diff --git a/clouder_template_red_october/README.rst b/clouder_template_red_october/README.rst new file mode 100644 index 0000000..7245a98 --- /dev/null +++ b/clouder_template_red_october/README.rst @@ -0,0 +1,72 @@ +.. image:: https://img.shields.io/badge/licence-LGPL--3-blue.svg + :target: http://www.gnu.org/licenses/lgpl-3.0-standalone.html + :alt: License: LGPL-3 + +============================== +Clouder Template - Red October +============================== + +This module provides a Clouder Template for Red Octover. + +Red October is a cryptographically-secure implementation of the two-person rule +to protect sensitive data. From a technical perspective, Red October is a +software-based encryption and decryption server. The server can be used to +encrypt a payload in such a way that no one individual can decrypt it. The +encryption of the payload is cryptographically tied to the credentials of the +authorized users. + +Authorized persons can delegate their credentials to the server for a period of +time. The server can decrypt any previously-encrypted payloads as long as the +appropriate number of people have delegated their credentials to the server. + +This architecture allows Red October to act as a convenient decryption service. +Other systems, including CloudFlare’s build system, can use it for decryption +and users can delegate their credentials to the server via a simple web interface. +All communication with Red October is encrypted with TLS, +ensuring that passwords are not sent in the clear. + +`Read More on CloudFlare's Blog +`_. + +`Browse Red October on Github +`_. + +Configuration +============= + +Clouder configuration instructions are available at https://clouder.readthedocs.io/ + +Usage +===== + +To use this module, you need to: + +#. Create a CFSSL Service in the Clouder Control Panel + +Known issues / Roadmap +====================== + +* Add more Signature Profile options - https://github.com/cloudflare/redoctober/blob/86ecfbe5750ebf05565e4c80104d0a7919792fee/doc/cmd/redoctober.txt#L113 + +Bug Tracker +=========== + +Bugs are tracked on `GitHub Issues +`_. In case of trouble, please +check there if your issue has already been reported. If you spotted it first, +help us smashing it by providing a detailed and welcomed feedback. + +Credits +======= + +Contributors +------------ + +* Dave Lasley + +Maintainer +---------- + +This module is maintained by Clouder Community. + +To contribute to this module, please visit https://github.com/clouder-community/clouder diff --git a/clouder_template_red_october/__init__.py b/clouder_template_red_october/__init__.py new file mode 100644 index 0000000..08d9d6b --- /dev/null +++ b/clouder_template_red_october/__init__.py @@ -0,0 +1,3 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). diff --git a/clouder_template_red_october/__manifest__.py b/clouder_template_red_october/__manifest__.py new file mode 100644 index 0000000..4668990 --- /dev/null +++ b/clouder_template_red_october/__manifest__.py @@ -0,0 +1,28 @@ +# -*- coding: utf-8 -*- +# Copyright 2016 LasLabs Inc. +# License LGPL-3.0 or later (http://www.gnu.org/licenses/lgpl.html). + +{ + 'name': 'Clouder Template - Red October', + 'version': '10.0.10.0.0', + 'category': 'Clouder', + 'depends': [ + 'clouder', + 'clouder_template_proxy', + ], + 'author': 'LasLabs Inc.', + 'license': 'LGPL-3', + 'website': 'https://github.com/clouder-community/clouder', + 'data': [ + 'data/image_template.xml', + 'data/image.xml', + 'data/image_port.xml', + 'data/image_volume.xml', + 'data/application_tag.xml', + 'data/application_type.xml', + 'data/application_template.xml', + 'data/application.xml', + ], + 'installable': True, + 'application': False, +} diff --git a/clouder_template_red_october/data/application.xml b/clouder_template_red_october/data/application.xml new file mode 100644 index 0000000..adc051b --- /dev/null +++ b/clouder_template_red_october/data/application.xml @@ -0,0 +1,42 @@ + + + + + + + CFSSL Data + data + + + + 1 + + + + + CFSSL Exec + exec + + + + 2 + + auto + + + + CFSSL + redoctober + + + + 1 + + + + diff --git a/clouder_template_red_october/data/application_tag.xml b/clouder_template_red_october/data/application_tag.xml new file mode 100644 index 0000000..62e887a --- /dev/null +++ b/clouder_template_red_october/data/application_tag.xml @@ -0,0 +1,11 @@ + + + + + + + cert_authority + + + diff --git a/clouder_template_red_october/data/application_template.xml b/clouder_template_red_october/data/application_template.xml new file mode 100644 index 0000000..1f684eb --- /dev/null +++ b/clouder_template_red_october/data/application_template.xml @@ -0,0 +1,13 @@ + + + + + + + CFSSL + + + diff --git a/clouder_template_red_october/data/application_type.xml b/clouder_template_red_october/data/application_type.xml new file mode 100644 index 0000000..8a60f66 --- /dev/null +++ b/clouder_template_red_october/data/application_type.xml @@ -0,0 +1,17 @@ + + + + + + + redoctober + root + + + + diff --git a/clouder_template_red_october/data/certificate_policy_use.xml b/clouder_template_red_october/data/certificate_policy_use.xml new file mode 100644 index 0000000..46a1a13 --- /dev/null +++ b/clouder_template_red_october/data/certificate_policy_use.xml @@ -0,0 +1,162 @@ + + + + + + + Certificate Signing + cert sign + + + + Signing + signing + + + + S/MIME + s/mime + + + + Server Authentication + server auth + + + + Client Authentication + client auth + + + + Digital Signatures + digital signature + + + + Email Protection + email protection + + + + Key Encipherment + key encipherment + + + + Content Commitment + content commitment + + + + Key Agreement + key agreement + + + + CRL Signing + crl sign + + + + Encipher Only + encipher only + + + + Decipher Only + decipher only + + + + Any + any + + + + Code Signing + code signing + + + + IPSEC End System + ipsec end system + + + + IPSEC Tunnel + ipsec tunnel + + + + IPSEC User + ipsec user + + + + Timestamping + timestamping + + + + OCSP Signing + ocsp signing + + + + Microsoft SGC + microsoft sgc + + + + Netscape SGC + netscape sgc + + + diff --git a/clouder_template_red_october/data/image.xml b/clouder_template_red_october/data/image.xml new file mode 100644 index 0000000..622b767 --- /dev/null +++ b/clouder_template_red_october/data/image.xml @@ -0,0 +1,24 @@ + + + + + + + image_redoctober_data + + lasley/redoctober-data + + + + image_redoctober_exec + + lasley/redoctober-exec + data + + + diff --git a/clouder_template_red_october/data/image_port.xml b/clouder_template_red_october/data/image_port.xml new file mode 100644 index 0000000..1562dc6 --- /dev/null +++ b/clouder_template_red_october/data/image_port.xml @@ -0,0 +1,15 @@ + + + + + + + + redoctober-http + 8888 + + + diff --git a/clouder_template_red_october/data/image_template.xml b/clouder_template_red_october/data/image_template.xml new file mode 100644 index 0000000..6e55bd3 --- /dev/null +++ b/clouder_template_red_october/data/image_template.xml @@ -0,0 +1,19 @@ + + + + + + + image_template_redoctober_data + + + + image_template_redoctober_exec + + + diff --git a/clouder_template_red_october/data/image_volume.xml b/clouder_template_red_october/data/image_volume.xml new file mode 100644 index 0000000..67c4d10 --- /dev/null +++ b/clouder_template_red_october/data/image_volume.xml @@ -0,0 +1,16 @@ + + + + + + + + cert_store + /var/pki + root + + + diff --git a/clouder_template_red_october/images/data/Dockerfile b/clouder_template_red_october/images/data/Dockerfile new file mode 100644 index 0000000..d9d246c --- /dev/null +++ b/clouder_template_red_october/images/data/Dockerfile @@ -0,0 +1,4 @@ +FROM clouder/base:3.4 +MAINTAINER Dave Lasley + +CMD tail -f /dev/null diff --git a/clouder_template_red_october/images/data/pki/ca/csr_ca.json b/clouder_template_red_october/images/data/pki/ca/csr_ca.json new file mode 100644 index 0000000..d9d246c --- /dev/null +++ b/clouder_template_red_october/images/data/pki/ca/csr_ca.json @@ -0,0 +1,4 @@ +FROM clouder/base:3.4 +MAINTAINER Dave Lasley + +CMD tail -f /dev/null diff --git a/clouder_template_red_october/images/exec/Dockerfile b/clouder_template_red_october/images/exec/Dockerfile new file mode 100644 index 0000000..eb4f5c2 --- /dev/null +++ b/clouder_template_red_october/images/exec/Dockerfile @@ -0,0 +1,37 @@ +FROM clouder/base:3.4 +MAINTAINER Dave Lasley + + +RUN groupadd -r redoctober --gid=999 && useradd -r -g redoctober --uid=999 redoctober + +# Install Build Dependencies + +ENV buildDeps "build-base \ + gcc \ + git \ + go \ + libtool \ + openssl \ + runit" + +RUN apk add --no-cache $buildDeps + +# Install Red October + +RUN git clone --depth=1 https://github.com/cloudflare/redoctober.git /go/src/github.com/cloudflare/redoctober + +RUN go install github.com/cloudflare/redoctober + +EXPOSE 8080 8081 +ENV RO_CERTS=/var/lib/redoctober/data/server.crt \ + RO_KEYS=/var/lib/redoctober/data/server.pem \ + RO_DATA=/var/lib/redoctober/data \ + RO_CERTPASSWD=password \ + RO_COMMONNAME=localhost + +ENTRYPOINT ["/go/src/github.com/cloudflare/redoctober/scripts/docker-entrypoint.sh"] +CMD ["redoctober", \ + "-addr=:8080", \ + "-vaultpath=/var/lib/redoctober/data/diskrecord.json", \ + "-certs=/var/lib/redoctober/data/server.crt", \ + "-keys=/var/lib/redoctober/data/server.pem"]