README.md index c83cc0d..277bb25 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,8 @@ The main goals of this project are: - [Collabora Online Development Edition](https://www.collaboraoffice.com/code/) (integrates with Nextcloud) - [Cryptpad](https://cryptpad.fr/) +For hosting several isolated instances of these services on the same server, see the section on [multitenancy](#multitenancy). + ### WIP - [BigBlueButton](https://bigbluebutton.org/) @@ -157,6 +159,21 @@ Restic assumes untrusted environments, hence backups are always encrypted using The `common` role comes with a [firewall](https://galaxy.ansible.com/geerlingguy/firewall) based on iptables. If you don't allow SSH (usually port 22) then you might lock yourself out. Have a look at `group_vars/vagrant.yml` for an example config. Add the corresponding [firewall parameters](https://galaxy.ansible.com/geerlingguy/firewall) to your `host_vars` and adapt them according to your needs. +## Multitenancy + +The roles used to provide the above services support multitenancy setups by offering the possibility to specify the installation path and further variables for proper routing of requests to the individual instances. +Note that in this setup, Traefik serves as the central entry point (and is not running multiple times!) and routes the request by the domain they were issued from. + +An example how to structure variables related to the individual instances and how to write an according inventory can be found under [examples/multitenancy](examples/multitenancy). +The main idea is to define **multiple hosts targeting the same machine** and providing a different set of service variables for each. + +Most importantly, to configure multiple instances for the same service, a unique `_install_path` and `_multitenant_label` need to be specified identifying the instance towards Traefik. +Also, exposed ports **must** differ per instance as docker maps container port to the host's network (even if the containers reside in a user-defined network). + +In the examples you'll find additional `group_vars` that can be used to ease up setting up individual install paths by introducting `tenant_name`s and deploying services into a unified directory structure depending on that. +For each individual host, all variables will be concatenated so that they are available in the service roles. + + ## Alternatives - [HomelabOS](https://gitlab.com/NickBusey/HomelabOS) diff --git a/examples/multitenancy/group_vars/all.yml b/examples/multitenancy/group_vars/all.yml new file mode 100644 index 0000000..1ab73f9 --- /dev/null +++ b/examples/multitenancy/group_vars/all.yml @@ -0,0 +1,8 @@ +# Deployment users and paths +default_user: '{{ ansible_user }}' +default_install_path: "/home/{{ default_user }}" +default_services_path: "{{ default_install_path }}/services" + +# Defaults for multitenant setups +tenant_name: '' +tenant_install_path: "{{ default_services_path }}{{ '/' + tenant_name if (tenant_name) else '' }}" \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1/firewall.yml b/examples/multitenancy/host_vars/server1/firewall.yml new file mode 100644 index 0000000..c1131ed --- /dev/null +++ b/examples/multitenancy/host_vars/server1/firewall.yml @@ -0,0 +1,16 @@ +# Firewall +firewall_disable_ufw: true +firewall_flush_rules_and_chains: true +firewall_additional_rules: + - "iptables --policy INPUT DENY" +firewall_allowed_tcp_ports: + - "22" + - "80" + - "443" + # Jitsi + - "4443" # tenant_a + - "4543" # tenant_b +firewall_allowed_udp_ports: + # Jitsi + - "10000" # tenant_a + - "11000" # tenant_b \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1/server1.yml b/examples/multitenancy/host_vars/server1/server1.yml new file mode 100644 index 0000000..c22e72b --- /dev/null +++ b/examples/multitenancy/host_vars/server1/server1.yml @@ -0,0 +1,6 @@ +# General settings +ansible_user: deploy +update_hostname: yes +hostname: "multitenant-server1" +users: [] +sudoers: [] diff --git a/examples/multitenancy/host_vars/server1/traefik.yml b/examples/multitenancy/host_vars/server1/traefik.yml new file mode 100644 index 0000000..f841885 --- /dev/null +++ b/examples/multitenancy/host_vars/server1/traefik.yml @@ -0,0 +1,8 @@ +# Traefik proxy +traefik_letsencrypt_email: max@example.com +traefik_install_user: "{{ default_user }}" +traefik_expose_internally: True +traefik_expose_externally: False +traefik_enable_acme: True +traefik_use_acme_staging: False +traefik_dns_challenge_provider: False \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1_tenant_a/jitsi_docker.yml b/examples/multitenancy/host_vars/server1_tenant_a/jitsi_docker.yml new file mode 100644 index 0000000..fd9387f --- /dev/null +++ b/examples/multitenancy/host_vars/server1_tenant_a/jitsi_docker.yml @@ -0,0 +1,26 @@ +jitsi_install_user: "{{ default_user }}" +jitsi_install_path: "{{ tenant_install_path }}" +jitsi_multitenant_label: "tenant_a" +jitsi_docker_image_tag: 'latest' +jitsi_public_url: https://tenant-a.example.com +jitsi_docker_host_address: "{{ ansible_host }}" +jitsi_exposed_http_port: 8010 +jitsi_exposed_https_port: 8453 +jitsi_bridge_udp_port: 11000 +jitsi_bridge_tcp_port: 4543 +jitsi_timezone: Europe/Amsterdam +jitsi_enable_letsencrypt: False +jitsi_virtual_host: tenant-a.example.com +jitsi_jvb_stun_servers: meet-jit-si-turnrelay.jitsi.net:443 +# Passwords +jitsi_jibri_recorder_password: secret1-CHANGE-ME +jitsi_jibri_recorder_user: recorder +jitsi_jibri_xmpp_password: secret2-CHANGE-ME +jitsi_jibri_xmpp_user: jibri +jitsi_jicofo_auth_password: secret3-CHANGE-ME +jitsi_jicofo_auth_user: focus +jitsi_jicofo_component_secret: secret4-CHANGE-ME +jitsi_jigasi_xmpp_password: secret5-CHANGE-ME +jitsi_jigasi_xmpp_user: jigasi +jitsi_jvb_auth_user: jvb +jitsi_jvb_auth_password: secret6-CHANGE-ME \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1_tenant_a/server1_tenant_a.yml b/examples/multitenancy/host_vars/server1_tenant_a/server1_tenant_a.yml new file mode 100644 index 0000000..89ab8ca --- /dev/null +++ b/examples/multitenancy/host_vars/server1_tenant_a/server1_tenant_a.yml @@ -0,0 +1,3 @@ +ansible_user: deploy +# Multitenant setup for tenant_a +tenant_name: "tenant_a" \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1_tenant_b/jitsi_docker.yml b/examples/multitenancy/host_vars/server1_tenant_b/jitsi_docker.yml new file mode 100644 index 0000000..afbb2cc --- /dev/null +++ b/examples/multitenancy/host_vars/server1_tenant_b/jitsi_docker.yml @@ -0,0 +1,26 @@ +jitsi_install_user: "{{ default_user }}" +jitsi_install_path: "{{ tenant_install_path }}" +jitsi_multitenant_label: "tenant_b" +jitsi_docker_image_tag: 'latest' +jitsi_public_url: https://tenant-b.example.com +jitsi_docker_host_address: "{{ ansible_host }}" +jitsi_exposed_http_port: 8010 +jitsi_exposed_https_port: 8453 +jitsi_bridge_udp_port: 11000 +jitsi_bridge_tcp_port: 4543 +jitsi_timezone: Europe/Amsterdam +jitsi_enable_letsencrypt: False +jitsi_virtual_host: tenant-b.example.com +jitsi_jvb_stun_servers: meet-jit-si-turnrelay.jitsi.net:443 +# Passwords +jitsi_jibri_recorder_password: secret1-CHANGE-ME +jitsi_jibri_recorder_user: recorder +jitsi_jibri_xmpp_password: secret2-CHANGE-ME +jitsi_jibri_xmpp_user: jibri +jitsi_jicofo_auth_password: secret3-CHANGE-ME +jitsi_jicofo_auth_user: focus +jitsi_jicofo_component_secret: secret4-CHANGE-ME +jitsi_jigasi_xmpp_password: secret5-CHANGE-ME +jitsi_jigasi_xmpp_user: jigasi +jitsi_jvb_auth_user: jvb +jitsi_jvb_auth_password: secret6-CHANGE-ME \ No newline at end of file diff --git a/examples/multitenancy/host_vars/server1_tenant_b/server1_tenant_b.yml b/examples/multitenancy/host_vars/server1_tenant_b/server1_tenant_b.yml new file mode 100644 index 0000000..d2fc1b8 --- /dev/null +++ b/examples/multitenancy/host_vars/server1_tenant_b/server1_tenant_b.yml @@ -0,0 +1,3 @@ +ansible_user: deploy +# Multitenant setup for tenant_b +tenant_name: "tenant_b" \ No newline at end of file diff --git a/examples/multitenancy/inventory.ini.sample b/examples/multitenancy/inventory.ini.sample new file mode 100644 index 0000000..0e749c1 --- /dev/null +++ b/examples/multitenancy/inventory.ini.sample @@ -0,0 +1,35 @@ +[server1_hosts] +# Main host +server1 +# Tenants +server1_tenant_a +server1_tenant_b + +[server1_hosts:vars] +ansible_host=1.2.3.4 +ansible_ssh_host=1.2.3.4 + +[common] +server1 + +[docker] +server1 + +[traefik] +server1 # Must only be running on the main host + +[nextcloud] +tenant_a + +[jitsi_docker] +tenant_a +tenant_b # Tenant B might only use Jitsi service + +[collabora] +tenant_a + +[onlyoffice] +tenant_a + +[cryptpad] +tenant_a \ No newline at end of file diff --git a/inventory.ini.sample b/examples/simple/inventory.ini.sample similarity index 100% rename from inventory.ini.sample rename to examples/simple/inventory.ini.sample