We Shall See

; SOA Record
JSKS.US.    3600    IN  SOA ns05.domaincontrol.com. dns.jomax.net (
                2015072400
                28800
                7200
                604800
                3600
                )

; A Records
@   1800    IN  A   54.82.143.206

; CNAME Records
blog    3600    IN  CNAME   @
img 3600    IN  CNAME   8e00c44fb080228f198f-d1e9688c9fbaaa049b87caca2fdd4594.r84.cf2.rackcdn.com
notes   3600    IN  CNAME   @
www 3600    IN  CNAME   @

; NS Records
@   3600    IN  NS  ns05.domaincontrol.com
@   3600    IN  NS  ns06.domaincontrol.com
ratz    1800    IN  NS  ns-1061.awsdns-04.org
ratz    1800    IN  NS  ns-1882.awsdns-43.co.uk
ratz    1800    IN  NS  ns-214.awsdns-26.com
ratz    1800    IN  NS  ns-992.awsdns-60.net

Jun 24 22:43:42 localhost sshd[29779]: Found matching RSA key: d8:d5:f3:5a:7e:27:42:91:e6:a5:e6:9e:f9:fd:d3:ce
Jun 24 22:43:42 localhost sshd[29779]: Accepted publickey for caleb from 127.0.0.1 port 59630 ssh2

$ mkdir -p ~/etc/nginx/conf.d
$ mkdir -p ~/var/log/nginx

~$ find etc/nginx/*
etc/nginx/woohoo-wildcard.key
etc/nginx/common
etc/nginx/conf.d
etc/nginx/conf.d/ratfoo.conf
etc/nginx/gd79_bundle.crt

~$ find var/*
var/log
var/log/nginx
var/log/nginx/foo.access.log
var/log/nginx/access.log
var/log/nginx/rat.access.log
var/log/nginx/error.log

~$ cat etc/nginx/common
ssl_certificate           gd79_bundle.crt;
ssl_certificate_key       wohoo-wildcard.key;
ssl on;
ssl_session_cache  builtin:1000  shared:SSL:10m;
ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;

~$ cat etc/nginx/conf.d/ratfoo.conf
server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name rat.woohoo.com;

    include common;

    access_log            /var/log/nginx/rat.access.log;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://localhost:1919;
      proxy_read_timeout  90;

      proxy_redirect      http://localhost:1919 https://rat.woohoo.com;
    }
}

server {

    listen 443;
    server_name foo.woohoo.com;

    include common;

    access_log            /var/log/nginx/foo.access.log;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://localhost:1919;
      proxy_read_timeout  90;

      proxy_redirect      http://localhost:1919 https://foo.woohoo.com;
    }
}

docker run -d -p 1919:80 tutum/hello-world 
docker run -d -p 2020:80 tutum/hello-world 

docker run -d \
 --net=host \
 -v /home/ubuntu/etc/nginx/conf.d:/etc/nginx/conf.d \
 -v /home/ubuntu/etc/nginx/common:/etc/nginx/common \
 -v /home/ubuntu/etc/nginx/gd79_bundle.crt:/etc/nginx/gd79_bundle.crt \
 -v /home/ubuntu/etc/nginx/woohoo-wildcard.key:/etc/nginx/woohoo-wildcard.key \
 -v /home/ubuntu/var/log/nginx:/var/log/nginx \
 nginx

server {
    listen 80;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name jenkins.domain.com;

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    access_log            /var/log/nginx/jenkins.access.log;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      # Fix the “It appears that your reverse proxy set up is broken" error.
      proxy_pass          http://localhost:8080;
      proxy_read_timeout  90;

      proxy_redirect      http://localhost:8080 https://jenkins.domain.com;
    }
}

#!/bin/bash

# /etc/init.d/vimmau-whitelist

# Controls access to  aztek banana and jersey server ports.
# Allows us to whitelist a lot more ip ranges than AWS
# security groups allow.

# To be run only on vimmau hosts.

# AWS security groups will grant full access to banana server--$BANANA_PORT,
# and jersey server--$JERSEY_PORT. We control whitelists here.

# banana and jersey servers may or may not be on the same box. And we may move
# them around. Currently all aztek services run on a single box. We may
# move banana and/or jersey off to a separate box. So this script needs to
# always turn off access on boxes that don't have banana or jersey running
# as well as turn on access if they do.

# NOTE: We assume we are the only one that does anything with iptables on
# a given box. We broadly nuke all chains in all tables, etc.

# whitelist of current customer ip ranges
CUST_WHITELIST=/home/ubuntu/customer.whitelist
# whitelist for rfc1918 addresses and
# whitelist for other special access like the vpn endpoint
RFC1918_WHITELIST=/home/ubuntu/rfc1918-custom.whitelist
HASHSIZE=4096

if [ -z "$ALLOW_BANANA" ]; then
  # so since we currently run banana and jersey on same server we will
  # just hard code this to true. we will need to get more fancy if
  # banana and jersey on different servers.
  ALLOW_BANANA=true
fi
if [ -z "$ALLOW_JERSEY" ]; then
  # so since we currently run banana and jersey on same server we will
  # just hard code this to true. we will need to get more fancy if
  # banana and jersey on different servers.
  ALLOW_JERSEY=true
fi
if [ -z "$BANANA_PORT" ]; then
  BANANA_PORT=4959
fi
if [ -z "$JERSEY_PORT" ]; then
  JERSEY_PORT=4960
fi

echo "ALLOW_BANANA: $ALLOW_BANANA"
echo "ALLOW_JERSEY: $ALLOW_JERSEY"
echo "BANANA_PORT: $BANANA_PORT"
echo "JERSEY_PORT: $JERSEY_PORT"

start() {
  echo "start"
  # nuke all rules in all chains which essentially allows everything.
  open
  port80and443
  whitelist
  if [ "$ALLOW_BANANA" = true ] ; then
    allow_port $BANANA_PORT
  else
    echo "not allowing banana $BANANA_PORT"
  fi
  if [ "$ALLOW_JERSEY" = true ] ; then
    allow_port $JERSEY_PORT
  else
    echo "not allowing jersey $JERSEY_PORT"
  fi
  block_port $BANANA_PORT
  block_port $JERSEY_PORT
}

# So this redirects 80 to 4959 and 443 to 4960 -- doh. The way this works
# customers can use either port and it will work. No need to set or configure
# per customer ports. We will of course have to set port per customer for
# vimmau receptor, but not for server side.
# We can allow all 4 in AWS security groups or just the two we know the
# customer will use.
port80and443() {
  iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 4959
  iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 4960
}

# opens all ports and deletes the whitelist.
open() {
  iptables -F
  iptables -X
  iptables -t nat -F
  iptables -t nat -X
  iptables -t mangle -F
  iptables -t mangle -X
  iptables -P INPUT ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -P OUTPUT ACCEPT
  ipset destroy whitelist &>/dev/null || true
}

# blocks 'all' ports and deletes the whitelist.
stop() {
  open
  block_port $BANANA_PORT
  block_port $JERSEY_PORT
}

whitelist() {
  echo "whitelist"
  ipset flush whitelist &>/dev/null || true
  load_whitelist $CUST_WHITELIST
  load_whitelist $RFC1918_WHITELIST
}

load_whitelist() {
  if [ -f $1 ] ; then
    # make sure there's an ipset named 'whitelist'.
    # this command seems to be idempotent.
    ipset -exist create whitelist hash:net hashsize $HASHSIZE
    # loop over lines in file
    while read rule; do
      # skip lines that start with #
      if [[ ${rule:0:1} == '#' ]]; then
        echo "skipping $rule"
      else
        ipset -exist add whitelist $rule
      fi
    done <"$1"
  else
    echo "$1 not found"
  fi
}

allow_port() {
  echo "allowing port: $1"
  iptables -v -A INPUT -m set --match-set whitelist src -p TCP --dport $1 -j ACCEPT
}

block_port() {
  echo "blocking port: $1"
  iptables -v -A INPUT -p TCP --dport $1 -j LOG --log-prefix "IPTABLES DROPPED: "
  iptables -v -A INPUT -p TCP --dport $1 -j DROP
}

status() {
  echo ""
  iptables -t nat -nvL
  echo ""
  iptables -nvL
  echo ""
  ipset list
}

if [ "$1" == "start" ]; then
  start
elif [ "$1" == "reload" ]; then
  whitelist
elif [ "$1" == "stop" ]; then
  stop
elif [ "$1" == "open" ]; then
  open
elif [ "$1" == "status" ]; then
  status
else
  echo "whitelist.sh <start|stop|reload|status>"
  echo "  start - allow only whitelisted ports and ips"
  echo "  stop - block both ports for all ips"
  echo "  reload - reload list of whitelisted ips"
  echo "  open - allow all ips for both ports (DANGER)"
  echo "  status - show rules and whitelist"
fi

- uri:
    url: "http://some.url"
    method: PUT
    body: '{"url": "http://{{ ansible_eth0.ipv4.address }}:3003"}'
    body_format: json

vars:
  listener_body:
    url: "http://{{ ansible_eth0.ipv4.address }}:3003"
    _hack: null
tasks:
  - uri:
    url: "http://some.url"
    method: PUT
    body: "{{ listener_body | to_json }}"
    body_format: json