initial commit

deploy/.gitignore

@@ -0,0 +1 @@
+state

deploy/db/tinkerbell-init.sql

@@ -0,0 +1,76 @@
+SET ROLE tinkerbell;
+
+CREATE TABLE IF NOT EXISTS hardware (
+	id UUID UNIQUE
+	, inserted_at TIMESTAMPTZ
+	, deleted_at TIMESTAMPTZ
+	, data JSONB
+);
+
+CREATE INDEX IF NOT EXISTS idx_id ON hardware (id);
+CREATE INDEX IF NOT EXISTS idx_deleted_at ON hardware (deleted_at NULLS FIRST);
+CREATE INDEX IF NOT EXISTS idxgin_type ON hardware USING GIN (data JSONB_PATH_OPS);
+
+CREATE TABLE IF NOT EXISTS template (
+        id UUID UNIQUE NOT NULL
+        , name VARCHAR(200) NOT NULL
+        , created_at TIMESTAMPTZ
+        , updated_at TIMESTAMPTZ
+        , deleted_at TIMESTAMPTZ
+        , data BYTEA
+
+        CONSTRAINT CK_name CHECK (name ~ '^[a-zA-Z0-9_-]*$')
+);
+
+CREATE INDEX IF NOT EXISTS idx_tid ON template (id);
+CREATE INDEX IF NOT EXISTS idx_tdeleted_at ON template (deleted_at NULLS FIRST);
+
+CREATE TABLE IF NOT EXISTS workflow (
+	id UUID UNIQUE NOT NULL
+	, template UUID NOT NULL
+	, devices JSONB NOT NULL
+	, created_at TIMESTAMPTZ
+	, updated_at TIMESTAMPTZ
+	, deleted_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_wid ON workflow (id);
+CREATE INDEX IF NOT EXISTS idx_wdeleted_at ON workflow (deleted_at NULLS FIRST);
+
+CREATE TABLE IF NOT EXISTS workflow_state (
+        workflow_id UUID UNIQUE NOT NULL
+        , current_task_name VARCHAR(200)
+        , current_action_name VARCHAR(200)
+        , current_action_state SMALLINT
+        , current_worker VARCHAR(200)
+        , action_list JSONB
+        , current_action_index int
+        , total_number_of_actions INT
+);
+
+CREATE INDEX IF NOT EXISTS idx_wfid ON workflow_state (workflow_id);
+
+CREATE TABLE IF NOT EXISTS workflow_event (
+        workflow_id UUID NOT NULL
+        , worker_id UUID  NOT NULL
+        , task_name VARCHAR(200)
+        , action_name VARCHAR(200)
+        , execution_time int
+	, message VARCHAR(200)
+	, status SMALLINT
+        , created_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_event ON workflow_event (created_at);
+
+CREATE TABLE IF NOT EXISTS workflow_worker_map (
+        workflow_id UUID NOT NULL
+        , worker_id UUID NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS workflow_data (
+        workflow_id UUID NOT NULL
+        , version INT
+        , metadata JSONB
+        , data JSONB
+);

deploy/docker-compose.yml

@@ -0,0 +1,155 @@
+version: "2.1"
+services:
+  tink-server:
+    image: quay.io/tinkerbell/tink:sha-adb49da
+    restart: unless-stopped
+    environment:
+      FACILITY: ${FACILITY:-onprem}
+      PACKET_ENV: ${PACKET_ENV:-testing}
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
+      ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
+      PGDATABASE: tinkerbell
+      PGHOST: db
+      PGPASSWORD: tinkerbell
+      PGPORT: 5432
+      PGSSLMODE: disable
+      PGUSER: tinkerbell
+      TINKERBELL_GRPC_AUTHORITY: :42113
+      TINKERBELL_HTTP_AUTHORITY: :42114
+      TINK_AUTH_USERNAME: ${TINKERBELL_TINK_USERNAME}
+      TINK_AUTH_PASSWORD: ${TINKERBELL_TINK_PASSWORD}
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- 127.0.0.1:42114/cert"] # port needs to match TINKERBELL_HTTP_AUTHORITY
+      interval: 5s
+      timeout: 2s
+      retries: 30
+    volumes:
+      - ./state/certs:/certs/${FACILITY:-onprem}
+    ports:
+      - 42113:42113/tcp
+      - 42114:42114/tcp
+
+  db:
+    image: postgres:10-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: tinkerbell
+      POSTGRES_PASSWORD: tinkerbell
+      POSTGRES_USER: tinkerbell
+    volumes:
+      - ./db/tinkerbell-init.sql:/docker-entrypoint-initdb.d/tinkerbell-init.sql:ro
+      - postgres_data:/var/lib/postgresql/data:rw
+    ports:
+      - 5432:5432
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U tinkerbell"]
+      interval: 1s
+      timeout: 1s
+      retries: 30
+
+  tink-cli:
+    image: quay.io/tinkerbell/tink-cli:sha-adb49da
+    restart: unless-stopped
+    environment:
+      TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
+      TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
+    depends_on:
+      tink-server:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    network_mode: host
+
+  registry:
+    build:
+      context: registry
+      args:
+        REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
+        REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl --cacert /certs/ca.pem https://127.0.0.1"]
+      interval: 5s
+      timeout: 1s
+      retries: 5
+    environment:
+      REGISTRY_HTTP_ADDR: 0.0.0.0:443
+      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/server.pem
+      REGISTRY_HTTP_TLS_KEY: /certs/server-key.pem
+      REGISTRY_AUTH: htpasswd
+      REGISTRY_AUTH_HTPASSWD_REALM: "Registry Realm"
+      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
+    volumes:
+      - ./state/certs:/certs
+      - ./state/registry:/var/lib/registry
+    network_mode: host
+
+  boots:
+    image: quay.io/tinkerbell/boots:327-58ab49913b5498908b16e2607d265a61a05f73b6
+    restart: unless-stopped
+    network_mode: host
+    command: -dhcp-addr 0.0.0.0:67 -tftp-addr $TINKERBELL_HOST_IP:69 -http-addr $TINKERBELL_HOST_IP:80 -log-level DEBUG
+    environment:
+      API_AUTH_TOKEN: ${PACKET_API_AUTH_TOKEN:-ignored}
+      API_CONSUMER_TOKEN: ${PACKET_CONSUMER_TOKEN:-ignored}
+      FACILITY_CODE: ${FACILITY:-onprem}
+      PACKET_ENV: ${PACKET_ENV:-testing}
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
+      ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
+      MIRROR_HOST: ${TINKERBELL_NGINX_IP:-127.0.0.1}
+      DNS_SERVERS: 8.8.8.8
+      PUBLIC_IP: $TINKERBELL_HOST_IP
+      BOOTP_BIND: $TINKERBELL_HOST_IP:67
+      HTTP_BIND: $TINKERBELL_HOST_IP:80
+      SYSLOG_BIND: $TINKERBELL_HOST_IP:514
+      TFTP_BIND: $TINKERBELL_HOST_IP:69
+      DOCKER_REGISTRY: $TINKERBELL_HOST_IP
+      REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
+      REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
+      TINKERBELL_GRPC_AUTHORITY: $TINKERBELL_HOST_IP:42113
+      TINKERBELL_CERT_URL: http://$TINKERBELL_HOST_IP:42114/cert
+      ELASTIC_SEARCH_URL: $TINKERBELL_HOST_IP:9200
+      DATA_MODEL_VERSION: 1
+    depends_on:
+      db:
+        condition: service_healthy
+    ports:
+      - $TINKERBELL_HOST_IP:80:80/tcp
+      - 67:67/udp
+      - 69:69/udp
+
+  nginx:
+    image: nginx:alpine
+    restart: unless-stopped
+    tty: true
+    ports:
+      - $TINKERBELL_NGINX_IP:80:80/tcp
+    volumes:
+      - ./state/webroot:/usr/share/nginx/html/
+
+  hegel:
+    image: quay.io/tinkerbell/hegel:196-fa897aa020769db8becb9be29adaeb6be92a7fc7
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN-ignored}
+      ROLLBAR_DISABLE: 1
+      PACKET_ENV: testing
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      GRPC_PORT: 42115
+      HEGEL_FACILITY: ${FACILITY:-onprem}
+      HEGEL_USE_TLS: 0
+      TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
+      TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
+      DATA_MODEL_VERSION: 1
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  postgres_data:

deploy/registry/Dockerfile

@@ -0,0 +1,7 @@
+FROM registry:2.7.1
+RUN apk add --no-cache --update curl apache2-utils
+ARG REGISTRY_USERNAME
+ARG REGISTRY_PASSWORD
+RUN mkdir -p /certs /auth
+RUN htpasswd -Bbn ${REGISTRY_USERNAME} ${REGISTRY_PASSWORD} > /auth/htpasswd
+EXPOSE 443

deploy/terraform/README.md

@@ -0,0 +1 @@
+https://tinkerbell.org/docs/setup/packet-with-terraform/

deploy/terraform/input.tf

@@ -0,0 +1,17 @@
+variable "packet_api_token" {
+  description = "Packet user api token"
+}
+
+variable "project_id" {
+  description = "Project ID"
+}
+
+variable "facility" {
+  description = "Packet facility to provision in"
+  default     = "sjc1"
+}
+
+variable "device_type" {
+  description = "Type of device to provision"
+  default     = "c3.small.x86"
+}

deploy/terraform/install_package.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+
+YUM="yum"
+APT="apt"
+PIP3="pip3"
+YUM_CONFIG_MGR="yum-config-manager"
+WHICH_YUM=$(command -v $YUM)
+WHICH_APT=$(command -v $APT)
+YUM_INSTALL="$YUM install"
+APT_INSTALL="$APT install"
+PIP3_INSTALL="$PIP3 install"
+declare -a YUM_LIST=("https://download.docker.com/linux/centos/7/x86_64/stable/Packages/containerd.io-1.2.6-3.3.el7.x86_64.rpm"
+	"docker-ce"
+	"docker-ce-cli"
+	"epel-release"
+	"python3")
+declare -a APT_LIST=("docker"
+	"docker-compose")
+
+add_yum_repo() (
+	$YUM_CONFIG_MGR --add-repo https://download.docker.com/linux/centos/docker-ce.repo
+)
+
+update_yum() (
+	$YUM_INSTALL -y yum-utils
+	add_yum_repo
+)
+
+update_apt() (
+	$APT update
+	DEBIAN_FRONTEND=noninteractive $APT --yes --force-yes -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" upgrade
+)
+
+restart_docker_service() (
+	service docker restart
+)
+
+install_yum_packages() (
+	$YUM_INSTALL "${YUM_LIST[@]}" -y
+)
+
+install_pip3_packages() (
+	$PIP3_INSTALL docker-compose
+)
+
+install_apt_packages() (
+	$APT_INSTALL "${APT_LIST[@]}" -y
+)
+
+main() (
+	if [[ -n $WHICH_YUM ]]; then
+		update_yum
+		install_yum_packages
+		install_pip3_packages
+		restart_docker_service
+	elif [[ -n $WHICH_APT ]]; then
+		update_apt
+		install_apt_packages
+		restart_docker_service
+	else
+		echo "Unknown platform. Error while installing the required packages"
+		exit 1
+	fi
+)
+
+main

deploy/terraform/main.tf

@@ -0,0 +1,65 @@
+# Configure the Packet Provider.
+provider "packet" {
+  auth_token = var.packet_api_token
+  version    = "~> 2.9"
+}
+
+# Create a new VLAN in datacenter "ewr1"
+resource "packet_vlan" "provisioning-vlan" {
+  description = "provisioning-vlan"
+  facility    = var.facility
+  project_id  = var.project_id
+}
+
+# Create a device and add it to tf_project_1
+resource "packet_device" "tink-provisioner" {
+  hostname         = "tink-provisioner"
+  plan             = var.device_type
+  facilities       = [var.facility]
+  operating_system = "ubuntu_18_04"
+  billing_cycle    = "hourly"
+  project_id       = var.project_id
+  network_type     = "hybrid"
+  user_data        = "${file("install_package.sh")}"
+}
+
+}
+
+# Create a device and add it to tf_project_1
+resource "packet_device" "tink-worker" {
+  hostname         = "tink-worker"
+  plan             = var.device_type
+  facilities       = [var.facility]
+  operating_system = "custom_ipxe"
+  ipxe_script_url  = "https://boot.netboot.xyz"
+  always_pxe       = "true"
+  billing_cycle    = "hourly"
+  project_id       = var.project_id
+  network_type     = "layer2-individual"
+}
+
+# Attach VLAN to provisioner
+resource "packet_port_vlan_attachment" "provisioner" {
+  device_id = packet_device.tink-provisioner.id
+  port_name = "eth1"
+  vlan_vnid = packet_vlan.provisioning-vlan.vxlan
+}
+
+# Attach VLAN to worker
+resource "packet_port_vlan_attachment" "worker" {
+  device_id = packet_device.tink-worker.id
+  port_name = "eth0"
+  vlan_vnid = packet_vlan.provisioning-vlan.vxlan
+}
+
+output "provisioner_dns_name" {
+  value = "${split("-", packet_device.tink-provisioner.id)[0]}.packethost.net"
+}
+
+output "provisioner_ip" {
+  value = "${packet_device.tink-provisioner.network[0].address}"
+}
+
+output "worker_mac_addr" {
+  value = "${packet_device.tink-worker.ports[1].mac}"
+}

deploy/tls/.gitignore

@@ -0,0 +1 @@
+*/

deploy/tls/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:3.11
+ENTRYPOINT [ "/entrypoint.sh" ]
+
+RUN apk add --no-cache --update --upgrade ca-certificates postgresql-client
+RUN apk add --no-cache --update --upgrade --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing cfssl
+
+COPY . .

deploy/tls/ca-config.json

@@ -0,0 +1,17 @@
+{
+  "signing": {
+    "default": {
+      "expiry": "168h"
+    },
+    "profiles": {
+      "server": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment", "server auth"]
+      },
+      "signing": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment"]
+      }
+    }
+  }
+}

deploy/tls/ca.in.json

@@ -0,0 +1,12 @@
+{
+  "CN": "Autogenerated CA",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}

deploy/tls/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+
+# set -o errexit -o nounset -o pipefail
+
+if [ -z "${TINKERBELL_TLS_CERT:-}" ]; then
+	(
+		echo "creating directory"
+		mkdir -p "certs"
+		./gencerts.sh
+	)
+fi
+
+"$@"

deploy/tls/gencerts.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+set -eux
+
+cd /certs
+
+if [ ! -f ca-key.pem ]; then
+	cfssl gencert \
+		-initca ca.json | cfssljson -bare ca
+fi
+
+if [ ! -f server.pem ]; then
+	cfssl gencert \
+		-ca=ca.pem \
+		-ca-key=ca-key.pem \
+		-config=/ca-config.json \
+		-profile=server \
+		server-csr.json |
+		cfssljson -bare server
+fi
+
+cat server.pem ca.pem >bundle.pem.tmp
+
+# only "modify" the file if truly necessary since workflow will serve it with
+# modtime info for client caching purposes
+if ! cmp -s bundle.pem.tmp bundle.pem; then
+	mv bundle.pem.tmp bundle.pem
+else
+	rm bundle.pem.tmp
+fi

deploy/tls/server-csr.in.json

@@ -0,0 +1,19 @@
+{
+  "CN": "tinkerbell",
+  "hosts": [
+    "tinkerbell.registry",
+    "tinkerbell.tinkerbell",
+    "tinkerbell",
+    "localhost",
+    "127.0.0.1"
+  ],
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}

deploy/vagrant/.gitignore

@@ -0,0 +1 @@
+.vagrant

deploy/vagrant/README.md

@@ -0,0 +1 @@
+https://tinkerbell.org/docs/setup/local-with-vagrant/

deploy/vagrant/Vagrantfile

@@ -0,0 +1,71 @@
+ENV['VAGRANT_NO_PARALLEL'] = 'yes'
+
+# Returns true if `GUI` environment variable is set to a non-empty value.
+# Defaults to false
+def worker_gui_enabled?
+  ENV.fetch('VAGRANT_WORKER_GUI', '').empty?
+end
+
+Vagrant.configure('2') do |config|
+
+  config.vm.define :provisioner do |provisioner|
+    provisioner.vm.box = 'generic/ubuntu1804'
+    provisioner.vm.hostname = 'provisioner'
+    provisioner.vm.synced_folder './../../', '/vagrant'
+    provisioner.vm.provision :shell, path: './scripts/tinkerbell.sh'
+
+    provisioner.vm.network :private_network,
+                        virtualbox__intnet: "tink_network",
+                        libvirt__dhcp_enabled: false,
+                        libvirt__forward_mode: 'none',
+                        auto_config: false
+
+    provisioner.vm.network "forwarded_port", guest: 42113, host: 42113
+    provisioner.vm.network "forwarded_port", guest: 42114, host: 42114
+
+
+    provisioner.vm.provider :libvirt do |lv, override|
+      lv.memory = 2*1024
+      lv.cpus = 2
+      lv.cpu_mode = 'host-passthrough'
+    end
+
+    provisioner.vm.provider :virtualbox do |vb, override|
+      vb.memory = 2*1024
+      vb.cpus = 2
+    end
+  end
+
+  config.vm.define "worker" do |worker|
+    worker.vm.box = nil
+    worker.vm.network :private_network,
+                      mac: "080027000001",
+                      virtualbox__intnet: "tink_network",
+                      libvirt__dhcp_enabled: false,
+                      libvirt__forward_mode: 'none',
+                      auto_config: false
+
+    worker.vm.provider :libvirt do |lv|
+      lv.memory = 4*1024
+      lv.cpus = 1
+      lv.boot 'network'
+      lv.mgmt_attach = false
+    end
+
+    worker.vm.provider :virtualbox do |vb, worker|
+      worker.vm.box = 'generic/alpine38'
+      vb.memory = 4*1024
+      vb.cpus = 1
+      vb.gui = worker_gui_enabled?
+      vb.customize [
+        'modifyvm', :id,
+        '--nic1', 'none',
+        '--boot1', 'net',
+        '--boot2', 'none',
+        '--boot3', 'none',
+        '--boot4', 'none',
+        '--macaddress1', '080027000001'
+      ]
+    end
+  end
+end

deploy/vagrant/scripts/tinkerbell.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+
+# abort this script on errors
+set -euxo pipefail
+
+whoami
+
+cd /vagrant
+
+setup_docker() (
+	# steps from https://docs.docker.com/engine/install/ubuntu/
+	sudo apt-get install -y \
+		apt-transport-https \
+		ca-certificates \
+		curl \
+		gnupg-agent \
+		software-properties-common
+
+	curl -fsSL https://download.docker.com/linux/ubuntu/gpg |
+		sudo apt-key add -
+
+	local repo
+	repo=$(
+		printf "deb [arch=amd64] https://download.docker.com/linux/ubuntu %s stable" \
+			"$(lsb_release -cs)"
+	)
+	sudo add-apt-repository "$repo"
+
+	sudo apt-get update
+	sudo apt-get install -y docker-ce docker-ce-cli containerd.io
+)
+
+setup_docker_compose() (
+	# from https://docs.docker.com/compose/install/
+	sudo curl -L \
+		"https://github.com/docker/compose/releases/download/1.26.0/docker-compose-$(uname -s)-$(uname -m)" \
+		-o /usr/local/bin/docker-compose
+
+	sudo chmod +x /usr/local/bin/docker-compose
+)
+
+make_certs_writable() (
+	local certdir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
+	sudo mkdir -p "$certdir"
+	sudo chown -R "$USER" "$certdir"
+)
+
+secure_certs() (
+	local certdir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
+	sudo chown "root" "$certdir"
+)
+
+command_exists() (
+	command -v "$@" >/dev/null 2>&1
+)
+
+configure_vagrant_user() (
+	sudo usermod -aG docker vagrant
+
+	echo -n "$TINKERBELL_REGISTRY_PASSWORD" |
+		sudo -iu vagrant docker login \
+			--username="$TINKERBELL_REGISTRY_USERNAME" \
+			--password-stdin "$TINKERBELL_HOST_IP"
+)
+
+main() (
+	export DEBIAN_FRONTEND=noninteractive
+
+	apt-get update
+
+	if ! command_exists docker; then
+		setup_docker
+	fi
+
+	if ! command_exists docker-compose; then
+		setup_docker_compose
+	fi
+
+	if ! command_exists jq; then
+		sudo apt-get install -y jq
+	fi
+
+	if [ ! -f ./envrc ]; then
+		./generate-envrc.sh eth1 >envrc
+	fi
+
+	# shellcheck disable=SC1091
+	. ./envrc
+
+	make_certs_writable
+
+	./setup.sh
+
+	secure_certs
+
+	configure_vagrant_user
+
+)
+
+main