apps/node-red: 80% done but still (WIP)

2 files changed, 129 insertions, 1 deletions

diff --git a/roles/apps/node-red/instance/tasks/main.yml b/roles/apps/node-red/instance/tasks/main.yml
index ec9b9dff..3533ab09 100644
--- a/roles/apps/node-red/instance/tasks/main.yml
+++ b/roles/apps/node-red/instance/tasks/main.yml
@@ -16,7 +16,7 @@
     owner: 1000
     mode: 0700
 
-- name: generate/install/fetch TLS certificate
+- name: generate/install/fetch TLS certificates for mqtt
   when: "'mqtt_tls' in node_red_instances[node_red_instance]"
   vars:
     x509_certificate_name: "node-red-{{ node_red_instance }}_mqtt"
@@ -45,6 +45,85 @@
   include_role:
     name: "x509/{{ node_red_instances[node_red_instance].mqtt_tls.certificate_provider }}/cert"
 
+- name: generate/install TLS certificates for publishment
+  vars:
+    x509_certificate_name: "node-red-{{ node_red_instance }}_publish"
+    x509_certificate_hostnames: []
+    x509_certificate_config:
+      ca: "{{ node_red_instances[node_red_instance].publish.zone.certificate_ca_config }}"
+      cert:
+        common_name: "node-red-{{ node_red_instance }}"
+        extended_key_usage:
+        - serverAuth
+        extended_key_usage_critical: yes
+        create_subject_key_identifier: yes
+        not_after: +100w
+    x509_certificate_renewal:
+      install:
+      - dest: "{{ node_red_instance_basepath }}/tls/publish-crt.pem"
+        src:
+        - fullchain
+        owner: root
+        group: 1000
+        mode: "0644"
+      - dest: "{{ node_red_instance_basepath }}/tls/publish-key.pem"
+        src:
+        - key
+        owner: root
+        group: 1000
+        mode: "0640"
+      - dest: "{{ node_red_instance_basepath }}/tls/publish-ca-crt.pem"
+        src:
+        - ca_cert
+        owner: root
+        group: 1000
+        mode: "0644"
+  include_role:
+    name: "x509/{{ node_red_instances[node_red_instance].publish.zone.certificate_provider }}/cert"
+
+- name: build custom image
+  when: "'custom_image' in node_red_instances[node_red_instance]"
+  block:
+  - name: create build directory for custom image
+    file:
+      path: "{{ node_red_instance_basepath }}/build"
+      state: directory
+
+  - name: generate Dockerfile for custom image
+    copy:
+      content: |
+        FROM {{ node_red_instances[node_red_instance].custom_image.from | default('nodered/node-red:' + node_red_instances[node_red_instance].version + '-debian') }}
+
+        {{ node_red_instances[node_red_instance].custom_image.dockerfile }}
+      dest: "{{ node_red_instance_basepath }}/build/Dockerfile"
+    register: node_red_custom_image_docker
+
+  - name: build custom image
+    docker_image:
+      name: "nodered/node-red/{{ node_red_instance }}:{{ node_red_instances[node_red_instance].version }}-debian"
+      state: present
+      force_source: "{{ node_red_custom_image_docker is changed }}"
+      source: build
+      build:
+        path: "{{ node_red_instance_basepath }}/build"
+        network: host
+        pull: yes
+
+## TODO: settings.js:
+#
+#  module.exports = {
+#    credentialSecret: "geheim",
+#    https: {
+#      key: require("fs").readFileSync('/tls/publish-key.pem'),
+#      cert: require("fs").readFileSync('/tls/publish-crt.pem'),
+#      ca: require("fs").readFileSync('/tls/publish-ca-crt.pem'),
+#      requestCert: true,
+#      minVersion: 'TLSv1.3'
+#    },
+#    {{ node_red_instances[node_red_instance].extra_settings }}
+#  }
+#
+
 - name: install pod manifest
   vars:
     kubernetes_standalone_pod:
@@ -52,3 +131,48 @@
       spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
   include_role:
     name: kubernetes/standalone/pod
+
+- name: configure nginx vhost for publishment
+  vars:
+    nginx_vhost__yaml: |
+      {% if node_red_instances[node_red_instance].publish.zone.publisher == inventory_hostname %}
+      name: "node-red-{{ node_red_instance }}"
+      {% else %}
+      name: "node-red-{{ node_red_instance }}-{{ inventory_hostname }}"
+      {% endif %}
+      template: generic
+      {% if 'tls' in node_red_instances[node_red_instance].publish %}
+      tls:
+        {{ node_red_instances[node_red_instance].publish.tls | to_nice_yaml(indent=2) | indent(2) }}
+      {% endif %}
+      hostnames:
+      {% for hostname in node_red_instances[node_red_instance].publish.hostnames %}
+      - {{ hostname }}
+      {% endfor %}
+      locations:
+        '/':
+      {% if node_red_instances[node_red_instance].publish.zone.publisher == inventory_hostname %}
+          proxy_pass: "https://127.0.0.1:{{ node_red_instances[node_red_instance].port }}"
+      {% else %}
+          proxy_pass: "https://{{ ansible_default_ipv4.address }}:{{ node_red_instances[node_red_instance].port }}"
+      {% endif %}
+          proxy_ssl:
+            certificate: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-crt.pem"
+            certificate_key: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-key.pem"
+            trusted_certificate: "/etc/ssl/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}/apps-publish-{{ node_red_instances[node_red_instance].publish.zone.name }}-ca-crt.pem"
+            verify: "on"
+            name: "node-red-{{ node_red_instance }}"
+            protocols: "TLSv1.3"
+      {% if 'location_extra_directives' in node_red_instances[node_red_instance].publish %}
+          extra_directives: |
+            {{ node_red_instances[node_red_instance].publish.location_extra_directives | indent(6) }}
+      {% endif %}
+      {% if 'vhost_extra_directives' in node_red_instances[node_red_instance].publish %}
+      extra_directives: |
+        {{ node_red_instances[node_red_instance].publish.vhost_extra_directives | indent(2) }}
+      {% endif %}
+    nginx_vhost: "{{ nginx_vhost__yaml | from_yaml }}"
+  include_role:
+    name: nginx/vhost
+    apply:
+      delegate_to: "{{ node_red_instances[node_red_instance].publish.zone.publisher }}"
diff --git a/roles/apps/node-red/instance/templates/pod-spec.yml.j2 b/roles/apps/node-red/instance/templates/pod-spec.yml.j2
index 29f2161a..1e60c122 100644
--- a/roles/apps/node-red/instance/templates/pod-spec.yml.j2
+++ b/roles/apps/node-red/instance/templates/pod-spec.yml.j2
@@ -1,6 +1,10 @@
 containers:
 - name: node-red
+{% if 'custom_image' in node_red_instances[node_red_instance] %}
+  image: "nodered/node-red/{{ node_red_instance }}:{{ node_red_instances[node_red_instance].version }}-debian"
+{% else %}
   image: "nodered/node-red:{{ node_red_instances[node_red_instance].version }}-debian"
+{% endif %}
   volumeMounts:
   - name: tls
     mountPath: /tls