Bastion+ with Dedicated URL

Overview of a Bastion+ WebSocket setup enabling protocol break and access to a work environment.

Prerequisites

Retrieve the following Ansible roles:

reemo-infra
reemo-provision
reemo-relayws

Have a license key.

Architecture

Overview of the infrastructure for a Bastion+ installation with a Dedicated URL

Flow Matrix

DESCRIPTION	TRANSPORT	SOURCE IP	SOURCE PORT	DESTINATION IP	DESTINATION PORT	SERVICES
INFRA -> PROVISION	TCP	10.1.1.1	1024:65535	10.4.1.1	8443	HTTPS
INFRA -> RELAY	TCP	10.1.1.1	1024:65535	10.2.1.1	443,8443	HTTPS
Admin -> INFRA	TCP	10.6.1.0/24	1024:65535	10.1.1.1	8444	HTTPS
PROVISION -> INFRA	TCP	10.4.1.0/24	1024:65535	10.1.1.1	8443	HTTPS
PROVISION -> RELAY	TCP	10.4.1.0/24	1024:65535	10.2.1.1	443	HTTPS
INTERNET -> RELAY	TCP	WAN	1024:65535	10.2.1.1	443	HTTPS
INTERNET -> INFRA	TCP	WAN	1024:65535	10.1.1.1	443	HTTPS

Ansible Inventory File

all:
vars:
    API_LICENSE: "ewogICAg ... Uw5NXhGVDF0NFU2TkxOdjQvZU53PT0iCiAgICC9Cn0="

infra_manager:
    vars:
        INIT_TYPE: "bastion"
        PORTAL_URL: "url.domain.tld"
        PORTALADMIN_URL: "admin.domain.local"
        PORTALADMIN_URL_PORT: "8444"
        RELAYS_URL: "relay.domain.tld"
        TRAEFIK_SSL_CERTS:
            - cert_file: "/localpath/to/cert_domain.tld.crt"
              key_file: "/localpath/to/key_domain.tld.key"
            - cert_file: "/localpath/to/cert_domain.local.crt"
              key_file: "/localpath/to/key_domain.local.key"
        PROVISION_SIGNAL_IP:
            - ip: "10.1.1.1"
        PROVISION_IP:
            - ip: "10.4.1.1"
        RELAYS_IP:
            - ip: "10.2.1.1"
    hosts:
        infra_manager1:
            ansible_host: "10.1.1.1"

provision:
    children:
        provision_manager:
            hosts:
                provision_manager1: 
                    ansible_host: "10.4.1.1"

relayws_manager:
    vars:
        TRAEFIK_SSL_CERTS:
            - cert_file: "/localpath/to/cert_domain.tld.crt"
              key_file: "/localpath/to/key_domain.tld.key"
    hosts:
        relayws_manager1:
            ansible_host: "10.2.1.1"

Installation

Prerequisites

Have the following Ansible roles:

• reemo-infra

• reemo-provision

• reemo-relayws

Have the following playbooks:

reemo-infra.yml

- name: Reemo Infra Server Installation
  hosts: infra_manager,portal_manager,api_manager
  gather_facts: yes

  roles:
      - role: reemo-infra
        become: yes

reemo-provision.yml

- name: Deploy Reemo Provision environment in swarm cluster
  hosts: provision,provision_manager
  gather_facts: yes

  roles:
      - role: reemo-provision
        become: yes

reemo-relayws.yml

- name: Reemo Relay WebSocket Installation
  hosts: relayws_manager
  gather_facts: yes

  roles:
      - role: reemo-relayws
        become: yes

With Internet

If the machines have Internet access, the Ansible role can install and automatically initialize Docker Swarm.

ansible-playbook -i inventory.yml playbooks/reemo-infra.yml --extra-vars "INIT_DB=true" --extra-vars "INSTALL_DOCKER=true"
ansible-playbook -i inventory.yml playbooks/reemo-provision.yml --extra-vars "PROVISION_INSTALL_DOCKER=true"
ansible-playbook -i inventory.yml playbooks/reemo-relayws.yml --extra-vars "RELAYWS_INSTALL_DOCKER=true"

Without Internet

If the machines do not have Internet access, install and initialize Docker Swarm before running the Ansible roles.

ansible-playbook -i inventory.yml playbooks/reemo-infra.yml --extra-vars "TARBALL_GENERATE=true" --extra-vars "TARBALL_PATH=/opt/reemo/images" --tags tarball_generate
ansible-playbook -i inventory.yml playbooks/reemo-infra.yml --extra-vars "INIT_DB=true" --extra-vars "TARBALL_PATH=/opt/reemo/images" --extra-vars "LOAD_IMAGE=true"
ansible-playbook -i inventory.yml playbooks/reemo-provision.yml 
ansible-playbook -i inventory.yml playbooks/reemo-relayws.yml --extra-vars "TARBALL_PATH=/opt/reemo/images" --extra-vars "LOAD_IMAGE=true"