DEV Community: Serzhan Akhmetov

InfluxDB 2.0 - Quickly Enabling TLS Encryption with Traefik

Serzhan Akhmetov — Wed, 24 Mar 2021 11:25:34 +0000

Jumpstart your influxdb stack with automated TLS certificate management.

Use case

So you're running a bunch of IoT/Finance or Cryptocurrency services with Docker or Kubernetes and decided to use that shiny InfluxDB 2.0 dashboard in production. Heck, maybe even play around with the flux API too - for those extra fancy queries.

(Who needs Grafana?)

Obviously, at this point you'll need to secure the traffic between your web application and your server (plus the microservices). This is exactly what TLS encryption does - you know, adds that https:// you see everywhere.

What you will need

You are running running your backend in Docker containers. This is either Docker, Docker Swarm or Kubernetes, or any other vendor that runs docker containers defined thru a YAML compose file or similar.
You are either running or planning to run Traefik as your proxy.
You own a domain name and can manage its DNS records.

Optional:

Your DNS Service allows DNS-01 ACME Challenge to generate wildcard TLS certificates.
You have the necessary credentials to access your DNS Service API.

Instructions

If you opt for the simpler HTTP-01 ACME Challenge, make sure you create all the necessary DNS records beforehand (i.e. create A or CNAME records), including any wildcard subdomain names. Having said that, if your really need wildcard certificates for subdomains, you should use the DNS-01 ACME Challenge.

CAUTION: There are pros and cons for using each type of challenge. Use industry best practices and your own judgement when deciding which method to use for your project.

Below is an example of typical DNS record table for a HTTP-01 Challenge:

Type	Hostname	Value	TTL (seconds)
A	example.com	directs to 203.0.113.123	3600
A	traefik.example.com	directs to 203.0.113.123	3600
CNAME	influxdb.example.com	is an alias of example.com	43200

Our main domain name is example.com and we are running two services that will be exposed via subdomain names traefik.* and influxdb.*. If you have more services you want accessible via subdomain, now's the time to add them here. TTL settings are irrelevant for this tutorial, so feel free to dive deeper into DNS on your own time.

And here is the same table when attempting the DNS-01 Challenge:

Type	Hostname	Value	TTL (seconds
A	*.example.com	directs to 203.0.113.123	3600
A	example.com	directs to 203.0.113.123	3600

We will store our certificates in a bind mounted acme.json. Therefore, appropriate permissions need to be set beforehand for Traefik to access (accept it as secure) this file:
```
touch acme.json; chmod 600 acme.json
```

(Re)define your InfluxDB container by applying the following labels:

For Docker (using Compose):

  ...
  my-influxdb:
    image: influxdb:2.0
    labels:
      # traefik router settings
      traefik.http.routers.my-influxdb.rule: "Host(`influxdb.example.com`)"
      traefik.http.routers.my-influxdb.tls: "true"
      traefik.http.routers.my-influxdb.tls.certresolver: "myresolver"
      traefik.http.routers.my-influxdb.entrypoints: "websecure"

For Docker Swarm:

  ...
  my-influxdb:
    image: influxdb:2.0
    deploy:
      labels:
        # traefik router settings
        traefik.http.routers.my-influxdb.rule: "Host(`influxdb.example.com`)"
        traefik.http.routers.my-influxdb.tls: "true"
        traefik.http.routers.my-influxdb.tls.certresolver: "myresolver"
        traefik.http.routers.my-influxdb.entrypoints: "websecure"

        # traefik service settings
        traefik.http.services.my-influxdb.loadbalancer.server.port: "8086"

The names my-influxdb, myresolver, and websecure are unique identifiers in the Traefik configuration representing the router (service), the certificate resolver, and the entrypoint (port 443), respectively. Here, we defined the router my-influxdb for now, whereas the latter two will be defined in the following step. Notice that we do not expose service ports in our compose file anymore, since all traffic will now be handled by Traefik.

Note: for Swarm, Traefik requires you explicitly define at least one port the service is running on, even it if has no listening ports. (see Port Detection - Traefik Docs)

Don't forget to deploy this new configuration using docker compose up or docker stack deploy -c docker-compose.yml <stack_name>.

Let's now add the Traefik container to your compose file.

Below are 4 different ways to do this - depending on the combination of orchestrator and type of ACME Challenge.

In all cases, we are using the staging Let's Encrypt server - this helps us to generate new certificates in case we mess up much faster since the rate limit is much higher. Once everything works, simply delete the line defining certificateresolvers.myresolver.acme.caserver and redeploy your Traefik container.

In addition, the DNS server I'm using for the DNS-01 Challenge is digitalocean, which requires I define a DO_AUTH_TOKEN. Depending on your DNS provider, you will need to define different credentials.

For Docker (Compose) + HTTP-01 Challenge:

traefik:
  image: "traefik:v2.0.0"
  command:
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --providers.docker
    - --api
    - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.myresolver.acme.email=sample@email.com
    - --certificatesresolvers.myresolver.acme.storage=acme.json
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
    - "./acme.json:/acme.json"
  labels:
    # Traefik Dashboard
    traefik.http.routers.traefik.rule: "Host(`traefik.sample.com`)"
    traefik.http.routers.traefik.service: "api@internal"
    traefik.http.routers.traefik.tls.certresolver: "myresolver"
    traefik.http.routers.traefik.entrypoints: "websecure"

    # Redirect to HTTPS
    traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: "https"
    traefik.http.routers.http-catchall.rule: "hostregexp(`{host:.+}`)"
    traefik.http.routers.http-catchall.entrypoints: "web"
    traefik.http.routers.http-catchall.middlewares: "redirect-to-https"

For Docker (Compose) + DNS-01 Challenge:

traefik:
  image: "traefik:v2.0.0"
  environment:
    DO_AUTH_TOKEN: "0f923jf..."
  command:
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --providers.docker
    - --api
    - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.myresolver.acme.dnschallenge.provider=digitalocean
    - --certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=0
    - --certificatesresolvers.myresolver.acme.email=sample@email.com
    - --certificatesresolvers.myresolver.acme.storage=acme.json
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
    - "./acme.json:/acme.json"
  labels:
    # Traefik Dashboard
    traefik.http.routers.traefik.rule: "Host(`traefik.sample.com`)"
    traefik.http.routers.traefik.service: "api@internal"
    traefik.http.routers.traefik.tls.certresolver: "myresolver"
    traefik.http.routers.traefik.entrypoints: "websecure"

    # Redirect to HTTPS
    traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: "https"
    traefik.http.routers.http-catchall.rule: "hostregexp(`{host:.+}`)"
    traefik.http.routers.http-catchall.entrypoints: "web"
    traefik.http.routers.http-catchall.middlewares: "redirect-to-https"

For Docker Swarm + HTTP-01 Challenge:

traefik:
  image: "traefik:v2.0.0"
  command:
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --providers.docker
    - --api
    - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.myresolver.acme.email=sample@email.com
    - --certificatesresolvers.myresolver.acme.storage=acme.json
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
    - "./acme.json:/acme.json"
  deploy:
    labels:
      # Traefik Dashboard
      traefik.http.routers.traefik.rule: "Host(`traefik.sample.com`)"
      traefik.http.routers.traefik.service: "api@internal"
      traefik.http.routers.traefik.tls.certresolver: "myresolver"
      traefik.http.routers.traefik.entrypoints: "websecure"

      # Redirect to HTTPS
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: "https"
      traefik.http.routers.http-catchall.rule: "hostregexp(`{host:.+}`)"
      traefik.http.routers.http-catchall.entrypoints: "web"
      traefik.http.routers.http-catchall.middlewares: "redirect-to-https"

      # service definitions
      traefik.http.services.traefik.loadbalancer.server.port: "80"
      traefik.http.services.traefik.loadbalancer.server.port: "443"

For Docker Swarm + DNS-01 Challenge:

traefik:
  image: "traefik:v2.0.0"
  environment:
    DO_AUTH_TOKEN: "0f923jf..."
  command:
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --providers.docker
    - --api
    - --certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory
    - --certificatesresolvers.myresolver.acme.dnschallenge.provider=digitalocean
    - --certificatesresolvers.myresolver.acme.dnschallenge.delaybeforecheck=0
    - --certificatesresolvers.myresolver.acme.email=sample@email.com
    - --certificatesresolvers.myresolver.acme.storage=acme.json
  ports:
    - "80:80"
    - "443:443"
  volumes:
    - "/var/run/docker.sock:/var/run/docker.sock:ro"
    - "./acme.json:/acme.json"
  deploy:
    labels:
      # Traefik Dashboard
      traefik.http.routers.traefik.rule: "Host(`traefik.sample.com`)"
      traefik.http.routers.traefik.service: "api@internal"
      traefik.http.routers.traefik.tls.certresolver: "myresolver"
      traefik.http.routers.traefik.entrypoints: "websecure"

      # Redirect to HTTPS
      traefik.http.middlewares.redirect-to-https.redirectscheme.scheme: "https"
      traefik.http.routers.http-catchall.rule: "hostregexp(`{host:.+}`)"
      traefik.http.routers.http-catchall.entrypoints: "web"
      traefik.http.routers.http-catchall.middlewares: "redirect-to-https"

      # service definitions
      traefik.http.services.traefik.loadbalancer.server.port: "80"
      traefik.http.services.traefik.loadbalancer.server.port: "443"

Again, don't forget to deploy this new service and after a couple of seconds you should be up and running.

Switch to Production

As mentioned in step 4, you'll be using the staging Let's Encrypt server for certificate generation. Thus, your certificate won't be trusted by the browser yet:

Easy fix: as soon as everything works as expected with the invalid certificate simply delete the line defining certificateresolvers.myresolver.acme.caserver and redeploy your Traefik container.

Still confused?

Start All Your DEV Programs in one Shortcut on Windows 10

Serzhan Akhmetov — Fri, 29 Nov 2019 11:35:03 +0000

If you're like me - god help us - then you have this constant itch to automate every single part of your existence. The following two scripts will give a blueprint for creating your own start-my-dev-environment scripts.

Step 1 - Launching apps in batch file

We'll be launching 3 programs:

Spotify
Chrome
Visual Studio Code

additionally, we'll start an OpenVPN client connection.

You'll want to create a batch file like so:

@ECHO OFF
tasklist /FI "IMAGENAME eq Spotify.exe" 2>NUL | find /I /N "Spotify.exe">NUL
if NOT "%ERRORLEVEL%" == "0" start "spotify_play_lofi-playlist.vbs" "C:\Users\<username>\Documents\batch_scripts\spotify_play_lofi-playlist.vbs" && TIMEOUT 5

tasklist /FI "IMAGENAME eq chrome.exe" 2>NUL | find /I /N "chrome.exe">NUL
if NOT "%ERRORLEVEL%" == "0" start "chrome.exe" "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

start " " "C:\Program Files\OpenVPN\bin\openvpn-gui.exe" --command disconnect_all
start "openvpn-gui.exe" "C:\Program Files\OpenVPN\bin\openvpn-gui.exe" --connect my_conf.ovpn

tasklist /FI "IMAGENAME eq Code.exe" 2>NUL | find /I /N "Code.exe">NUL
if NOT "%ERRORLEVEL%" == "0" start "Code" "C:\Users\<username>\AppData\Local\Programs\Microsoft VS Code\Code.exe"

Here, the tasklist commands are there to make sure we don't run a second instance of an app. For OpenVPN, it's easier to just reconnect.

Step 2 - Spotify Autoplay Script

The spotify VB script is there to launch Spotify and start a playlist in shuffle mode. Save it in the same folder as your batch script, for safekeeping.

Set WshShell = WScript.CreateObject("WScript.Shell")
Comandline = "C:\Users\<username>\AppData\Roaming\Spotify\Spotify.exe"
WScript.sleep 500
CreateObject("WScript.Shell").Run("spotify:playlist:74sUjcvpGfdOvCHvgzNEDO")
WScript.sleep 3000
WshShell.SendKeys " "
WScript.sleep 100
WshShell.SendKeys "^{RIGHT}"

You can get the playlist URI by right-clicking the playlist > Share > Copy Spotify URI.

Step 3 - Shortcut Placement

This is simple, create a shortcut to your batch file and place it in your Start Menu Programs folder (%ProgramData%\Microsoft\Windows\Start Menu\Programs). You may then move it to the quick-launch bar if you wish.

References

VS Code with Python in Docker Quickstart

Serzhan Akhmetov — Tue, 25 Jun 2019 06:44:38 +0000

You love VS Code? Get ready to love it even more!

Recently, a new extension pack has come out from the good folks at Microsoft that enables remote development! Not only SSH, but also using local containers with either single containers or multiple containers with docker-compose!

Steps

Install VS Code and the Remote Development extension pack
Start a new project by opening a new directory with VS Code Insiders and create a requirements.txt file with the Python packages you wish to have, e.g.:
```
django==2.2.2
```
ctrl+shift+p and start typing "remdev", select "Remote-Containers: Add Dev Container Configuration Files..."
Search for "pypo" and select "Python 3 & PostgreSQL" as your environmet. This will create a .devcontainer folder with the files:
- devcontainer.json
- docker-compose.yml
- Dockerfile
- noop.txt
ctrl+shift+p and start typing "rerefo", select "Remote-Containers: Reopen Folder in Container"
Start coding ☕💻

A note on opening ports

So how do you open a port to your container? Easy! VS Code already knows which ports are open in your container.

Say you started your server with python manage.py runserver, which would open a port on 127.0.0.1:8000 in your container. VS Code is aware of this and will give you the option to forward your system ports to that port.

Press ctrl+shift+p, search "port" and select "Remote-Containers: Forward Port from Container...". A list of open ports will come up, select port 8000.

Source Code

https://github.com/siaarzh/python-vscode-starter

References

Container Remote Development with VS Code
Django Tutorial part 1