Document Airgap Process for NPM

[tsmaeder]

Test and document the process of setting up an airgap solution for NPM. In particular, configure a workspace based on our default nodejs devfile to use a npm repository that uses a self-signed certificate.

[tsmaeder]

Instructions should be attached to this issue.

[nickboldt]

Related: #14857

[sunix]

@tsmaeder these are the important informations to setup a npm registry with selfsigned certificate, using devfile at the moment. The next comment is the complete steps to setup a test environment and check that these are actually working.

Npm airgap devfile

Having that you have a remote NPM private registry and the npm https://registry.npmjs.org. is not accessible from your network.

In your npm project devfile:

1. Zip your certificate and make it available through http to your workspace (tls.crt in our example).
2. Import your zip into the workspace from the devfile:

   - source:
      type: zip
      location: 'https://github.com/sunix/che-quarkus-demo/releases/download/nexus/config-nexus.zip'
    name: config-nexus
   

3. Add to the component where the npm commands will be executed, providing your npm registry location and the certificate location previously downloaded

 env:
  - name: NODE_EXTRA_CA_CERTS
    value: "/projects/config-nexus/tls.crt"
  - name: NPM_CONFIG_REGISTRY
    value: "https://snexus-airgap.apps.acme.com/repository/npm-proxy/"

[sunix]

Setup Test environment

Setup Nexus

Here, I will describe how I install Nexus to test my configuration. The Nexus will be installed through an operator in Openshift 4.2.

Install the operator

From the the openshift 4.2 console, as an admin,

• Create a airgap project,

• install nexus3 operator from the operatorhub
  

• Create Nexus by going to Installed Operators and the Nexus tab

• Once nexus is started, access to nexus
  

• Login as admin, you can get to the generated admin password which is located in /nexus-data/admin.password of the nexus pod

• Change the admin password from nexus profile.

Create a proxy repo

Create a nexus repository for NPM. Select proxy to https://registry.npmjs.org. Block outbound connections on the repository for now. (we are going to test that we are really offline)

Copy the repo URL that we are going to use just next.

Start the test workspace

Start a workspace from this devfile:

https://gist.github.com/sunix/00f890965f04620139e616fbcba75444

This devfile will set user.home to /project for the quarkus-backend-dev container.

Test offline

Remove the file `postit-app/node-frontend` package-lock.json` (or any lock file that may contain informations about registries where to download a dependency)

In the container `node-frontend-dev` open the terminal

npm config set registry http://nexus3-airgap.apps.cluster-paris-8905.paris-8905.example.opentlc.com/repository/npm-proxy/

cd /projects/postit-app/node-frontend; npm install

Npm build is failling as we blocked internet from nexus (won’t mirror)

The file we have changed is:

cat ~/.npmrc

registry=http://nexus3-airgap.apps.cluster-paris-8905.paris-8905.example.opentlc.com/repository/npm-proxy/

TODO try: NPM_CONFIG_REGISTRY

But doesn’t work if need auth ...

Checking Language Server

Nothing to do as the plugin is do not download any dependencies. User would have to perform a `npm install` manually from the terminal or task.

Checking NPM command line

Re-enable the proxy to connect to internet

Retry a build

Setup TLS with self signed certificate for Nexus

Configure Nexus with TLS and self-signed certificate

We are going to add a new route with tls and a self signed certificate that we create:

Create the certificate (adapt the CN with your hostname)

openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
 -keyout tls.key -out tls.crt -subj '/CN=acme.com' \
 -addext 'subjectAltName=DNS:*.apps.acme.com'

or if openssl version < 1.1.1

openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes -keyout tls.key -out tls.crt -subj '/CN=opentlc.com' \
 -extensions san \  
 -config <(echo '[req]'; echo 'distinguished_name=req'; \
echo '[san]'; echo 'subjectAltName=DNS:*.apps.cluster-paris-8905.paris-8905.example.opentlc.com')

Notes:

• We use SubjectAltName for DNS. See http://wiki.cacert.org/FAQ/subjectAltName

Create a new route in the project where the nexus operator cluster is deployed:

$ oc project airgap
$ oc create route edge snexus --service=nexus3 --cert=tls.crt --key=tls.key
$ oc describe Route snexus
Name: snexus
Namespace: airgap
Created: 14 seconds ago
Labels: app=nexus3
Annotations: openshift.io/host.generated=true
Requested Host: snexus-airgap.apps.acme.com
exposed on router default (host apps.acme.com) 14 seconds ago
Path: <none\>
TLS Termination: edge
Insecure Policy: <none\>
Endpoint Port: http
Service: nexus3
Weight: 100 (100%)
Endpoints: 10.128.2.18:8081

Configure NPM to use the Secured Nexus (with self-signed certificate)

Change the registry url to point to the secured one

npm config set registry https://snexus-airgap.apps.cluster-paris-8905.paris-8905.example.opentlc.com/repository/npm-proxy/

Remove node_modules folder and try to rebuild it

It fails as expected: we have not uploaded the certificate and told NPM to use it

Upload tls.crt and set the env variable:

export NODE_EXTRA_CA_CERTS=/projects/config-nexus/tls.crt
export NPM_CONFIG_REGISTRY=https://snexus-airgap.apps.cluster-paris-8905.paris-8905.example.opentlc.com/repository/npm-proxy/

Npm airgap devfile

Having that you have a remote NPM private registry and the npm https://registry.npmjs.org. is not accessible from your network.

In your npm project devfile:

1. Zip your certificate and make it available through http to your workspace.
2. Import your zip into the workspace from the devfile:

- source:  
    type: zip  
    location: 'https://github.com/sunix/che-quarkus-demo/releases/download/nexus/config-nexus.zip'  
    name: config-nexus

3. Add to the component where the npm commands will be executed, providing your npm registry location and the certificate location previously downloaded

env:  
  - name: NODE_EXTRA_CA_CERTS  
    value: "/projects/config-nexus/tls.crt"  
  - name: NPM_CONFIG_REGISTRY  
    value: "https://snexus-airgap.apps.acme.com/repository/npm-proxy/"

[tsmaeder]

@sunix what about authenticated access to the registry?

[tsmaeder]

@sunix why not use NPM_CONFIG_CAFILE? That would be in keeping with the rest of the documented procedures.

[sunix]

@tsmaeder not sure ... I think i've tried but it wasn't working ... nodejs/node-gyp#695 (comment)

[ericwill]

Is there anything left to document here?