safeshare puppet module

Table of Contents

1. Description
2. Setup
3. Usage
4. Reference
5. Limitations

Description

This module installs and configures the Covata SafeShare version 3 and above on Ubuntu 14.04 or CentOS/RHEL 6/7 Linux servers.

An example Puppet manifest which uses this module can be found in Bitbucket.

Setup

Setup Requirements

• Postgresql 9.3, with the following roles:

  • so3 (with CREATE_DB and CREATE_ROLE permission)
  • so3app
  • access_service_app_blue

  For security reasons, we recommend that the so3 user (credentials for schema updates) should not have the same password as so3app and access_service_app_blue (credentials for application).

• Rabbitmq 3.5

• (optional) AWS S3 buckets (if local storage is not used for the content service)

Also, it's expected that all nodes with Safe Share have OpenJDK 8 installed and the java command is on the path.

Beginning with safeshare

Every node which installs a Safe Share component should have the following:

  class { '::safeshare::globals':
     repo_token => 'unique_repository_token',
  }

This configures the yum or apt repository and any other required global configuration.

Note that in order to be able to retrieve Safe Share installation packages you need a repository token. It is generated by Covata for each customer. If you are a customer and didn't receive a token, contact repository-token@covata.com and request yours.

The token shouldn't be committed in clear text, like any other secret. Options for storing it encrypted in VCS would include eyaml, BlackBox.

Other options are passing an alternative repository to download the packages; or provide the packages using some other repository configured in your puppet tree.

Usage

There are three subclasses to be used:

• safeshare::content_service - for storing and recovering encrypted data
• safeshare:access_service_migration - for the migration of the database schema during upgrades
• access_service - for authorization and authentication, also includes a web client for modern browsers.

While they could technically be installed on the same machine, we advise you to keep them on separate servers.

Using safeshare:access_service_migration

You should only install this module on one machine. safeshare::access_service_migration should be called after postgresql and OpenJDK8 are properly installed.

We recommend keeping the database migration on the same machine as your database. This is not a service, but rather a executable which will update the database schema when a new version of the access service is installed.

  class { '::safeshare::access_service_migration':
    version            => '3.0.994-1',
    access_service_url => 'http://url-access-service.xycompany.com',
    database_password  => 'p4ssw0rd_for_so3_user_in_postgresql',
    require            => Class['::java'],
  }

The version parameter should have the same value as safeshare::access_service::version.

Using safeshare:access_service

You can have multiple access service nodes, to improve performance or for high availability. On that case, you'll need to configure a load balancer as usual in front of those nodes.

It should be called after OpenJDK8 is properly installed.

  class { '::safeshare::access_service':
    version                   => '3.0.994-1',
    database_hostname         => 'url-postgres-service.xycompany.com',
    database_username         => 'so3app',
    database_password         => 'p4ssw0rd_for_so3app_user_in_postgresql',
    access_service_url        => 'http://url-access-service.xycompany.com',
    content_service_url       => 'http://url-content-service.xycompany.com',
    master_encryption_key     => 'rand0mmasterkey',
    bearer_signing_key        => 'r4and0m_string_for_communication_with_content_service',
    jwt_signing_key           => 'rand0msigningkey',
    rabbitmq_user_name        => 'rabbitmq_username',
    rabbitmq_password         => 'r4bb1tmq_password',
    rabbitmq_host             => 'url-to-rabbitmq.xycompany.com',
    require                   => Class['::java'],
  }

Note: bearer_signing_key has to be the same for all access service and content service nodes.

We advise you keep the access service's database in another machine, to facilitate backups and reprovisioning of new Safe Share nodes without losing data.

Using safeshare:content_service

You can have multiple access service nodes, to improve performance or for high availability. On that case, you'll need to configure a load balancer as usual in front of those nodes.

It should be called after OpenJDK8 is properly installed.

  class { '::safeshare::content_service':
    version            => '3.0.114-1',
    access_service_url => 'http://url-access-service.xycompany.com',
    data_bucket        => 'folder-for-data-bucket',
    readonly_bucket    => 'folder-for-readonly-data-bucket',
    bearer_signing_key => 'r4and0m_string_for_communication_with_access_service',
    rabbitmq_host      => 'url-to-rabbitmq.xycompany.com',
    rabbitmq_user_name => 'rabbitmq_username',
    rabbitmq_password  => 'r4bb1tmq_password',
    require            => Class['::java'],
  }

Note: bearer_signing_key has to be the same for all access service and content service nodes you have.

By default, the storage folder for LOCAL storage type will be /var/lib/content-service-storage. If you have multiple content service nodes, you'll need to make sure they are all using a shared folder (e.g. accessing it through NFS, or any other way you prefer).

The other option for storage is using S3, using the type S3COVATA.

We advise you keep the content service's object store in another machine, to facilitate backups and reprovisioning of new Safe Share nodes.

Limitations

Supports Ubuntu 14.04 and CentOS/RHEL 6/7.

This module does not install client software.

This module doesn't install external software dependencies (like Postgresql or rabbitmq).

3.5.3 ($DATE_RELEASE)

3.5.2 (2017-04-12) MIN-2084: Allow database name and port to be configured

3.5.1 (2017-03-08) MIN-1964: update nginx module after ownership of the module transferred

3.5.0 (2017-03-03) MIN-1936: Allow virtual host to be configured so the same message queue can be used for different deployments

3.4.1 (2016-12-09) MIN-1493: add rng-tools to content server

3.4.0 (2016-12-07) MIN-1501: Add support for HSTS configuration

3.3.6 (2016-09-27) MIN-775: webapp: compress static content larger than 1000 bytes MIN-1346: add CORS header so themes.json will load

3.3.5 (2016-09-06) MIN-1278: globals.pp: explicitly contain repo

3.3.4 (2016-09-01) MIN-1272: add SSL support for the webapp

3.3.3 (2016-08-31) MIN-1205: allow custom properties

3.3.1 (2016-08-11) MIN-770: exclude index.html and themes.json from cache control MIN-771: apply cache control headers static assets

3.3.0 (2016-08-08) MIN-1141: windows oauth property added for 3.3 support MIN-1141: bitbucketci fix for invalid parameter MIN-1141: windows auth callback default added for migration

3.2.5 (2016-05-20) MIN-815: safeshare_module_version.rb: fix syntax to support also Ruby 1.8

3.2.4 (2016-05-20) MIN-815: safeshare_module_version: replace fact by Puppet function

3.2.3 (2016-05-17) DEL-426: migration can be run against externally hosted database

3.2.2 (2016-05-12) MIN-820: added 'service_ensure' parameter to access-service and content-service

3.2.1 (2016-04-21) MIN-774: Organisation theming support

3.2.0 (2016-04-18) MIN-763: remove incorrect and redundant property for 3.2 MIN-686: Breaking change.

* Adding web app configuration (URL of access service, mandatory)
* DB migration configuration pointing to web app instead of access service
* Adding URL of webapp to content service (mandatory)

3.1.5 (2016-04-07) MIN-753: custom app path for webapp

3.1.4 (2016-03-23) MIN-697: pinning major version of safeshare using major version of puppet module

3.1.3 (2016-03-23) MIN-717: add 'mail_starttls_enabled'

3.1.2 (2016-03-16) MIN-702: always remove trailing "/" on access service URL on content service

3.1.1 (2016-03-16) MIN-698: fixing logo not showing up

3.1.0 (2016-03-14) MIN-535: Breaking change. Adding web app server. MIN-663: Breaking change. Adding mandatory JWT key pair for access service

3.0.7 (2016-03-23) MIN-697: pinning major version of safeshare using major version of puppet module

3.0.6 (2016-03-23) MIN-717: add 'mail_starttls_enabled' - re-released

3.0.5 (2016-03-23) MIN-717: add 'mail_starttls_enabled'

3.0.4 (2016-01-27) MIN-336: adding puppet lint build

3.0.3 (2015-12-30) Improvements in documentation MIN-522: local storage folder managed by the module

3.0.2 (2015-12-01) Allowing another apt/yum repositories