Deploying an OpsAny Proxy Controller

OpsAny achieves distributed management by deploying multiple Proxies. An OpsAny Proxy is called a controller in the Control Platform. OpsAny supports multiple controllers, i.e. multiple Proxies — for example across data centers, in hybrid cloud scenarios, or when different regions of a cloud provider cannot reach each other. Deploy one opsany-proxy per region, and that Proxy manages the hosts in that region. All controllers (Proxies) must be able to communicate with the OpsAny central platform.

• The OpsAny platform must be able to reach port 8011 on every Proxy to dispatch tasks.
• A Proxy must be able to reach ports 80 and 443 on OpsAny to fetch task scripts and files.
• A Proxy is not the same as a bastion host network proxy. To use a bastion network proxy, create one under Bastion Host.

Note

A common pitfall: if OpsAny is deployed on an intranet host without a public IP, you cannot manage internet hosts through the Job Platform — even with a Proxy deployed — because of the second requirement above. The Proxy must reach ports 80 and 443 on OpsAny to fetch task scripts and files. If you have a better solution, feel free to bring it up in the community WeChat group.

Proxy Deployment

Overview

A dedicated deployment script is provided at install/proxy-install.sh. It deploys four containers:

• opsany-proxy-mysql: the MySQL database used by the Proxy. Port: 3306
• opsany-proxy-redis: the Redis cache used by the Proxy. Port: 6379
• opsany-proxy-openresty: the Nginx reverse proxy. Ports: 8011 (HTTPS), 8012 (HTTP)
• opsany-paas-proxy: the Proxy container itself. Port: 8010, which is rarely used — port 8011/8012 of the reverse proxy are used instead. Note: in older versions this container was named opsany-proxy.

The script is intended for adding a standalone Proxy. A default OpsAny installation already starts a built-in controller (Proxy) that shares the MySQL and Redis instances with the other OpsAny services.

Step-by-step

1. Install Docker and the required packages

CentOS 7.x

1.1 Install Docker and MySQL

curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
curl -o /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install -y git wget docker-ce mariadb jq python3 python3-pip ntpdate
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

CentOS 8.x

1.1 Install Docker and MySQL

dnf config-manager --add-repo=http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
dnf -y install docker-ce --nobest
dnf -y install mariadb jq git
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

Ubuntu

1.1 Install Docker and the MySQL client

# step 1: install the required system tools
sudo apt-get update
sudo apt-get -y install apt-transport-https ca-certificates curl software-properties-common
# step 2: install the GPG key
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
# step 3: add the repository
sudo add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
# step 4: update and install Docker CE
sudo apt-get -y update
sudo apt-get -y install docker-ce jq wget mysql-client git ntpdate
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

On Ubuntu 16.04, install Python 3 and pip additionally: sudo apt-get -y install python3 python3-pip

1. Clone the code

Gitee

cd /opt && git clone --depth=1 https://gitee.com/unixhot/opsany-paas.git

GitHub

cd /opt && git clone --depth=1 https://github.com/unixhot/opsany-paas.git

1. Edit the installation configuration (mandatory)

Tip

Make sure the OpsAny platform can reach port 8011 on the Proxy. DOMAIN_NAME is not used by the Proxy and does not need to be configured.

# Generate the configuration file from the template
$ cd /opt/opsany-paas/install && cp install.config.example install.config

# Edit the file, and make sure to change the passwords (default is INIT_PASSWORD)
$ vim /opt/opsany-paas/install/install.config
DOMAIN_NAME="demo.opsany.com"    # set to the local IP address
LOCAL_IP="192.168.56.11"         # set to the local IP address
PROXY_LOCAL_IP="192.168.56.11"   # set to the local IP address
PROXY_PUBLIC_IP="192.168.56.11"  # set to the public IP of this host; on an intranet, use the local IP
MYSQL_ROOT_PASSWORD="INIT_PASSWORD"    # set your MySQL password
MYSQL_OPSANY_PASSWORD="INIT_PASSWORD"  # set your MySQL password
REDIS_SERVER_PASSWORD="INIT_PASSWORD"  # set your Redis password

1. Run the installation script to deploy the Proxy

Do not run this script on a host that already has OpsAny Community Edition installed — that host already has a built-in Proxy.

# Get the Control Platform Secret Key on the OpsAny platform: cat ${INSTALL_PATH}/conf/.control_secret_key
CONTROL_SECRET_KEY=<the Control Platform Secret Key>
source install.config
mkdir -p ${INSTALL_PATH}/conf/
echo "<the Control Platform Secret Key>" > ${INSTALL_PATH}/conf/.control_secret_key

# Run the Proxy installation
mkdir -p ${INSTALL_PATH}/logs/proxy
cd /opt/opsany-paas/install
./proxy-install.sh install

When the script finishes, it prints the Proxy Token. Add a controller under Control Platform → Collection Management → Controllers, filling in the Proxy IP address and Token.

• Proxy address: https://<IP>:8011

• Proxy token: the Proxy Token printed by the script. Do not add quotes!

• Download the OpsAny Agent to the Proxy host so monitoring plugins can be installed automatically.

cd ${INSTALL_PATH}/uploads/
wget https://opsany.oss-cn-beijing.aliyuncs.com/opsany-agent-2.2.3.tar.gz
tar zxf opsany-agent-2.2.3.tar.gz

All managed hosts must be able to reach ports 8011 and 8012 on the Proxy to download the Agent and monitoring plugin packages.

---

Updating a Standalone Proxy

To update a standalone Proxy, simply replace the containers and then run the database migrations.

Proxy Security

We recommend restricting access to ports 8011 and 8012 on the Proxy so that only the OpsAny platform IP can connect, which further hardens the Proxy.

Uninstalling the Proxy

Uninstalling stops and removes the four Proxy containers and completely deletes the installation directory. This is destructive — double-check that you are on a dedicated Proxy host.

cd /opt/opsany-paas/install
./proxy-install.sh uninstall

Note: the OpsAny Proxy is unrelated to the bastion network proxy. We do usually recommend running the Proxy on the same host as the bastion network proxy, but since that requires setting up SSH users and passwords, the deployment script does not perform such unauthorized operations — add the network proxy in the Bastion Host yourself. The network proxy relies on SSH tunneling and has nothing to do with the Proxy.