This post follows on from the NetBox setup post, upto the API token setup.
SSL Configuration with Nginx
In that previous post, SSL was not used. The connection was made insecure and ignored. Here, I will detail the steps to use Nginx as a proxy for the NetBox docker container.
Add SAN to SSL Creation
I have used a self-signed SSL for this, and I found that SANs needed to be added to the SSL certificate creation.
|
0 1 2 |
sudo cp /usr/lib/ssl/openssl.cnf ~/openssl.my.cnf |
|
0 1 2 |
sudo nano ~/openssl.my.cnf |
|
0 1 2 3 4 5 6 7 8 |
[ v3_req ] ... subjectAltName = @alt_names [ alt_names ] DNS.1 = netboxtest.test DNS.2 = *.netboxtest.test |
Create SSL Certificate
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 |
sudo openssl req -x509 -nodes -days 99999 -newkey rsa:2048 -keyout /etc/ssl/private/netboxtest-selfsigned.key -out /etc/ssl/certs/netboxtest-selfsigned.crt -config ~/openssl.my.cnf -extensions 'v3_req' Generating a RSA private key ............................................................................................................................................+++++ ...............+++++ writing new private key to '/etc/ssl/private/netboxtest-selfsigned.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:GB State or Province Name (full name) [Some-State]:London Locality Name (eg, city) []:London Organization Name (eg, company) [Internet Widgits Pty Ltd]: Organizational Unit Name (eg, section) []:IT Common Name (e.g. server FQDN or YOUR name) []:netboxtest.test Email Address []: stef@stef-VirtualBox:~/netbox-docker3_6/netbox-docker/ssl$ |
Add Certificate to CA Certificate Store
As I will be using the same Linux host to host NetBox and run the Terraform, I will add the self-signed certificate to the CA store. If Terraform was to be run from another host, I would need to copy the certificate to that CA store.
|
0 1 2 3 4 5 6 7 8 9 |
sudo cp /etc/ssl/certs/netboxtest-selfsigned.crt /usr/local/share/ca-certificates sudo update-ca-certificates Updating certificates in /etc/ssl/certs... rehash: warning: skipping ca-certificates.crt,it does not contain exactly one certificate or CRL rehash: warning: skipping duplicate certificate in netboxtest-selfsigned.crt 1 added, 0 removed; done. Running hooks in /etc/ca-ce |
Create Nginx Server Block (vHost)
Copy the SSL cert and key into the nginx/ssl directory
|
0 1 2 3 4 |
sudo mkdir /etc/nginx/ssl sudo cp /etc/ssl/certs/netboxtest-selfsigned.crt /etc/nginx/ssl/netboxtest-selfsigned.crt sudo cp /etc/ssl/private/netboxtest-selfsigned.key /etc/nginx/ssl/netboxtest-selfsigned.key |
Create the server block
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
sudo nano /etc/nginx/sites-available/netboxtest server { listen 443 ssl; server_name 127.0.0.1; # Replace with your actual domain or IP address ssl_certificate /etc/nginx/ssl/netboxtest-selfsigned.crt; ssl_certificate_key /etc/nginx/ssl/netboxtest-selfsigned.key; # Forward headers # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-Proto $scheme; location / { proxy_pass http://localhost:8000; # Adjust the port to match your Docker Compose setup proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } server { listen 80; server_name 127.0.0.1; return 301 https://$host$request_uri; } |
|
0 1 2 |
sudo ln -s /etc/nginx/sites-available/netboxtest /etc/nginx/sites-enabled/ |
Setup Terraform
The Terraform provider I will be using is by e-breuninger, and can be found here. Below, I have provided an example of how to get it setup and started. This example simply adds a tag called “DMZ”, coloured pink
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
terraform { required_providers { netbox = { source = "e-breuninger/netbox" version = "3.7.0" } } } # example provider configuration for https://demo.netbox.dev provider "netbox" { server_url = "https://netboxtest.test" api_token = "<ENTER YOUR API TOKEN>" } resource "netbox_tag" "dmz" { name = "DMZ" color_hex = "ff00ff" } |
|
0 1 2 3 4 |
terraform init terraform plan terraform terraform apply |