| Name |
Description |
- Auto-rotation |
+ Auto-Rotation |
+ Smart Proxy |
Onion Service |
Group |
Actions |
@@ -215,6 +227,7 @@
{{ origin.description }} |
{% if origin.auto_rotation %}✅{% else %}❌{% endif %} |
+ {% if origin.smart %}✅{% else %}❌{% endif %} |
{% if origin.onion() %}✅{% else %}❌{% endif %} |
{{ origin.group.group_name }}
@@ -257,9 +270,9 @@
| {{ origin.description }} |
{% if origin.onion() %}
- ⎋
- {{ origin.onion() }}.onion
+ {{ origin.onion() }}
{% endif %}
|
diff --git a/app/terraform/__init__.py b/app/terraform/__init__.py
index fcbb947..37567c8 100644
--- a/app/terraform/__init__.py
+++ b/app/terraform/__init__.py
@@ -1,6 +1,8 @@
from abc import ABCMeta, abstractmethod
import os
-from typing import Tuple, Optional
+from typing import Tuple, Optional, Any
+
+import jinja2
from app import app
@@ -34,3 +36,16 @@ class BaseAutomation(metaclass=ABCMeta):
self.short_name or self.__class__.__name__.lower(),
filename or ""
)
+
+ def tmpl_write(self, filename: str, template: str, **kwargs: Any) -> None:
+ """
+ Write a Jinja2 template to the working directory for use by an automation module.
+
+ :param filename: filename to write to
+ :param template: Jinja2 template
+ :param kwargs: variables for use with the template
+ :return: None
+ """
+ tmpl = jinja2.Template(template)
+ with open(self.working_directory(filename), 'w') as tf:
+ tf.write(tmpl.render(**kwargs))
diff --git a/app/terraform/proxy/__init__.py b/app/terraform/proxy/__init__.py
index 63abc77..9c95d92 100644
--- a/app/terraform/proxy/__init__.py
+++ b/app/terraform/proxy/__init__.py
@@ -12,10 +12,32 @@ from tldextract import tldextract
from app import app
from app.extensions import db
from app.models.base import Group
-from app.models.mirrors import Proxy
+from app.models.mirrors import Proxy, Origin, SmartProxy
from app.terraform.terraform import TerraformAutomation
+def update_smart_proxy_instance(group_id: int,
+ provider: str,
+ region: str,
+ instance_id: str) -> None:
+ print("SMART PROXY")
+ instance = SmartProxy.query.filter(
+ SmartProxy.group_id == group_id,
+ SmartProxy.region == region,
+ SmartProxy.provider == provider,
+ SmartProxy.destroyed.is_(None)
+ ).first()
+ if instance is None:
+ instance = SmartProxy()
+ instance.added = datetime.datetime.utcnow()
+ instance.group_id = group_id
+ instance.provider = provider
+ instance.region = region
+ db.session.add(instance)
+ instance.updated = datetime.datetime.utcnow()
+ instance.instance_id = instance_id
+
+
class ProxyAutomation(TerraformAutomation):
subgroup_max = math.inf
"""
@@ -35,6 +57,11 @@ class ProxyAutomation(TerraformAutomation):
in the templating of the Terraform configuration.
"""
+ smart_proxies = False
+ """
+ Whether this provider supports "smart" proxies.
+ """
+
def get_subgroups(self) -> Dict[int, Dict[int, int]]:
conn = db.engine.connect()
result = conn.execute(text("""
@@ -118,18 +145,40 @@ class ProxyAutomation(TerraformAutomation):
self.import_state(self.tf_show())
def tf_generate(self) -> None:
+ groups = Group.query.all()
self.tf_write(
self.template,
- groups=Group.query.all(),
+ groups=groups,
proxies=Proxy.query.filter(
- Proxy.provider == self.provider,
- Proxy.destroyed.is_(None)
- ).all(),
- subgroups=self.get_subgroups(),
- global_namespace=app.config['GLOBAL_NAMESPACE'],
- bypass_token=app.config['BYPASS_TOKEN'],
- **{
- k: app.config[k.upper()]
- for k in self.template_parameters
- }
- )
+ Proxy.provider == self.provider, Proxy.destroyed.is_(None)).all(), subgroups=self.get_subgroups(),
+ global_namespace=app.config['GLOBAL_NAMESPACE'], bypass_token=app.config['BYPASS_TOKEN'],
+ **{k: app.config[k.upper()] for k in self.template_parameters})
+ if self.smart_proxies:
+ for group in groups:
+ self.sp_config(group)
+
+ def sp_config(self, group: Group) -> None:
+ group_origins: List[Origin] = Origin.query.filter(
+ Origin.group_id == group.id,
+ Origin.destroyed.is_(None),
+ Origin.smart.is_(True)
+ ).all()
+ self.tmpl_write(f"smart_proxy.{group.id}.conf", """
+ {% for origin in origins %}
+ server {
+ listen 443 ssl;
+ server_name origin-{{ origin.id }}.{{ provider }}.smart.censorship.guide;
+ location / {
+ proxy_set_header Accept-Encoding "";
+ proxy_ssl_server_name on;
+ proxy_pass https://{{ origin.domain_name }}/;
+ subs_filter_types text/html text/css text/xml;
+ subs_filter https://{{ origin.domain_name }}/ /;
+ }
+ ssl_certificate /etc/ssl/smart_proxy.crt;
+ ssl_certificate_key /etc/ssl/private/smart_proxy.key;
+ }
+ {% endfor %}
+ """,
+ provider=self.provider,
+ origins=group_origins)
diff --git a/app/terraform/proxy/cloudfront.py b/app/terraform/proxy/cloudfront.py
index a6af756..ecd1f47 100644
--- a/app/terraform/proxy/cloudfront.py
+++ b/app/terraform/proxy/cloudfront.py
@@ -3,34 +3,66 @@ from typing import Any
from app.extensions import db
from app.models.mirrors import Proxy
-from app.terraform.proxy import ProxyAutomation
+from app.terraform.proxy import ProxyAutomation, update_smart_proxy_instance
class ProxyCloudfrontAutomation(ProxyAutomation):
short_name = "proxy_cloudfront"
description = "Deploy proxies to AWS CloudFront"
provider = "cloudfront"
+ smart_proxies = True
template_parameters = [
"aws_access_key",
- "aws_secret_key"
+ "aws_secret_key",
+ "rfc2136_nameserver",
+ "rfc2136_tsig_key",
+ "rfc2136_tsig_secret",
+ "smart_zone"
]
template = """
terraform {
required_providers {
+ acme = {
+ source = "vancluever/acme"
+ version = "~> 2.8.0"
+ }
aws = {
version = "~> 4.4.0"
}
+ dns = {
+ version = "~> 3.2.3"
+ }
}
}
+ provider "acme" {
+ server_url = "https://acme-v02.api.letsencrypt.org/directory"
+ }
+
provider "aws" {
access_key = "{{ aws_access_key }}"
secret_key = "{{ aws_secret_key }}"
region = "us-east-2"
}
+ provider "dns" {
+ update {
+ server = local.rfc2136_nameserver
+ key_name = local.rfc2136_tsig_key
+ key_secret = local.rfc2136_tsig_secret
+ key_algorithm = "hmac-sha512"
+ }
+ }
+
+ locals {
+ rfc2136_nameserver = "{{ rfc2136_nameserver }}"
+ rfc2136_tsig_key = "{{ rfc2136_tsig_key }}"
+ rfc2136_tsig_secret = "{{ rfc2136_tsig_secret }}"
+ smart_zone = "{{ smart_zone }}"
+ }
+
{% for group in groups %}
module "label_{{ group.id }}" {
source = "cloudposse/label/null"
@@ -55,13 +87,47 @@ class ProxyCloudfrontAutomation(ProxyAutomation):
resource "aws_sns_topic" "alarms_{{ group.id }}" {
name = "${module.label_{{ group.id }}.id}-cloudfront-alarms"
}
+
+ {% for origin in group.origins | selectattr("destroyed", "none") | selectattr("smart") %}
+ {% if loop.first %}
+ module "smart_proxy_{{ group.id }}" {
+ source = "sr2c/bc-smart-proxy-instance/aws"
+ version = "0.0.1"
+ context = module.label_{{ group.id }}.context
+ name = "smart-proxy"
+ disable_api_termination = false
+ domain_name = "cloudfront.smart.${local.smart_zone}"
+ rfc2136_nameserver = local.rfc2136_nameserver
+ rfc2136_tsig_key = local.rfc2136_tsig_key
+ rfc2136_tsig_secret = local.rfc2136_tsig_secret
+ }
+
+ resource "aws_s3_object" "smart_config_{{ group.id }}" {
+ bucket = module.smart_proxy_{{ group.id }}.config_bucket_name
+ key = "default"
+ source = "smart_proxy.{{ group.id }}.conf"
+ etag = filemd5("smart_proxy.{{ group.id }}.conf")
+ }
+ {% endif %}
+
+ resource "dns_a_record_set" "smart_dns_{{ origin.id }}" {
+ zone = "{{ smart_zone }}"
+ name = "origin-{{ origin.id }}.cloudfront.smart"
+ addresses = module.smart_proxy_{{ origin.group.id }}.ip_addresses
+ ttl = 60
+ }
+ {% endfor %}
{% endfor %}
{% for proxy in proxies %}
module "cloudfront_{{ proxy.id }}" {
source = "sr2c/bc-proxy/aws"
version = "0.0.7"
+ {% if proxy.origin.smart %}
+ origin_domain = "origin-{{ proxy.origin.id }}.cloudfront.smart.{{ smart_zone[:-1] }}"
+ {% else %}
origin_domain = "{{ proxy.origin.domain_name }}"
+ {% endif %}
logging_bucket = module.log_bucket_{{ proxy.origin.group.id }}.bucket_domain_name
sns_topic_arn = aws_sns_topic.alarms_{{ proxy.origin.group.id }}.arn
low_bandwidth_alarm = false
@@ -88,4 +154,12 @@ class ProxyCloudfrontAutomation(ProxyAutomation):
proxy.slug = res['values']['id']
proxy.terraform_updated = datetime.datetime.utcnow()
break
+ for g in state["values"]["root_module"]["child_modules"]:
+ if g["address"].startswith("module.smart_proxy_"):
+ group_id = int(g["address"][len("module.smart_proxy_"):])
+ for s in g["child_modules"]:
+ if s["address"].endswith(".module.instance"):
+ for x in s["resources"]:
+ if x["address"].endswith(".module.instance.aws_instance.default[0]"):
+ update_smart_proxy_instance(group_id, self.provider, "us-east-2", x['values']['id'])
db.session.commit()
diff --git a/app/terraform/terraform.py b/app/terraform/terraform.py
index e58bbfb..feda6c0 100644
--- a/app/terraform/terraform.py
+++ b/app/terraform/terraform.py
@@ -3,8 +3,6 @@ import subprocess # nosec
from abc import abstractmethod
from typing import Any, Optional, Tuple
-import jinja2
-
from app.terraform import BaseAutomation
@@ -151,6 +149,4 @@ class TerraformAutomation(BaseAutomation):
return json.loads(terraform.stdout)
def tf_write(self, template: str, **kwargs: Any) -> None:
- tmpl = jinja2.Template(template)
- with open(self.working_directory("main.tf"), 'w') as tf:
- tf.write(tmpl.render(**kwargs))
+ self.tmpl_write("main.tf", template, **kwargs)
diff --git a/migrations/versions/133961a48525_add_smart_proxies.py b/migrations/versions/133961a48525_add_smart_proxies.py
new file mode 100644
index 0000000..b9c1abd
--- /dev/null
+++ b/migrations/versions/133961a48525_add_smart_proxies.py
@@ -0,0 +1,50 @@
+"""add smart proxies
+
+Revision ID: 133961a48525
+Revises: 31aec2f86c40
+Create Date: 2022-05-24 14:56:43.071054
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = '133961a48525'
+down_revision = '31aec2f86c40'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ op.create_table('smart_proxy',
+ sa.Column('id', sa.Integer(), nullable=False),
+ sa.Column('added', sa.DateTime(), nullable=False),
+ sa.Column('updated', sa.DateTime(), nullable=False),
+ sa.Column('deprecated', sa.DateTime(), nullable=True),
+ sa.Column('deprecation_reason', sa.String(), nullable=True),
+ sa.Column('destroyed', sa.DateTime(), nullable=True),
+ sa.Column('group_id', sa.Integer(), nullable=False),
+ sa.Column('instance_id', sa.String(length=100), nullable=True),
+ sa.Column('provider', sa.String(length=20), nullable=False),
+ sa.Column('region', sa.String(length=20), nullable=False),
+ sa.ForeignKeyConstraint(['group_id'], ['group.id'], name=op.f('fk_smart_proxy_group_id_group')),
+ sa.PrimaryKeyConstraint('id', name=op.f('pk_smart_proxy'))
+ )
+ with op.batch_alter_table('origin', schema=None) as batch_op:
+ batch_op.add_column(sa.Column('smart', sa.Boolean(), nullable=True))
+ with op.batch_alter_table('origin', schema=None) as batch_op:
+ batch_op.execute("UPDATE origin SET smart=FALSE")
+ batch_op.alter_column(sa.Column('smart', sa.Boolean(), nullable=False))
+
+ # ### end Alembic commands ###
+
+
+def downgrade():
+ # ### commands auto generated by Alembic - please adjust! ###
+ with op.batch_alter_table('origin', schema=None) as batch_op:
+ batch_op.drop_column('smart')
+
+ op.drop_table('smart_proxy')
+ # ### end Alembic commands ###
|