Slawek Zachcial slawekzachcial

This Gist is based on Self Signed Certificate with Custom Root CA gist.

It adds the use of AWS KMS to generate and decrypt the Root CA private key, so that this key does not need to be stored in plaintext. Instead, the key is stored encrypted, and is being decrypted using AWS KMS only when needed.

Create AWS KMS CMK - Done Once

Create symmetic CMK (customer-managed key) and give it an alias of alias/root-ca-encrypting-key that will be used later to reference to it:

	### MESOS
	yum -y update
	for url in \
	#https://get.docker.com/rpm/1.7.1/centos-7/RPMS/x86_64/docker-engine-1.7.1-1.el7.centos.x86_64.rpm \
	http://download.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-5.noarch.rpm \
	https://tstclair.fedorapeople.org/mesos/centos7/mesos-0.21.0-1.SNAPSHOT.3133734.el7.centos.x86_64.rpm \
	https://tstclair.fedorapeople.org/mesos/centos7/python-mesos-0.21.0-1.SNAPSHOT.3133734.el7.centos.x86_64.rpm \
	https://tstclair.fedorapeople.org/mesos/centos7/mesos-devel-0.21.0-1.SNAPSHOT.3133734.el7.centos.x86_64.rpm \
	https://tstclair.fedorapeople.org/mesos/centos7/mesos-java-0.21.0-1.SNAPSHOT.3133734.el7.centos.x86_64.rpm \
	;

	package main

	import (
	"fmt"
	"sync"
	)

	type Fetcher interface {
	// Fetch returns the body of URL and
	// a slice of URLs found on that page.

	#!/bin/bash

	PROMPT="\n$ "
	DELAY_COMMENT_CHAR="0.1s"
	DELAY_COMMENT="1s"
	DELAY_RUN="3s"

	GRAY="\033[1;30m"
	LIGHT_GRAY="\033[0;37m"
	CYAN="\033[0;36m"

	# Configuration based on
	# http://www.andrews-corner.org/linux/abcde/index.html and
	# http://www.andrews-corner.org/linux/abcde/getalbumart.html

	LOWDISK=n
	CDDBMETHOD=musicbrainz
	ACTIONS=cddb,read,getalbumart,encode,tag,move,playlist,clean

	OUTPUTTYPE="flac,mp3"

	# We do it in a Docker container
	docker run -it --name svn_build debian:jessie

	# Set HTTP proxy if required
	export http{,s}_proxy=http://proxy_host:proxy_port

	# Install all the dependencies
	apt-get update
	apt-get install curl bzip2 gcc autoconf libtool make python

	# SSH to GitHub appliance and go to your working directory where you do migrations

	# Type your Subversion username + Enter
	read SVN_USER
	# type your Subversion password + Enter
	read SVN_PASSWORD
	# type your GitHub username + Enter
	read GIT_USER
	# type your GitHub Personal Access Token + Enter
	read GIT_TOKEN

	// Explict call parameters
	def containerBuildAndPublish1(image, tag, dockerRegistry, dockerRegistryCredsId) {
	//IMPLEMENTATION USAGE EXAMPLE
	println "Building ${image}:${tag} and publishing to ${dockerRegistry} using creds ${dockerRegistryCredsId}"
	}

	// PIPELINE USAGE EXAMPLE: Explict call parameters
	containerBuildAndPublish1('myimage', 'latest', 'my.docker.registry:1234', 'jenkins-docker')
	containerBuildAndPublish1 'myimage', 'latest', 'my.docker.registry:1234', 'jenkins-docker'

	const cookieSecret = process.env.COOKIE_SECRET \|\| 'secret'
	const cookieName = process.env.COOKIE_NAME \|\| 'GitHubAuthenticated'
	const githubHost = process.env.GHE_HOST \|\| 'https://github.com'
	const githubApiUrl = process.env.GHE_API_URL \|\| 'https://api.github.com'
	const clientId = process.env.CLIENT_ID
	const clientSecret = process.env.CLIENT_SECRET
	const userAgent = 'My-App'

	const express = require('express')
	const app = express()

	const express = require('express')
	const proxy = require('http-proxy-middleware')

	const app = express()

	app.use('/xxx', proxy('/xxx', {
	target: 'http://localhost:8443',
	changeOrigin: true,
	ws: true,
	pathRewrite: {