• Stars
    star
    168
  • Rank 212,960 (Top 5 %)
  • Language
    Python
  • Created over 8 years ago
  • Updated about 2 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Docker files for the Lemur certificate orchestration tool

Lemur Docker

For full documentation on Lemur, please see the docs.

This repo utilizes docker compose to launch a cluster of containers to support development of the Lemur project. This is only meant for development and testing, not for production. See the Issues section for information regarding productionalizing these containers.

This project builds the current state of a checked out lemur repository subdirectory, meaning you may make changes and rebuild your container to pick them up. It also has the ability to dump and load another database, in case you want to
test with a copy of a real Lemur DB. Alternatively, it has the option to initialize an empty database.
Celery tasks will also run, if you choose to enable them.

Requirements

Prepare

Check out the current repo:

git clone [email protected]:Netflix/lemur-docker.git
cd lemur-docker

Starting

One magic command for all things that you need:

make

NOTE: all containers running in background by default NOTE: make automatically resolves access rights to the docker. If we haven't start containers with sudo.
NOTE: make commands tested on Linux and Mac. If you have any suggestion how it can be improved for Windows, feel free to make PR.

Starting with more control

Check out the lemur repo and make a local copy of the config files:

git clone --depth=1 https://github.com/Netflix/lemur.git lemur-build-docker/lemur
cp .lemur.env.dist .lemur.env
cp .pgsql.env.dist .pgsql.env

Start the containers:

docker-compose up

Stopping

docker-compose stop

Try It Out

Launch web browser and connect to your docker container at https://localhost:447. The default credentials are lemur/admin.

Architecture

This project launches four containers:

  1. nginx
  2. postgres
  3. redis
  4. lemur

Externally, only nginx exposes any ports. This container exposes TCP 87 and 447. We use standard ports to avoid conflicts.

The lemur container is built on a local copy of the Lemur code. It runs two processes via supervisord:

  • lemur
  • lemur-celery

The file entrypoint is used to perform setup and initialization both for postgres and lemur within the lemur container.

Note that then lemur subdirectory is git ignored, so you may make changes to the lemur repository without causing any changes to show up in lemur-docker.

Configuration

Lemur configuration Lemur configuration can happen in two places:

  • .lemur.env can be used for a few basic configuration overrides
  • lemur.conf.py must be used for any configuration that requires Python execution, and any options not available in .lemur.env

Note that by default, the Celery process is running, but all Celery tasks are disabled. If you wish to enable a Celery task, it should be done in lemur.conf.py.

lemur.conf.py is mounted on the container, so all you need to do to update these settings is to make the desired changes and restart the containers:

docker-compose stop
docker-compose start

Your changes should now be reflected in Lemur.

Database configuration Database configuration is located in:

  • .pgsql.env

This Docker configuration includes three ways to run the database, controlled via the option POSTGRES_DB_MODE in .pgsql.env:

  • init will create a brand new Lemur database, initialized with base data
  • load-frum-dump will use specified DB info to dump another database and load it into the container database (see .pgsql.env for config options)
  • blank/not set will reuse whatever data already exists in the volume lemur-docker_pg_data

Note that the init and load-from-dump options will drop whatever data is already in the volume. Aside from those, explicitly deleting the Docker volume will also delete all data. Otherwise, the volume is persistent and should contain persistent data across multiple runs of the Docker container.

Issues

Default credentials on the web UI

The username for the Lemur web UI is lemur and the default password is admin (unless overridden by environment variable LEMUR_ADMIN_PASSWORD). You may create new users and disable this service account after the apps has been launched.

Default Config

This comes with a default lemur.conf.py. Things like encryption keys and tokens have been randomized in these configs, and should instead be generated and persisted securely for anything other than experimentation.

Default credentials on the postgres database

The username for the postgres database is lemur and the default password is 12345 (located in .pgsql.env).

Untrusted web certificate

The certificate used by nginx to serve Lemur in the container is self-signed and untrusted. You would need to use a trusted certificate if you were to run this for anything other than experimentation.

Alternatively, for local development, mkcert can be used to generate a locally-trusted development certificate and key. For nginx to use these files they must be mounted into the nginx container to /etc/nginx/ssl/server.crt and /etc/nginx/ssl/server-key.crt respectively.

Example:

  1. Generate a locally-trusted certificate and key for localhost

    mkcert localhost
  2. Modify the nginx service in docker-compose.yml to mount the generated certificate and key

    --- a/docker-compose.yml
    +++ b/docker-compose.yml
    @@ -33,6 +33,8 @@ services:
           - appnet
         volumes:
           - app_data:/opt/lemur/lemur/static/dist:ro
    +      - ./localhost.pem:/etc/nginx/ssl/server.crt:ro
    +      - ./localhost-key.pem:/etc/nginx/ssl/server.key:ro
         restart: on-failure
         depends_on:
           - lemur
  3. Restart the containers

    make restart_containers

More Repositories

1

Hystrix

Hystrix is a latency and fault tolerance library designed to isolate points of access to remote systems, services and 3rd party libraries, stop cascading failure and enable resilience in complex distributed systems where failure is inevitable.
Java
23,594
star
2

chaosmonkey

Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.
Go
13,846
star
3

zuul

Zuul is a gateway service that provides dynamic routing, monitoring, resiliency, security, and more.
Java
12,993
star
4

conductor

Conductor is a microservices orchestration engine.
Java
12,943
star
5

eureka

AWS Service registry for resilient mid-tier load balancing and failover.
Java
11,991
star
6

falcor

A JavaScript library for efficient data fetching
JavaScript
10,338
star
7

pollyjs

Record, Replay, and Stub HTTP Interactions.
JavaScript
9,992
star
8

SimianArmy

Tools for keeping your cloud operating in top form. Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.
Java
7,951
star
9

metaflow

πŸš€ Build and manage real-life ML, AI, and data science projects with ease!
Python
7,382
star
10

fast_jsonapi

No Longer Maintained - A lightning fast JSON:API serializer for Ruby Objects.
Ruby
5,092
star
11

ribbon

Ribbon is a Inter Process Communication (remote procedure calls) library with built in software load balancers. The primary usage model involves REST calls with various serialization scheme support.
Java
4,468
star
12

security_monkey

Security Monkey monitors AWS, GCP, OpenStack, and GitHub orgs for assets and their changes over time.
Python
4,343
star
13

dispatch

All of the ad-hoc things you're doing to manage incidents today, done for you, and much more!
Python
4,168
star
14

dynomite

A generic dynamo implementation for different k-v storage engines
C
4,104
star
15

vmaf

Perceptual video quality assessment based on multi-method fusion.
Python
4,048
star
16

vizceral

WebGL visualization for displaying animated traffic graphs
JavaScript
4,018
star
17

vector

Vector is an on-host performance monitoring framework which exposes hand picked high resolution metrics to every engineer’s browser.
JavaScript
3,588
star
18

atlas

In-memory dimensional time series database.
Scala
3,331
star
19

consoleme

A Central Control Plane for AWS Permissions and Access
Python
3,055
star
20

concurrency-limits

Java
3,036
star
21

flamescope

FlameScope is a visualization tool for exploring different time ranges as Flame Graphs.
Python
2,922
star
22

dgs-framework

GraphQL for Java with Spring Boot made easy.
Kotlin
2,842
star
23

bless

Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function
Python
2,701
star
24

archaius

Library for configuration management API
Java
2,426
star
25

asgard

[Asgard is deprecated at Netflix. We use Spinnaker ( www.spinnaker.io ).] Web interface for application deployments and cloud management in Amazon Web Services (AWS). Binary download: http://github.com/Netflix/asgard/releases
Groovy
2,235
star
26

curator

ZooKeeper client wrapper and rich ZooKeeper framework
Java
2,138
star
27

titus

1,993
star
28

EVCache

A distributed in-memory data store for the cloud
Java
1,900
star
29

lemur

Repository for the Lemur Certificate Manager
Python
1,651
star
30

genie

Distributed Big Data Orchestration Service
Java
1,635
star
31

metacat

Java
1,487
star
32

netflix.github.com

HTML
1,419
star
33

servo

Netflix Application Monitoring Library
Java
1,400
star
34

mantis

A platform that makes it easy for developers to build realtime, cost-effective, operations-focused applications
Java
1,359
star
35

vectorflow

D
1,286
star
36

hubcommander

A Slack bot for GitHub organization management -- and other things too
Python
1,254
star
37

rend

A memcached proxy that manages data chunking and L1 / L2 caches
Go
1,175
star
38

hollow

Hollow is a java library and toolset for disseminating in-memory datasets from a single producer to many consumers for high performance read-only access.
Java
1,098
star
39

repokid

AWS Least Privilege for Distributed, High-Velocity Deployment
Python
1,082
star
40

astyanax

Cassandra Java Client
Java
1,034
star
41

Priam

Co-Process for backup/recovery, Token Management, and Centralized Configuration management for Cassandra.
Java
1,024
star
42

aminator

A tool for creating EBS AMIs. This tool currently works for CentOS/RedHat Linux images and is intended to run on an EC2 instance.
Python
938
star
43

Turbine

SSE Stream Aggregator
Java
831
star
44

governator

Governator is a library of extensions and utilities that enhance Google Guice to provide: classpath scanning and automatic binding, lifecycle management, configuration to field mapping, field validation and parallelized object warmup.
Java
821
star
45

Fido

C#
816
star
46

suro

Netflix's distributed Data Pipeline
Java
783
star
47

security-bulletins

Security Bulletins that relate to Netflix Open Source
734
star
48

spectator

Client library for collecting metrics.
Java
713
star
49

Fenzo

Extensible Scheduler for Mesos Frameworks
Java
703
star
50

msl

Message Security Layer
C++
687
star
51

unleash

Professionally publish your JavaScript modules in one keystroke
JavaScript
589
star
52

denominator

Portably control DNS clouds using java or bash
Java
573
star
53

blitz4j

Logging framework for fast asynchronous logging
Java
559
star
54

edda

AWS API Read Cache
Scala
554
star
55

PigPen

Map-Reduce for Clojure
Clojure
551
star
56

netflix-graph

Compact in-memory representation of directed graph data
Java
548
star
57

karyon

The nucleus or the base container for Applications and Services built using the NetflixOSS ecosystem
Java
495
star
58

go-env

a golang library to manage environment variables
Go
494
star
59

Prana

A sidecar for your NetflixOSS based services.
Java
492
star
60

Lipstick

Pig Visualization framework
JavaScript
464
star
61

iceberg

Iceberg is a table format for large, slow-moving tabular data
Java
455
star
62

Surus

Java
453
star
63

aws-autoscaling

Tools and Documentation about using Auto Scaling
Shell
429
star
64

nf-data-explorer

The Data Explorer gives you fast, safe access to data stored in Cassandra, Dynomite, and Redis.
TypeScript
409
star
65

go-expect

an expect-like golang library to automate control of terminal or console based programs.
Go
397
star
66

Workflowable

Ruby
370
star
67

vizceral-example

Example Vizceral app
JavaScript
361
star
68

osstracker

Github organization OSS metrics collector and metrics dashboard
Scala
359
star
69

ndbench

Netflix Data Store Benchmark
HTML
358
star
70

Raigad

Co-Process for backup/recovery, Auto Deployments and Centralized Configuration management for ElasticSearch
Java
346
star
71

recipes-rss

RSS Reader Recipes that uses several of the Netflix OSS components
Java
339
star
72

aegisthus

A Bulk Data Pipeline out of Cassandra
Java
323
star
73

titus-control-plane

Titus is the Netflix Container Management Platform that manages containers and provides integrations to the infrastructure ecosystem.
Java
320
star
74

weep

The ConsoleMe CLI utility
Go
307
star
75

metaflow-ui

🎨 UI for monitoring your Metaflow executions!
TypeScript
297
star
76

dyno-queues

Dyno Queues is a recipe that provides task queues utilizing Dynomite.
Java
261
star
77

image_compression_comparison

Image Compression Comparison Framework
Python
251
star
78

falcor-express-demo

Demonstration Falcor end point for a Netflix-style Application using express
HTML
246
star
79

gradle-template

Java
244
star
80

ember-nf-graph

Composable graphing component library for EmberJS.
JavaScript
241
star
81

falcor-router-demo

A demonstration of how to build a Router for a Netflix-like application
JavaScript
236
star
82

titus-executor

Titus Executor is the container runtime/executor implementation for Titus
Go
233
star
83

photon

Photon is a Java implementation of the Interoperable Master Format (IMF) standard. IMF is a SMPTE standard whose core constraints are defined in the specification st2067-2:2013
Java
227
star
84

dial-reference

C
220
star
85

s3mper

s3mper - Consistent Listing for S3
Java
218
star
86

ReactiveLab

Experiments and prototypes with reactive application design.
Java
207
star
87

inviso

JavaScript
205
star
88

NfWebCrypto

Web Cryptography API Polyfill
C++
205
star
89

staash

A language-agnostic as well as storage-agnostic web interface for storing data into persistent storage systems, the metadata layer abstracts a lot of storage details and the pattern automation APIs take care of automating common data access patterns.
Java
204
star
90

zeno

Netflix's In-Memory Data Propagation Framework
Java
200
star
91

brutal

A multi-network asynchronous chat bot framework using twisted
Python
200
star
92

vizceral-react

JavaScript
198
star
93

pytheas

Web Resources and UI Framework
JavaScript
187
star
94

dispatch-docker

Shell
187
star
95

dyno

Java client for Dynomite
Java
184
star
96

hal-9001

Hal-9001 is a Go library that offers a number of facilities for creating a bot and its plugins.
Go
176
star
97

Nicobar

Java
171
star
98

yetch

Yet-another-fetch polyfill library. Supports AbortController/AbortSignal
JavaScript
168
star
99

metaflow-service

πŸš€ Metadata tracking and UI service for Metaflow!
Python
168
star
100

Cloud-Prize

Description and terms for the Netflix Cloud Prize, which runs from March-September 2013. Read the rules, fork to your GitHub account to create a Submission, then send us your email address.
165
star