services/Distributed-Wiki.md
... ...
@@ -0,0 +1,250 @@
1
+The idea is to deploy the mirrors across dn42 using [anycast](https://en.wikipedia.org/wiki/Anycast) addressing (BGP), thus providing redundancy, load-balancing and improved access times for the site.
2
+The local webserver is monitored with a simple shell script (below) [working in conjuction](https://wiki.dn42/services/Anycast-Wiki#distributed-wiki-sites_exabgp) with [ExaBGP](https://github.com/Exa-Networks/exabgp), announcing/withdrawing the assigned route if the service is up/down.
3
+
4
+### Network
5
+
6
+ - Install wiki anycast address `172.23.0.80/32` on the system
7
+ - Setup tunnel(s) to the dn42 network (routing daemon not required)
8
+
9
+### Setup gollum
10
+
11
+ - Install [gollum](https://github.com/gollum/gollum)
12
+ - Clone the dn42 wiki repo:
13
+
14
+ `git clone ssh://[email protected]/dn42/wiki <path>`
15
+
16
+ - Setup cron for periodic pull/push jobs for the repo
17
+ - Generate a [CSR](/services/Certificate-Authority) and send to `[email protected]`. Wait for a reply containing internal.dn42/wiki.dn42 certificates.
18
+ - Start two gollum instances, read-only and editing on `127.0.0.1`:
19
+
20
+ Read/write (SSL access only):
21
+ ```
22
+gollum --css <path>/custom.css --gollum-path <path> --host 127.0.0.1 --port 4568
23
+ ```
24
+ Read-only:
25
+ ```
26
+gollum --css <path>/custom.css --gollum-path <path> --host 127.0.0.1 --port 4567 --no-edit
27
+ ```
28
+
29
+### Nginx proxy
30
+
31
+A custom header `X-SiteID` identifies the site you're connecting to:
32
+
33
+ + X-SiteID: `AS number`-`ISO country code`
34
+
35
+
36
+##### Config example
37
+
38
+```
39
+ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
40
+ssl_session_cache shared:SSL:2m;
41
+
42
+ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
43
+
44
+ssl_prefer_server_ciphers on;
45
+
46
+upstream wiki { server 127.0.0.1:4567; }
47
+
48
+server {
49
+ server_name internal.dn42 wiki.dn42;
50
+
51
+ listen 172.23.0.80:80 default;
52
+
53
+ add_header strict-transport-security "max-age=0; includeSubDomains";
54
+ add_header X-SiteID '<aut-num>-<cc>';
55
+
56
+ location / {
57
+ location =/robots.txt { root <path>/wiki.dn42/; }
58
+ location =/custom.css { root <path>/wiki.dn42/; }
59
+ proxy_pass http://wiki;
60
+ }
61
+}
62
+
63
+upstream wikirw { server 127.0.0.1:4568; }
64
+
65
+
66
+server {
67
+ server_name internal.dn42 wiki.dn42;
68
+
69
+ listen 172.23.0.80:443 ssl default;
70
+
71
+ ssl on;
72
+ ssl_certificate <path>/ssl.crt;
73
+ ssl_certificate_key <path>/ssl.key;
74
+
75
+ add_header strict-transport-security "max-age=0; includeSubDomains";
76
+ add_header Public-Key-Pins 'pin-sha256="mJ1xUCzfru8Ckq2+M6VkNKGOGgSETImRAHBF24mjalw="; pin-sha256="/gOyi7syRMR+d2jZoB/MzcSD++8ciZkSl/hZAQgzWws="; max-age=0; includeSubDomains';
77
+ add_header X-SiteID '<aut-num>-<cc>';
78
+
79
+ location / {
80
+ location =/robots.txt { root <path>/wiki.dn42/; }
81
+ location =/custom.css { root <path>/wiki.dn42/; }
82
+ proxy_pass http://wikirw;
83
+ }
84
+}
85
+
86
+```
87
+
88
+### [ExaBGP](https://github.com/Exa-Networks/exabgp)
89
+
90
+##### Announcing
91
+
92
+The prefix AS-PATH should show the announcement is originating from your AS. After peering ExaBGP to the nearest speaker(s), check if the prefix is routing properly inside your network. Try not to blackhole the passing traffic (e.g. no static routes to `172.23.0.80/28`). Test the whole thing by shutting down nginx/gollum and watch what happens.
93
+
94
+##### Configuration
95
+
96
+```
97
+# exabgp.conf
98
+
99
+group gollum-watchdog {
100
+ neighbor <peer1> {
101
+ router-id x.x.x.x;
102
+ local-address <source-address>;
103
+ local-as <ownas>;
104
+ peer-as <peeras>;
105
+ }
106
+
107
+ ## (example) peer with one of our iBGP speakers:
108
+ neighbor <172.22.0.1> {
109
+ router-id 172.23.0.80;
110
+ local-address 172.22.0.2;
111
+ local-as 123456;
112
+ peer-as 123456;
113
+ }
114
+
115
+ ## ...
116
+
117
+ process watch-gollum {
118
+ run <path>/gollum-watchdog.sh;
119
+ }
120
+}
121
+
122
+```
123
+
124
+##### Watchdog script
125
+
126
+Watchdog runs in an infinite loop, sending the appropriate commands to stdout. [ExaBGP](https://github.com/Exa-Networks/exabgp) attaches to the process' stdout and listens for instructions. Watchdog sends either a route announce or widthdraw.
127
+
128
+Run `gollum-watchdog.sh` in a shell first to validate it's working:
129
+
130
+```
131
+#!/bin/bash
132
+
133
+CURL=curl
134
+
135
+## url's to check (all listed must be alive to send announce)
136
+URL=( "http://172.23.0.80" "https://172.23.0.80" )
137
+
138
+## the anycast route (/28 due to prefix size limits)
139
+ROUTE='172.23.0.80/28'
140
+
141
+## the next-hop we'll be advertising to neighbor(s)
142
+NEXTHOP='<source-address>'
143
+
144
+## regex match this keyword against HTTP response from curl
145
+VALIDATE_KEYWORD='gollum'
146
+
147
+INTERVAL=60
148
+
149
+###########################
150
+
151
+RUN_STATE=0
152
+
153
+check_urls() {
154
+ for url in "${URL[@]}"; do
155
+
156
+ ## workaround curl errno 23 when piping
157
+ http_response=`${CURL} --insecure -L -o - "${url}"`
158
+
159
+ echo "${http_response}" | egrep -q "${VALIDATE_KEYWORD}" || {
160
+ return 1
161
+ }
162
+
163
+ ## add more checks
164
+
165
+ done
166
+ return 0
167
+}
168
+
169
+while [ 1 ]; do
170
+ if [ ${RUN_STATE} -eq 0 ]; then
171
+ check_urls && {
172
+ RUN_STATE=1
173
+ echo "announce route ${ROUTE} next-hop ${NEXTHOP}"
174
+ }
175
+ else
176
+ check_urls || {
177
+ RUN_STATE=0
178
+ echo "withdraw route ${ROUTE} next-hop ${NEXTHOP}"
179
+ }
180
+ fi
181
+
182
+ sleep ${INTERVAL}
183
+
184
+done
185
+
186
+exit 0
187
+
188
+
189
+```
190
+
191
+##### Run
192
+
193
+ Normally SIGUSR1 to the exabgp process triggers a configuration update, but at occasion the process might need to be restarted - since its gracefull shutdown can be glitchy , this might be a bit difficult. Sending SIGKILL to the child(ren) and immediately after, the parent, does the job (quick-and-dirty).
194
+
195
+`USAGE: /etc/exabgp/run.sh [start|stop|restart]`
196
+
197
+```
198
+
199
+#!/bin/bash
200
+
201
+PID_FILE=/var/run/exaBGP/exabgp_PID
202
+
203
+######################################
204
+
205
+EXABGP=<path>/sbin/exabgp
206
+EXA_LOG=/var/log/exabgp.log
207
+CONF=/etc/exabgp/exabgp.conf
208
+
209
+
210
+start() {
211
+ [ -f ${PID_FILE} ] && {
212
+ echo "WARNING: `cat ${PID_FILE}`: exabgp already running"; return 1
213
+ }
214
+ ${EXABGP} ${CONF} &> ${EXA_LOG} &
215
+ cpid=$!
216
+ [ ${cpid} -eq 0 ] && {
217
+ echo "ERROR: could not start process"; return 1
218
+
219
+ }
220
+ echo $! > ${PID_FILE}
221
+}
222
+
223
+stop(){
224
+ [ -f ${PID_FILE} ] || return 1
225
+ pkill -9 -P $(cat ${PID_FILE})
226
+ kill -9 $(cat ${PID_FILE})
227
+ rm -f ${PID_FILE}
228
+}
229
+
230
+case ${1} in
231
+ start )
232
+ start
233
+ ;;
234
+ stop )
235
+ stop
236
+ ;;
237
+ restart )
238
+ stop
239
+ sleep 1
240
+ start
241
+ ;;
242
+esac
243
+
244
+exit 0
245
+
246
+```
247
+
248
+
249
+
250
+
... ...
\ No newline at end of file
services/Distributed-wiki.md
... ...
@@ -1,250 +0,0 @@
1
-The idea is to deploy the mirrors across dn42 using [anycast](https://en.wikipedia.org/wiki/Anycast) addressing (BGP), thus providing redundancy, load-balancing and improved access times for the site.
2
-The local webserver is monitored with a simple shell script (below) [working in conjuction](https://wiki.dn42/services/Anycast-Wiki#distributed-wiki-sites_exabgp) with [ExaBGP](https://github.com/Exa-Networks/exabgp), announcing/withdrawing the assigned route if the service is up/down.
3
-
4
-### Network
5
-
6
- - Install wiki anycast address `172.23.0.80/32` on the system
7
- - Setup tunnel(s) to the dn42 network (routing daemon not required)
8
-
9
-### Setup gollum
10
-
11
- - Install [gollum](https://github.com/gollum/gollum)
12
- - Clone the dn42 wiki repo:
13
-
14
- `git clone ssh://[email protected]/dn42/wiki <path>`
15
-
16
- - Setup cron for periodic pull/push jobs for the repo
17
- - Generate a [CSR](/services/Certificate-Authority) and send to `[email protected]`. Wait for a reply containing internal.dn42/wiki.dn42 certificates.
18
- - Start two gollum instances, read-only and editing on `127.0.0.1`:
19
-
20
- Read/write (SSL access only):
21
- ```
22
-gollum --css <path>/custom.css --gollum-path <path> --host 127.0.0.1 --port 4568
23
- ```
24
- Read-only:
25
- ```
26
-gollum --css <path>/custom.css --gollum-path <path> --host 127.0.0.1 --port 4567 --no-edit
27
- ```
28
-
29
-### Nginx proxy
30
-
31
-A custom header `X-SiteID` identifies the site you're connecting to:
32
-
33
- + X-SiteID: `AS number`-`ISO country code`
34
-
35
-
36
-##### Config example
37
-
38
-```
39
-ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
40
-ssl_session_cache shared:SSL:2m;
41
-
42
-ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
43
-
44
-ssl_prefer_server_ciphers on;
45
-
46
-upstream wiki { server 127.0.0.1:4567; }
47
-
48
-server {
49
- server_name internal.dn42 wiki.dn42;
50
-
51
- listen 172.23.0.80:80 default;
52
-
53
- add_header strict-transport-security "max-age=0; includeSubDomains";
54
- add_header X-SiteID '<aut-num>-<cc>';
55
-
56
- location / {
57
- location =/robots.txt { root <path>/wiki.dn42/; }
58
- location =/custom.css { root <path>/wiki.dn42/; }
59
- proxy_pass http://wiki;
60
- }
61
-}
62
-
63
-upstream wikirw { server 127.0.0.1:4568; }
64
-
65
-
66
-server {
67
- server_name internal.dn42 wiki.dn42;
68
-
69
- listen 172.23.0.80:443 ssl default;
70
-
71
- ssl on;
72
- ssl_certificate <path>/ssl.crt;
73
- ssl_certificate_key <path>/ssl.key;
74
-
75
- add_header strict-transport-security "max-age=0; includeSubDomains";
76
- add_header Public-Key-Pins 'pin-sha256="mJ1xUCzfru8Ckq2+M6VkNKGOGgSETImRAHBF24mjalw="; pin-sha256="/gOyi7syRMR+d2jZoB/MzcSD++8ciZkSl/hZAQgzWws="; max-age=0; includeSubDomains';
77
- add_header X-SiteID '<aut-num>-<cc>';
78
-
79
- location / {
80
- location =/robots.txt { root <path>/wiki.dn42/; }
81
- location =/custom.css { root <path>/wiki.dn42/; }
82
- proxy_pass http://wikirw;
83
- }
84
-}
85
-
86
-```
87
-
88
-### [ExaBGP](https://github.com/Exa-Networks/exabgp)
89
-
90
-##### Announcing
91
-
92
-The prefix AS-PATH should show the announcement is originating from your AS. After peering ExaBGP to the nearest speaker(s), check if the prefix is routing properly inside your network. Try not to blackhole the passing traffic (e.g. no static routes to `172.23.0.80/28`). Test the whole thing by shutting down nginx/gollum and watch what happens.
93
-
94
-##### Configuration
95
-
96
-```
97
-# exabgp.conf
98
-
99
-group gollum-watchdog {
100
- neighbor <peer1> {
101
- router-id x.x.x.x;
102
- local-address <source-address>;
103
- local-as <ownas>;
104
- peer-as <peeras>;
105
- }
106
-
107
- ## (example) peer with one of our iBGP speakers:
108
- neighbor <172.22.0.1> {
109
- router-id 172.23.0.80;
110
- local-address 172.22.0.2;
111
- local-as 123456;
112
- peer-as 123456;
113
- }
114
-
115
- ## ...
116
-
117
- process watch-gollum {
118
- run <path>/gollum-watchdog.sh;
119
- }
120
-}
121
-
122
-```
123
-
124
-##### Watchdog script
125
-
126
-Watchdog runs in an infinite loop, sending the appropriate commands to stdout. [ExaBGP](https://github.com/Exa-Networks/exabgp) attaches to the process' stdout and listens for instructions. Watchdog sends either a route announce or widthdraw.
127
-
128
-Run `gollum-watchdog.sh` in a shell first to validate it's working:
129
-
130
-```
131
-#!/bin/bash
132
-
133
-CURL=curl
134
-
135
-## url's to check (all listed must be alive to send announce)
136
-URL=( "http://172.23.0.80" "https://172.23.0.80" )
137
-
138
-## the anycast route (/28 due to prefix size limits)
139
-ROUTE='172.23.0.80/28'
140
-
141
-## the next-hop we'll be advertising to neighbor(s)
142
-NEXTHOP='<source-address>'
143
-
144
-## regex match this keyword against HTTP response from curl
145
-VALIDATE_KEYWORD='gollum'
146
-
147
-INTERVAL=60
148
-
149
-###########################
150
-
151
-RUN_STATE=0
152
-
153
-check_urls() {
154
- for url in "${URL[@]}"; do
155
-
156
- ## workaround curl errno 23 when piping
157
- http_response=`${CURL} --insecure -L -o - "${url}"`
158
-
159
- echo "${http_response}" | egrep -q "${VALIDATE_KEYWORD}" || {
160
- return 1
161
- }
162
-
163
- ## add more checks
164
-
165
- done
166
- return 0
167
-}
168
-
169
-while [ 1 ]; do
170
- if [ ${RUN_STATE} -eq 0 ]; then
171
- check_urls && {
172
- RUN_STATE=1
173
- echo "announce route ${ROUTE} next-hop ${NEXTHOP}"
174
- }
175
- else
176
- check_urls || {
177
- RUN_STATE=0
178
- echo "withdraw route ${ROUTE} next-hop ${NEXTHOP}"
179
- }
180
- fi
181
-
182
- sleep ${INTERVAL}
183
-
184
-done
185
-
186
-exit 0
187
-
188
-
189
-```
190
-
191
-##### Run
192
-
193
- Normally SIGUSR1 to the exabgp process triggers a configuration update, but at occasion the process might need to be restarted - since its gracefull shutdown can be glitchy , this might be a bit difficult. Sending SIGKILL to the child(ren) and immediately after, the parent, does the job (quick-and-dirty).
194
-
195
-`USAGE: /etc/exabgp/run.sh [start|stop|restart]`
196
-
197
-```
198
-
199
-#!/bin/bash
200
-
201
-PID_FILE=/var/run/exaBGP/exabgp_PID
202
-
203
-######################################
204
-
205
-EXABGP=<path>/sbin/exabgp
206
-EXA_LOG=/var/log/exabgp.log
207
-CONF=/etc/exabgp/exabgp.conf
208
-
209
-
210
-start() {
211
- [ -f ${PID_FILE} ] && {
212
- echo "WARNING: `cat ${PID_FILE}`: exabgp already running"; return 1
213
- }
214
- ${EXABGP} ${CONF} &> ${EXA_LOG} &
215
- cpid=$!
216
- [ ${cpid} -eq 0 ] && {
217
- echo "ERROR: could not start process"; return 1
218
-
219
- }
220
- echo $! > ${PID_FILE}
221
-}
222
-
223
-stop(){
224
- [ -f ${PID_FILE} ] || return 1
225
- pkill -9 -P $(cat ${PID_FILE})
226
- kill -9 $(cat ${PID_FILE})
227
- rm -f ${PID_FILE}
228
-}
229
-
230
-case ${1} in
231
- start )
232
- start
233
- ;;
234
- stop )
235
- stop
236
- ;;
237
- restart )
238
- stop
239
- sleep 1
240
- start
241
- ;;
242
-esac
243
-
244
-exit 0
245
-
246
-```
247
-
248
-
249
-
250
-
... ...
\ No newline at end of file