diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst new file mode 100644 index 0000000..70383d2 --- /dev/null +++ b/clouder_template_red_october/README.rst @@ -0,0 +1,80 @@ +.. image:: https://img.shields.io/badge/licence-LGPL--3-blue.svg + :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html + :alt: License: LGPL-3 + +============================== +Clouder Template - Red October +============================== + +This module provides a Clouder Template for Red October. + +Red October is a cryptographically-secure implementation of the two-person rule +to protect sensitive data. From a technical perspective, Red October is a +software-based encryption and decryption server. The server can be used to +encrypt a payload in such a way that no one individual can decrypt it. The +encryption of the payload is cryptographically tied to the credentials of the +authorized users. + +Authorized persons can delegate their credentials to the server for a period of +time. The server can decrypt any previously-encrypted payloads as long as the +appropriate number of people have delegated their credentials to the server. + +This architecture allows Red October to act as a convenient decryption service. +Other systems, including CloudFlare’s build system, can use it for decryption +and users can delegate their credentials to the server via a simple web interface. +All communication with Red October is encrypted with TLS, +ensuring that passwords are not sent in the clear. + +`Read More on CloudFlare's Blog +`_. + +`Browse Red October on Github +`_. + +Configuration +============= + +Clouder configuration instructions are available at https://clouder.readthedocs.io/ + +Usage +===== + +To use this module, you need to: + +#. Create a new service in the Clouder Control Panel +#. Select ``Red October`` as the application & configure everything else to preference + +Known issues / Roadmap +====================== + +* The service is currently using a self-signed certificate. This should be changed once a CA exists. +* Runit is being installed via community repos, which are HTTP only. This is insecure. +* Path isn't persisting so there is a symlink to redoctober being created. This should be fixed at some point, + likely in a base Go container instead of here. +* Image volume is being mounted as root, then chown is happening in the docker entrypoint. This sseems weird, + so should investigate further, but is how the CloudFlare people rigged it up so it's possible they're simply + smarter than me. +* Add dependency cleanup to Dockerfile. + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues +`_. In case of trouble, please +check there if your issue has already been reported. If you spotted it first, +help us smashing it by providing a detailed and welcomed feedback. + +Credits +======= + +Contributors +------------ + +* Dave Lasley + +Maintainer +---------- + +This module is maintained by Clouder Community. + +To contribute to this module, please visit https://github.com/clouder-community/clouder diff --git a/clouder_template_red_october/__init__.py b/clouder_template_red_october/__init__.py new file mode 100644 index 0000000..6b7b00c --- /dev/null +++ b/clouder_template_red_october/__init__.py @@ -0,0 +1,5 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). + +from . import models diff --git a/clouder_template_red_october/__manifest__.py b/clouder_template_red_october/__manifest__.py new file mode 100644 index 0000000..ec0c2bb --- /dev/null +++ b/clouder_template_red_october/__manifest__.py @@ -0,0 +1,27 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). + +{ + 'name': 'Clouder Template - Red October', + 'version': '10.0.10.0.0', + 'category': 'Clouder', + 'depends': [ + 'clouder', + 'clouder_template_proxy', + ], + 'author': 'LasLabs Inc.', + 'license': 'LGPL-3', + 'website': 'https://github.com/clouder-community/clouder', + 'data': [ + 'data/image_template.xml', + 'data/image.xml', + 'data/image_port.xml', + 'data/image_volume.xml', + 'data/application_type.xml', + 'data/application_template.xml', + 'data/application.xml', + ], + 'installable': True, + 'application': False, +} diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml new file mode 100644 index 0000000..163dfd9 --- /dev/null +++ b/clouder_template_red_october/data/application.xml @@ -0,0 +1,45 @@ + + + + + + + Red October Data + data + + + + 1 + + + + + Red October Exec + exec + + + + 2 + + auto + + + + Red October + redoctober + + + + + 1 + + + + diff --git a/clouder_template_red_october/data/application_template.xml b/clouder_template_red_october/data/application_template.xml new file mode 100644 index 0000000..85cebc8 --- /dev/null +++ b/clouder_template_red_october/data/application_template.xml @@ -0,0 +1,13 @@ + + + + + + + Red October + + + diff --git a/clouder_template_red_october/data/application_type.xml b/clouder_template_red_october/data/application_type.xml new file mode 100644 index 0000000..46125fa --- /dev/null +++ b/clouder_template_red_october/data/application_type.xml @@ -0,0 +1,14 @@ + + + + + + + redoctober + redoctober + + + diff --git a/clouder_template_red_october/data/image.xml b/clouder_template_red_october/data/image.xml new file mode 100644 index 0000000..8f40a2d --- /dev/null +++ b/clouder_template_red_october/data/image.xml @@ -0,0 +1,24 @@ + + + + + + + image_redoctober_data + + clouder/base:3.4 + + + + image_redoctober_exec + + laslabs/clouder-red-october-exec + data + + + diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml new file mode 100644 index 0000000..3cbec4e --- /dev/null +++ b/clouder_template_red_october/data/image_port.xml @@ -0,0 +1,25 @@ + + + + + + + + https + 8080 + internet + + + + + metrics + 8081 + internet + + + diff --git a/clouder_template_red_october/data/image_template.xml b/clouder_template_red_october/data/image_template.xml new file mode 100644 index 0000000..6e55bd3 --- /dev/null +++ b/clouder_template_red_october/data/image_template.xml @@ -0,0 +1,19 @@ + + + + + + + image_template_redoctober_data + + + + image_template_redoctober_exec + + + diff --git a/clouder_template_red_october/data/image_volume.xml b/clouder_template_red_october/data/image_volume.xml new file mode 100644 index 0000000..1ae494f --- /dev/null +++ b/clouder_template_red_october/data/image_volume.xml @@ -0,0 +1,16 @@ + + + + + + + + data + /var/lib/redoctober/data + root + + + diff --git a/clouder_template_red_october/models/__init__.py b/clouder_template_red_october/models/__init__.py new file mode 100644 index 0000000..4949cfb --- /dev/null +++ b/clouder_template_red_october/models/__init__.py @@ -0,0 +1,5 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). + +from . import service diff --git a/clouder_template_red_october/models/service.py b/clouder_template_red_october/models/service.py new file mode 100644 index 0000000..8575f27 --- /dev/null +++ b/clouder_template_red_october/models/service.py @@ -0,0 +1,18 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). + +from odoo import api, models + + +class ClouderService(models.Model): + _inherit = 'clouder.service' + + @api.multi + def deploy_post(self): + super(ClouderService, self).deploy_post() + for record in self: + if record.application_id.type_id.name == 'redoctober': + if record.application_id.code == 'data': + # @TODO: Create a CSR, sign it with the CA, execute echo + pass