new proxy

kibana/start_service.sh

@@ -1,11 +1,10 @@
 #!/bin/bash
 IMAGE=netcomposer/kibana:5.0.2-1
-ES="http://elastic_openresty:9200"
+ES="http://elastic_proxy:9200"
 
 docker service create \
 	--name kibana \
 	--network elastic \
-	-p 5601:5601 \
 	--env "ELASTICSEARCH_URL=$ES" \
 	--env "SERVER_PORT=5601" \
 	$IMAGE 

openresty/build/Dockerfile → proxy/build/Dockerfile

@@ -3,3 +3,6 @@ FROM openresty/openresty:1.11.2.2-alpine
 
 COPY nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
 COPY profile.sh /etc/profile.d/netcomposer.sh
+COPY start.sh /root/start.sh
+
+ENTRYPOINT ["/root/start.sh"]

proxy/build/build.sh

@@ -0,0 +1,8 @@
+# You must set 
+# /usr/local/openresty/nginx/conf/elastic_passwords and
+# /usr/local/openresty/nginx/conf/kibana_passwords
+
+
+NAME="netcomposer/elastic-proxy:0"
+docker build -t $NAME  .  && docker push $NAME
+

proxy/build/nginx.conf

@@ -0,0 +1,64 @@
+daemon off;
+
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+
+http {
+    default_type application/octet-stream;
+    sendfile on;
+    #tcp_nopush on;
+    #keepalive_timeout 0;
+    keepalive_timeout 65;
+
+	upstream elastic {
+		server elastic:9200;
+		keepalive 15;
+	}
+
+	upstream kibana {
+		server kibana:5601;
+		keepalive 15;
+	}
+
+	# Internal proxy for ES
+	server {
+		listen 9200;
+		location / {
+			proxy_pass http://elastic;
+			proxy_http_version 1.1;
+        	proxy_set_header Connection "Keep-Alive";
+        	proxy_set_header Proxy-Connection "Keep-Alive";
+        }
+    }
+
+	# External proxy for ES
+	server {
+		listen 9201;
+		location / {
+			auth_basic "NetComposer Site";
+			auth_basic_user_file elastic_passwords;
+			proxy_pass http://elastic;
+			proxy_http_version 1.1;
+        	proxy_set_header Connection "Keep-Alive";
+        	proxy_set_header Proxy-Connection "Keep-Alive";
+        }
+    }
+
+	server {
+		listen 9202;
+		location / {
+			auth_basic "NetComposer Site";
+			auth_basic_user_file kibana_passwords;
+			proxy_pass http://kibana;
+			proxy_http_version 1.1;
+        	proxy_set_header Connection "Keep-Alive";
+        	proxy_set_header Proxy-Connection "Keep-Alive";
+        }
+    }
+
+
+}

proxy/build/start.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+cp /run/secrets/elastic_passwords /usr/local/openresty/nginx/conf/elastic_passwords
+cp /run/secrets/kibana_passwords /usr/local/openresty/nginx/conf/kibana_passwords
+exec /usr/local/openresty/bin/openresty

openresty/start.sh → proxy/start.sh

@@ -1,13 +1,15 @@
 #!/bin/bash
-IMAGE=netcomposer/elastic-openresty:1.11.2-0
+IMAGE=netcomposer/elastic-proxy:0
+NAME=elastic_proxy
 
-docker rm elastic_openresty > /dev/null 2>&1
+docker rm $NAME > /dev/null 2>&1
 
 docker run \
 	-ti \
-	--name elastic_openresty \
+	--name $NAME \
 	--network elastic \
-	-p 9201:9200 \
+	-p 9201:9201 \
+	-p 9202:9202 \
 	-v /etc/letsencrypt:/etc/letsencrypt:ro \
 	$IMAGE
 

proxy/start_service.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+IMAGE=netcomposer/elastic-proxy:0
+
+docker service create \
+	--constraint 'node.hostname==k1.netc.io' \
+	--name elastic_proxy \
+	--network elastic \
+	--secret elastic_passwords \
+	--secret kibana_passwords \
+	-p 9201:9201 \
+	-p 9202:9202 \
+	--mount type=bind,src=/etc/letsencrypt,dst=/etc/letsencrypt:ro \
+	$IMAGE
+
+#	--restart unless-stopped \
+

set_pass.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+EP=elastic_passwords
+KP=kibana_passwords
+
+docker secret rm $EP > /dev/null 2>&1
+docker secret rm $KP > /dev/null 2>&1
+PASS=$(openssl passwd $1)
+echo "user:$PASS" | docker secret create $EP && \
+echo "user:$PASS" | docker secret create $KP && \
+docker service update --secret-add $EP --secret-add $KP elastic_proxy