Fix #375: rsiviz expose service ports and enable tls

rsconf/component/network.py

@@ -142,16 +142,13 @@ def unchecked_public_ip(self):
         return None
 
     def _add_ports(self, which, ports):
-        assert len(ports[0]) > 2, "invalid ports: {}".format(ports)
         z = self.j2_ctx.network
         c = (
             ("trusted_tcp_ports", "public_tcp_ports")
             if "tcp" in which
             else ("public_udp_ports",)
         )
         for p in ports:
-            for w in c:
-                assert not p in z[w], "port {} already in {}".format(p, w)
             z[which].append(p)
 
     def _restricted_public_tcp_ports(self, z):

rsconf/component/rsiviz.py

@@ -45,6 +45,9 @@ def internal_build_compile(self):
             # is there a way to just use it and not specify cmd?
             docker_exec=f"bash {db.user_home_path(z._run_u)}/.radia-run/start",
         )
+        self.buildt.get_component("network").add_public_tcp_ports(
+            (z.index_iframe_port, z.server_port)
+        )
 
     def internal_build_write(self):
         from rsconf.component import nginx

rsconf/package_data/rsiviz/nginx.conf.jinja

@@ -1,17 +1,20 @@
-client_max_body_size 200m;
-
 server {
-    listen {{ nginx.index_port }};
+    listen {{ nginx.index_port }} ssl;
     root {{ nginx.default_root }};
     server_name {{ nginx.vhost }};
+    ssl_certificate {{ nginx.tls_crt }};
+    ssl_certificate_key {{ nginx.tls_key }};
     location /{{ rsiviz.url_secret }}/ {
         proxy_pass http://127.0.0.1:{{ nginx.docker_index_port }}/;
     }
 }
 server {
-    listen {{ nginx.flask_port }};
+    client_max_body_size 200m;
+    listen {{ nginx.flask_port }} ssl;
     root {{ nginx.default_root }};
     server_name {{ nginx.vhost }};
+    ssl_certificate {{ nginx.tls_crt }};
+    ssl_certificate_key {{ nginx.tls_key }};
     location /{{ rsiviz.url_secret }}/ {
         proxy_pass http://127.0.0.1:{{ nginx.docker_flask_port }}/;
     }

tests/pkcli/build_data/1.out/srv/host/v9.radia.run/etc/nginx/conf.d/v9.radia.run.conf

@@ -0,0 +1,21 @@
+server {
+    listen 8880 ssl;
+    root /usr/share/nginx/html;
+    server_name v9.radia.run;
+    ssl_certificate /etc/nginx/conf.d/v9.radia.run.crt;
+    ssl_certificate_key /etc/nginx/conf.d/v9.radia.run.key;
+    location /aurlsecret/ {
+        proxy_pass http://127.0.0.1:8000/;
+    }
+}
+server {
+    client_max_body_size 200m;
+    listen 8882 ssl;
+    root /usr/share/nginx/html;
+    server_name v9.radia.run;
+    ssl_certificate /etc/nginx/conf.d/v9.radia.run.crt;
+    ssl_certificate_key /etc/nginx/conf.d/v9.radia.run.key;
+    location /aurlsecret/ {
+        proxy_pass http://127.0.0.1:8002/;
+    }
+}

tests/pkcli/build_data/1.out/srv/host/v9.radia.run/etc/sysconfig/iptables

@@ -9,7 +9,7 @@
     -A INPUT -i lo -j ACCEPT
     -A INPUT -i em1 -j ACCEPT
 -A INPUT -i em2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-    -A INPUT -i em2 -p tcp -m state --state NEW -m tcp --match multiport --dports 3100,3101,3102,3103,9999,http,pop3s,smtp,submission -j ACCEPT
+    -A INPUT -i em2 -p tcp -m state --state NEW -m tcp --match multiport --dports 3100,3101,3102,3103,8000,8002,9999,http,pop3s,smtp,submission -j ACCEPT
         -A INPUT -i em2 -s 192.168.1.0/24 -p tcp -m state --state NEW -m tcp --dport https  -j ACCEPT
         -A INPUT -i em2 -s 127.0.0.1 -p tcp -m state --state NEW -m tcp --dport https  -j ACCEPT
 -A INPUT -i em2 -m state --state INVALID -j REJECT --reject-with icmp-port-unreachable

tests/pkcli/build_data/1.out/srv/host/v9.radia.run/network.sh

@@ -6,7 +6,7 @@ rsconf_install_access '444' 'root' 'root'
 rsconf_install_file '/etc/resolv.conf' 'c333a7a816c03062d4e61effd6d2a8ce'
 rsconf_install_file '/etc/sysconfig/network-scripts/ifcfg-em1' 'e225a3f7b4b071e5c204b1182c17ab94'
 rsconf_install_file '/etc/sysconfig/network-scripts/ifcfg-em2' '4f8c01335a3bf1a8a89ba5d09fdf28df'
-rsconf_install_file '/etc/sysconfig/iptables' '797fdace2e6dd01371697aa815251bc5'
+rsconf_install_file '/etc/sysconfig/iptables' '958f6f8fd43b50be100472adbf1369cb'
 network_main
 }
 #!/bin/bash