schmichael

enable_debug = true
log_level    = "DEBUG"

data_dir = "/tmp/nomad-devagent"

client {
  enabled = true
}

server {

schmichael

job "nginx-proxy" {

  group "nginx" {
    network {
      port "http" {
        static = 8080
        to     = 8080
      }
    }

schmichael

• PayPal supports HS256 https://www.paypalobjects.com/.well-known/openid-configuration
• Yahoo supports ES256 https://api.login.yahoo.com/.well-known/openid-configuration

RS256 only:

• GitHub - https://token.actions.githubusercontent.com/.well-known/openid-configuration
• GitLab - https://gitlab.com/.well-known/openid-configuration
• Google - https://accounts.google.com/.well-known/openid-configuration
• Intuit - https://developer.api.intuit.com/.well-known/openid_configuration
• Microsoft - https://login.microsoftonline.com/fabrikamb2c.onmicrosoft.com/v2.0/.well-known/openid-configuration

schmichael

job "example" {
  type = "batch"
  task t {
    driver = "exec"
    config {
      command = "/bin/sh"
      args    = ["-c", "echo '>> /proc'; grep ^Cap /proc/self/status; echo '>> getpcaps'; getpcaps 0; echo '>> prlimit'; prlimit"]
    }
  }
}

schmichael

variable "vault_version" {
  type = string
  default = "1.14.0"
}

job "vault" {
  datacenters = ["*"]
  type = "service"
  group "vault" {
    count = 1

schmichael

enable_debug = true
log_level    = "debug"

name     = "mixed1"
data_dir = "/tmp/nomad-mixed1"

client {
  enabled = true
  servers = ["127.0.0.1:4647"]
}

schmichael

package main

import (
	"fmt"
	"sync"
	"time"
)

func timeTasks(count int) time.Duration {
	nopTask := func(done func()) {

schmichael

job "example" {

  group "cache" {
    network {
      port "db" {
        to = 6379
      }
    }

    task "redis" {

schmichael

Nomad+Consul TLS Story

See https://github.com/schmichael/nomad-tls for sample configs.

Nomad issues

• Consul uses ssl instead of tls config parameters
• Consul uses verify_ssl instead of verify_tls
• consul.cert_file should specify that it's the client certificate used for mutual authentication.
• consul.{ca,cert,key}_file should default to tls.{ca,cert,key}_file

schmichael

package main

import (
	"bufio"
	"compress/gzip"
	"fmt"
	"io"
	"io/ioutil"
	"log"
	"net/http"