Skip to content
Snippets Groups Projects
Commit b097ca6a authored by Jean-Paul Calderone's avatar Jean-Paul Calderone
Browse files

Merge branch 'develop' into 'staging'

Merge develop into staging

See merge request !100
parents 3b34d708 5f46cc30
No related branches found
No related tags found
3 merge requests!393Draft: Support QEmu local grid - DO NOT MERGE,!101Merge staging into production,!100Merge develop into staging
Pipeline #701 passed
Showing
with 151 additions and 92 deletions
...@@ -23,6 +23,7 @@ unit-tests: ...@@ -23,6 +23,7 @@ unit-tests:
vulnerability-scan: vulnerability-scan:
stage: "test" stage: "test"
script: script:
- "sed -i 's/undefined/\"unundefined\"/' morph/grid/local/secrets/users.nix"
- "ci-tools/vulnerability-scan security-report.json" - "ci-tools/vulnerability-scan security-report.json"
- "ci-tools/count-vulnerabilities <security-report.json" - "ci-tools/count-vulnerabilities <security-report.json"
artifacts: artifacts:
......
...@@ -21,7 +21,7 @@ OUTPUT=$1 ...@@ -21,7 +21,7 @@ OUTPUT=$1
[ -e scan-target ] && rm -v scan-target [ -e scan-target ] && rm -v scan-target
nix-shell --run ' nix-shell --run '
set -x set -x
if morph_result=$(morph build morph/grid/testing/grid.nix 2>&1); then if morph_result=$(morph build morph/grid/local/grid.nix 2>&1); then
object=$(echo "$morph_result" | tail -n 1) object=$(echo "$morph_result" | tail -n 1)
ln -s "$object" scan-target ln -s "$object" scan-target
else else
......
...@@ -9,3 +9,5 @@ This contains documentation regarding running PrivateStorageio. ...@@ -9,3 +9,5 @@ This contains documentation regarding running PrivateStorageio.
.. include:: .. include::
monitoring.rst monitoring.rst
.. include::
generating-keys.rst
Generating keys
===============
``config.json`` has the paths for the Ristretto and the Stripe secret key files.
Here is a Ristretto key you can use, randomly generated just now::
SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=
Generate your own like this::
[flo@la:~/PrivateStorageio]$ nix-shell
[nix-shell:~/PrivateStorageio]$ nix-shell -p zkapissuer.components.exes.PaymentServer-generate-key
[nix-shell:~/PrivateStorageio]$ PaymentServer-generate-key
SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=
Make sure you write it into the key file `without any leading or trailing white space, also without newlines <https://github.com/LeastAuthority/python-challenge-bypass-ristretto/issues/37>`_.
For example::
echo -n "SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=" > ristretto.signing-key
For the Stripe key any random bytes with a little light formatting "work" - at least to make our software happy - but if you want to be able to interact with Stripe and have payments (even pretend payments) move all the way through the system you should get a Stripe account and generate a key w/ them.
Lauri can get you added to our "dev" Stripe account, too, though I forget how important that is for ad hoc dev/testing.
I think this will work for generating random Stripe secret keys (that our software will load, I think, but Stripe will reject)::
>>> import base64, os
>>> print((b"sk_test_" + base64.b64encode(os.urandom(25)).strip(b"=")).decode("ascii"))
sk_test_Dr+XLVjkC0oO3Zw8Ws0yWtDLqR1sM+/fmw
Public keys are the same but "pk_test" instead of "sk_test" ("test" is for "test mode" key that can only process pretend txns; for real txns there are keys with "live" embedded).
The ZKAPIssuer.service needs a working TLS certificate and expects it in the certbot directory for the domain you configured, in my case::
openssl req -x509 -newkey rsa:4096 -nodes -keyout privkey.pem -out cert.pem -days 3650
touch chain.pem
Move the three .pem files into the payment's server ``/var/lib/letsencrypt/live/payments.localdev/`` directory and issue a ``sudo systemctl restart zkapissuer.service``.
Create Wireguard VPN key pairs in ``PrivateStorageSecrets/monitoringvpn/`` or where you have them::
for i in "172.23.23.11" "172.23.23.12" "172.23.23.13" "server"; do
wg genkey | tee ${i}.key | wg pubkey > ${i}.pub
done
And a shared VPN key for "post-quantum resistance"::
wg genpsk > preshared.key
...@@ -55,6 +55,10 @@ This path is **ignored** by git. ...@@ -55,6 +55,10 @@ This path is **ignored** by git.
The intended workflow is that the secrets will be maintained on secure storage and a symlink to the correct location created here. The intended workflow is that the secrets will be maintained on secure storage and a symlink to the correct location created here.
This keeps the secrets themselves out of the git working tree as an extra protection against unintentionally committing them. This keeps the secrets themselves out of the git working tree as an extra protection against unintentionally committing them.
An exception is the ``secrets`` directory in the ``local`` morph grid:
That directory is fully populated, provided as an example, and mostly: not very secret.
Do not deploy these keys to machines reachable via the internet.
config.json config.json
~~~~~~~~~~~ ~~~~~~~~~~~
......
.vagrant
Set up and use a network of local development VMs Set up and use a network of local development VMs
------------------------------------------------- -------------------------------------------------
... using `Vagrant <https://www.vagrantup.com/>`_ to manage VirtualBox VMs [#]_. ... using `Vagrant <https://www.vagrantup.com/>`_ to manage VirtualBox VMs.
To get started, first install Vagrant and make sure it works. (The author of this documentation wasted a lot of time trying to get Vagrant to work with KVM/libvirt.
One possible way to do it in NixOS: Issues with networking that looked like guest misconfigurations vanished after changing to the better-tested combination of Vagrant and VirtualBox.)
1. Install Vagrant, by adding the packages:
- ``vagrant`` (orchestrating virtual machines on the command line) Use the local development environment
- Only use when version >= 2.2.16 has become available. Else see below. `````````````````````````````````````
- Optional: ``packer`` (for creating your own VM images)
2. Add configuration to install and enable VirtualBox:
- ``virtualisation.virtualbox.host.enable = true;``
3. Add your user to the ``vboxusers`` group, for example:
- ``users.extraGroups.vboxusers.members = [ "flo" "jp" ];``
.. [#] The author of this documentation wasted a lot of time trying to get Vagrant to work with KVM/libvirt. Issues with networking that looked like guest misconfigurations vanished after changing to the better-tested combination of Vagrant and VirtualBox.
Pre-Vagrant 2.2.16: Get Vagrant with the required fixes for NixOS guests
````````````````````````````````````````````````````````````````````````
The Vagrant nixos-guest template `received a critical update on 2021-03-08 <https://github.com/hashicorp/vagrant/commit/990d94ed9d0b3092e855bc1bb9deeeb7aa7792cf>`_ which came out with Vagrant version 2.2.16.
If you run an older Nixpkgs, retrieve and use the latest Vagrant development version like so::
NIX_PATH=nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/master.tar.gz nix-shell -p vagrant
Generating and deploying keys
`````````````````````````````
``config.json`` has the paths for the Ristretto and the Stripe secret key files.
Here is a Ristretto key you can use, randomly generated just now::
SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=
Generate your own like this::
[flo@la:~/PrivateStorageio]$ nix-shell
[nix-shell:~/PrivateStorageio]$ nix-shell -p zkapissuer.components.exes.PaymentServer-generate-key
[nix-shell:~/PrivateStorageio]$ PaymentServer-generate-key
SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=
Make sure you write it into the key file `without any leading or trailing white space, also without newlines <https://github.com/LeastAuthority/python-challenge-bypass-ristretto/issues/37>`_.
For example::
echo -n "SILOWzbnkBjxC1hGde9d5Q3Ir/4yLosCLEnEQGAxEQE=" > ristretto.signing-key
For the Stripe key any random bytes with a little light formatting "work" - at least to make our software happy - but if you want to be able to interact with Stripe and have payments (even pretend payments) move all the way through the system you should get a Stripe account and generate a key w/ them.
Lauri can get you added to our "dev" Stripe account, too, though I forget how important that is for ad hoc dev/testing.
I think this will work for generating random Stripe secret keys (that our software will load, I think, but Stripe will reject)::
>>> import base64, os
>>> print((b"sk_test_" + base64.b64encode(os.urandom(25)).strip(b"=")).decode("ascii"))
sk_test_Dr+XLVjkC0oO3Zw8Ws0yWtDLqR1sM+/fmw
Public keys are the same but "pk_test" instead of "sk_test" ("test" is for "test mode" key that can only process pretend txns; for real txns there are keys with "live" embedded). 1. Enter the morph local grid directory::
The ZKAPIssuer.service needs a working TLS certificate and expects it in the certbot directory for the domain you configured, in my case:: cd morph/grid/local
openssl req -x509 -newkey rsa:4096 -nodes -keyout privkey.pem -out cert.pem -days 3650 2. Enter the project's nix-shell::
touch chain.pem
Move the three .pem files into the payment's server ``/var/lib/letsencrypt/live/payments.localdev/`` directory and issue a ``sudo systemctl restart zkapissuer.service``. nix-shell ../../../shell.nix
3. Build and start the VMs::
Use the local development environment
`````````````````````````````````````
1. Build and start the VMs::
VAGRANT_DEFAULT_PROVIDER=virtualbox vagrant up VAGRANT_DEFAULT_PROVIDER=virtualbox vagrant up
2. Then, once:: 4. Then, add the Vagrant SSH configuration to your user's ``~/.ssh/config`` file::
vagrant ssh-config > ./vagrant-ssh-config install -d ~/.ssh ; vagrant ssh-config >> ~/.ssh/config
3. Edit the output: Add the IPs from ``grid.nix`` to the ``vagrant-ssh-config`` **Host match blocks** so the config reads like:: 5. Edit the generated configuration: Add the ``publicIP`` addresses from ``grid.nix`` to ssh config **Host** match blocks (**not** HostName) so the ``Host`` lines all read like::
Host payments1 192.168.67.21 Host payments1 192.168.67.21
HostName 192.168.67.21 HostName 127.0.0.1
User vagrant User vagrant
Port 22
[...] [...]
4. Then, make morph use this ssh config either - with newer morph [#]_ - by pointing it to it:: Latest Morph honors the ``SSH_CONFIG_FILE`` environment variable (`since 3f90aa88 (March 2020, v 1.5.0) <https://github.com/DBCDK/morph/commit/3f90aa885fac1c29fce9242452fa7c0c505744ef#diff-d155ad793bd62e6ea4c44ba985049ecb13a4f4f32f799791b2bce695a16c0101>`_), so in the future this should get a bit more convenient.
export SSH_CONFIG_FILE=./vagrant-ssh-config
Or, with older morph, adding the config to your user's ``~/.ssh/config`` file. 6. Add your SSH key to ``users.nix`` so you'll be able to log in after deploying the new configuration::
.. [#] Morph honors the ``SSH_CONFIG_FILE`` environment variable `since 3f90aa88 (March 2020, v 1.5.0) <https://github.com/DBCDK/morph/commit/3f90aa885fac1c29fce9242452fa7c0c505744ef#diff-d155ad793bd62e6ea4c44ba985049ecb13a4f4f32f799791b2bce695a16c0101>`_. $EDITOR secrets/users.nix
5. Then, build and deploy our software to the Vagrant VMs:: 7. Then, build and deploy our software to the Vagrant VMs::
morph build grid.nix morph build grid.nix
morph push grid.nix morph push grid.nix
morph deploy grid.nix boot
vagrant halt
vagrant up
morph upload-secrets grid.nix morph upload-secrets grid.nix
morph deploy grid.nix switch
You will now be able to log in with the users and keys you set in your ``localdev-users.nix`` file. You should now be able to log in with the users and keys you set in your ``users.nix`` file.
...@@ -14,6 +14,10 @@ Vagrant.configure("2") do |config| ...@@ -14,6 +14,10 @@ Vagrant.configure("2") do |config|
config.vm.box_version = "20.09" config.vm.box_version = "20.09"
config.vm.box_check_update = false config.vm.box_check_update = false
config.vm.network "private_network", ip: "192.168.67.21" config.vm.network "private_network", ip: "192.168.67.21"
# Add self signed SSL key for zkap-issuer:
config.vm.provision "file", source: "secrets/payments-localdev-ssl", destination: "/tmp/payments-localdev-ssl"
config.vm.provision "shell", inline: "sudo mkdir -p /var/lib/letsencrypt/live/payments.localdev/"
config.vm.provision "shell", inline: "sudo mv /tmp/payments-localdev-ssl/* /var/lib/letsencrypt/live/payments.localdev/"
end end
config.vm.define "storage1" do |config| config.vm.define "storage1" do |config|
...@@ -32,6 +36,14 @@ Vagrant.configure("2") do |config| ...@@ -32,6 +36,14 @@ Vagrant.configure("2") do |config|
config.vm.network "private_network", ip: "192.168.67.23" config.vm.network "private_network", ip: "192.168.67.23"
end end
config.vm.define "monitoring1" do |config|
config.vm.hostname = "monitoring1"
config.vm.box = "esselius/nixos"
config.vm.box_version = "20.09"
config.vm.box_check_update = false
config.vm.network "private_network", ip: "192.168.67.24"
end
# To make the VMs assign the static IPs to the network interfaces we need a rebuild: # To make the VMs assign the static IPs to the network interfaces we need a rebuild:
config.vm.provision "shell", inline: "echo '{nix.trustedUsers = [ \"@wheel\" \"root\" \"vagrant\" ];}' > /etc/nixos/custom-configuration.nix" config.vm.provision "shell", inline: "echo '{nix.trustedUsers = [ \"@wheel\" \"root\" \"vagrant\" ];}' > /etc/nixos/custom-configuration.nix"
config.vm.provision "shell", inline: "nixos-rebuild switch" config.vm.provision "shell", inline: "nixos-rebuild switch"
......
{ "publicStoragePort": 8898 { "publicStoragePort": 8898
, "ristrettoSigningKeyPath": "../../PrivateStorageSecrets/ristretto.signing-key" , "ristrettoSigningKeyPath": "./secrets/ristretto.signing-key"
, "stripeSecretKeyPath": "../../PrivateStorageSecrets/privatestorageio-testing-stripe.secret" , "stripeSecretKeyPath": "./secrets/stripe.secret"
, "monitoringvpnKeyDir": "./secrets/monitoringvpn"
, "monitoringvpnEndpoint": "192.168.67.24:51820"
, "passValue": 1000000 , "passValue": 1000000
, "issuerDomains": ["payments.localdev"] , "issuerDomains": ["payments.localdev"]
, "letsEncryptAdminEmail": "florian@privatestorage.io" , "letsEncryptAdminEmail": "florian@privatestorage.io"
......
...@@ -6,27 +6,46 @@ import ../../lib/make-grid.nix { ...@@ -6,27 +6,46 @@ import ../../lib/make-grid.nix {
config = ./config.json; config = ./config.json;
nodes = cfg: nodes = cfg:
let let
sshUsers = import ../../../../PrivateStorageSecrets/localdev-users.nix; sshUsers = import ./secrets/users.nix;
vpnClientIPs = [ "172.23.23.11" "172.23.23.12" "172.23.23.13" ]; # TBD: derive automatically
# Get absolute vpn key directory path, as a string:
monitoringvpnKeyDir = toString ./. + "/${cfg.monitoringvpnKeyDir}";
in { in {
"payments1" = import ../../lib/make-issuer.nix (rec { "payments1" = import ../../lib/make-issuer.nix (cfg // rec {
publicIPv4 = "192.168.67.21"; publicIPv4 = "192.168.67.21";
monitoringvpnIPv4 = "172.23.23.11";
inherit monitoringvpnKeyDir;
inherit sshUsers; inherit sshUsers;
hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; });
stateVersion = "19.03"; stateVersion = "19.03";
} // cfg); });
"storage1" = import ../../lib/make-testing.nix (rec { "storage1" = import ../../lib/make-testing.nix (cfg // rec {
publicIPv4 = "192.168.67.22"; publicIPv4 = "192.168.67.22";
monitoringvpnIPv4 = "172.23.23.12";
inherit monitoringvpnKeyDir;
inherit sshUsers; inherit sshUsers;
hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; });
stateVersion = "19.09"; stateVersion = "19.09";
} // cfg); });
"storage2" = import ../../lib/make-testing.nix (rec { "storage2" = import ../../lib/make-testing.nix (cfg // rec {
publicIPv4 = "192.168.67.23"; publicIPv4 = "192.168.67.23";
monitoringvpnIPv4 = "172.23.23.13";
inherit monitoringvpnKeyDir;
inherit sshUsers; inherit sshUsers;
hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; });
stateVersion = "19.09"; stateVersion = "19.09";
} // cfg); });
"monitoring1" = import ../../lib/make-monitoring.nix (cfg // rec {
publicIPv4 = "192.168.67.24";
monitoringvpnIPv4 = "172.23.23.1";
inherit vpnClientIPs;
inherit sshUsers;
inherit monitoringvpnKeyDir;
hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; });
stateVersion = "19.09";
});
}; };
} }
cLP62YAYoA7FY+OhSLR64DIHekOjGGQlfJAWp5cYP00=
GYNjLkoyQ1d3OMymYbgq40WAHIUzrSEGBWXvxqceF00=
qFjBtvJKBchzl2HwFvEDoe3zFzyc10osiRlP8HOk2n0=
veio/0E0sJYOjwp3E8EccCyME1pqjkZr4R6whFMdrhs=
8HlKTvxZBAZeww6JaNk9kBPjSfT0pVMbDJbzV67yUGE=
4VlUMl9FubrLWaN0pRvfdNjjRBQzfCVLMA2lU7OwPzA=
E7KTLVnWMmP/mIEkU8WX2DBZJaeMS2+sYArRZuGT1o4=
iOp2pk2HWyNgRnke7nJgFwodkTWMyHRIKwe8pk+bN3M=
ojo+p9ZE03GN66ewoIlrHmyV7ICt+2LV32Prs66JsA4=
-----BEGIN CERTIFICATE-----
MIIDGTCCAgGgAwIBAgIUM9YnOMe2yYQuCLpYiI2TpZg21AMwDQYJKoZIhvcNAQEL
BQAwHDEaMBgGA1UEAwwRcGF5bWVudHMubG9jYWxkZXYwHhcNMjEwNjA5MTQzNzU4
WhcNMzEwNjA3MTQzNzU4WjAcMRowGAYDVQQDDBFwYXltZW50cy5sb2NhbGRldjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOBCvkMprdRjD8ECeweMVTFT
pILu5VA8HC8XK15Y4iE8G48cSYE3m/e6w5g4JvfXgED9eY+1/ZazQXVI6sojnfHL
Vj9XqsUww3IVtq2Zn+0B8YTrbNxcDH77mUx0mUziAm1bglmoNbd4+q0Fe8FhK/EN
Jj7UppRjD2ziV9Mw7UT1JjMbfSo7/7ZOV2cWk+hezOywsE+3BM6mju1aHbbYryAd
EzRwfQKcI/9PC84Bck9e+tEiWQImBf8DguQ+ChuSOmGtP1rI+hq5HfCimH0NCCNS
iUfNVcubz920FRBeAx9oM0G/u4feeS8T5a1PThZrdhjIycEmU5wsM7F34RzkuEkC
AwEAAaNTMFEwHQYDVR0OBBYEFAbBfAFOlx4c53CNgsRlobFwUIBbMB8GA1UdIwQY
MBaAFAbBfAFOlx4c53CNgsRlobFwUIBbMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
hvcNAQELBQADggEBACD+47l30gGaZBPvuCMc/CENLmuqZqj7WGGmWcmUAzsdEgHt
Q1zhj4un4u4qQ78jeT+cjqNK9qartQIjxzYTpn6lKDBpM9sS2G7RdLxOWWRVAXQj
Cv6l0tEQArIqqMnzmECe0VDCc97kTg6tnMLFeyQL29XSSNIpS0DiQ+NC69fyrF2E
vt2bAi+QTlN1U1ZGDJqWlwqkpI3xTRDJnmRPuVNrt07gkMWeSJHEI98Qcve7Ujf3
hFcAnbshJ8iXxbNjTFIQcCJzHq1UF+eZo8BF1ixYmrk/jmaLNBOSy93tOk1XeJfS
XtV6X9jmAE20V0XV8uCli6cDxQQYthll/1q5JYQ=
-----END CERTIFICATE-----
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment