View source for Docker/Infrastruktūras dokumentācija un receptes

<div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output">
= Docker management servera instalācija =
<div class="mw-parser-output">
=== Sagatavošana ===

Izveidojam uz visiem serveriem nepieciešamos vides mainīgos, kas jāpielāgo attiecīgajai videi:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>export CLUSTER_SERVER1=vafldckr25</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">export CLUSTER_DOMAIN=zzdats.lv</div> 
Izveidojam uz visiem serveriem nepieciešamos automātiski aprēķināmos vides mainīgos:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>export HOSTNAME_IP=$(ip route get 8.8.8.8 | tr -s ' ' | cut -d' ' -f7 | tr -s '\n')<br/> export CLUSTER_SERVER1_IP=$(getent hosts $CLUSTER_SERVER1.$CLUSTER_DOMAIN | awk '{ print $1 }')</code></div> </div> <div class="mw-parser-output">
<div class="mw-parser-output">
<div class="mw-parser-output">
=== Instalācija ===

Instalējam atjauninājumus
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>apt-get -y update<br/> apt-get -y dist-upgrade<br/> apt-get -y autoremove</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>apt-get install curl gnupg software-properties-common -y</code></div> 
Instalējam Docker CE
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>curl -fsSL [https://download.docker.com/linux/ubuntu/gpg https://download.docker.com/linux/ubuntu/gpg] | apt-key add -</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">add-apt-repository&nbsp;&nbsp;&nbsp; "deb [arch=amd64] [https://download.docker.com/linux/ubuntu https://download.docker.com/linux/ubuntu] $(lsb_release -cs) stable"</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">apt-get -y install docker-ce unzip</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">curl -L [https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname] -s)-$(uname -m) -o /usr/local/bin/docker-compose</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">chmod +x /usr/local/bin/docker-compose</div> </div>

=== Konfigurācija ===

Pamata konfigurācijai izpildam:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>cat >/etc/docker/daemon.json <<EOL<br/> {<br/> &nbsp;&nbsp;&nbsp; "graph": "/srv/docker",<br/> &nbsp;&nbsp;&nbsp; "storage-driver": "overlay2",<br/> &nbsp;&nbsp;&nbsp; "icc": false,<br/> &nbsp;&nbsp;&nbsp; "disable-legacy-registry": true,<br/> &nbsp;&nbsp;&nbsp; "userland-proxy": false,<br/> &nbsp;&nbsp;&nbsp; "no-new-privileges": false<br/> }<br/> EOL</code></div> 
&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>rm -rf /var/lib/docker/*</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">echo "vm.max_map_count=262144" > /etc/sysctl.d/00-elastic.conf</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">sysctl -w vm.max_map_count=262144</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">systemctl restart docker</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">docker swarm init --advertise-addr $HOSTNAME_IP</div> </div> </div> <div class="mw-parser-output"><div class="mw-parser-output">
== Vadības un starpniekservera servisu uzstādīšana ==
<div class="mw-parser-output"><div class="mw-parser-output">
=== Instalējam iekšējo HaProxy servisu ===

Augšupielādējam failu&nbsp;<code>ssl_cert.key</code>, kas satur PEM formatā privāto un publisko sertifikāta atslēgu, ko izmantot HTTPS.

Izpildam uz servera komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker secret create ssl_cert_key ssl_cert.key</code></div> 
&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">version: '3.5'</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">services:</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp; proxy:<br/> &nbsp; &nbsp; image: dockerflow/docker-flow-proxy:latest<br/> &nbsp; &nbsp; ports:<br/> &nbsp; &nbsp; &nbsp; - 80:80<br/> &nbsp; &nbsp; &nbsp; - 443:443<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - proxy<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; - LISTENER_ADDRESS=swarm-listener<br/> &nbsp; &nbsp; &nbsp; - MODE=swarm<br/> &nbsp; &nbsp; &nbsp; - STATS_USER=admin<br/> &nbsp; &nbsp; &nbsp; - STATS_PASS=oSFDHjI4s3Wa<br/> &nbsp; &nbsp; &nbsp; - HTTPS_ONLY=true<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; mode: global<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 1s<br/> &nbsp; &nbsp; depends_on:<br/> &nbsp; &nbsp; &nbsp; - swarm-listener<br/> &nbsp; &nbsp; secrets:<br/> &nbsp; &nbsp; &nbsp; - source: "ssl_cert_key"<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: "cert-mgmt.pem" &nbsp; &nbsp; &nbsp;</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp; swarm-listener:<br/> &nbsp; &nbsp; image: dockerflow/docker-flow-swarm-listener:latest<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - proxy<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - /var/run/docker.sock:/var/run/docker.sock<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; - DF_NOTIFY_CREATE_SERVICE_URL=[http://proxy:8080/v1/docker-flow-proxy/reconfigure http://proxy:8080/v1/docker-flow-proxy/reconfigure]<br/> &nbsp; &nbsp; &nbsp; - DF_NOTIFY_REMOVE_SERVICE_URL=[http://proxy:8080/v1/docker-flow-proxy/remove http://proxy:8080/v1/docker-flow-proxy/remove]<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; placement:<br/> &nbsp; &nbsp; &nbsp; &nbsp; constraints: [node.role == manager]<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">secrets:<br/> &nbsp; ssl_cert_key:<br/> &nbsp; &nbsp; external: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">networks:<br/> &nbsp; proxy:<br/> &nbsp; &nbsp; name: proxy<br/> &nbsp;</div> <div class="mw-parser-output">&nbsp;</div> <div class="mw-parser-output">
Uz pirmā servera augšupielādējam&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/mgmt-docker-flow-proxy.yml mgmt-docker-flow-proxy.yml]&nbsp;un izpildam komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker stack deploy -c mgmt-docker-flow-proxy.yml proxy</code></div> </div> </div> <div class="mw-parser-output">
=== Instalējam portainer serveri ===
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">version: '3.5'</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">services:<br/> &nbsp; agent:<br/> &nbsp; &nbsp; image: portainer/agent<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; AGENT_CLUSTER_ADDR: tasks.agent<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - /var/run/docker.sock:/var/run/docker.sock<br/> &nbsp; &nbsp; &nbsp; - /srv/docker/volumes:/var/lib/docker/volumes<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - portainer_agent<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; mode: global<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp; portainer:<br/> &nbsp; &nbsp; image: portainer/portainer<br/> &nbsp; &nbsp; command: -H tcp://agent:9001 --tlsskipverify<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - portainer:/data<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - portainer_agent<br/> &nbsp; &nbsp; &nbsp; - proxy<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; mode: replicated<br/> &nbsp; &nbsp; &nbsp; replicas: 1<br/> &nbsp; &nbsp; &nbsp; placement:<br/> &nbsp; &nbsp; &nbsp; &nbsp; constraints: [node.role == manager]<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s<br/> &nbsp; &nbsp; &nbsp; labels:<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.docker.network=proxy"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.frontend.rule=Host:vafl-mgmt-atv.zzdats.lv; PathPrefixStrip: /portainer; PathPrefix: /portainer"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.port=9000"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.notify=true"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.serviceDomain=vafl-mgmt-atv.zzdats.lv"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.servicePath=/portainer"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.reqPathSearchReplace=/portainer,"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port=9000"</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">networks:<br/> &nbsp; portainer_agent:<br/> &nbsp; &nbsp; driver: overlay<br/> &nbsp; &nbsp; attachable: true<br/> &nbsp; proxy:<br/> &nbsp; &nbsp; external: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">volumes:<br/> &nbsp; portainer:<br/> &nbsp;</div> 
&nbsp;

Uz pirmā servera augšupielādējam&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/portainer-server.yml portainer-server.yml]&nbsp;un izpildam komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker stack deploy -c portainer-server.yml portainer</code></div> </div> </div> </div> </div> 
== Management servisu uzstādīšana un konfigurācija ==
<div class="mw-parser-output"><div class="mw-parser-output"><div class="mw-parser-output">
=== Uzstādām Docker reģistru servisu ===

<div class="mw-parser-output">
=== Pirms tam jāizveido&nbsp;'''token parakstīšanas sertifikāts'''. ===

Portainer managment serverim pievienojam jaunu konfigurāciju sadaļā pievienojam konfigurācijas (''Configs''):

[[File:Dckr mgmt add config.png|RTENOTITLE]]
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">server:<br/> &nbsp; addr: ":5001"</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">token:<br/> &nbsp; issuer: "VAFL IS Docker Auth (Pre-production)"<br/> &nbsp; expiration: 900<br/> &nbsp; certificate: "/config/sign.crt"<br/> &nbsp; key: "/run/secrets/docker-registry-sign-certificate-private"</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">ldap_auth:<br/> &nbsp; addr: "dcast.ast.zzdats.lv:389"<br/> &nbsp; tls: none<br/> &nbsp; bind_dn: CN=vafl_cc-service,OU=VAFL,DC=ast,DC=zzdats,DC=lv<br/> &nbsp; bind_password_file: /run/secrets/docker-registry-ad-user-password<br/> &nbsp; base: OU=VAFL,DC=ast,DC=zzdats,DC=lv<br/> &nbsp; filter: (&(objectCategory=Person)(memberOf=CN=Docker Registry,OU=VAFL,DC=ast,DC=zzdats,DC=lv)(sAMAccountName=${account})(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">acl:<br/> &nbsp; - match:<br/> &nbsp; &nbsp; &nbsp; account: /.+/<br/> &nbsp; &nbsp; actions: ['*']<br/> &nbsp;</div> 
Pievienojam konfigurāciju ar nosaukumu&nbsp;<code>docker-registry-auth-config</code>&nbsp;un saturu no faila&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/docker-registry/config-auth.yml config-auth.yml], kuru pielāgojam attiecīgās vides konfigurācijai (AD serveris, lietotāji).
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">listen_addr: 0.0.0.0:8000<br/> base_path: /hub/</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">registry_url: [https://vafl-mgmt-atv.zzdats.lv/ https://vafl-mgmt-atv.zzdats.lv/]<br/> verify_tls: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">registry_username: vafl_cc-service<br/> registry_password_file: /run/secrets/docker-registry-ad-user-password</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">event_listener_token: token<br/> event_retention_days: 7</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">event_database_driver: sqlite3<br/> event_database_location: data/registry_events.db</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">cache_refresh_interval: 10</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">anyone_can_delete: false<br/> # Lietotāji, kam ir atļauts dzēst docker image atzīmes<br/> admins: [vafl_admin]</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">debug: false</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">purge_tags_keep_days: 90<br/> purge_tags_keep_count: 2<br/> purge_tags_schedule: '00 00 03 * * *'<br/> &nbsp;</div> 
Pievienojam konfigurāciju ar nosaukumu&nbsp;<code>docker-registry-ui-config</code>&nbsp;un saturu no faila&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/docker-registry/config-ui.yml config-ui.yml], kuru pielāgojam attiecīgās vides konfigurācijai (Docker reģistra URL, lietotāji).

*&nbsp; 

Pievienojam konfigurāciju ar nosaukumu&nbsp;<code>docker-registry-sign-certificate-public</code>&nbsp;un saturā parakstīšanas sertifikāta publisko daļu PEM formātā.

Sadaļā noslēpumi (''Secret'') pievienojam jaunu noslēpumu:

[[File:Dckr mgmt add secret.png|RTENOTITLE]]

*&nbsp; 

Pievienojam noslēpumu ar nosaukumu&nbsp;<code>docker-registry-sign-certificate-private</code>&nbsp;un saturā parakstīšanas sertifikāa privāto daļu PEM formātā.

&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">listen_addr: 0.0.0.0:8000<br/> base_path: /hub/</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">registry_url: https://vafl-mgmt-atv.zzdats.lv/<br/> verify_tls: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">registry_username: vafl_cc-service<br/> registry_password_file: /run/secrets/docker-registry-ad-user-password</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">event_listener_token: token<br/> event_retention_days: 7</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">event_database_driver: sqlite3<br/> event_database_location: data/registry_events.db</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">cache_refresh_interval: 10</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">anyone_can_delete: false<br/> # Lietotāji, kam ir atļauts dzēst docker image atzīmes<br/> admins: [vafl_admin]</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">debug: false</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">purge_tags_keep_days: 90<br/> purge_tags_keep_count: 2<br/> purge_tags_schedule: '00 00 03 * * *'<br/> &nbsp;</div> 
&nbsp;

Pievienojam konfigurāciju ar nosaukumu&nbsp;<code>docker-registry-ui-config</code>&nbsp;un saturu no faila&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/docker-registry/config-ui.yml config-ui.yml], kuru pielāgojam attiecīgās vides konfigurācijai (Docker reģistra URL, lietotāji).

*&nbsp; 

Pievienojam noslēpumu ar nosaukumu&nbsp;<code>docker-registry-ad-user-password</code>&nbsp;un saturā norādām AD lietotaja, kas norādīts&nbsp;<code>docker-registry-auth-config</code>&nbsp;konfigurācijā, paroli.

Sadaļā steki (''Stacks'') pievienojam jaunu steku:

[[File:Dckr mgmt add stack.png|RTENOTITLE]]
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">version: '3.5'</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">services:<br/> &nbsp; auth:<br/> &nbsp; &nbsp; image: cesanta/docker_auth:1<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - authlog:/logs<br/> &nbsp; &nbsp; &nbsp; - authconf:/config<br/> &nbsp; &nbsp; secrets:<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-ad-user-password<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: docker-registry-ad-user-password<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-sign-certificate-private<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: docker-registry-sign-certificate-private<br/> &nbsp; &nbsp; configs:<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-auth-config<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: /config/auth_config.yml<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-sign-certificate-public<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: /config/sign.crt<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s<br/> &nbsp; &nbsp; &nbsp; labels:<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.notify=true"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.serviceDomain=vafl-mgmt-atv.zzdats.lv"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.servicePath=/auth"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port=5001"<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - proxy</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp; registry:<br/> &nbsp; &nbsp; image: registry:2<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_AUTH=token"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_AUTH_TOKEN_REALM=[https://vafl-mgmt-atv.zzdats.lv/auth https://vafl-mgmt-atv.zzdats.lv/auth]"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_AUTH_TOKEN_SERVICE=VAFL IS Docker Registry (Pre-production)"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_AUTH_TOKEN_ISSUER=VAFL IS Docker Auth (Pre-production)"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY=/var/lib/registry"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE=/certs/sign.crt"<br/> &nbsp; &nbsp; &nbsp; - "REGISTRY_STORAGE_DELETE_ENABLED=true"<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - registrydata:/var/lib/registry<br/> &nbsp; &nbsp; &nbsp; - registrycerts:/certs<br/> &nbsp; &nbsp; configs:<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-sign-certificate-public<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: /certs/sign.crt<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s<br/> &nbsp; &nbsp; &nbsp; labels:<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.notify=true"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.serviceDomain=vafl-mgmt-atv.zzdats.lv"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.servicePath=/v2"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port=5000"<br/> &nbsp; &nbsp; depends_on:<br/> &nbsp; &nbsp; &nbsp; - auth<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - proxy</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">&nbsp; ui:<br/> &nbsp; &nbsp; image: quiq/docker-registry-ui:latest<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - uidata:/opt/data<br/> &nbsp; &nbsp; secrets:<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-ad-user-password<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: docker-registry-ad-user-password<br/> &nbsp; &nbsp; configs:<br/> &nbsp; &nbsp; &nbsp; - source: docker-registry-ui-config<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: /opt/config.yml<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s<br/> &nbsp; &nbsp; &nbsp; labels:<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.notify=true"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.serviceDomain=vafl-mgmt-atv.zzdats.lv"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.servicePath=/hub"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port=8000"<br/> &nbsp; &nbsp; depends_on:<br/> &nbsp; &nbsp; &nbsp; - registry<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - proxy</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">volumes:<br/> &nbsp; authlog:<br/> &nbsp; authconf:<br/> &nbsp; registrydata:<br/> &nbsp; registrycerts:<br/> &nbsp; uidata:</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">networks:<br/> &nbsp; proxy:<br/> &nbsp; &nbsp; external: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">configs:<br/> &nbsp; docker-registry-auth-config:<br/> &nbsp; &nbsp; external: true<br/> &nbsp; docker-registry-sign-certificate-public:<br/> &nbsp; &nbsp; external: true<br/> &nbsp; docker-registry-ui-config:<br/> &nbsp; &nbsp; external: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">secrets:<br/> &nbsp; docker-registry-ad-user-password:<br/> &nbsp; &nbsp; &nbsp;external: true<br/> &nbsp; docker-registry-sign-certificate-private:<br/> &nbsp; &nbsp; &nbsp;external: true<br/> &nbsp;</div> 
*Pievienojam steku ar nosaukumu&nbsp;<code>docker-registry</code>&nbsp;un definicijā norādām saturu no faila&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/docker-registry/docker-registry.yml docker-registry.yml]. 

Pēc tam kad ir piestartējies Docker reģistrs, sadaļa reģistri (''Registries'') pievienojam jaunu reģistru:

[[File:Dckr mgmt add registry.png|RTENOTITLE]]

*Pievienojam jaunu reģistru ar nosaukumu&nbsp;<code>vafl-mgmt-atv.zzdats.lv</code>, adresi&nbsp;<code>vafl-mgmt-atv.zzdats.lv</code>&nbsp;un autorizāciju ar sistēmas lietotāju un paroli. 

</div> </div> </div> </div> </div> </div> </div>
</div>

= Docker swarm instalācija =

&nbsp;
<div class="mw-parser-output">
== Sagatavošana ==

Izveidojam uz visiem serveriem nepieciešamos vides mainīgos, kas jāpielāgo attiecīgajai videi:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>export CLUSTER_SERVER1=vafldckr11<br/> export CLUSTER_SERVER2=vafldckr12<br/> export CLUSTER_SERVER3=vafldckr13<br/> export CLUSTER_SERVER4=vafldckr14</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">export CLUSTER_DOMAIN=zzdats.lv</div> 
Izveidojam uz visiem serveriem nepieciešamos automātiski aprēķināmos vides mainīgos:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>export HOSTNAME_IP=$(ip route get 8.8.8.8 | tr -s ' ' | cut -d' ' -f7 | tr -s '\n')<br/> export CLUSTER_SERVER1_IP=$(getent hosts $CLUSTER_SERVER1.$CLUSTER_DOMAIN | awk '{ print $1 }')<br/> export CLUSTER_SERVER2_IP=$(getent hosts $CLUSTER_SERVER2.$CLUSTER_DOMAIN | awk '{ print $1 }')<br/> export CLUSTER_SERVER3_IP=$(getent hosts $CLUSTER_SERVER3.$CLUSTER_DOMAIN | awk '{ print $1 }')<br/> export CLUSTER_SERVER4_IP=$(getent hosts $CLUSTER_SERVER4.$CLUSTER_DOMAIN | awk '{ print $1 }')</code></div> </div> <div class="mw-parser-output">
== Instalācija ==

Instalējam atjauninājumus
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>apt-get -y update<br/> apt-get -y dist-upgrade<br/> apt-get -y autoremove</code></div> 
Instalējam Docker CE
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>curl -fsSL [https://download.docker.com/linux/ubuntu/gpg https://download.docker.com/linux/ubuntu/gpg] | apt-key add -</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">add-apt-repository&nbsp;&nbsp;&nbsp; "deb [arch=amd64] [https://download.docker.com/linux/ubuntu https://download.docker.com/linux/ubuntu] $(lsb_release -cs) stable"</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">apt-get -y install docker-ce unzip</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">curl -L [https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname https://github.com/docker/compose/releases/download/1.22.0/docker-compose-$(uname] -s)-$(uname -m) -o /usr/local/bin/docker-compose</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">chmod +x /usr/local/bin/docker-compose</div> </div> <div class="mw-parser-output">
== Konfigurācija ==

Pamata konfigurācijai izpildam:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>cat >/etc/docker/daemon.json <<EOL<br/> {<br/> &nbsp;&nbsp;&nbsp; "graph": "/srv/docker",<br/> &nbsp;&nbsp;&nbsp; "storage-driver": "overlay2",<br/> &nbsp;&nbsp;&nbsp; "icc": false,<br/> &nbsp;&nbsp;&nbsp; "disable-legacy-registry": true,<br/> &nbsp;&nbsp;&nbsp; "userland-proxy": false,<br/> &nbsp;&nbsp;&nbsp; "no-new-privileges": true<br/> }<br/> EOL</code></div> 
&nbsp;
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>rm -rf /var/lib/docker/*</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">echo "vm.max_map_count=262144" > /etc/sysctl.d/00-elastic.conf</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">sysctl -w vm.max_map_count=262144</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">systemctl restart docker</div> </div> <div class="mw-parser-output">
== Izveidojam Docker Swarm klāsteri ==

Uz pirmā servera izpildām:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker swarm init --advertise-addr $HOSTNAME_IP</code></div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">docker swarm join-token manager</div> 
Šo komandu izpildes rezultātā konsolē tiks izdrukāts Docker swarm klāstera pievienošanāš talons (piemmēram,&nbsp;<code>SWMTKN-...</code>), kas nepieciešams nākošajā solī.

Pārējos serveros izpildām komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker swarm join --token <token> $CLUSTER_SERVER1_IP:2377</code></div> </div> <div class="mw-parser-output">
== Docker Swarm klāstera izveide ==

Uz pirmā servera izpildām komandas:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker node demote $(docker node ls -f "name=$CLUSTER_SERVER4" --format "{{.ID}}")<br/> docker node update --label-add lv.zzdats.vaflis.backoffice=true $(docker node ls -f "name=$CLUSTER_SERVER4" --format "{{.ID}}")<br/> docker node update --label-add lv.zzdats.vaflis.queueserver=true $(docker node ls -f "name=$CLUSTER_SERVER2" --format "{{.ID}}")<br/> docker node update --label-add lv.zzdats.vaflis.maindb=true $(docker node ls -f "name=$CLUSTER_SERVER3" --format "{{.ID}}")<br/> docker node update --label-add lv.zzdats.vaflis.elastic=node1 $(docker node ls -f "name=$CLUSTER_SERVER2" --format "{{.ID}}")<br/> docker node update --label-add lv.zzdats.vaflis.elastic=node2 $(docker node ls -f "name=$CLUSTER_SERVER4" --format "{{.ID}}")</code></div> </div> 
== Vadības un starpniekservera servisu uzstādīšana ==

&nbsp;
<div class="mw-parser-output"><div class="mw-parser-output">
=== Instalējam portainer aģentu ===
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">version: '3.5'</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">services:<br/> &nbsp; agent:<br/> &nbsp; &nbsp; image: portainer/agent<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; AGENT_CLUSTER_ADDR: tasks.agent<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - /var/run/docker.sock:/var/run/docker.sock<br/> &nbsp; &nbsp; &nbsp; - /srv/docker/volumes:/var/lib/docker/volumes<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - portainer_agent<br/> &nbsp; &nbsp; ports:<br/> &nbsp; &nbsp; &nbsp; - target: 9001<br/> &nbsp; &nbsp; &nbsp; &nbsp; published: 9001<br/> &nbsp; &nbsp; &nbsp; &nbsp; protocol: tcp<br/> &nbsp; &nbsp; &nbsp; &nbsp; mode: host<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; mode: global<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.2'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '128M'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 5s</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">networks:<br/> &nbsp; portainer_agent:<br/> &nbsp; &nbsp; driver: overlay<br/> &nbsp; &nbsp; attachable: true<br/> &nbsp;</div> 
Uz pirmā servera augšupielādējam&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/portainer-agent.yml portainer-agent.yml]&nbsp;un izpildam komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker stack deploy -c portainer-agent.yml portainer</code></div> &nbsp; <div class="mw-parser-output">&nbsp;</div> </div> 
=== Pievienojam klāsteri Portainer administrācijas rīkam ===

Kā galapunktu (''endpoint'') izmantojam pirmā servera adresi un portu&nbsp;<code>9001</code>, piemēram&nbsp;'''<code>node1.domain:9001</code>'''
</div> <div class="mw-parser-output">
=== Instalējam klāstera iekšējo HaProxy servisu ===

Izmantojot portainer administrēšanas rīku, pievienojam jaunu nospēpumu ar nosaukumu&nbsp;<code>ssl_cert_key</code>, kas satur PEM formatā privāto un publisko sertifikāta atslēgu, ko izmantot HTTPS.

Uz pirmā servera augšupielādējam&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/docker-flow-proxy.yml docker-flow-proxy.yml]&nbsp;un izpildam komandu:
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;"><code>docker stack deploy -c docker-flow-proxy.yml proxy</code></div> 
&nbsp;

= Pamatservisu uzstādīšana un konfigurācija =

&nbsp;

<div class="mw-parser-output">
== Pārvaldes vietnes PostgreSQL datu bāze ==

&nbsp;

<div class="mw-parser-output">
<div class="mw-parser-output">
=== Izmantojot portainer administrēšanas rīku ===

Pievienojam jaunus nospēpumus:

*<code><span style="background-color:#D3D3D3;">backoffice_db_password</span></code>&nbsp;ar paroli, kas tiks izmantota, lai uzstādītu datu bāzes struktūru. 
*<code><span style="background-color:#D3D3D3;">backoffice_db_password2</span></code>&nbsp;ar paroli, kas tiks izmantota, lai no aplikācijas pieslēgtos datu bāzei. 

Izveidojam jaunu servisu steku (''stack''):

*Nosaukums:&nbsp;<code><span style="background-color:#D3D3D3;">backoffice-db</span></code> 
*Būvēšanas metode: <span style="background-color:#D3D3D3;">git repozitorijs</span> 
*Repozitorija URL:&nbsp;<code>[https://git.zzdats.lv/vaflis/infrastructure.git <span style="background-color:#D3D3D3;">https://git.zzdats.lv/vaflis/infrastructure.git</span>]</code> 
*Compose ceļš:&nbsp;<code><span style="background-color:#D3D3D3;">recepies/postgresql/backoffice-db.yml</span></code> 
*Izmantojot autentifikāciju norādām lietotāju un API talonu 

&nbsp;
</div>

== API servisu PostgreSQL datu bāze ==

&nbsp;

<div class="mw-parser-output">
<div class="mw-parser-output">
=== Izmantojot portainer administrēšanas rīku ===

Pievienojam jaunus nospēpumus:

*<code><span style="background-color:#D3D3D3;">vaflis_db_password</span></code>&nbsp;ar paroli, kas tiks izmantota, lai uzstādītu datu bāzes struktūru. 

Izveidojam jaunu servisu steku (''stack''):

*Nosaukums:&nbsp;<code><span style="background-color:#D3D3D3;">api-db</span></code> 
*Būvēšanas metode: git repozitorijs 
*Repozitorija URL:&nbsp;<code><span style="background-color:#D3D3D3;">[https://git.zzdats.lv/vaflis/infrastructure.git https://git.zzdats.lv/vaflis/infrastructure.git]</span></code> 
*Compose ceļš:&nbsp;<code><span style="background-color:#D3D3D3;">recepies/postgresql/api-db.yml</span></code> 
*Izmantojot autentifikāciju norādām lietotāju un API talonu 

&nbsp;
</div>

== Rindu serviss RabbitMQ ==

&nbsp;

<div class="mw-parser-output">
<div class="mw-parser-output">
=== Izmantojot portainer administrēšanas rīku ===

Pievienojam jaunus nospēpumus:

*<code><span style="background-color:#D3D3D3;">rabbitmq_password</span></code>&nbsp;ar paroli, kas tiks izmantota, lai konfigurētu RabbitMQ serveri. 

Izveidojam jaunu servisu steku (''stack''):

*Nosaukums:&nbsp;<code><span style="background-color:#D3D3D3;">queue-service</span></code> 
*Būvēšanas metode: tīmekļa redaktors 
<div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">version: '3.5'</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">services:<br/> &nbsp; rabbit1:<br/> &nbsp; &nbsp; image: rabbitmq:3.7-management-alpine<br/> &nbsp; &nbsp; hostname: rabbit1<br/> &nbsp; &nbsp; environment:<br/> &nbsp; &nbsp; &nbsp; - RABBITMQ_ERLANG_COOKIE=CLXRSSZKSRMFBBZLDGHQ<br/> &nbsp; &nbsp; &nbsp; - RABBITMQ_DEFAULT_USER=admin<br/> &nbsp; &nbsp; &nbsp; - RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/rabbitmq_password<br/> &nbsp; &nbsp; secrets:<br/> &nbsp; &nbsp; &nbsp; - source: "rabbitmq_password"<br/> &nbsp; &nbsp; &nbsp; &nbsp; target: "rabbitmq_password"<br/> &nbsp; &nbsp; networks:<br/> &nbsp; &nbsp; &nbsp; - rabbitnet<br/> &nbsp; &nbsp; &nbsp; - proxy<br/> &nbsp; &nbsp; deploy:<br/> &nbsp; &nbsp; &nbsp; placement:<br/> &nbsp; &nbsp; &nbsp; &nbsp; constraints:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - node.labels.lv.zzdats.vaflis.queueserver == true<br/> &nbsp; &nbsp; &nbsp; resources:<br/> &nbsp; &nbsp; &nbsp; &nbsp; limits:<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cpus: '0.5'<br/> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; memory: '1G'<br/> &nbsp; &nbsp; &nbsp; restart_policy:<br/> &nbsp; &nbsp; &nbsp; &nbsp; condition: on-failure<br/> &nbsp; &nbsp; &nbsp; &nbsp; delay: 2s<br/> &nbsp; &nbsp; &nbsp; labels:<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.docker.network=proxy"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.frontend.rule=PathPrefix: /rabbitmq; StripPathPrefix: /rabbitmq"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "traefik.port=15672"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.notify=true"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.servicePath.1=/rabbitmq"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.reqPathSearchReplace.1=/rabbitmq,"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port.1=15672"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.reqMode.2=tcp"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.srcPort.2=5672"<br/> &nbsp; &nbsp; &nbsp; &nbsp; - "com.df.port.2=5672"<br/> &nbsp; &nbsp; volumes:<br/> &nbsp; &nbsp; &nbsp; - rabbitdata:/var/lib/rabbitmq</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">volumes:<br/> &nbsp; rabbitdata:</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">networks:<br/> &nbsp; rabbitnet:<br/> &nbsp; &nbsp; driver: overlay<br/> &nbsp; proxy:<br/> &nbsp; &nbsp; external: true</div> <div style="background:#eee;border:1px solid #ccc;padding:5px 10px;">secrets:<br/> &nbsp; rabbitmq_password:<br/> &nbsp; &nbsp; external: true<br/> &nbsp;</div> 
*Saturā iekopējam faila&nbsp;[https://git.zzdats.lv/vaflis/infrastructure/src/branch/master/recepies/rabbitmq.yml rabbitmq.yml]&nbsp;saturu 

&nbsp;
</div>