TKControl Server on one host

Installation on Debian 10.

Before starting the installation, update the package list and install the required libraries:

sudo apt update -y
sudo apt install -y git gnupg2 make gcc python3-pip libsasl2-dev python-dev libldap2-dev libssl-dev

Installation

Mongo DB

  1. Import mongodb public gpg key:

    wget -qO - https://www.mongodb.org/static/pgp/server-4.4.asc | sudo apt-key add -
    
  2. Add mongodb to the list of repositories:

    echo "deb http://repo.mongodb.org/apt/debian buster/mongodb-org/4.4 main" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.4.list
    
  3. Update package list and install mongodb:

    sudo apt update -y
    sudo apt install -y mongodb-org
    
  4. Add mongodb to autostart and enable the service:

    sudo systemctl enable mongod
    sudo systemctl start mongod
    

Rabbit MQ

  1. Install Rabbit MQ Server:

    sudo apt install -y rabbitmq-server
    
  2. Add rabbitmq to autostart and enable the service:

    sudo systemctl enable rabbitmq-server
    sudo systemctl start rabbitmq-server
    

SaltStack

  1. Install Salt Master and Salt Api:

    sudo apt install -y salt-master salt-api
    
  2. Add salt-master and salt-api to autostart and enable services:

    sudo systemctl enable salt-master salt-api
    sudo systemctl start salt-master salt-api
    

Websockify

  1. Install websockify:

    sudo apt install -y websockify
    

VNC Repeater

  1. Clone the repository uvncrepeater-ac:

    git clone https://github.com/tenchman/uvncrepeater-ac
    
  2. Start building the app:

    sudo make -C uvncrepeater-ac install
    
  3. Add user for uvncrepeater:

    sudo useradd -s /sbin/nologin uvncrep
    

Nginx JWT Module

Installing from source files

  1. Set module versions to environment variables:

    export NGINX_VERSION=1.14.2 && \
    export JANSSON_VERSION=2.10 && \
    export LIBJWT_VERSION=1.9.0
    
  2. Install required libraries to build source files:

    sudo apt install -y build-essential
    sudo apt install -y wget unzip git cmake check autoconf libtool openssl libssl-dev libpcre3 libpcre3-dev zlib1g zlib1g-dev libxml2 libxml2-dev libxslt-dev libgd-dev google-perftools libgoogle-perftools-dev libperl-dev
    
  3. Install nginx:

    sudo apt install -y nginx=$NGINX_VERSION-2+deb10u4
    
  4. Stop and disable nginx:

    sudo systemctl stop nginx
    sudo systemctl disable nginx
    
  5. Install the library to work with JSON:

    wget https://github.com/akheron/jansson/archive/v$JANSSON_VERSION.zip && \
    unzip v$JANSSON_VERSION.zip && \
    rm v$JANSSON_VERSION.zip && \
    cd jansson-$JANSSON_VERSION && \
    cmake . -DJANSSON_BUILD_SHARED_LIBS=1 -DJANSSON_BUILD_DOCS=OFF && \
    make && \
    make check && \
    sudo make install && \
    cd ..
    
  6. Install the library for working with JWT tokens:

    wget https://github.com/benmcollins/libjwt/archive/v$LIBJWT_VERSION.zip && \
    unzip v$LIBJWT_VERSION.zip && \
    rm v$LIBJWT_VERSION.zip && \
    cd libjwt-$LIBJWT_VERSION && \
    autoreconf -i && \
    ./configure && \
    make all && \
    sudo make install && \
    cd ..
    
  7. Download the nginx module for working with JWT tokens:

    git clone https://github.com/TeslaGov/ngx-http-auth-jwt-module
    
  8. Build nginx with required modules:

    wget http://nginx.org/download/nginx-$NGINX_VERSION.tar.gz && \
    tar -xzf nginx-$NGINX_VERSION.tar.gz && \
    rm nginx-$NGINX_VERSION.tar.gz && \
    cd nginx-$NGINX_VERSION
    
    # Configuring nginx modules
    ./configure --add-dynamic-module=../ngx-http-auth-jwt-module \
                --prefix=/usr/share/nginx \
                --sbin-path=/usr/sbin/nginx \
                --modules-path=/usr/lib/nginx/modules \
                --conf-path=/etc/nginx/nginx.conf \
                --error-log-path=/var/log/nginx/error.log \
                --http-log-path=/var/log/nginx/access.log \
                --pid-path=/run/nginx.pid \
                --lock-path=/var/lock/nginx.lock \
                --user=www-data \
                --group=www-data \
                --build=Ubuntu \
                --http-client-body-temp-path=/var/lib/nginx/body \
                --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
                --http-proxy-temp-path=/var/lib/nginx/proxy \
                --http-scgi-temp-path=/var/lib/nginx/scgi \
                --http-uwsgi-temp-path=/var/lib/nginx/uwsgi \
                --with-pcre \
                --with-pcre-jit \
                --with-compat \
                --with-file-aio \
                --with-threads \
                --with-http_addition_module \
                --with-http_auth_request_module \
                --with-http_dav_module \
                --with-http_flv_module \
                --with-http_gunzip_module \
                --with-http_gzip_static_module \
                --with-http_image_filter_module=dynamic \
                --with-http_mp4_module \
                --with-http_random_index_module \
                --with-http_realip_module \
                --with-http_slice_module \
                --with-http_ssl_module \
                --with-http_sub_module \
                --with-http_stub_status_module \
                --with-http_xslt_module=dynamic \
                --with-http_v2_module \
                --with-http_secure_link_module \
                --with-mail=dynamic \
                --with-mail_ssl_module \
                --with-stream=dynamic \
                --with-stream_realip_module \
                --with-stream_ssl_module \
                --with-stream_ssl_preread_module \
                --with-debug \
                --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-mcUg8N/nginx-$NGINX_VERSION=. -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2'\
                --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -fPIC'
    
    # Build nginx
    make && \
    sudo make install && \
    cd ..
    
    # Unlink configurations of old modules
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-auth-pam.conf && \
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-dav-ext.conf && \
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-echo.conf && \
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-geoip.conf && \
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-subs-filter.conf && \
    sudo unlink /etc/nginx/modules-enabled/50-mod-http-upstream-fair.conf
    
    # Add configuration for jwt module
    echo "load_module modules/ngx_http_auth_jwt_module.so;" | sudo tee /etc/nginx/modules-enabled/http-auth-jwt.conf
    
  9. Update dynamic libraries:

    sudo /sbin/ldconfig
    

TKControl

  1. Install tkcontrol modules packages:

    sudo pip3 install --prefix /usr/local \
        --index-url http://pypi.accentos.ru/ \
        --trusted-host pypi.accentos.ru \
        tkcontrol-auth \
        tkcontrol-backend \
        tkcontrol-dbadapter \
        tkcontrol-modules \
        tkcontrol-configure \
        tkcontrol-services
    
  2. Add link to gunicorn:

    sudo ln -s /usr/local/bin/gunicorn /usr/bin/gunicorn
    

Configurating

System will use following ports:

Module Ports
proxy 80
salt-master 4505 4506
vnc-repeater 5500 5900
rabbitmq 5672
backend, frontend 8001
auth 8002
db_adapter 8003
salt-api 8004
novnc-proxy 8081
mongodb 27017
  1. Add hostnames to /etc/hosts:

    127.0.0.1 localhost db dbadapter backend auth mq saltstack vnc-repeater novnc-proxy
    
  2. Run commands to configure services:

    sudo tkcontrol-auth configure --with-systemd && \
    sudo tkcontrol-backend configure --with-systemd && \
    sudo tkcontrol-dbadapter configure --with-systemd && \
    sudo tkcontrol-services configure --with-systemd && \
    sudo tkcontrol-configure websockify --with-systemd && \
    sudo tkcontrol-configure vnc-repeater --with-systemd && \
    sudo tkcontrol-configure salt-master --with-patch && \
    sudo tkcontrol-configure proxy && \
    sudo tkcontrol-configure ipresolver
    

Start

  1. Restart the services salt-master and salt-api:

    sudo systemctl restart salt-master
    sudo systemctl restart salt-api
    
  2. Start vnc-repeater:

    sudo systemctl enable tkcontrol-vnc-repeater
    sudo systemctl start tkcontrol-vnc-repeater
    
  3. Start novnc-proxy:

    sudo systemctl enable tkcontrol-websockify
    sudo systemctl start tkcontrol-websockify
    
  4. Start tkcontrol-auth:

    sudo systemctl enable tkcontrol-auth
    sudo systemctl start tkcontrol-auth
    
  5. Start tkcontrol-dbadapter:

    sudo systemctl enable tkcontrol-dbadapter
    sudo systemctl start tkcontrol-dbadapter
    
  6. Start tkcontrol-backend:

    sudo systemctl enable tkcontrol-backend
    sudo systemctl start tkcontrol-backend
    
  7. Start tkcontrol-services:

    sudo systemctl enable tkcontrol-services
    sudo systemctl start tkcontrol-services
    
  8. Start nginx-proxy:

    sudo systemctl enable nginx
    sudo systemctl start nginx