(Nexus Docker Hub) [Spike] Generate Letsencrypt SSL cert

[jjgriff93]

As part of solution to #1089, we need to generate an SSL certificate for consumption by Nexus (as it will no longer be hosted on App Service due to #1479 and thus won't have an included cert) so that it can proxy Docker Hub over https.

An approach outlined by @marrobi can potentially address this:

 ┌──────────────────────────────────────────┐    ┌────────────────────────────────┐
 │                                          │    │                                │
 │ Public IP: mytre123.uksouth.cloudapp.net │    │  Storage static site           │
 │                                          ├───►│                                │
 │                                          │    │                                │
 └──────────────────────────────────────────┘    └────────────────────────────────┘
                                                        ▲
                                                        │
                                                        │
                                                        │
                                                        │
                                                        │
 ┌──────────────────────────────────┐                   │
 │                                  ├───────────────────┘
 │  Letsencrypt cert                │
 │  processor (run on schedule)     ├────────────────────┐
 │                                  │                    │
 └──────────────────────────────────┘                    │
                                                         │       ▼
                                                         │
                                                         │
                                                         │
                                                 ┌───────▼────────────────────────┐
                                                 │                                │
                                                 │  Key Vault                     │
                                                 │                                │
                                                 └────────────────────────────────┘
                                                         ▲
                                                         │
                                                         │
                                                         │
                          ┌──────────────────────────────┼────────────────────────────────────┐
                          │                              │                                    │
                          │   VNET                       │                                    │
                          │                              │                                    │
                          │                              │                                    │
                          │                      ┌───────┴─────────────────────────────┐      │
                          │                      │                                     │      │
                          │                      │ VM                                  │      │
                          │                      │                                     │      │
                          │                      │                                     │      │
                          │                      └─────────────────────────────────────┘      │
                          │                                                                   │
                          │                                                                   │
                          │                                                                   │
                          │                      ┌─────────────────────────────────────┐      │
                          │                      │                                     │      │
                          │                      │  Private DNS Zone:                  │      │
                          │                      │  map mytre123.uksouth.cloudapp.net  │      │
                          │                      │         to VM IP address            │      │
                          │                      │                                     │      │
                          │                      │                                     │      │
                          │                      │                                     │      │
                          │                      └─────────────────────────────────────┘      │
                          │                                                                   │
                          │                                                                   │
                          │                                                                   │
                          └───────────────────────────────────────────────────────────────────┘
                          

This will involve the below steps:

• Get a domain name through Azure (i.e. azure-tre.io)
• Set up a storage account with the DNS configured to map the above domain name to its public IP
• Use LetsEncrypt to get a wildcard cert by validating with the above storage account
• Push this cert into a shared KeyVault

[jjgriff93]

@marrobi can you update anything in the above description that I've mis-translated please

[marrobi]

I think:

• Set up private DNS zone to map domain name to Nexus VM private IP
• Configure Nexus Repository Manager to consume SSL certificate from KeyVault

Should be in #1479

[jjgriff93]

Makes sense, will move

[oliver7598]

Assign this to me

[marrobi]

@jjgriff93 good to close this one?

[martinpeck]

I'm going to close it. Please reopen if closed in error @jjgriff93