natoascode/olympiad-dev repository overview

⁠Olympiad DevSecOps Toolbox for Edge-Based Cloud Native Engineering -- STANDARD BUILD Includes k3d Kubernetes

This is the best image for building maintainable and scalable Olympiad-based deployments for production use. The Olympiad is designed to provide cloud and edge-based Phoenix Server hosting for engineering and building continuous business applications.

If not being used for development or testing purposes, production use of this image requires a load balancer and a firewall that sit in front of it (for example, an “NGINX” container with a software firewall inside, such as “firewalld”). This image is built from a docker file for the official Docker-in-Docker repository, which allows this to always remain up-to-date as long as Docker remains active!

The Official production Olympiad system container (which houses apps) is generated from this repository image, and the docker file for this image is what sets it apart from Docker-in-Docker (docker:stable-dind). Buildx can be used with this image to create agnostic Olympiad-based images and applications that support more universal compatibility.

If scaling out a Docker Swarm, this image can be used to build out worker scaler node fleets.

New to Phoenix Servers?
Learn more about Phoenix Servers here: https://youtu.be/hX3sb0w5uhQ⁠

Learn more from someone else's word here: https://www.thoughtworks.com/en-us/insights/blog/moving-to-phoenix-server-pattern-introduction⁠

---

⁠Quick-Start Guide to Deploy Olympiad's Tool Suite - STANDARD BUILD:

To deploy the fully Olympiad toolbox, start by pulling the system container with a basic command to begin testing first (later this command will be updated with volume and port mappings; for now, see the volume and port mapping guidance further down in this write-up).

(run these commands on your chosen primary Docker host - buildx was used to make this image multi-architecture for wide compatibility!)
=> docker run -itd --privileged --init -p 22:22 -p 9050:9050 -p 9051:9051 -h Olympiad --name=Olympiad --restart=always -v olympiad0:/home/portainer/ -v olympiad-deployment-volumes:/var/lib/docker/volumes -v olympiad-docker-socket:/var/run/ -v /home/:/home/ -v olympiad-bin:/usr/local/bin/ -v /var/lib/docker/volumes/olympiad-bin/_data/dockerd-entrypoint.sh:/usr/local/bin/dockerd-entrypoint.sh natoascode/olympiad-dev:latest

=> docker exec Olympiad docker run -itd --privileged --init -p 22:22 -h Athena0 --name=Athena0 --restart=always -v athena0:/home/ -v /usr/local/bin/:/usr/local/bin/ -v /var/run/docker:/var/run/docker natoascode/athena0:latest

=> docker exec Olympiad sh /var/lib/docker/volumes/athena0/_data/olympiad.sh

--CONGRATULATIONS, you are now able begin using your Olympiad tool suite!--

Once these two commands have been run, Portainer is accessible via port 9050 and Pihole is accessible via 9051 (or whatever ports these ports have been forwarded to; regardless, these ports must be open to access to these tools from outside of the Olympiad application container system).

Navigate to the following for Portainer and Pihole access:
Portainer (Olympiad0) - http://localhost:9050⁠
Pihole (Inner-DNS-Control) - http://localhost:9051⁠

This deployment method includes Kubernetes - access Kubernetes by typing k3d as a shell command from inside of the Athena0 node (Athena0's shell can be accessed via Portainer / Olympiad0):
-- --More guidance on how to use k3d Kubernetes HERE => https://k3d.io/⁠
-- --Learn more about Athena0 here => https://hub.docker.com/r/natoascode/athena0⁠

--Build something special--

IMPORTANT BEFORE ENABLING ssh ON ATHENA0 - CHANGE THE ATHENA0 DEFAULT PASSWORD!

Default Username: notitia
Default Password: notiaPoint!1

Run the Change Password Command (from inside the Athena0 shell) => passwd notitia

Enable ssh => service ssh start

If the STANDARD BUILD was used to deploy the Olympiad system container, the physical system running Olympiad can now provide access to Athena0 through using ssh on the physical host's IP address from a remote device (other containers can also then ssh into Athena0 using the Docker network's IP address, which usually looks something like 172.20.0.x). Depending on the network environment - this can make it easier to distribute secure access to the Olympiad system container's Docker socker and engine.

---

⁠Athena0 nodes are the primary gateways for back-end access for administrative Docker engine work, while Olympiad0 is the primary gateway for ALL front-end access. It is NOT recommended to use the primary Olympiad system container (that houses the apps) for direct use beyond updates and maintenance. Instead Athena0 nodes can be cloned and a unique login can be assigned to developers to allow Docker engine work without providing direct access to the Olympiad system container itself; this adds an extra layer of security to the system.

Here is a direct example and Proof of Concept on how user access can be securely configured and deployed to provide unique logins to developers - Hide n' Hunt | Ethical Hacking Training Simulation:

Administrative User Configuration DevSecOps Session => https://youtu.be/aZt7BTgK3Fo⁠

See User Access In Action for a Hide n' Hunt Game Night! => https://youtu.be/UZ2X-wP2djI⁠

Hide n' Hunt tournament deployment guidance can be found here => https://hub.docker.com/r/natoascode/athena0⁠

-- --How to Update the Olympiad's STANDARD BUILD Tool Suite-- --

To update the tools in the Olympiad suite's STANDARD BUILD (Athena0, Pihole and Portainer):
-- --Delete all build-related docker images tagged with ":latest" (from within the Olympiad system container shell, itself) =>docker stop Inner-DNS-Control Olympiad0 Athena0 && docker rm Inner-DNS-Control Olympiad0 Athena0 && docker image rm pihole/pihole:latest portainer/portainer-ce:latest natoascode/athena0:latest

-- --next simply re-run this script (also inside the Olympiad system container's shell) => sh /var/lib/docker/volumes/athena0/_data/olympiad.sh

Below is the docker file used for this image.

---

⁠Place a load balancer and software firewall in front of Olympiad Toolbox for Continuous Production Use

⁠"OLYMPIAD-DEV" NODE DOCKER FILE

ARG VERSION=stable-dind
FROM docker:$VERSION

EXPOSE 22 53 80 222 443 514 2222 2375 2376 9050 9051 9052 9055 9080 9090 9100 9550 9551 9555
VOLUME ["/usr/local/bin", "/var/lib/docker", "/portainer", "/var/log", "/etc", "/home", "/mnt/config", "/var/lib/docker/volumes"]

(BUILDS OLYMPIAD-DEV TO SAVE IN DOCKER HUB THEN SAVE AS "olympiad:base" TO PRODUCE "olympiad:latest")

---

To create a custom tool suite from a template to begin building with this image, create a file called "olympiad.sh" and add the contents below. Creating a custom "olympiad.sh" script is unnecessary if you used the Quick-Start Guide above to deploy the Olympiad tool suite.

⁠(build this script inside of the Olympiad system container; tools like “nano” allow the script to be copy pasted inside of the container)

⁠olympiad.sh - custom template:

#!/bin/sh
apk update
apk upgrade
docker network create -d bridge --subnet=172.20.0.0/24 Inner-Athena
docker run -itd --privileged -p 53:53/tcp -p 53:53/udp -p 67:67 -p 9051:80 -p 9550:443 -h Inner-DNS-Control --name=Inner-DNS-Control --net=Inner-Athena --ip=172.20.0.20 --restart=always -v /home:/home -v /var/log/pihole.log:/var/log/pihole.log -v /etc/pihole:/etc/pihole -v pihole_DNS_data:/etc/dnsmasq.d/ pihole/pihole:latest
docker run -d -p 9050:9000 --name=Olympiad0 --dns=172.20.0.20 --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v /home/portainer:/data portainer/portainer-ce
exec "$@"

---

Add any additional docker run commands to the ".sh" script and run the command below to begin deploying!

(run your script inside of the Olympiad system container) => sh /(location of .sh file)/olympiad.sh

Excellent Images for Docker RUN olympiad.sh template additions:
-- --Monitoring => https://hub.docker.com/r/grafana/grafana⁠
-- --Logging => https://hub.docker.com/r/grafana/loki⁠
-- --Log Shipping and Collection => https://hub.docker.com/r/grafana/promtail⁠
-- --GitLab Official CE (amd64) => https://hub.docker.com/_/gitlab-community-edition⁠
-- --GitLab CE for ARM => https://hub.docker.com/r/ulm0/gitlab⁠
-- --Agnostic Powershell for Scripting Beyond BASH => https://hub.docker.com/_/microsoft-powershell⁠
-- --Portable Modular Cloud Node Coding => https://hub.docker.com/_/golang⁠
-- --Load Balancing (good home for software firewall) => https://hub.docker.com/_/nginx⁠

For an entire fleet of outstanding open source engineering images to add to the script template, with Docker RUN commands - check out:
https://fleet.linuxserver.io/⁠

---

Default port and volume mappings are as listed in the port and volume guide below!

Container DevCenter Port and Volume Resource Mapping

Portainer:
-ports *8000, *9000

Pihole:
-ports *80, *443, *53, 67

Grafana + Loki + Promtail:
-ports *3000, *3100, *514

GitLab (BYOG - Bring Your Own Git - this will remain left this out of the default package so Git can be custom tailored for GitOps):
-ports *80, *443, *22, 5432, 6379, 8080, 8181, *9090, *9100

---

Docker-in-Docker:

Ports
-Expose 22:22 (to athena0), 80, 443, 2375, 2376
-Portainer 9050:9050 (9000)
-Pihole 9051:9051 (80) - 9550:9550 (443) - optional DNS 53:53 (53)
-Grafana 9052:9052 (3000) - 9551:9551 (3100 Loki) - 9080:9080 (9080 Promtail) - 514:514 (514 Promtail)
-GitLab 9055:9055 (80) - 9555:9555 (443) - 2222:2222 (22) - 9090:9090 (9090) - 9100:9100 (9100)

Volumes
-olympiad-vol/dockerd-entrypoint.sh:/usr/local/bin/dockerd-entrypoint.sh
-olympiad-vol/docker:/var/lib/docker
-olympiad-vol/portainer:portainer:portainer
-olympiad-vol/logs:/var/log:/var/log
-olympiad-vol/etc:/etc:/etc
-olympiad-vol/home:/home:/home
-olympiad/loki-mnt:/mnt/config:/mnt/config
-olympiad/internal-volumes:/var/lib/docker/volumes:/var/lib/docker/volumes

---

⁠Read the original Olympiad Whitepaper this image is based on to learn more about this open source cloud toolbox and threat intelligence engine!

Olympiad Whitepaper:
https://docs.google.com/document/d/e/2PACX-1vRgdggHVwch6TzX-gd6r4vA_OXaJk3A086-pOErgh3CZlR1HegKfzFMZL15YSlN4jgUrlG1DZsAS1GG/pub⁠

Here is the original concept draft of what became the Olympiad Whitepaper (ELK stack was replaced with Grafana, Loki and Promtail) - Hack Back! | Home SOC:
https://youtu.be/GNOhimi9-eY⁠

---

⁠What is the Cloud Native Foundation?

Here is an ocean of Cloud Native “Docker RUN” ready tools - Cloud Native Landscape:
https://landscape.cncf.io/⁠

Here is a Whitepaper on how Cloud Native engineering principles work with Docker and Kubernetes construction:
https://github.com/cncf/tag-security/blob/main/security-whitepaper/CNCF_cloud-native-security-whitepaper-Nov2020.pdf⁠

---

⁠Pihole + Grafana/Loki/Promtail + NEMS Linux OSINT Engine - Guidance Coming SOON!

Check out NEMS Linux:
https://nemslinux.com/⁠

Learn more about Pihole:
https://pi-hole.net/⁠

Read about Grafana's Loki logger:
https://grafana.com/oss/loki/⁠

Here you will find tons of container management training resources from Portainer:
https://www.portainer.io/⁠