add container_rabbitmq
This commit is contained in:
3
active/container_rabbitmq/compose/README.md
Normal file
3
active/container_rabbitmq/compose/README.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# Compose
|
||||
|
||||
Put your compose.yaml here.
|
||||
11
active/container_rabbitmq/compose/compose.yaml
Normal file
11
active/container_rabbitmq/compose/compose.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
services:
|
||||
rabbitmq:
|
||||
container_name: rabbitmq
|
||||
restart: always
|
||||
image: docker.io/rabbitmq:3-management
|
||||
ports:
|
||||
- 15672:15672
|
||||
- 5672:5672
|
||||
env_file: /home/rabbitmq/rabbitmq.env
|
||||
volumes:
|
||||
- /home/rabbitmq/data:/var/lib/rabbitmq
|
||||
2
active/container_rabbitmq/example.env
Normal file
2
active/container_rabbitmq/example.env
Normal file
@@ -0,0 +1,2 @@
|
||||
RABBITMQ_DEFAULT_USER=user
|
||||
RABBITMQ_DEFAULT_PASS=password
|
||||
196
active/container_rabbitmq/foobar.md
Normal file
196
active/container_rabbitmq/foobar.md
Normal file
@@ -0,0 +1,196 @@
|
||||
# Podman rabbitmq
|
||||
|
||||
- [Podman rabbitmq](#podman-rabbitmq)
|
||||
- [Setup rabbitmq Project](#setup-rabbitmq-project)
|
||||
- [Install rabbitmq](#install-rabbitmq)
|
||||
- [Create the rabbitmq user](#create-the-rabbitmq-user)
|
||||
- [Generate the rabbitmq tls certs](#generate-the-rabbitmq-tls-certs)
|
||||
- [Write the rabbitmq compose spec](#write-the-rabbitmq-compose-spec)
|
||||
- [A Note on Volumes](#a-note-on-volumes)
|
||||
- [Convert rabbitmq compose spec to quadlets](#convert-rabbitmq-compose-spec-to-quadlets)
|
||||
- [Create any container-mounted directories](#create-any-container-mounted-directories)
|
||||
- [Start and enable your systemd quadlet](#start-and-enable-your-systemd-quadlet)
|
||||
- [Alias rabbitmqctl](#alias-rabbitmqctl)
|
||||
- [Expose rabbitmq](#expose-rabbitmq)
|
||||
- [firewalld](#firewalld)
|
||||
- [Backup rabbitmq](#backup-rabbitmq)
|
||||
- [Upgrade rabbitmq](#upgrade-rabbitmq)
|
||||
- [Upgrade Quadlets](#upgrade-quadlets)
|
||||
- [Uninstall](#uninstall)
|
||||
- [Notes](#notes)
|
||||
- [SELinux](#selinux)
|
||||
|
||||
## Setup rabbitmq Project
|
||||
|
||||
- [x] Copy and rename this folder to active/container_rabbitmq
|
||||
- [x] Find and replace rabbitmq with the name of the service.
|
||||
- [ ] Create the rootless user to run the podman containers
|
||||
- [ ] Write the compose.yaml spec for your service
|
||||
- [ ] Convert the compose.yaml spec to a quadlet
|
||||
- [ ] Install the quadlet on the podman server
|
||||
- [ ] Expose the quadlet service
|
||||
- [ ] Install a backup service and timer
|
||||
|
||||
## Install rabbitmq
|
||||
|
||||
### Create the rabbitmq user
|
||||
|
||||
```bash
|
||||
# SSH into your podman server as root
|
||||
useradd rabbitmq
|
||||
loginctl enable-linger $(id -u rabbitmq)
|
||||
systemctl --user --machine=rabbitmq@.host enable podman-restart
|
||||
systemctl --user --machine=rabbitmq@.host enable --now podman.socket
|
||||
mkdir -p /home/rabbitmq/.config/containers/systemd
|
||||
```
|
||||
|
||||
### Generate the rabbitmq tls certs
|
||||
|
||||
We'll use tls authentication to ensure encryption between our servers and clients.
|
||||
|
||||
<https://www.rabbitmq.com/docs/ssl#automated-certificate-generation-transcript>
|
||||
|
||||
```bash
|
||||
ssh rabbitmq
|
||||
git clone https://github.com/rabbitmq/tls-gen tls-gen
|
||||
cd tls-gen/basic
|
||||
# private key password
|
||||
make PASSWORD=bunnies
|
||||
make verify
|
||||
make info
|
||||
ls -l ./result
|
||||
```
|
||||
|
||||
### Write the rabbitmq compose spec
|
||||
|
||||
Edit the compose.yaml at active/container_rabbitmq/compose/compose.yaml
|
||||
|
||||
#### A Note on Volumes
|
||||
|
||||
Named volumes are stored at `/home/rabbitmq/.local/share/containers/storage/volumes/`.
|
||||
|
||||
### Convert rabbitmq compose spec to quadlets
|
||||
|
||||
Run the following to convert a compose.yaml into the various `.container` files for systemd:
|
||||
|
||||
```bash
|
||||
# Generate the systemd service
|
||||
podman run \
|
||||
--security-opt label=disable \
|
||||
--rm \
|
||||
-v $(pwd)/active/container_rabbitmq/compose:/compose \
|
||||
-v $(pwd)/active/container_rabbitmq/quadlets:/quadlets \
|
||||
quay.io/k9withabone/podlet \
|
||||
-f /quadlets \
|
||||
-i \
|
||||
--overwrite \
|
||||
compose /compose/compose.yaml
|
||||
|
||||
# Copy the files to the server
|
||||
export PODMAN_SERVER=rabbitmq
|
||||
scp -r active/container_rabbitmq/quadlets/. $PODMAN_SERVER:/home/rabbitmq/.config/containers/systemd/
|
||||
ssh $PODMAN_SERVER chown -R rabbitmq:rabbitmq /home/rabbitmq/.config/containers/systemd/
|
||||
```
|
||||
|
||||
### Create any container-mounted directories
|
||||
|
||||
SSH into your podman server as root:
|
||||
|
||||
```bash
|
||||
machinectl shell rabbitmq@
|
||||
podman unshare
|
||||
# /var/lib/rabbitmq
|
||||
mkdir data
|
||||
# Chown to the namespaced user with UID 1000
|
||||
# This will be some really obscure UID outside the namespace
|
||||
# This will also solve most permission denied errors
|
||||
chown -R 1000:1000 some_volume
|
||||
```
|
||||
|
||||
### Start and enable your systemd quadlet
|
||||
|
||||
SSH into your podman server as root:
|
||||
|
||||
```bash
|
||||
machinectl shell rabbitmq@
|
||||
systemctl --user daemon-reload
|
||||
systemctl --user restart rabbitmq
|
||||
# Enable auto-update service which will pull new container images automatically every day
|
||||
systemctl --user enable --now podman-auto-update.timer
|
||||
```
|
||||
|
||||
### Alias rabbitmqctl
|
||||
|
||||
We'll use containers to run rabbitmqctl, so we'll add an alias to our `.bashrc`
|
||||
to make things easier:
|
||||
|
||||
```bash
|
||||
alias rabbitmqctl='podman exec -it rabbitmq rabbitmqctl'
|
||||
```
|
||||
|
||||
### Expose rabbitmq
|
||||
|
||||
1. If you need a domain, follow the [DDNS instructions](/active/container_ddns/ddns.md#install-a-new-ddns-service)
|
||||
2. For a web service, follow the [Caddy instructions](/active/container_caddy/caddy.md#adding-a-new-caddy-record)
|
||||
3. Finally, follow your OS's guide for opening ports via its firewall service.
|
||||
|
||||
#### firewalld
|
||||
|
||||
```bash
|
||||
# command to get current active zone and default zone
|
||||
firewall-cmd --get-active-zones
|
||||
firewall-cmd --get-default-zone
|
||||
|
||||
# command to open 443 on tcp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
|
||||
|
||||
# command to open 80 and 443 on tcp and udp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
|
||||
|
||||
# command to list available services and then open http and https
|
||||
firewall-cmd --get-services
|
||||
firewall-cmd --permanent --zone=<zone> --add-service={http,https}
|
||||
```
|
||||
|
||||
## Backup rabbitmq
|
||||
|
||||
Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup)
|
||||
|
||||
## Upgrade rabbitmq
|
||||
|
||||
### Upgrade Quadlets
|
||||
|
||||
Upgrades should be a repeat of [writing the compose spec](#convert-rabbitmq-compose-spec-to-quadlets) and [installing the quadlets](#start-and-enable-your-systemd-quadlet)
|
||||
|
||||
```bash
|
||||
export PODMAN_SERVER=
|
||||
scp -r quadlets/. $PODMAN_SERVER$:/home/rabbitmq/.config/containers/systemd/
|
||||
ssh rabbitmq systemctl --user daemon-reload
|
||||
ssh rabbitmq systemctl --user restart rabbitmq
|
||||
```
|
||||
|
||||
## Uninstall
|
||||
|
||||
```bash
|
||||
# Stop the user's services
|
||||
systemctl --user disable podman-restart
|
||||
podman container stop --all
|
||||
systemctl --user disable --now podman.socket
|
||||
systemctl --user disable --now podman-auto-update.timer
|
||||
|
||||
# Delete the user (this won't delete their home directory)
|
||||
# userdel might spit out an error like:
|
||||
# userdel: user rabbitmq is currently used by process 591255
|
||||
# kill those processes and try again
|
||||
userdel rabbitmq
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
### SELinux
|
||||
|
||||
<https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/>
|
||||
|
||||
:z allows a container to share a mounted volume with all other containers.
|
||||
|
||||
:Z allows a container to reserve a mounted volume and prevents any other container from accessing.
|
||||
3
active/container_rabbitmq/quadlets/README.md
Normal file
3
active/container_rabbitmq/quadlets/README.md
Normal file
@@ -0,0 +1,3 @@
|
||||
# Quadlets
|
||||
|
||||
Put your quadlets here.
|
||||
12
active/container_rabbitmq/quadlets/rabbitmq.container
Normal file
12
active/container_rabbitmq/quadlets/rabbitmq.container
Normal file
@@ -0,0 +1,12 @@
|
||||
[Container]
|
||||
ContainerName=rabbitmq
|
||||
EnvironmentFile=/srv/rabbitmq/rabbitmq.env
|
||||
Image=docker.io/rabbitmq:3-management
|
||||
PublishPort=15672:15672
|
||||
PublishPort=5672:5672
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
108
active/container_rabbitmq/rabbitmq.md
Normal file
108
active/container_rabbitmq/rabbitmq.md
Normal file
@@ -0,0 +1,108 @@
|
||||
# Podman rabbitmq
|
||||
|
||||
- [Podman rabbitmq](#podman-rabbitmq)
|
||||
- [Setup rabbitmq Project](#setup-rabbitmq-project)
|
||||
- [Install rabbitmq](#install-rabbitmq)
|
||||
- [Expose rabbitmq](#expose-rabbitmq)
|
||||
- [firewalld](#firewalld)
|
||||
- [Backup rabbitmq](#backup-rabbitmq)
|
||||
- [Upgrade rabbitmq](#upgrade-rabbitmq)
|
||||
- [Upgrade Quadlets](#upgrade-quadlets)
|
||||
- [Uninstall](#uninstall)
|
||||
- [Notes](#notes)
|
||||
- [SELinux](#selinux)
|
||||
|
||||
## Setup rabbitmq Project
|
||||
|
||||
- [x] Copy and rename this folder to active/container_foobar
|
||||
- [x] Find and replace rabbitmq with the name of the service.
|
||||
- [ ] Create the rootless user to run the podman containers
|
||||
- [ ] Write the compose.yaml spec for your service
|
||||
- [ ] Convert the compose.yaml spec to a quadlet
|
||||
- [ ] Install the quadlet on the podman server
|
||||
- [ ] Expose the quadlet service
|
||||
- [ ] Install a backup service and timer
|
||||
|
||||
## Install rabbitmq
|
||||
|
||||
<https://hub.docker.com/_/rabbitmq/>
|
||||
|
||||
```bash
|
||||
ssh rabbitmq mkdir /srv/rabbitmq
|
||||
scp active/container_rabbitmq/example.env rabbitmq:/srv/rabbitmq/rabbitmq.env
|
||||
scp active/container_rabbitmq/rabbitmq-compose.yaml rabbitmq:
|
||||
ssh rabbitmq docker compose -f rabbitmq-compose.yaml up
|
||||
```
|
||||
|
||||
List queues
|
||||
|
||||
```bash
|
||||
docker exec -it rabbitmq rabbitmqctl list_queues
|
||||
```
|
||||
|
||||
### Expose rabbitmq
|
||||
|
||||
1. If you need a domain, follow the [DDNS instructions](/active/container_ddns/ddns.md#install-a-new-ddns-service)
|
||||
2. For a web service, follow the [Caddy instructions](/active/container_caddy/caddy.md#adding-a-new-caddy-record)
|
||||
3. Finally, follow your OS's guide for opening ports via its firewall service.
|
||||
|
||||
#### firewalld
|
||||
|
||||
```bash
|
||||
# command to get current active zone and default zone
|
||||
firewall-cmd --get-active-zones
|
||||
firewall-cmd --get-default-zone
|
||||
|
||||
# command to open 443 on tcp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port=443/tcp
|
||||
|
||||
# command to open 80 and 443 on tcp and udp
|
||||
firewall-cmd --permanent --zone=<zone> --add-port={80,443}/{tcp,udp}
|
||||
|
||||
# command to list available services and then open http and https
|
||||
firewall-cmd --get-services
|
||||
firewall-cmd --permanent --zone=<zone> --add-service={http,https}
|
||||
```
|
||||
|
||||
## Backup rabbitmq
|
||||
|
||||
Follow the [Borg Backup instructions](/active/systemd_borg/borg.md#set-up-a-client-for-backup)
|
||||
|
||||
## Upgrade rabbitmq
|
||||
|
||||
### Upgrade Quadlets
|
||||
|
||||
Upgrades should be a repeat of [writing the compose spec](#convert-rabbitmq-compose-spec-to-quadlets) and [installing the quadlets](#start-and-enable-your-systemd-quadlet)
|
||||
|
||||
```bash
|
||||
export PODMAN_SERVER=
|
||||
scp -r quadlets/. $PODMAN_SERVER$:/home/rabbitmq/.config/containers/systemd/
|
||||
ssh rabbitmq systemctl --user daemon-reload
|
||||
ssh rabbitmq systemctl --user restart rabbitmq
|
||||
```
|
||||
|
||||
## Uninstall
|
||||
|
||||
```bash
|
||||
# Stop the user's services
|
||||
systemctl --user disable podman-restart
|
||||
podman container stop --all
|
||||
systemctl --user disable --now podman.socket
|
||||
systemctl --user disable --now podman-auto-update.timer
|
||||
|
||||
# Delete the user (this won't delete their home directory)
|
||||
# userdel might spit out an error like:
|
||||
# userdel: user rabbitmq is currently used by process 591255
|
||||
# kill those processes and try again
|
||||
userdel rabbitmq
|
||||
```
|
||||
|
||||
## Notes
|
||||
|
||||
### SELinux
|
||||
|
||||
<https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/>
|
||||
|
||||
:z allows a container to share a mounted volume with all other containers.
|
||||
|
||||
:Z allows a container to reserve a mounted volume and prevents any other container from accessing.
|
||||
Reference in New Issue
Block a user