mirror of
https://github.com/bigchaindb/bigchaindb.git
synced 2024-10-13 13:34:05 +00:00
b6ec3e5f5c
* Support for secure TLS communication in MongoDB, MongoDB Monitoring Agent and MongoDB Backup Agent - Move from Golang to Bash for entrypoint program - Update image tag to 2.0 for Backup and Monitoring Agents and to 3.4.4 for MongoDB - Add documentation * changed title & rewrote Step 1 of workflow.rst * copy-edited ca-installation.rst * copy-edited & modified structure of workflow.rst * moved repeated Easy-RSA install & config docs to new page * edited the sentences describing the Easy-RSA dirs * copy-edited the page about generating server certificate * copy-edited the page about generating client certificate * renamed page to 'How to Set Up a Self-Signed Certificate Authority' * copy-edited page about how to revoke a certificate * Comments on how to uniquely name all instances in the cluster * Added comments about the other questions when setting up a CA * Added note about one Agent Api Key per Cloud Manager backup * docs: clarified instructions for generating server CSR * docs: added back 'from your PKI infrastructure' * docs: fixed step & added step re/ FQDNs & certs in workflow.rst * docs: added note re/ the Distinguished Name * Update docs for env vars setup * docs: added tip: how to get help with the easyrsa command
123 lines
4.4 KiB
ReStructuredText
123 lines
4.4 KiB
ReStructuredText
Overview
|
|
========
|
|
|
|
This page summarizes the steps *we* go through
|
|
to set up a production BigchainDB cluster.
|
|
We are constantly improving them.
|
|
You can modify them to suit your needs.
|
|
|
|
|
|
Things the Managing Organization Must Do First
|
|
----------------------------------------------
|
|
|
|
|
|
1. Set Up a Self-Signed Certificate Authority
|
|
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
We use SSL/TLS and self-signed certificates
|
|
for MongoDB authentication (and message encryption).
|
|
The certificates are signed by the organization managing the cluster.
|
|
If your organization already has a process
|
|
for signing certificates
|
|
(i.e. an internal self-signed certificate authority [CA]),
|
|
then you can skip this step.
|
|
Otherwise, your organization must
|
|
:ref:`set up its own self-signed certificate authority <How to Set Up a Self-Signed Certificate Authority>`.
|
|
|
|
|
|
2. Register a Domain and Get an SSL Certificate for It
|
|
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
The BigchainDB APIs (HTTP API and WebSocket API) should be served using TLS,
|
|
so the organization running the cluster
|
|
should choose an FQDN for their API (e.g. api.organization-x.com),
|
|
register the domain name,
|
|
and buy an SSL/TLS certificate for the FQDN.
|
|
|
|
|
|
Things Each Node Operator Must Do
|
|
---------------------------------
|
|
|
|
☐ Every MongoDB instance in the cluster must have a unique (one-of-a-kind) name.
|
|
Ask the organization managing your cluster if they have a standard
|
|
way of naming instances in the cluster.
|
|
For example, maybe they assign a unique number to each node,
|
|
so that if you're operating node 12, your MongoDB instance would be named
|
|
``mdb-instance-12``.
|
|
Similarly, other instances must also have unique names in the cluster.
|
|
|
|
#. Name of the MongoDB instance (``mdb-instance-*``)
|
|
#. Name of the BigchainDB instance (``bdb-instance-*``)
|
|
#. Name of the NGINX instance (``ngx-instance-*``)
|
|
#. Name of the MongoDB monitoring agent instance (``mdb-mon-instance-*``)
|
|
#. Name of the MongoDB backup agent instance (``mdb-bak-instance-*``)
|
|
|
|
|
|
☐ Every node in a BigchainDB cluster needs its own
|
|
BigchainDB keypair (i.e. a public key and corresponding private key).
|
|
You can generate a BigchainDB keypair for your node, for example,
|
|
using the `BigchainDB Python Driver <http://docs.bigchaindb.com/projects/py-driver/en/latest/index.html>`_.
|
|
|
|
.. code:: python
|
|
|
|
from bigchaindb_driver.crypto import generate_keypair
|
|
print(generate_keypair())
|
|
|
|
|
|
☐ Share your BigchaindB *public* key with all the other nodes
|
|
in the BigchainDB cluster.
|
|
Don't share your private key.
|
|
|
|
|
|
☐ Get the BigchainDB public keys of all the other nodes in the cluster.
|
|
That list of public keys is known as the BigchainDB "keyring."
|
|
|
|
|
|
☐ Ask the managing organization
|
|
for the FQDN used to serve the BigchainDB APIs
|
|
(e.g. ``api.orgname.net`` or ``bdb.clustername.com``).
|
|
|
|
|
|
☐ Make up an FQDN for your BigchainDB node (e.g. ``mynode.mycorp.com``).
|
|
Make sure you've registered the associated domain name (e.g. ``mycorp.com``),
|
|
and have an SSL certificate for the FQDN.
|
|
(You can get an SSL certificate from any SSL certificate provider).
|
|
|
|
|
|
☐ If the cluster uses 3scale for API authentication, monitoring and billing,
|
|
you must ask the managing organization for all relevant 3scale credentials.
|
|
|
|
|
|
☐ If the cluster uses MongoDB Cloud Manager for monitoring and backup,
|
|
you must ask the managing organization for the ``Agent Api Key``.
|
|
(Each Cloud Manager backup will have its own ``Agent Api Key``.
|
|
If there's one Cloud Manager backup,
|
|
there will be one ``Agent Api Key`` for the whole cluster.)
|
|
|
|
|
|
☐ Generate four keys and corresponding certificate signing requests (CSRs):
|
|
|
|
#. Server Certificate (a.k.a. Member Certificate) for the MongoDB instance
|
|
#. Client Certificate for BigchainDB Server to identify itself to MongoDB
|
|
#. Client Certificate for MongoDB Monitoring Agent to identify itself to MongoDB
|
|
#. Client Certificate for MongoDB Backup Agent to identify itself to MongoDB
|
|
|
|
Ask the managing organization to use its self-signed CA to sign those certificates.
|
|
|
|
For help, see the pages:
|
|
|
|
* :ref:`How to Generate a Server Certificate for MongoDB`
|
|
* :ref:`How to Generate a Client Certificate for MongoDB`
|
|
|
|
|
|
☐ :doc:`Deploy a Kubernetes cluster on Azure <template-kubernetes-azure>`.
|
|
|
|
|
|
☐ Create the Kubernetes Configuration for this node.
|
|
We will use Kubernetes ConfigMaps and Secrets to hold all the information
|
|
gathered above.
|
|
|
|
|
|
☐ Deploy your BigchainDB node on your Kubernetes cluster.
|
|
|
|
TODO: Links to instructions for first-node-in-cluster or second-or-later-node-in-cluster |