This Branch contains guidance on how to securely encrypt network traffic with OpenVPN for technologies like Docker, Kubernetes or tools that deploy both like the Underground Nexus.
Using a VPN allows applicaitons deployed from the Underground Nexus or other software factory platforms to be accessed more securely.
The Underground Nexus can be deployed from inside of a VPN's VXLAN network to optionally allow remote Docker Swarm workers (local prem, cloud, hybrid) to cluster with cloud nodes to gain access to using Docker overlay networks that allow Docker to be used as a load balancer for Kubernetes, through the use of KuberNexus (default Underground Nexus deployment k8s cluster - build with k3d).
The quick start guidance below is based on the following maintainer's OpenVPN source project:
Pick a name for the $OVPN_DATA data volume container. It's recommended to use the ovpn-data- prefix to operate seamlessly with the reference systemd service. Users are encourage to replace example with a descriptive name of their choosing.
=>OVPN_DATA="ovpn-data-nexus"
=>docker volume create --name $OVPN_DATA
=>docker run -v $OVPN_DATA:/etc/openvpn --rm natoascode/underground-openvpn ovpn_genconfig -u udp://VPN.SERVERNAME.COM
=>docker run -v $OVPN_DATA:/etc/openvpn --rm -it natoascode/underground-openvpn ovpn_initpki
VPN.SERVERNAME.COM is the domain name or public IP address of the VPN Server.=>docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN natoascode/underground-openvpn
nopass flag from the end of the next string)=>docker run -v $OVPN_DATA:/etc/openvpn --rm -it natoascode/underground-openvpn easyrsa build-client-full CLIENTNAME nopass
nopass beyond testing
(alternate preferred example for setting up a VPN client password - =>docker run -v $OVPN_DATA:/etc/openvpn --rm -it natoascode/underground-openvpn easyrsa build-client-full CLIENTNAME)=>docker run -v $OVPN_DATA:/etc/openvpn --rm natoascode/underground-openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn
Head to OpenVPN's official website to identify the proper download and installation option for the device you wish to connect to the newly configured Underground Nexus VPN WebApp server.
Use the OpenVPN file generated from the steps above with the client OpenVPN app to connect to the VPN server.
GA release is LIVE!
The Underground Nexus is a hyperconverged data center that contains a specialized cloud construction toolkit for Cloud Native engineering, DevSecOps and all-around general data center needs.
What is a hyperconverged data center? --> Learn more here!
The Underground Nexus official repository lives here: https://github.com/Underground-Ops/underground-nexus
Check out how to get started with Underground Nexus quick-start guidance here: https://youtu.be/oXelz-AMwBU
Dockerhub DEVELOPMENT pull for Docker Desktop or amd64 systems: docker run -itd --name=Underground-Nexus -h Underground-Nexus --privileged --init -p 22:22 -p 53:53/tcp -p 53:53/udp -p 80:80 -p 443:443 -p 1000:1000 -p 2375:2375 -p 2376:2376 -p 2377:2377 -p 9010:9010 -p 9050:9443 -p 18443:18443 -v underground-nexus-docker-socket:/var/run -v underground-nexus-data:/var/lib/docker/volumes -v nexus-bucket:/nexus-bucket natoascode/underground-nexus:amd64
Dockerhub SECURE pull for Docker Desktop or amd64 systems: docker run -itd --name=Underground-Nexus -h Underground-Nexus --privileged --init -p 1000:1000 -p 9050:9443 -v underground-nexus-docker-socket:/var/run -v underground-nexus-data:/var/lib/docker/volumes -v nexus-bucket:/nexus-bucket natoascode/underground-nexus:amd64
Dockerhub DEVELOPMENT pull for Apple M1, Raspberry Pi, NVIDIA Jetson and arm64 systems: docker run -itd --name=Underground-Nexus -h Underground-Nexus --privileged --init -p 22:22 -p 53:53/tcp -p 53:53/udp -p 80:80 -p 443:443 -p 1000:1000 -p 2375:2375 -p 2376:2376 -p 2377:2377 -p 9010:9010 -p 9050:9443 -p 18443:18443 -v underground-nexus-docker-socket:/var/run -v underground-nexus-data:/var/lib/docker/volumes -v nexus-bucket:/nexus-bucket natoascode/underground-nexus:arm64
Dockerhub SECURE pull for Apple M1, Raspberry Pi, NVIDIA Jetson and arm64 systems: docker run -itd --name=Underground-Nexus -h Underground-Nexus --privileged --init -p 1000:1000 -p 9050:9443 -v underground-nexus-docker-socket:/var/run -v underground-nexus-data:/var/lib/docker/volumes -v nexus-bucket:/nexus-bucket natoascode/underground-nexus:arm64
IMPORTANT: After deploying the Underground Nexus from the appropriate docker run command for your system, enter the command below for "Install Step 2" in the exact same terminal or console in which the docker run command ran. This script does quite a lot and can take a LONG time to complete - depending on the power of your system and internet speeds it can take anywhere from 15 to 45 minutes to complete activating and initializing the Underground Nexus stack.
ACTIVATE the Underground Nexus (this is the only necessary command to run IMMEDIATELY after deploying the Underground Nexus to activate it):
docker exec Underground-Nexus sh deploy-olympiad.sh
ALTERNATIVE - From inside of either a Docker Desktop shell to the Underground Nexus container or a Portainer shell into the Nexus, enter this command from inside the Underground Nexus container itself for activation:
sh deploy-olympiad.sh
The minimum recommended hardware for the Underground Nexus is the Raspberry Pi 4; anything more powerful will also certainly run the Underground Nexus well (compatible with amd64 and arm systems).
Underground Nexus - Cloud Native Server Architecture: https://github.com/Underground-Ops/underground-nexus/blob/main/Underground_Nexus_Architecture.pdf
Quick Start Guide (ESPECIALLY pay attention to STEP 4 - if using the dockerhub pull, skip to STEP 3 of guide): https://github.com/Underground-Ops/underground-nexus/blob/main/Underground_Nexus_Quick_Guide.pdf
How to use the Underground Nexus - Once Deployed:
1. Access the Nexus MATE admin desktop at "http://localhost:1000" - If deployed on ARM, Visual Studio Code will need to be manually installed. On amd64 builds you will see Visual Studio Code, GitHub Desktop and GitKraken listed in the MATE desktop. (The webtop is a loadbalancer, not just a desktop.)
2. The Underground Nexus is designed to only need one open port to use, for security purposes (port 1000 is the single access port - alternatively, port 9050 is a safe second port to have open due to having https, and optionally port 2000 can be used for a least privileged Security Operation Center dashboard builder - ports beyond these three need to have purpose). Every other port opened should be opened with intention and monitoring, which the Pi hole monitors all default apps by default (the recommended open port for primary access is http://localhost:1000, Portainer with https can be made securely available at https://localhost:9050 and the SOC can be made available optionally at http://localhost:2000 - keep in mind that port 1000 is a portal to root access, so keep security in mind for port 1000).
3. Inside of the Portainer interface, KuberNexus can be found for using Kubernetes. To modify KuberNexus or to create a custom cluster of your own, the MATE admin desktop's terminal works with the k3d command which allows Kubernetes clusters to be built or modifed.
4. Nexus apps are accessible from inside Firefox or any web browser inside the Nexus MATE admin desktop.
5. GitHub makes for an easy-to-use Single Sign On solution for setting up developer tools to use Nexus. Visual Studio Code can be integrated from GitHub with Code Spaces for cloud compute scaling to get more power for development.
6. The Kali shell is secured behind Portainer's login for security purposes by default. Configure Kali Linux for ssh to give ssh access to the entire Nexus through the Kali Athena0 node as a gateway.
7. The Athena0 Kali node happens to be a primary monitoring point for Grafana and Loki and also includes Radare2 (forensics tool used by NSA) for deep analysis that can be monitored with Grafana dashboards.
8. Nexus can be turned into an ultra Pi hole if its DNS server ports are opened when Nexus is deployed (ports 53 and 67). This would allow the Underground Nexus to be used as a company or home SOC that can have data integrated with Pi hole data using Grafana and Loki).
9. Default URLs will show up if Nexus deploys without errors - the links below can be used from inside the Nexus desktop if accessing this GitHub URL from inside the Firefox browser within the Nexus MATE desktop itself (these will ONLY exist from inside a webtop web browser - Firefox works with these addresses from within the Nexus desktops):
user:password is minioadmin:minioadmin)http://10.20.0.1:1000 (runs as root - default user:password is abc:abc - don't access this host from inside the Underground Nexus MATE Desktop)user:password is abc:abc)myroot - it is recommended to not make this port available for access outside of the Underground Nexus)10. Here are the default apps mapped to the development ports if opened for access outside of the Underground Nexus (it's recommended to only open ports 1000 and 9443 unless other ports are being used intentionally - port 22 allows ssh access through a Kali Linux node, and any port being used can be opened as needed, however, Nexus is more securely accessed from inside the Underground Nexus MATE Admin Desktop):
radare2 - must first enable ssh from within Kali Linux to use remote shell access this way)11. From inside Portainer there is a Kali Linux system titled Athena0 (access the terminal with Athena0's >_ icon seen inside of Portainer's menu) - this tool is designed for pentesting and chaos engineering:
terraform), Metasploit (msfconsole), nmap and the Kali Linux Bleeding Edge repository for extensive resource accessdocker exec Athena0 followed by the desired command (for example, try docker exec Athena0 terraform -v)12. Terraform comes pre-installed for immediate use from both the Underground Nexus MATE Desktop's terminal and the Athena0 Kali Linux node:
root privilegesDeploying Virtual Machines in Underground Nexus:
The Underground Nexus can be configured to emulate and run virtual machines inside of its stack with an application called Virtual Machine Manager and can be configured to use QEMU, which is already pre-installed for immediate use upon being deployed.
Please see the images found in the repository for examples on how to use virtual machines to begin configuring emulated virtual systems.
Using Underground Nexus Virtual Machines:
Content type
Image
Digest
sha256:2c3ced333…
Size
6.8 MB
Last updated
over 3 years ago
docker pull natoascode/underground-openvpn