SINFERE sinfere

How to setup your own CA with OpenSSL

For educational reasons I've decided to create my own CA. Here is what I learned.

First things first

Lets get some context first.

Install Rancher 2.0 HA by using self signed certificates (+ intermediate) and Layer 4 Loadbalancer (TCP)

Warning: the RKE install method is only supported up to v2.0.8!

This gist describes how to setup Rancher 2 HA, by using self signed certificates (with intermediate) and a Layer 4 Loadbalancer (TCP)

Requirements

Linux OS
OS Binaries

Generate self signed certificates for Rancher 2.x

Generate certificates

docker run -v $PWD/certs:/certs \
  -e SSL_SUBJECT=test.example.com \
  -e SSL_DNS=test.example.com,test2.example.com \
  -e SSL_IP=10.0.0.1 \
 superseb/omgwtfssl

Generate CA, intermediate CA and server certificate with DNS alt names using Terraform in Docker and launch Rancher

Generate CA, intermediate CA and server certificate

docker run --rm -v $PWD/testcerts:/tmp/certs/files -e TF_VAR_ip_addresses='["127.0.0.1"]' -e TF_VAR_dns_names='["yolo.seb.local"]' superseb/intermediate

Run Rancher

Assigning Static IP Addresses in WSL2

WSL2 uses Hyper-V for networking. The WSL2 network settings are ephemeral and configured on demand when any WSL2 instance is first started in a Windows session. The configuration is reset on each Windows restart and the IP addresses change each time. The Windows host creates a hidden switch named "WSL" and a network adapter named "WSL" (appears as "vEthernet (WSL)" in the "Network Connections" panel). The Ubuntu instance creates a corresponding network interface named "eth0".

Assigning static IP addresses to the network interfaces on the Windows host or the WSL2 Ubuntu instance enables support for the following scenarios:

	#!/bin/sh

	TMPFILE="/tmp/xtrabackup-runner.$$.tmp"
	USEROPTIONS="--user=${MYSQL_USER} --password=${MYSQL_PASSWORD} --host=${MYSQL_HOST}"
	BACKDIR=/srv/mysql-bak
	BASEBACKDIR=$BACKDIR/base
	INCRBACKDIR=$BACKDIR/incr
	FULLBACKUPCYCLE=604800 # Create a new full backup every X seconds
	KEEP=1 # Number of additional backups cycles a backup should kept for.
	START=`date +%s`

	China stock api
	1.163_API(0-sh,1-sz):http://api.money.126.net/data/feed/1002151,0600036,hkHSI,hkHSCEI,hk00005
	2.QQ_API(sh,sz,s_simple data):http://qt.gtimg.cn/r=0.8409869808238q=s_sz000559,s_sz002434,s_sz002472,s_sz002488,hk00700
	3.sina_API(sh,sz,s_simple data):http://hq.sinajs.cn/list=sh600000,sh600004,hk00700,sz002594
	# 4.xueqiu_API:http://xueqiu.com/v4/stock/quote.json?code=02318,01211,SH000001,DJI30,HKHSI

	163
	日内实时盘口（JSON）：
	http://api.money.126.net/data/feed/1000002,1000001,1000881,0601398,money.api

	#!/bin/bash

	veth_in_use=()
	veth_unused=()
	veth_all=()

	function veth_interface_for_container() {
	local pid=$(docker inspect -f '{{.State.Pid}}' "${1}")
	mkdir -p /var/run/netns
	ln -sf /proc/$pid/ns/net "/var/run/netns/${1}"

	# This file contains only partial paths to match on
	# This file should reside in the same directory as the haproxy.cfg simply due to the way it is configured in the sample snippet-but they can go anywhere in the /etc/haproxy directory
	/my-partial- https://subdomain3.mydomain.com/my-new-full-path