bridgehead/README.md

262 lines
13 KiB
Markdown
Raw Normal View History

# Bridgehead
2022-03-23 11:54:23 +01:00
2022-11-18 19:02:13 +01:00
The Bridgehead is a secure, low-effort solution to connect your research institution to a federated research network. It bundles interoperable, open-source software components into a turnkey package for installation on one of your secure servers. The Bridgehead is pre-configured with sane defaults, centrally monitored and with an absolute minimum of "moving parts" on your side, making it an extremely low-maintenance gateway to data sharing.
2022-11-18 19:02:13 +01:00
This repository is the starting point for any information and tools you will need to deploy a Bridgehead. If you have questions, please [contact us](mailto:verbis-support@dkfz-heidelberg.de).
2022-03-23 11:54:23 +01:00
1. [Requirements](#requirements)
- [Hardware](#hardware)
- [System](#system)
- [Git](#git)
- [Docker](#docker)
2. [Deployment](#deployment)
- [Installation](#installation)
2022-11-18 19:02:13 +01:00
- [Register with Samply.Beam](#register-with-samplybeam)
- [Starting and stopping your Bridgehead](#starting-and-stopping-your-bridgehead)
- [Auto-starting your Bridgehead when the server starts](#auto-starting-your-bridgehead-when-the-server-starts)
3. [Additional Services](#additional-Services)
- [Monitoring](#monitoring)
- [Register with a Directory](#register-with-a-Directory)
4. [Site-specific configuration](#site-specific-configuration)
- [HTTPS Access](#https-access)
- [Locally Managed Secrets](#locally-managed-secrets)
- [Git Proxy Configuration](#git-proxy-configuration)
- [Docker Daemon Proxy Configuration](#docker-daemon-proxy-configuration)
- [Non-Linux OS](#non-linux-os)
5. [License](#license)
2022-03-23 11:54:23 +01:00
## Requirements
2022-03-23 11:54:23 +01:00
### Hardware
2022-11-18 19:02:13 +01:00
Hardware requirements strongly depend on the specific use-cases of your network as well as on the data it is going to serve. Most use-cases are well-served with the following configuration:
2022-03-23 11:54:23 +01:00
- 4 CPU cores
2022-11-18 19:02:13 +01:00
- 32 GB RAM
- 160GB Hard Drive, SSD recommended
2022-03-23 11:54:23 +01:00
2022-11-18 19:02:13 +01:00
### Software
2021-12-27 11:16:27 +01:00
2022-11-18 19:02:13 +01:00
You are strongly recommended to install the Bridgehead under a Linux operating system (but see the section [Non-Linux OS](#non-linux-os)). You will need root (administrator) priveleges on this machine in order to perform the deployment. We recommend the newest Ubuntu LTS server release.
2022-11-18 19:02:13 +01:00
Ensure the following software (or newer) is installed:
2022-11-18 19:02:13 +01:00
- git >= 2.0
- docker >= 20.10.1
- docker-compose >= 2.xx (`docker-compose` and `docker compose` are both supported).
- systemd
2022-03-23 11:54:23 +01:00
2022-11-21 18:13:40 +01:00
We recommend to install Docker(-compose) from its official sources as described on the [Docker website](https://docs.docker.com).
Note for Ubuntu: Please note that snap versions of Docker are not supported.
2022-05-12 13:00:08 +02:00
### Network
Since it needs to carry sensitive patient data, Bridgeheads are intended to be deployed within your institution's secure network and behave well even in networks in strict security settings, e.g. firewall rules. The only connectivity required is an outgoing HTTPS proxy. TLS termination is supported, too (see [below](#tls-terminating-proxies))
2022-11-21 18:13:40 +01:00
Note for Ubuntu: Please note that the uncomplicated firewall (ufw) is known to conflict with Docker [here](https://github.com/chaifeng/ufw-docker).
## Deployment
### Site name
You will need to choose a short name for your site. This is not a URL, just a simple identifying string. For the examples below, we will use "your-site-name", but you should obviously choose something that is meaningful to you and which is unique.
2023-01-19 11:22:48 +01:00
Site names should adhere to the following conventions:
- They should be lower-case.
- They should generally be named after the city where your site is based, e.g. ```karlsruhe```.
- If you have a multi-part name, please use a hypen ("-") as separator, e.g. ```le-havre```.
- If your site is for testing purposes, rather than production, please prepend with "test-", e.g. ```test-zaragoza```.
- If you are a developer and you are making changes to the Bridgehead, please use your name and prepend with "dev-", e.g. ```dev-joe-doe```.
### Projects
The following "projects" are known to the Bridgehead installation:
- bbmri
- ccp
Use "bbmri" if you are in the BBMRI-ERIC European biobank network or the GBA (German Biobank Alliance) network.
Use "ccp" if you are in the DKTK network, the C4 network or the nNGM network.
### GitLab repository
In order to be able to install, you will need to have your own repository in GitLab for your site's configuration settings. This allows automated updates of the Bridgehead software.
To request a new repository, please send an email to bridgehead@helpdesk.bbmri-eric.eu. Mention which project you belong to, i.e. "bbmri" or "ccp", plus your chosen site name.
We will set the repository up for you. We will then send you the repository's URL plus a token to access it.
Before installation, you must set up your site's configuration in GitLab.
To do this, visit the configuration repository's URL and click on the configuration file. Depending on your project, this will be called either ```bbmri.conf```or ```ccp.conf```. Use the blue button to edit it. You will need to change, as a minimum, the following variables:
- SITE_NAME
- SITE_ID
- OPERATOR_FIRST_NAME
- OPERATOR_LAST_NAME
- OPERATOR_EMAIL
- OPERATOR_PHONE
SITE_NAME and SITE_ID can be set to the chosen name for your site, e.g. "your-site-name". OPERATOR_* should be set to values appropriate for the administrator of your site.
2022-03-23 11:54:23 +01:00
2023-01-23 14:49:03 +01:00
Once you have made your changes, these will need to be reviewed by members of our team before you can proceed with the installation.
2022-11-18 19:02:13 +01:00
### Base Installation
2022-05-09 12:57:24 +02:00
First, get the Bridgehead:
2022-10-26 16:34:47 +02:00
```shell
2022-11-18 19:02:13 +01:00
sudo mkdir -p /srv/docker/
sudo git clone https://github.com/samply/bridgehead.git /srv/docker/bridgehead
2022-10-26 16:34:47 +02:00
```
2022-11-18 19:02:13 +01:00
Then, run the installation script:
```shell
2022-11-18 19:02:13 +01:00
cd /srv/docker/bridgehead
sudo ./bridgehead install <PROJECT>
```
2022-05-12 13:00:08 +02:00
When prompted with "Please enter your site", you should enter the name you have given to your site (not its URL). E.g., in the example in the previous section, that would be "your-site-name".
When prompted with "Please enter the bridgehead's access token for your site configuration repository", you should enter the token for the GitLab repository that was given to you.
You should then be prompted to do the next step:
2022-11-18 19:02:13 +01:00
### Register with Samply.Beam
2022-11-18 19:02:13 +01:00
Many Bridgehead services rely on the secure, performant and flexible messaging middleware called [Samply.Beam](https://github.com/samply/beam). You will need to register ("enroll") with Samply.Beam by creating a cryptographic key pair for your bridgehead:
``` shell
2022-11-18 19:02:13 +01:00
cd /srv/docker/bridgehead
sudo ./bridgehead enroll <PROJECT>
```
2022-11-18 19:02:13 +01:00
... and follow the instructions on the screen. You should then be prompted to do the next step:
2022-05-12 13:00:08 +02:00
2022-11-18 19:02:13 +01:00
### Starting and stopping your Bridgehead
2022-03-01 17:24:53 +01:00
2022-11-18 19:02:13 +01:00
If you followed the above steps, your Bridgehead should already be configured to autostart (via systemd). If you would like to start/stop manually:
2022-11-18 19:02:13 +01:00
To start, run
2022-05-05 15:03:06 +02:00
2022-11-18 19:02:13 +01:00
```shell
sudo systemctl start bridgehead@<PROJECT>.service
```
2021-12-27 11:16:27 +01:00
2022-11-18 19:02:13 +01:00
To stop, run
2022-11-18 19:02:13 +01:00
```shell
sudo systemctl stop bridgehead@<PROJECT>.service
```
2022-05-12 13:00:08 +02:00
2022-11-18 19:02:13 +01:00
To enable/disable autostart, run
2022-11-18 19:02:13 +01:00
```shell
sudo systemctl [enable|disable] bridgehead@<PROJECT>.service
```
### De-installing a Bridgehead
You may decide that you want to remove a Bridgehead installation from your machine, e.g. if you want to migrate it to a new location or if you want to start a fresh installation because the initial attempts did not work.
The following steps will remove all traces of the Bridgehead from your machine. All locally stored data pertaining to the Bridgehead will be lost.
First, purge the Bridgehead from ```systemctl```:
```shell
sudo systemctl stop bridgehead@bbmri.service
sudo systemctl disable bridgehead@bbmri.service
sudo systemctl daemon-reload
sudo systemctl reset-failed
```
Now remove the directories where the Bridgehead files reside:
```shell
sudo rm -rf /srv/docker/bridgehead /etc/bridgehead
```
Finally, get rid of the Docker images:
```shell
docker image rm traefik:latest samply/beam-proxy:develop samply/blaze:0.18 samply/bridgehead-forward-proxy:latest samply/bridgehead-landingpage:master samply/spot:latest
```
Note that you will still have a functioning Beam certificate and a functioning GitLab configuration repository, even after you have removed everything locally.
## Site-specific configuration
2022-05-12 13:00:08 +02:00
2022-05-05 15:03:06 +02:00
### HTTPS Access
2022-11-18 19:02:13 +01:00
Even within your internal network, the Bridgehead enforces HTTPS for all services. During the installation, a self-signed, long-lived certificate was created for you. To increase security, you can simply replace the files under `/etc/bridgehead/traefik-tls` with ones from established certification authorities such as [Let's Encrypt](https://letsencrypt.org) or [DFN-AAI](https://www.aai.dfn.de).
### TLS terminating proxies
All of the Bridgehead's outgoing connections are secured by transport encryption (TLS) and a Bridgehead will refuse to connect if certificate verification fails. If your local forward proxy server performs TLS termination, please place its CA certificate in `/etc/bridgehead/trusted-ca-certs` as a `.pem` file, e.g. `/etc/bridgehead/trusted-ca-certs/mylocalca.pem`. Then, all Bridgehead components will pick up this certificate and trust it for outgoing connections.
### File structure
- `/srv/docker/bridgehead` contains this git repository with the shell scripts and *project-specific configuration*. In here, all files are identical for all sites. You should not make any changes here.
- `/etc/bridgehead` contains your *site-specific configuration* synchronized from your site-specific git repository as part of the [base installation](#base-installation). To change anything here, please consult your git repository (find out its URL via `git -C /etc/bridgehead remote -v`).
- `/etc/bridgehead/<PROJECT>.conf` is your main site-specific configuration, all bundled into one concise config file. Do not change it here but via the central git repository.
- `/etc/bridgehead/<PROJECT>.local.conf` contains site-specific parameters to be known to your Bridgehead only, e.g. local access credentials. The file is ignored via git, and you may edit it here via a text editor.
- `/etc/bridgehead/traefik-tls` contains your Bridgehead's reverse proxies TLS certificates for [HTTPS access](#https-access).
- `/etc/bridgehead/pki` contains your Bridgehead's private key (e.g., but not limited to Samply.Beam), generated as part of the [Samply.Beam enrollment](#register-with-samplybeam).
- `/etc/bridgehead/trusted-ca-certs` contains third-party certificates to be trusted by the Bridgehead. For example, you want to place the certificates of your [TLS-terminating proxy](#network) here.
Your Bridgehead's actual data is not stored in the above directories, but in named docker volumes, see `docker volume ls` and `docker volume inspect <volume_name>`.
## Things you should know
### Auto-Updates
Your Bridgehead will automatically and regularly check for updates. Whenever something has been updates (e.g., one of the git repositories or one of the docker images), your Bridgehead is automatically restarted. This should happen automatically and does not need any configuration.
If you would like to understand what happens exactly and when, please check the systemd units deployed during the [installation](#base-installation) via `systemctl cat bridgehead-update@<PROJECT>.service` and `systemctl cat bridgehead-update@<PROJECT.timer`.
### Monitoring
To keep all Bridgeheads up and working and detect any errors before a user does, a central monitoring
- Your Bridgehead itself will report relevant system events, such as successful/failed updates, restarts, performance metrics or version numbers.
- Your Bridgehead is also monitored from the outside by your network's central components. For example, the federated search will regularly perform a black-box test by sending an empty query to your Bridgehead and checking if the results make sense.
In all monitoring cases, obviously no sensitive information is transmitted, in particular not any patient-related data. Aggregated data, e.g. total amount of datasets, may be transmitted for diagnostic purposes.
2022-11-18 19:02:13 +01:00
## Troubleshooting
### Docker Daemon Proxy Configuration
2022-03-23 11:54:23 +01:00
2022-11-18 19:02:13 +01:00
Docker has a background daemon, responsible for downloading images and starting them. Sometimes, proxy configuration from your system won't carry over and it will fail to download images. In that case, configure the proxy for this daemon as described in the [official documentation](https://docs.docker.com).
2022-03-23 11:54:23 +01:00
### Non-Linux OS
2022-03-23 11:54:23 +01:00
The installation procedures described above have only been tested under Linux.
2022-03-23 11:54:23 +01:00
Below are some suggestions for getting the installation to work on other operating systems. Note that we are not able to provide support for these routes!
2022-03-23 11:54:23 +01:00
We believe that it is likely that installation would also work with FreeBSD and MacOS.
2022-03-23 11:54:23 +01:00
Under Windows, you have 2 options:
2022-03-23 11:54:23 +01:00
- Virtual machine
- WSL
2022-03-23 11:54:23 +01:00
We have tested the installation procedure with an Ubuntu 22.04 guest system running on a VMware virtual machine. That worked flawlessly.
2022-03-23 11:54:23 +01:00
Installation under WSL ought to work, but we have not tested this.
2022-03-23 11:54:23 +01:00
## License
Copyright 2019 - 2022 The Samply Community
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.