SSL Certificates¶

All user connections go through a Traefik service. The infrastructure uses SSL certificates for exposing the Portal through Traefik as well as for internal communications between platform services.

Important

It is recommended to use a different PKI for internal communications than the one used for Traefik.

Traefik¶

Three modes are available:

Default certificate¶

By default, a self-signed certificate is automatically generated when creating the Traefik container. This mode is suitable for test environments but not recommended for production.

Local certificate¶

You can provide a certificate and key stored on the Ansible machine. The reemo-infra role deploys these files on the servers hosting Traefik.

Inventory example:

TRAEFIK_SSL_CERTS:
    - cert_file: "/localpath/to/cert.crt"
      key_file: "/localpath/to/key.key"

Certificate already present on the server¶

If certificates are already installed on the target servers, you can specify their local paths. They will then be mounted directly into the Traefik container.

Inventory example:

TRAEFIK_SSL_CERTS_REMOTE:
    - cert_file_remotepath: "/remotepath/to/cert.crt"
      key_file_remotepath: "/remotepath/to/key.key"

Internal communications¶

All micro-services communicate with each other using mTLS, which requires certificate management.

You have 3 options:

Default PKI¶

The reemo-infra Ansible role includes a complete, ready-to-use dedicated PKI. It enables a simple deployment with encrypted and authenticated internal communications.

Automatically generated CA¶

You can use a Certification Authority (CA) generated automatically when running the reemo-infra role.

Steps:

Create a local directory on the Ansible machine, writable by the user running Ansible.
Add the required options in the inventory file to enable this feature.

all:
    vars:
        LOCAL_PATH: "/opt/reemo/ssl"
        INITCA_ENABLE: "true"
    infra_manager:
        hosts:
            infra_manager1:
                ansible_host: "10.0.0.1"
            infra_manager2:
                ansible_host: "10.0.0.2"
            infra_manager3:
                ansible_host: "10.0.0.3"

When the role starts, a CA will be created automatically in this directory. The associated keys and certificates will then be exported to the Docker Swarm cluster as Secrets and mounted into the containers that need them.

Manual configuration¶

You can also generate the SSL certificates yourself for the URLs:

reemo_portal
reemo_portaladmin
reemo_api
reemo_proapi
reemo_signal
reemo_provision
reemo_prorelayapi
reemo_procloudapi
reemo_relayws

Then specify in the Ansible inventory the local paths of the keys and certificates. They will be copied automatically to the Docker Swarm cluster by the reemo-infra role.

Example:

all:
    vars:
        API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="
        ...
    infra_manager:
        hosts:
            infra_manager1:
                ansible_host: "10.0.0.1"
            infra_manager2:
                ansible_host: "10.0.0.2"
            infra_manager3:
                ansible_host: "10.0.0.3"
        vars:
            CA_SSL_CRT_LOCALPATH: "/local/path/ca.crt"
            API_SSL_CRT_LOCALPATH: "/local/path/reemo_api.crt"
            API_SSL_KEY_LOCALPATH: "/local/path/reemo_api.key"
            PROAPI_SSL_CRT_LOCALPATH: "/local/path/reemo_proapi.crt"
            PROAPI_SSL_KEY_LOCALPATH: "/local/path/reemo_proapi.key"
            PRORELAYAPI_SSL_CRT_LOCALPATH: "/local/path/reemo_prorelayapi.crt"
            PRORELAYAPI_SSL_KEY_LOCALPATH: "/local/path/reemo_prorelayapi.key"
            SIGNAL_SSL_CRT_LOCALPATH: "/local/path/reemo_signal.crt"
            SIGNAL_SSL_KEY_LOCALPATH: "/local/path/reemo_signal.key"
            PORTAL_SSL_CRT_LOCALPATH: "/local/path/reemo_portal.crt"
            PORTAL_SSL_KEY_LOCALPATH: "/local/path/reemo_portal.key"
            TRAEFIK_SSL_CERTS:
                - cert_file: "/local/path/domain.crt"
                  key_file: "/local/path/domain.key"