diff options
author | Didier Wenzek <didier.wenzek@acidalie.com> | 2021-03-18 17:22:25 +0000 |
---|---|---|
committer | GitHub <noreply@github.com> | 2021-03-18 17:22:25 +0000 |
commit | 36a8246fc7988f183f1f4d6817c9e7ee1c326a11 (patch) | |
tree | 77bc372b614d248c1bed3a7d9f9f67ec8558d528 /configuration | |
parent | 8a660ab5a355a5d324a23a1e3cb42332d5bc2d78 (diff) |
Remove unused scripts (#99)
Those have been replaced by the `tedge cert` and `tedge connect` commands.
Co-authored-by: Wenzek <diw@softwareag.com>
Diffstat (limited to 'configuration')
7 files changed, 0 insertions, 406 deletions
diff --git a/configuration/broker/configuration/cumulocity/.gitignore b/configuration/broker/configuration/cumulocity/.gitignore deleted file mode 100644 index 6418d3f2..00000000 --- a/configuration/broker/configuration/cumulocity/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -*.key -*.crt -*.conf diff --git a/configuration/broker/configuration/cumulocity/README.md b/configuration/broker/configuration/cumulocity/README.md deleted file mode 100644 index 3fb874d0..00000000 --- a/configuration/broker/configuration/cumulocity/README.md +++ /dev/null @@ -1,139 +0,0 @@ -# Connecting ThinEdge to Cumulocity - -Here is a set of scripts to configure a MQTT channel between a device and Cumulocity. - -If you have no certificate for your device, you can create one for testing purpose: - -``` -./create-self-signed-certificate.sh device-xyz xyz.crt xyz.key -``` - -Since a test certificate is self signed, you need to upload it on Cumulocity to be trusted: - -``` -./upload-certificate.sh device-xyz xyz.crt latest.stage.c8y.io t398942 alice -``` - -The certificate is then used to configure a secured bridge between the local MQTT broker and the Cumulocity MQTT endpoint. - -``` -./create-mosquitto-conf.sh latest.stage.c8y.io device-xyz xyz.crt xyz.key -``` - -You have then to run mosquitto with that configuration: - -``` -mosquitto -c mosquitto.conf -``` - -The bridge can be tested with: -``` -./test-bridge.sh -``` - -Once configured, the bridge: -* ensures that the cloud tenant is authenticated each time the bridge is open, -* uses the device certificate to authenticate the device, -* let any local client connects without any authentication, -* forwards the measurements, events, alarms and templates published on `c8y/#` topics to Cumulocity IoT. -* forwards the responses and operations received from Cumulocity to the corresponding `c8y/#` topics. -* let the local clients use the non-Cumulocity topics as local communication channels. - - -See [Device integration using MQTT](https://cumulocity.com/guides/10.7.0-beta/device-sdk/mqtt/#device-certificates) - -## Pre-requisite - -A cumulocity tenant, user and password, plus an identifier for the device: - -* C8Y: the c8y domain -* TENANT: the c8y tenant ID -* USER: the c8y user -* PASSWORD: ... -* DEVICE: an identifier for the device - -Notes: - -* Cumulocity version 10.7.0 onwards is required for certificate management. -* The scripts assume that mosquitto is installed on the device. -* The user and password are only used when a test certificate is generated, - this certificate having to be uploaded on Cumulocity. - -## Running the bridge - -The bridge is established by mosquitto: - -``` -$ mosquitto -c mosquitto.conf -1603903971: mosquitto version 1.6.9 starting -1603903971: Config loaded from mosquitto.conf. -1603903971: Opening ipv4 listen socket on port 1883. -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/s/ucr -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/s/ut/# -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/s/us -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/t/us -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/q/us -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/c/us -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/s/uc/# -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/t/uc/# -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/q/uc/# -1603903971: Bridge local.my-edge-device doing local SUBSCRIBE on topic c8y/c/uc/# -1603903971: Connecting bridge (step 1) edge_to_c8y (mqtt.latest.stage.c8y.io:8883) -1603903971: Connecting bridge (step 2) edge_to_c8y (mqtt.latest.stage.c8y.io:8883) -1603903971: Bridge my-edge-device sending CONNECT -... - -``` - -Pitfalls -* Ensure no MQTT brocker is already listining on port 1883. -* This might require to stop the mosquitto daemon with `sudo service mosquitto stop`. - -## Testing the bridge - -The script `test-bridge.sh` check the bridge with a round trip between the device and the cloud: - -``` -$ ./test-bridge.sh -[OK] sending and receiving data to and from c8y -[OK] the device certificate is a PEM file -[OK] the device certificate is trusted by c8y -``` - -The c8y topics are prefixed by `c8y/` and any messages publish to one of these sub-topics is forwarded unchanged to Cumulocity: - -For instance, a temperature measurement can be published by the device using a local connection with no credentials: -``` -mosquitto_pub -h 127.0.0.1 --topic c8y/s/us --message "211,21" -``` - -Here is the list of topics forwarded to Cumulocity: -* Subscription - * `c8y/s/ucr` -* Templates - * `c8y/s/ut/#` -* Static templates - * `c8y/s/us` - * `c8y/t/us` - * `c8y/q/us` - * `c8y/c/us` -* SmartRest 2.0 - * `c8y/s/uc/#` - * `c8y/t/uc/#` - * `c8y/q/uc/#` - * `c8y/c/uc/#` - -And the list of topics which can be locally subscribed to to receive responses and commands from Cumulocity: -* Subscription - * `c8y/s/dcr` -* Templates - * `c8y/s/dt` -* Static templates - * `c8y/s/ds` - * `c8y/s/os` -* Debug - * `c8y/s/e` -* SmartRest 2.0 - * `c8y/s/dc/#` - * `c8y/s/oc/#` - diff --git a/configuration/broker/configuration/cumulocity/c8y-trusted-root-certificates.pem b/configuration/broker/configuration/cumulocity/c8y-trusted-root-certificates.pem deleted file mode 100644 index 25f2243f..00000000 --- a/configuration/broker/configuration/cumulocity/c8y-trusted-root-certificates.pem +++ /dev/null @@ -1,6 +0,0 @@ ------BEGIN CERTIFICATE-----
-MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0NlowSjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMTGkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EFq6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWAa6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj/PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIGCCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNvbTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9kc3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAwVAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcCARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAzMDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwuY3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsFAAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJouM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwuX4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlGPfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMTDkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVowPzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQDEw5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4Orz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEqOLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9bxiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaDaeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqGSIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXrAvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZzR8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYoOb8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ
------END CERTIFICATE-----
diff --git a/configuration/broker/configuration/cumulocity/create-mosquitto-conf.sh b/configuration/broker/configuration/cumulocity/create-mosquitto-conf.sh deleted file mode 100755 index b5705b90..00000000 --- a/configuration/broker/configuration/cumulocity/create-mosquitto-conf.sh +++ /dev/null @@ -1,103 +0,0 @@ -#!/usr/bin/env bash -C8Y_URL=$1 -DEVICE_ID=$2 -CERT_PATH=$3 -KEY_PATH=$4 - -if [ -z "$C8Y_URL" -o -z "$DEVICE_ID" -o -z "$CERT_PATH" -o -z "$KEY_PATH" -o "$#" -ne 4 ] -then - echo "usage: $0 C8Y_URL DEVICE_ID CERT_PATH KEY_PATH" - echo - echo "Configure mosquitto to use the given certificate to connect c8y." - exit 1 -fi - -if [ ! -f "$CERT_PATH" ] -then - echo "Certificate file $CERT_PATH not found." - exit 1 -fi -if [ ! -f "$KEY_PATH" ] -then - echo "Private key file $KEY_PATH not found." - exit 1 -fi -if ! (file "$CERT_PATH" | grep -q PEM) -then - echo "[ERROR] The file $CERT_PATH is not a certificate: $(file $CERT_PATH)" - exit 1 -fi -if !(openssl x509 -in $CERT_PATH -noout -subject | grep -q "subject=CN = $DEVICE_ID,") -then - echo "The certificate $CERT_PATH doesn't match the identifier $DEVICE_ID." - exit 1 -fi - -C8Y_CERT=$PWD/c8y-trusted-root-certificates.pem -LOG=stdout -DATA=/tmp - -cat >mosquitto.conf <<EOF -# Only local connections are accepted. No authentication is required. -bind_address 127.0.0.1 -allow_anonymous true - -# Logs -log_dest $LOG -log_type debug -log_type error -log_type warning -log_type notice -log_type information -log_type subscribe # log subscriptions -log_type unsubscribe -connection_messages true # log connections and disconnections - -# Connection, subscription and message data are written to the disk in $DATA/mosquitto.db -persistence true -persistence_location $DATA/ -persistence_file mosquitto.db -autosave_interval 60 # saved every minute - -# Tune for no data-loss, throughput and low memory usage, not for high-concurrency -max_connections 10 -max_inflight_messages 5 # per client -max_queued_messages 20 # per client - -# C8Y Bridge -connection edge_to_c8y -address mqtt.$C8Y_URL:8883 -bridge_cafile $C8Y_CERT -remote_clientid $DEVICE_ID -bridge_certfile $CERT_PATH -bridge_keyfile $KEY_PATH -try_private false -start_type automatic - -### Registration -topic s/dcr in 2 c8y/ "" -topic s/ucr out 2 c8y/ "" - -### Templates -topic s/dt in 2 c8y/ "" -topic s/ut/# out 2 c8y/ "" - -### Static templates -topic s/us out 2 c8y/ "" -topic t/us out 2 c8y/ "" -topic q/us out 2 c8y/ "" -topic c/us out 2 c8y/ "" -topic s/ds in 2 c8y/ "" -topic s/os in 2 c8y/ "" - -### Debug -topic s/e in 0 c8y/ "" - -### SmartRest 2.0 -topic s/uc/# out 2 c8y/ "" -topic t/uc/# out 2 c8y/ "" -topic q/uc/# out 2 c8y/ "" -topic c/uc/# out 2 c8y/ "" -topic s/dc/# in 2 c8y/ "" -topic s/oc/# in 2 c8y/ "" -EOF diff --git a/configuration/broker/configuration/cumulocity/create-self-signed-certificate.sh b/configuration/broker/configuration/cumulocity/create-self-signed-certificate.sh deleted file mode 100755 index 7f62c9f2..00000000 --- a/configuration/broker/configuration/cumulocity/create-self-signed-certificate.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/usr/bin/env bash -DEVICE=$1 -CERT_PATH=$2 -KEY_PATH=$3 - -if [ -z "$DEVICE" -o -z "$CERT_PATH" -o -z "$KEY_PATH" -o "$#" -ne 3 ] -then - echo "usage: $0 IDENTIFIER CERT-PATH KEY-PATH" - echo - echo "Generates a self signed certificate" - echo "using the given IDENTIFIER as common name." - echo - echo "The certificate is stored in CERT-PATH" - echo "The private key is stored in KEY-PATH" - exit 1 -fi - -if [ -f "$CERT_PATH" ] -then - echo "[ERROR] The file $CERT_PATH already exists" - exit 1 -fi - -if [ -f "$KEY_PATH" ] -then - echo "[ERROR] The file $KEY_PATH already exists" - exit 1 -fi - -# see https://www.mkssoftware.com/docs/man1/openssl_req.1.asp - -CONFIG=" -[ req ] -default_bits = 2048 -distinguished_name = dist_name -x509_extensions = v3_ca -output_password = nopass -prompt = no - -[ dist_name ] -commonName = $DEVICE -organizationName = 'Thin Edge' -organizationalUnitName = 'Test Device' - -[ v3_ca ] -basicConstraints = CA:true -" - -openssl req -config <(echo "$CONFIG") -new -nodes -x509 -days 365 -extensions v3_ca -keyout $KEY_PATH -out $CERT_PATH - -if [ -f $CERT_PATH ] -then - echo "[OK] The device certificate is stored in $CERT_PATH" -else - echo "[ERROR] No device certificate has been created" - exit 1 -fi diff --git a/configuration/broker/configuration/cumulocity/test-bridge.sh b/configuration/broker/configuration/cumulocity/test-bridge.sh deleted file mode 100755 index f62832c1..00000000 --- a/configuration/broker/configuration/cumulocity/test-bridge.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/usr/bin/env bash -#---------------------------------------------------------------- -# Test a bi-directionel chanel is established with c8y over MQTT -#---------------------------------------------- - -ACTUAL_ERROR=$( - # Wait for a single error message at most 3 seconds - mosquitto_sub -C 1 -W 3 --topic c8y/s/e 2>&1 & - - # In parallel wait a bit, then send a dummy smart-rest template - sleep 1 - mosquitto_pub --topic c8y/s/us --message "999,foo bar" 2>/dev/null -) -EXPECTED_ERROR="40,999,No static template for this message id" - -if [ "$ACTUAL_ERROR" = "$EXPECTED_ERROR" ] -then - echo "[OK] sending and receiving data to and from c8y" -else - if [ -z "$ACTUAL_ERROR" ] - then - echo "[ERROR] fail to get a response for a message sent to c8y" - echo " Is the error topic s/e replicated over the bridge?" - else - echo "[ERROR] unexpected error: $ACTUAL_ERROR" - echo " Is the bridge running?" - fi - exit 1 -fi diff --git a/configuration/broker/configuration/cumulocity/upload-certificate.sh b/configuration/broker/configuration/cumulocity/upload-certificate.sh deleted file mode 100755 index d18c33a6..00000000 --- a/configuration/broker/configuration/cumulocity/upload-certificate.sh +++ /dev/null @@ -1,69 +0,0 @@ -#!/usr/bin/env bash -DEVICE=$1 -CERT_PATH=$2 -C8Y=$3 -TENANT=$4 -USER=$5 - -if [ -z "$DEVICE" -o -z "$CERT_PATH" -o -z "$C8Y" -o -z "$TENANT" -o -z "$USER" -o "$#" -ne 5 ] -then - echo "usage: $0 DEVICE_ID CERT_PATH C8Y_URL TENANT USER" - echo - echo "Upload the certificate CERT_PATH to c8y." - exit 1 -fi - -if [ ! -f "$CERT_PATH" ] -then - echo "File not found: $CERT_PATH" - exit 1 -fi - -if ! (file "$CERT_PATH" | grep -q PEM) -then - echo "[ERROR] The file $CERT_PATH is not a certificate: $(file $CERT_PATH)" - exit 1 -fi - -echo -n "$USER PASSWORD:" -stty -echo -read PASSWORD -stty echo -echo -HASH=$(echo -n "$TENANT/$USER:$PASSWORD" | base64) - -### Upload request - -CERT=$(cat $CERT_PATH | tr -d '\n') -DATA=$(cat <<EOF -{ "name": "$DEVICE", - "certInPemFormat":"$CERT", - "autoRegistrationEnabled": true, - "status":"ENABLED"} -EOF -) - -if curl --request POST \ - --url https://$TENANT.$C8Y/tenant/tenants/$TENANT/trusted-certificates/ \ - --header "authorization: Basic $HASH" \ - --header 'Content-Type: application/json' \ - --data-raw "$DATA" -then - echo "[OK] the device certificate has been uploaded to c8y" -else - echo "[ERROR] the device certificate has not been uploaded to c8y" -fi - -### Test request - -CERT_ID=$(cat $CERT_PATH | grep -v CERTIFICATE | tr -d '\n') - -if (curl --request GET --silent \ - --url https://$TENANT.$C8Y/tenant/tenants/$TENANT/trusted-certificates/ \ - --header "authorization: Basic $HASH" \ - --header 'Content-Type: application/json' | grep -q "$CERT_ID") -then - echo "[OK] the device certificate is trusted by c8y" -else - echo "[ERROR] the device certificate is not trusted by c8y" -fi |