docker-compose.yml

# SPDX-License-Identifier: Apache-2.0
# Copyright (c) 2022-2023 Dell Inc, or its subsidiaries.
---
version: '3.7'

services:

  bootstrap:
    image: docker.io/opiproject/sztpd:0.0.15
    depends_on:
      setup-cert:
        condition: service_completed_successfully
    volumes:
      - server-certs:/certs
      - ./images:/media
      - ./config:/mnt
      - ./scripts/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    environment:
      SZTPD_INIT_PORT: 6080
      SZTPD_NBI_PORT: 7080
      SZTPD_SBI_PORT: 9090
      SZTPD_INIT_MODE: 1
      SZTPD_ACCEPT_CONTRACT: "Yes"
      SZTPD_INIT_ADDR: 0.0.0.0
      SZTPD_OPI_MODE: "running"
      SZTPD_RETRY_ATTEMPTS: 30
    ports:
      - 7080:7080
      - 9090:9090
    networks:
      - opi
    healthcheck:
      test: ["CMD-SHELL", "curl --fail -H Accept:application/yang-data+json http://127.0.0.1:$$SZTPD_NBI_PORT/.well-known/host-meta || exit 1"]

  redirecter:
    image: docker.io/opiproject/sztpd:0.0.15
    depends_on:
      setup-cert:
        condition: service_completed_successfully
    volumes:
      - server-certs:/certs
      - ./config/sztpd.redirect.json.template:/mnt/sztpd.redirect.json.template
      - ./scripts/docker-entrypoint.sh:/usr/local/bin/docker-entrypoint.sh
    entrypoint: /usr/local/bin/docker-entrypoint.sh
    environment:
      SZTPD_INIT_PORT: 6080
      SZTPD_NBI_PORT: 7070
      SZTPD_SBI_PORT: 8080
      SZTPD_INIT_MODE: 1
      SZTPD_ACCEPT_CONTRACT: "Yes"
      SZTPD_INIT_ADDR: 0.0.0.0
      BOOTSVR_PORT: 9090
      BOOTSVR_ADDR: "bootstrap"
      SZTPD_OPI_MODE: "redirect"
      SZTPD_RETRY_ATTEMPTS: 30
    ports:
      - 8080:8080
    networks:
      - opi
    healthcheck:
      test: ["CMD-SHELL", "curl --fail -H Accept:application/yang-data+json http://127.0.0.1:$$SZTPD_NBI_PORT/.well-known/host-meta || exit 1"]

  dhcp:
    image: docker.io/networkboot/dhcpd:1.3.0
    environment:
      NODE_IP_SUBNET: 10.127.127.0
      NODE_IP_NETMASK: 255.255.255.0
      NODE_IP_RANGE_MIN: 10.127.127.100
      NODE_IP_RANGE_MAX: 10.127.127.253
      NODE_IP_ADDRESS: 10.127.127.3
    volumes:
      - ./dhcp:/opt
    cap_add:
      - CAP_NET_BIND_SERVICE
      - CAP_NET_RAW
    ports:
      - 67:67/udp
    networks:
      - opi
    command: sh -e -u -x -c 'touch /var/lib/dhcp/dhcpd.leases && eval "echo \"$$(cat /opt/dhcpd.conf.template)\"" > /etc/dhcp/dhcpd.conf && dhcpd -d'

  nmap:
    image: docker.io/instrumentisto/nmap:7.94
    networks:
      - opi
    command: --script broadcast-dhcp-discover

  nmapmdnsclient:
    image: docker.io/instrumentisto/nmap:7.94
    networks:
      - opi
    command: --script=dns-service-discovery -p 5353 avahi

  setup-cert:
    image: docker.io/alpine/openssl:3.3.1
    volumes:
      - server-certs:/certs/server
      - client-certs:/certs/client
    user: "0"
    entrypoint: /bin/ash
    command: >
      -c '
        set -euxo pipefail
        env
        apk add --no-cache --no-check-certificate curl make && rm -rf /var/cache/apk/*
        rm -rf /tmp/sztpd-simulator
        curl -kL https://watsen.net/support/sztpd-simulator-0.0.11.tgz | tar -zxvf - -C /tmp/
        cd /tmp/sztpd-simulator/pki
        echo === SERVER SBI certificates ===
        echo "DNS.2 = bootstrap" >> sztpd1/sbi/end-entity/openssl.cnf
        echo "DNS.3 = web" >> sztpd1/sbi/end-entity/openssl.cnf
        echo "DNS.4 = redirecter" >> sztpd1/sbi/end-entity/openssl.cnf
        make -C sztpd1/sbi pki SHELL=/bin/ash
        cat sztpd1/sbi/end-entity/my_cert.pem sztpd1/sbi/intermediate2/my_cert.pem > /tmp/cert_chain.pem
        openssl crl2pkcs7 -nocrl -certfile /tmp/cert_chain.pem -outform DER -out /tmp/cert_chain.cms
        echo === CLIENT cert DevID trust anchor ===
        make -C client pki SHELL=/bin/ash
        cat client/root-ca/my_cert.pem client/intermediate1/my_cert.pem client/intermediate2/my_cert.pem > /tmp/ta_cert_chain.pem
        openssl crl2pkcs7 -nocrl -certfile /tmp/ta_cert_chain.pem -outform DER -out /tmp/ta_cert_chain.cms
        echo === COPY TO FINAL DESTINATION ===
        cat sztpd1/sbi/root-ca/my_cert.pem sztpd1/sbi/intermediate1/my_cert.pem > /certs/client/opi.pem
        cp sztpd1/sbi/end-entity/private_key.der \
          sztpd1/sbi/end-entity/private_key.pem \
          sztpd1/sbi/end-entity/public_key.der \
          sztpd1/sbi/end-entity/my_cert.pem \
          /tmp/cert_chain.cms \
          /tmp/cert_chain.pem \
          /tmp/ta_cert_chain.cms \
          /tmp/ta_cert_chain.pem \
          /certs/server/
        echo === Generate Clients Endponts ===
        for vendor in first second third; do
            sed -i "s/my-serial-number/$${vendor}-serial-number/g" client/end-entity/openssl.cnf
            make -C client/end-entity    cert_request      OPENSSL=openssl SHELL=/bin/ash
            make -C client/intermediate2 sign_cert_request OPENSSL=openssl SHELL=/bin/ash REQDIR="../end-entity"
            cp client/end-entity/private_key.pem /certs/client/$${vendor}_private_key.pem
            cp client/end-entity/my_cert.pem /certs/client/$${vendor}_my_cert.pem
            sed -i "s/$${vendor}-serial-number/my-serial-number/g" client/end-entity/openssl.cnf
        done
      '

  web:
    image: docker.io/library/httpd:2.4.57-alpine3.17
    depends_on:
      setup-cert:
        condition: service_completed_successfully
    volumes:
      - server-certs:/certs
      - ./images:/usr/local/apache2/htdocs
    ports:
      - 443:443
    networks:
      - opi
    entrypoint: /bin/ash
    command: |
        -x -e -c '
        sed -i \
        -e "s/^#\(Include .*httpd-ssl.conf\)/\1/" \
        -e "s/^#\(LoadModule .*mod_ssl.so\)/\1/" \
        -e "s/^#\(LoadModule .*mod_socache_shmcb.so\)/\1/" \
        conf/httpd.conf
        sed -i \
        -e "s/^#\(SSLVerifyClient .*require\)/\1/" \
        -e "s/^#\(SSLVerifyDepth .*\)/\1/" \
        -e "s/^#\(SSLCACertificateFile .*\)/\1/" \
        conf/extra/httpd-ssl.conf
        cp /certs/my_cert.pem conf/server.crt
        cp /certs/private_key.pem conf/server.key
        mkdir -p /usr/local/apache2/conf/ssl.crt/
        cp /certs/ta_cert_chain.pem /usr/local/apache2/conf/ssl.crt/ca-bundle.crt
        httpd-foreground
        '

  client:
    image: docker.io/modularitycontainers/dhcp-client:latest
    cap_add:
      - CAP_NET_RAW
    volumes:
      - dhcp-leases-folder:/var/lib/dhclient/
      - ./dhcp/dhclient.conf:/etc/dhcp/dhclient.conf
    networks:
      - opi
    command: dhclient -d -v

  agent3: &agent
    image: ghcr.io/opiproject/opi-sztp-client:main
    build:
      context: sztp-agent
    depends_on:
      bootstrap:
        condition: service_healthy
      redirecter:
        condition: service_healthy
      setup-cert:
        condition: service_completed_successfully
    volumes:
      - client-certs:/certs
      - dhcp-leases-folder:/var/lib/dhclient/
      - /etc/os-release:/etc/os-release
      - /etc/ssh:/etc/ssh
    networks:
      - opi
    command: ['/opi-sztp-agent', 'daemon',
              '--dhcp-lease-file', '/var/lib/dhclient/dhclient.leases',
              '--bootstrap-trust-anchor-cert', '/certs/opi.pem',
              '--device-end-entity-cert', '/certs/third_my_cert.pem',
              '--device-private-key', '/certs/third_private_key.pem',
              '--serial-number', 'third-serial-number']

  agent2:
    <<: *agent
    command: ['/opi-sztp-agent', 'daemon',
              '--dhcp-lease-file', '/var/lib/dhclient/dhclient.leases',
              '--bootstrap-trust-anchor-cert', '/certs/opi.pem',
              '--device-end-entity-cert', '/certs/second_my_cert.pem',
              '--device-private-key', '/certs/second_private_key.pem',
              '--serial-number', 'second-serial-number']

  agent1:
    <<: *agent
    command: ['/opi-sztp-agent', 'daemon',
              '--dhcp-lease-file', '/var/lib/dhclient/dhclient.leases',
              '--bootstrap-trust-anchor-cert', '/certs/opi.pem',
              '--device-end-entity-cert', '/certs/first_my_cert.pem',
              '--device-private-key', '/certs/first_private_key.pem',
              '--serial-number', 'first-serial-number']

  agent4:
    <<: *agent
    command: ['/opi-sztp-agent', 'daemon',
              '--bootstrap-url', 'https://redirecter:8080/restconf/operations/ietf-sztp-bootstrap-server:get-bootstrapping-data',
              '--bootstrap-trust-anchor-cert', '/certs/opi.pem',
              '--device-end-entity-cert', '/certs/first_my_cert.pem',
              '--device-private-key', '/certs/first_private_key.pem',
              '--serial-number', 'first-serial-number']

  agent5:
    <<: *agent
    command: ['/opi-sztp-agent', 'run',
              '--dhcp-lease-file', '/var/lib/dhclient/dhclient.leases',
              '--bootstrap-trust-anchor-cert', '/certs/opi.pem',
              '--device-end-entity-cert', '/certs/first_my_cert.pem',
              '--device-private-key', '/certs/first_private_key.pem',
              '--serial-number', 'first-serial-number']

  avahi:
    image: docker.io/flungo/avahi:latest
    environment:
      SERVER_HOST_NAME: "opi"
    networks:
      - opi

  swtpm:
    build:
      context: tpm
    volumes:
      - tpm-data:/swtpm
    networks:
      - opi
    command: ['socket', '--tpm2',
              '--server', 'type=unixio,path=/swtpm/swtpm.sock',
              '--ctrl', 'type=unixio,path=/swtpm/swtpm.sock.ctrl',
              '--tpmstate', 'dir=/swtpm',
              '--log', 'file=swtpm.log',
              '--log', 'level=20',
              '--flags', 'not-need-init,startup-clear']

  swtpm-test:
    image: docker.io/strongx509/tpm:5.9.13
    depends_on:
      - swtpm
    volumes:
      - tpm-data:/swtpm
    networks:
      - opi
    environment:
      TPM2TOOLS_TCTI: swtpm:path=/swtpm/swtpm.sock
    command: ['tpm2', 'clear']

volumes:
  tpm-data:
  server-certs:
  client-certs:
  dhcp-leases-folder:

networks:
  opi:
    ipam:
      config:
        - subnet: "10.127.127.0/24"
          gateway: "10.127.127.1"