Bastion+ in WebRTC mode¶

Description of a typical Bastion+ installation in WebRTC mode, providing protocol breaking and access to a work environment

Prerequisites¶

License & Ansible: Reemo API license key and access to the reemo-infra role.
DNS resolution:
- Portal: url.domain.tld
- Admin: admin.domain.local
SSL certificates: .pem files (Cert + Key) for Traefik.
Image access: valid account on the Reemo Docker registry.

Architecture¶

../../_static/images/infra/bastion_webrtc.png — *Overview of the infrastructure for a Bastion+ installation in WebRTC mode*¶

Sizing (10 concurrent sessions)¶

Machine	CPU	RAM	Disk
infra_manager1	4 vCPU	8 GB	100G SSD
provision1_manager1	10 vCPU	10 GB	100G SSD

Flow matrix¶

DESCRIPTION	TRANSPORT	SOURCE IP	SOURCE PORT	DESTINATION IP	DESTINATION PORT	SERVICES
INFRA -> PROVISION	TCP	192.168.10.66	1024:65535	192.168.10.47	8443	HTTPS
PROVISION -> INFRA	TCP	192.168.10.47	1024:65535	192.168.10.66	8443,8446	HTTPS
PROVISION -> INFRA	UDP/TCP	192.168.10.47	1024:65535	192.168.10.66	58200	STUN/TURN
INTERNET -> INFRA	TCP	WAN	1024:65535	192.168.10.66	443	HTTPS
INTERNET -> INFRA	UDP/TCP	WAN	1024:65535	192.168.10.66	58200	STUN/TURN
INFRA -> REGISTRY	TCP	192.168.10.66	1024:65535	registry.reemo.io, registry-auth.reemo.io	443	HTTPS
PROVISION -> REGISTRY	TCP	192.168.10.47	1024:65535	registry.reemo.io, registry-auth.reemo.io	443	HTTPS

Ansible inventory file¶

all:
  vars:
    API_LICENSE: "< LICENSING_KEY >"
    REGISTRY_URL: "registry.reemo.io"
    REGISTRY_ENV: "reemoinfra"
    REGISTRY_USERNAME: "< username >"
    REGISTRY_PASSWORD: "< password >"
infra_manager:
  vars:
    TRAEFIK_SSL_CERTS:
      - cert_file: "/local/path/ssl/cert.pem"
        key_file: "/local/path/ssl/key.pem"
    PORTAL_URL: "url.domain.tld"
    PROVISION_SIGNAL_IP:
      - ip: "192.168.10.66"
    INIT_PROVISION:
      provision1:
        type: "SWARM"
        ip:
          - "192.168.10.47"
    PORTALADMIN_URL: "admin.domain.local"
    PORTALADMIN_URL_RESTRICT_IP: "10.3.1.2,10.3.2.0/24"
    PORTALADMIN_TYPE: "instadmin"
    PORTAL_TYPE: "orguser"
    # credential
    CREDENTIAL_ENABLED: true
    CREDENTIALPORTAL_ENABLED: true
    # vault
    VAULT_ENABLED: true
    VAULT_INIT_FILE: "/path/file/init.crypt"
    TURN_ENABLED: true
    TURN_OVERRIDE: true
  hosts:
    infra_manager1:
      ansible_host: "192.168.10.66"
provision:
  children:
    provision1_manager:
      hosts:
        provision1_manager1:
          ansible_host: "192.168.10.47"

Ansible playbook file¶

reemo-infra.yml

- name: Installation Reemo Infra Server
  hosts: infra_manager
  gather_facts: "True"
  roles:
    - role: reemo-infra
      become: yes

- name: Installation Provision
  hosts: provision
  gather_facts: "True"
  roles:
    - role: reemo-infra
      become: yes

Installation¶

# Initial deployment — run only once
ansible-playbook -i inventory.yml playbooks/reemo-infra.yml --extra-vars "INIT_DB=true" --extra-vars "INSTALL_DOCKER=true"

Securing the Vault (ansible-vault)¶

Immediately after the first deployment, you must:

Save the init.json file in a secure location (password manager, vault, offline encrypted backup).
Encrypt the local file with ansible-vault.

Initial encryption¶

Right after the first deployment, encrypt the file:

ansible-vault encrypt playbooks/secrets/reemo/vault/init.json

Ansible will ask for a strong passphrase (also save it in your password manager).

Note

The passphrase is different from the contents of init.json. Save both: the contents of init.json and the ansible-vault passphrase.

To run the ansible-playbook command again afterward, you will then need to provide the password for this file:

ansible-playbook -i inventory.yml playbooks/reemo-infra.yml --ask-vault-pass

Warning

If you are using self-signed SSL certificates, launch Chrome with the --ignore-certificate-errors option.

Usage guides¶

widgets

Container Configuration

Access setup

container.html