Nautobot - Installation

1. Informations

1.1. nautobo1.home.lab

Caractéristique
RAM	2 GO
CPU	1 coeur
Disque	10 Go
Hostname	nautobot1.home.lab
IP admin	192.168.50.21

1.2. Documentations

• https://docs.nautobot.com/projects/core/en/v1.2.1/installation/centos/
• https://networktocode.com/blog/installing-nautobot/

2. Installation de PostgreSQL

• https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/installation/install_system/#database-setup

2.1. Installer le package postgresql-server

• Installer le package postgresql-server

$ sudo dnf check-update
$ sudo dnf install -y git python3 python3-devel python3-pip redis
$ sudo dnd install postgresql-server

• Initialiser la base PostgreSQL

sudo postgresql-setup --initdb

• Modifier le fichier : /var/lib/pgsql/data/postgresql.conf

/var/lib/pgsql/data/postgresql.conf

password_encryption = scram-sha-256

• Modifier le fichier: /var/lib/pgsql/data/pg_hba.conf et remplacer "ident" par "scram-sha-256"

• Redémarrer le service postgresql

$ sudo systemctl enable postrgesql
$ sudo systemctl restart postgresql

• Se logger en tant qu'utilisateur postgres

$ sudo -u postgres psql

2.2. Créer la base de données nautobot

• Créer la base de données nautobot

CREATE DATABASE nautobot;
CREATE USER nautobot WITH PASSWORD $PASSWORD;
GRANT ALL PRIVILEGES ON DATABASE nautobot TO nautobot;
\connect nautobot
GRANT CREATE ON SCHEMA public TO nautobot;
\q

3. Installation de Redis

$ sudo yum install redis
$ sudo systemctl enable --now redis

4. Installation de Nautobot

• https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/installation/nautobot/

4.1. Créer l'utilisateur nautobot

• Créer l'utilisateur système nautobot

$ sudo useradd --system --shell /bin/bash --create-home --home-dir /opt/nautobot nautobot

4.2. Créer le virtual env python /opt/nautobot

• Créer le virtual env /opt/nautobot

$ sudo -u nautobot python3 -m venv /opt/nautobot

4.3. Installer le paquet pip nautobot

• Installer le paquet pip nautobot

$ sudo -u nautobot -s /bin/bash
$ pip3 install --upgrade pip wheel
$ pip3 install --no-binary=pyuwsgi nautobot

• Vérifier l'installation de nautobot

$ nautobot-server --version

4.4. Modifier le fichier nautobot_config.py

• Initialiser la configuration de nautobot

nautobot-server init

• Modifier le fichier /opt/nautobot/nautobot_config.py

#TODO : à compléter

/opt/nautobot/nautobot_config.py

ALLOWED_HOSTS = ['nautobot1.home.lab', 'nautobot1']


DATABASES = {

}

4.5. Initialiser la base de données postgresql

• Initialiser la base de données nautobot

$ nautobot-server migrate

• Créer un super utilisateur nautobot admin

$ nautobot-server createsuperuser
Username: admin
Email address: admin@home.lab
Password:
Password (again):
Superuser created successfully.

• Vérifier la configuration de nautobot

$ nautobot-server check

5. Tester le serveur nautobot

• Lancer le serveur nautobot en mode test (pas pour la production !)

$ nautobot-server runserver 0.0.0.0:8000 --insecure

• Ouvrir le port 8000/TCP sur le firewall

$ sudo firewall-cmd --add-port=8000/tcp

• Accéder à l'url : http://nautobot1.home.lab:8000/

6. Configuration de uWSGI

6.1. Créer le fichier uwsgi.ini

• Créer le fichier /opt/nautobot/uwsgi.ini

/opt/nautobot/uwsgi.ini

[uwsgi]
; The IP address (typically localhost) and port that the WSGI process should listen on
socket = 127.0.0.1:8001

; Fail to start if any parameter in the configuration file isn’t explicitly understood by uWSGI
strict = true

; Enable master process to gracefully re-spawn and pre-fork workers
master = true

; Allow Python app-generated threads to run
enable-threads = true

;Try to remove all of the generated file/sockets during shutdown
vacuum = true

; Do not use multiple interpreters, allowing only Nautobot to run
single-interpreter = true

; Shutdown when receiving SIGTERM (default is respawn)
die-on-term = true

; Prevents uWSGI from starting if it is unable load Nautobot (usually due to errors)
need-app = true

; By default, uWSGI has rather verbose logging that can be noisy
disable-logging = true

; Assert that critical 4xx and 5xx errors are still logged
log-4xx = true
log-5xx = true

; Enable HTTP 1.1 keepalive support
http-keepalive = 1

;
; Advanced settings (disabled by default)
; Customize these for your environment if and only if you need them.
; Ref: https://uwsgi-docs.readthedocs.io/en/latest/Options.html
;

; Number of uWSGI workers to spawn. This should typically be 2n+1, where n is the number of CPU cores present.
processes = 3

; If using subdirectory hosting e.g. example.com/nautobot, you must uncomment this line. Otherwise you'll get double paths e.g. example.com/nautobot/nautobot/.
; Ref: https://uwsgi-docs.readthedocs.io/en/latest/Changelog-2.0.11.html#fixpathinfo-routing-action
; route-run = fixpathinfo:

; If hosted behind a load balancer uncomment these lines, the harakiri timeout should be greater than your load balancer timeout.
; Ref: https://uwsgi-docs.readthedocs.io/en/latest/HTTP.html?highlight=keepalive#http-keep-alive
; harakiri = 65
; add-header = Connection: Keep-Alive
; http-keepalive = 1

6.2. Générer le site web, en copiant les fichiers statiques

$ nautobot-server collectstatic

1257 static files copied to '/opt/nautobot/static'.

7. Création du service nautobot

• https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/installation/services/

7.1. Créer le répertoire /var/run/nautobot

• Le répertoire va stocker les pid des services nautobot

$ sudo mkdir /var/run/nautobot
$ sudo chown nautobot:nautobot /var/run/nautobot

7.2. Créer le service nautobot

• Créer le fichier /etc/systemd/system/nautobot.service

/etc/systemd/system/nautobot.service

[Unit]
Description=Nautobot WSGI Service
Documentation=https://docs.nautobot.com/projects/core/en/stable/
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
Environment="NAUTOBOT_ROOT=/opt/nautobot"

User=nautobot
Group=nautobot
RuntimeDirectory=nautobot
RuntimeDirectoryMode=0755
PIDFile=/var/run/nautobot/nautobot.pid
WorkingDirectory=/opt/nautobot

ExecStart=/opt/nautobot/bin/nautobot-server start --pidfile /var/run/nautobot/nautobot.pid --ini /opt/nautobot/uwsgi.ini
ExecStop=/opt/nautobot/bin/nautobot-server start --stop /var/run/nautobot/nautobot.pid
ExecReload=/opt/nautobot/bin/nautobot-server start --reload /var/run/nautobot/nautobot.pid

Restart=on-failure
RestartSec=30
PrivateTmp=true

[Install]
WantedBy=multi-user.target

7.3. Créer le service nautobot-worker

• Créer le fichier /etc/systemd/system/nautobot-worker.service

/etc/systemd/system/nautobot-worker.service

[Unit]
Description=Nautobot Celery Worker
Documentation=https://docs.nautobot.com/projects/core/en/stable/
After=network-online.target
Wants=network-online.target

[Service]
Type=exec
Environment="NAUTOBOT_ROOT=/opt/nautobot"

User=nautobot
Group=nautobot
RuntimeDirectory=nautobot
RuntimeDirectoryMode=0755
PIDFile=/var/run/nautobot/nautobot-worker.pid
WorkingDirectory=/opt/nautobot

ExecStart=/opt/nautobot/bin/nautobot-server celery worker --loglevel INFO --pidfile /var/run/nautobot/nautobot-worker.pid

Restart=always
RestartSec=30
PrivateTmp=true

[Install]
WantedBy=multi-user.target

7.4. Démarrer le service nautobot

$ sudo systemctl daemon-reload
$ sudo systemctl enable --now nautobot
$ sudo systemctl status nautobot

7.5. Démarrer le service nautobot-worker

$ sudo systemctl enable --now nautobot-worker
$ sudo systemctl status nautobot-worker

8. Génération du certificat nautobot

8.1. Générer le certificat

• Générer le cerfificat nautobot1.home.lab

$ sudo ipa-getcert request \
  -f /etc/pki/tls/certs/nautobot1.home.lab.pem \
  -k /etc/pki/tls/private/nautobot1.home.lab.key \
  -K host/nautobot1.home.lab \
  -N "CN=nautobot1.home.lab" \
  -D nautobot1.home.lab \
  -D nautobot1

• Changer les permissions du certificat

$ sudo chmod a+r /etc/pki/tls/certs/nautobot1.home.lab.pem

8.2. Récupérer le certificat de l'Autorité de Certification

• Télécharger le certificat de l'AC (Autorité de Certification)

$ sudo curl http://ipa1.home.lab/ipa/config/ca.crt -o /etc/pki/ca-trust/source/anchors/ca-homelab.pem

• Mettre à jour la base des certificats des AC de confiance

$ sudo update-ca-trust

9. Configuration du serveur web Nginx

9.1. Installer le package nginx

$ sudo yum install nginx

9.2. Modifier les permissions de l'utilisateur nginx

$ sudo usermod -aG nautobot nginx
$ sudo chmod 750 /opt/nautobot

9.3. Configurer nginx

• Modifier le fichier : /etc/nginx/nginx.conf

Désactiver le serveur par défaut écoutant sur le port :80

• Créer le fichier : /etc/nginx/conf.d/nautobot.conf

/etc/nginx/conf.d/nautobot.conf

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;

    server_name _;

    ssl_certificate /etc/pki/tls/certs/nautobot1.home.lab.pem;
    ssl_certificate_key /etc/pki/tls/private/nautobot1.home.lab.key;

    client_max_body_size 25m;

    location /static/ {
        alias /opt/nautobot/static/;
    }

    # For subdirectory hosting, you'll want to toggle this (e.g. `/nautobot/`).
    # Don't forget to set `FORCE_SCRIPT_NAME` in your `nautobot_config.py` to match.
    # location /nautobot/ {
    location / {
        include uwsgi_params;
        uwsgi_pass  127.0.0.1:8001;
        uwsgi_param Host $host;
        uwsgi_param X-Real-IP $remote_addr;
        uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
        uwsgi_param X-Forwarded-Proto $http_x_forwarded_proto;

        # If you want subdirectory hosting, uncomment this. The path must match
        # the path of this location block (e.g. `/nautobot`). For NGINX the path
        # MUST NOT end with a trailing "/".
        # uwsgi_param SCRIPT_NAME /nautobot;
    }

}

server {
    # Redirect HTTP traffic to HTTPS
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

9.4. Configurer SELinux pour Nginx et Nautobot

$ sudo setsebool -P httpd_can_network_connect 1

9.5. Redémarrer le service nginx

$ sudo systemctl restart nginx

9.6. Configurer Firewalld

$ sudo firewall-cmd --permanent --add-port=443/tcp 
$ sudo firewall-cmd --reload

9.7. Tester le serveur nginx+nautobot

• Accèder à l'url : https://nautobot1.home.lab

10. Authentification par LDAP

https://docs.nautobot.com/projects/core/en/stable/user-guide/administration/configuration/authentication/ldap/

10.1. Installer le package openldap-devel

$ sudo dnf install -y openldap-devel

10.2. Installer le plugin nautobot LDAP

$ source /opt/nautobot/bin/activate
$ pip3 install "nautobot[ldap]"
$ echo "nautobot[ldap]" >> /opt/nautobot/local_requirements.txt

10.3. Modifier le fichier nautobot_config.py

nautobot_config.py

AUTHENTICATION_BACKENDS = [
    'django_auth_ldap.backend.LDAPBackend',
    'nautobot.core.authentication.ObjectPermissionBackend',
]

import ldap

# Server URI
AUTH_LDAP_SERVER_URI = "ldaps://ad.example.com"

# Set the path to the trusted CA certificates and create a new internal SSL context.
AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_X_TLS_CACERTFILE: "/opt/nautobot/ca.pem",
    ldap.OPT_X_TLS_NEWCTX: 0
}

# The following may be needed if you are binding to Active Directory.
AUTH_LDAP_CONNECTION_OPTIONS = {
    ldap.OPT_REFERRALS: 0
}

# Set the DN and password for the Nautobot service account.
AUTH_LDAP_BIND_DN = "CN=NAUTOBOTSA, OU=Service Accounts,DC=example,DC=com"
AUTH_LDAP_BIND_PASSWORD = "demo"

from django_auth_ldap.config import LDAPSearch

# This search matches users with the sAMAccountName equal to the provided username. This is required if the user's
# username is not in their DN (Active Directory).
AUTH_LDAP_USER_SEARCH = LDAPSearch("ou=Users,dc=example,dc=com",
                                    ldap.SCOPE_SUBTREE,
                                    "(sAMAccountName=%(user)s)")

# If a user's DN is producible from their username, we don't need to search.
AUTH_LDAP_USER_DN_TEMPLATE = "uid=%(user)s,ou=users,dc=example,dc=com"

# You can map user attributes to Django attributes as so.
AUTH_LDAP_USER_ATTR_MAP = {
    "first_name": "givenName",
    "last_name": "sn",
    "email": "mail"
}

11. Installation de Nautobot Apps

$ pip3 install -r $NAUTOBOT_ROOT/local_requirements.txt

11.1. Firewall models

https://docs.nautobot.com/projects/firewall-models/en/latest/admin/install/#install-guide

11.1.1. Installation

$ sudo -u nautobot -s /bin/bash
$ pip3 install nautobot-firewall-models
$ echo nautobot-firewall-models >> /opt/nautobot/local_requirements.txt

11.1.2. Configuration

• Modifier le fichier nautot_config.py

nautobot_config.py

# In your nautobot_config.py
PLUGINS = ["nautobot_firewall_models"]

# PLUGINS_CONFIG = {
#   "nautobot_firewall_models": {
#     ADD YOUR SETTINGS HERE
#   }
# }

12. Exploitation du service Nautobot

12.1. Mise à jour de nautobot

• Mettre à jour Nautobot

$ nautobot-server post_upgrade

12.2. Redémarrage de nautobot

• Redémarrer les services Nautobot

$ sudo systemctl restart nautobot nautobot-worker