docker.yml

application:
  configuration:
    configuration.imageId:    "ami-1ccae774"
    configuration.hardwareId: "m3.medium"
    configuration.locationId: "us-east-1"
    configuration.login:      "ec2-user"
    configuration.group:      "default"
  interfaces:
    configuration:
      imageId:         bind(compute#configuration.imageId)
      hardwareId:      bind(compute#configuration.hardwareId)
      locationId:      bind(compute#configuration.locationId)
      login:           bind(compute#configuration.login)
      group:           bind(compute#configuration.group)
    docker:
      "*": "bind(docker#docker.*)"
  components:
    docker:
      type: cobalt.docker.Service
    compute:
      type: compute.Instance
    installer:
      type: workflow.Instance
      interfaces:
        compute:
          networks: consume-signal(map<string, map<string, string>>)
          exec:     send-command(string command, int timeout => string stdOut, string stdErr => string stdOut, string stdErr, int exitCode)
        result:
          address:            publish-signal(string)
          client-key:         publish-signal(string)
          client-certificate: publish-signal(string)
          ca-certificate:     publish-signal(string)
      required:
      - compute
      configuration:
        configuration.workflows:
          launch:
            steps:
              install:
                action: execrun
                parameters:
                  roles: [ compute ]
                  isSudo: true
                  command: [ "yum -y -q install docker" ]
              get-signals:
                action: getSignals
                output:
                  signals: result
              generate-keys:
                action: execrun
                precedingPhases: [ install, get-signals ]
                parameters:
                  roles: [ compute ]
                  isSudo: false
                  command:
                  - bash -exc
                  - |
                      mkdir -p certs
                      cd certs
                      echo 01 > ca.srl
                      openssl genrsa -out ca-key.pem     2048
                      openssl genrsa -out server-key.pem 2048
                      openssl genrsa -out client-key.pem 2048
                      openssl req -new -nodes -x509 -days 3650 -subj '/O=Docker' -key ca-key.pem -out ca.pem
                      openssl req -new -nodes -subj '/CN=*' -key server-key.pem -out server.csr
                      echo 'subjectAltName = IP:{$.signals.compute.networks.public.ip}' > extfile.cnf
                      openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -out server-cert.pem -extfile extfile.cnf
                      openssl req -new -nodes -subj '/CN=client' -key client-key.pem -out client.csr
                      echo 'extendedKeyUsage = clientAuth' > extfile.cnf
                      openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca-key.pem -out client-cert.pem -extfile extfile.cnf
              configure:
                action: execrun
                precedingPhases: [ generate-keys ]
                parameters:
                  roles: [ compute ]
                  isSudo: true
                  command:
                  - bash -exc
                  - |
                      mkdir -p /var/ssl
                      cp certs/ca.pem certs/server-cert.pem certs/server-key.pem /var/ssl/
                      echo "OPTIONS='--host=unix:///var/run/docker.sock --host=tcp://0.0.0.0:2376 --tlsverify --tlscacert=/var/ssl/ca.pem --tlscert=/var/ssl/server-cert.pem --tlskey=/var/ssl/server-key.pem'" >/etc/sysconfig/docker
                      service docker restart
              get-private-key:
                action: execrun
                precedingPhases: [ generate-keys ]
                parameters:
                  roles: [ compute ]
                  isSudo: false
                  command: [ "cat certs/client-key.pem" ]
                output:
                  clientKey: stdout
              get-client-certificate:
                action: execrun
                precedingPhases: [ generate-keys ]
                parameters:
                  roles: [ compute ]
                  isSudo: false
                  command: [ "cat certs/client-cert.pem" ]
                output:
                  clientCertificate: stdout
              get-ca-certificate:
                action: execrun
                precedingPhases: [ generate-keys ]
                parameters:
                  roles: [ compute ]
                  isSudo: false
                  command: [ "cat certs/ca.pem" ]
                output:
                  caCertificate: stdout
            return:
              address:            { value: "{$.signals.compute.networks.public.ip}" }
              client-key:         { value: "{$.clientKey[*][0]}"                    }
              client-certificate: { value: "{$.clientCertificate[*][0]}"            }
              ca-certificate:     { value: "{$.caCertificate[*][0]}"                }
  bindings:
  - [docker#host, installer]
  - [docker#credentials, installer]
  - [installer#compute, compute]