You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@trafficcontrol.apache.org by de...@apache.org on 2018/08/07 17:30:51 UTC
[trafficcontrol] branch master updated (bde83e6 -> 7229e31)
This is an automated email from the ASF dual-hosted git repository.
dewrich pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git.
from bde83e6 switched from grep/tr/cut pipelines to jq parsing.
new c0467d6 trafficvault in cdn-in-a-box
new add9896 add comments for cdn-in-a-box
new b1ffc32 cleanup
new 7229e31 fix TV port
The 4 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
infrastructure/cdn-in-a-box/docker-compose.yml | 82 ++-
.../cdn-in-a-box/traffic_ops/Dockerfile-db | 1 +
.../traffic_ops/initdb.d/10-create-roles.sh | 5 +
.../traffic_ops/initdb.d/90-load-dumps.sh | 2 +-
infrastructure/cdn-in-a-box/traffic_ops/run-go.sh | 2 +-
infrastructure/cdn-in-a-box/traffic_ops/run.sh | 5 +-
.../traffic_vault/Dockerfile} | 36 +-
.../cdn-in-a-box/traffic_vault/riak.conf | 684 +++++++++++++++++++++
infrastructure/cdn-in-a-box/traffic_vault/run.sh | 125 ++++
infrastructure/cdn-in-a-box/variables.env | 3 +-
10 files changed, 888 insertions(+), 57 deletions(-)
copy infrastructure/{docker/traffic_ops/Dockerfile_psql => cdn-in-a-box/traffic_vault/Dockerfile} (66%)
create mode 100644 infrastructure/cdn-in-a-box/traffic_vault/riak.conf
create mode 100755 infrastructure/cdn-in-a-box/traffic_vault/run.sh
[trafficcontrol] 03/04: cleanup
Posted by de...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dewrich pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git
commit b1ffc3240965cc05fddc8c8f68992474c70615bb
Author: Dan Kirkwood <da...@apache.org>
AuthorDate: Tue Aug 7 11:25:18 2018 -0600
cleanup
---
infrastructure/cdn-in-a-box/variables.env | 2 --
1 file changed, 2 deletions(-)
diff --git a/infrastructure/cdn-in-a-box/variables.env b/infrastructure/cdn-in-a-box/variables.env
index e8ac7d3..3c474f7 100644
--- a/infrastructure/cdn-in-a-box/variables.env
+++ b/infrastructure/cdn-in-a-box/variables.env
@@ -20,14 +20,12 @@ CERT_COUNTRY=US
CERT_STATE=CO
DB_NAME=traffic_ops
DB_PORT=5432
-DB_ROOT_PASS=twelve
DB_SERVER=db
DB_USER=traffic_ops
DB_USER_PASS=twelve
DBIC_TRACE=0
DOMAIN=cdn.local
PGPASSWORD=twelve
-#POSTGRES_USER=traffic_ops
POSTGRES_PASSWORD=twelve
TM_PASSWORD=twelve
TM_USER=tmonitor
[trafficcontrol] 04/04: fix TV port
Posted by de...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dewrich pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git
commit 7229e3185564225183bdfb56cc37eb70ff1a8c9e
Author: Dan Kirkwood <da...@apache.org>
AuthorDate: Tue Aug 7 11:30:29 2018 -0600
fix TV port
---
infrastructure/cdn-in-a-box/docker-compose.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/infrastructure/cdn-in-a-box/docker-compose.yml b/infrastructure/cdn-in-a-box/docker-compose.yml
index 09cf8cf..0bd4f2f 100644
--- a/infrastructure/cdn-in-a-box/docker-compose.yml
+++ b/infrastructure/cdn-in-a-box/docker-compose.yml
@@ -156,7 +156,7 @@ services:
networks:
- tcnet
ports:
- - "80:80"
+ - "8010:80"
mid:
build:
[trafficcontrol] 02/04: add comments for cdn-in-a-box
Posted by de...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dewrich pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git
commit add9896a47e9f8c5678efb40590c5ae3aa13f7cf
Author: Dan Kirkwood <da...@apache.org>
AuthorDate: Tue Aug 7 11:04:12 2018 -0600
add comments for cdn-in-a-box
---
infrastructure/cdn-in-a-box/docker-compose.yml | 58 +++++++++++++++++---------
1 file changed, 39 insertions(+), 19 deletions(-)
diff --git a/infrastructure/cdn-in-a-box/docker-compose.yml b/infrastructure/cdn-in-a-box/docker-compose.yml
index 721039e..09cf8cf 100644
--- a/infrastructure/cdn-in-a-box/docker-compose.yml
+++ b/infrastructure/cdn-in-a-box/docker-compose.yml
@@ -44,6 +44,8 @@ networks:
- subnet: "fc01:9400:1000:8::/64"
services:
+ # db is the Traffic Ops database running in postgresql. Only trafficops and trafficops-perl need to have access to it.
+ # All other components access the database thru the Traffic Ops API
db:
build:
context: traffic_ops
@@ -60,44 +62,50 @@ services:
ports:
- "5432:5432"
- trafficops-perl:
+ # trafficops runs only the Go version of Traffic Ops in a container. All Traffic Ops API endpoints that have
+ # been rewritten in Go will be handled here. All that have not are passed to the trafficops-perl service
+ # defined below
+ trafficops:
build:
context: traffic_ops
- args:
- TRAFFIC_OPS_RPM: traffic_ops.rpm
+ dockerfile: Dockerfile-go
depends_on:
- db
+ - trafficops-perl
domainname: cdn.local
env_file:
- variables.env
- hostname: trafficops-perl
- image: trafficops-perl
+ hostname: trafficops
+ image: trafficops-go
networks:
- tcnet
- # TODO: change to expose: "60443" to limit to containers
ports:
- - "60443:60443"
+ - "6443:6443"
- trafficops:
+ # trafficops-perl runs the legacy Traffic Ops in Perl using the Mojolicious framework. This remains
+ # in place until all API endpoints have been rewritten in Go
+ trafficops-perl:
build:
context: traffic_ops
- dockerfile: Dockerfile-go
+ args:
+ TRAFFIC_OPS_RPM: traffic_ops.rpm
depends_on:
- db
- - trafficops-perl
domainname: cdn.local
env_file:
- variables.env
- hostname: trafficops
- image: trafficops-go
+ hostname: trafficops-perl
+ image: trafficops-perl
networks:
- tcnet
- ports:
- - "6443:6443"
depends_on:
- db
- - trafficops-perl
+ # TODO: change to expose: "60443" to limit to containers
+ ports:
+ - "60443:60443"
+ # trafficportal defines the web interface for Traffic Ops. It uses only the API exposed by Traffic Ops
+ # and passes any /api/... routes directly to Traffic Ops
trafficportal:
build:
context: traffic_portal
@@ -113,6 +121,7 @@ services:
ports:
- "443:443"
+ # trafficmonitor is an HTTP service that monitors the caches in a CDN for a variety of metrics
trafficmonitor:
build:
context: traffic_monitor
@@ -128,15 +137,22 @@ services:
ports:
- "80:80"
+ # trafficvault runs a riak container to store private keys
trafficvault:
- build:
- context: .
- dockerfile: traffic_vault/Dockerfile
+ image: basho/riak-kv
+ ports:
+ - "8087:8087"
+ - "8098:8098"
+ environment:
+ - CLUSTER_NAME=riakkv
+ labels:
+ - "com.basho.riak.cluster.name=trafficvault"
+ volumes:
+ - schemas:/etc/riak/schemas
domainname: cdn.local
env_file:
- variables.env
hostname: trafficvault
- image: trafficvault
networks:
- tcnet
ports:
@@ -163,3 +179,7 @@ services:
- tcnet
ports:
- "9080:80"
+
+volumes:
+ schemas:
+ external: false
[trafficcontrol] 01/04: trafficvault in cdn-in-a-box
Posted by de...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
dewrich pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficcontrol.git
commit c0467d64707de7b061271b6f15cb57c4ab11e83f
Author: Dan Kirkwood <da...@apache.org>
AuthorDate: Thu Aug 2 15:59:31 2018 -0600
trafficvault in cdn-in-a-box
---
infrastructure/cdn-in-a-box/docker-compose.yml | 38 +-
.../cdn-in-a-box/traffic_ops/Dockerfile-db | 1 +
.../traffic_ops/initdb.d/10-create-roles.sh | 5 +
.../traffic_ops/initdb.d/90-load-dumps.sh | 2 +-
infrastructure/cdn-in-a-box/traffic_ops/run-go.sh | 2 +-
infrastructure/cdn-in-a-box/traffic_ops/run.sh | 5 +-
.../Dockerfile-db => traffic_vault/Dockerfile} | 24 +-
.../cdn-in-a-box/traffic_vault/riak.conf | 684 +++++++++++++++++++++
infrastructure/cdn-in-a-box/traffic_vault/run.sh | 125 ++++
infrastructure/cdn-in-a-box/variables.env | 3 +-
10 files changed, 860 insertions(+), 29 deletions(-)
diff --git a/infrastructure/cdn-in-a-box/docker-compose.yml b/infrastructure/cdn-in-a-box/docker-compose.yml
index 942acf8..721039e 100644
--- a/infrastructure/cdn-in-a-box/docker-compose.yml
+++ b/infrastructure/cdn-in-a-box/docker-compose.yml
@@ -52,6 +52,8 @@ services:
domainname: cdn.local
networks:
- tcnet
+ volumes:
+ - ./traffic_ops/data:/var/lib/postgresql/data
env_file:
- variables.env
# TODO: change to expose: "5432" to limit to containers
@@ -79,8 +81,7 @@ services:
trafficops:
build:
context: traffic_ops
- args:
- TRAFFIC_OPS_RPM: traffic_ops.rpm
+ dockerfile: Dockerfile-go
depends_on:
- db
- trafficops-perl
@@ -93,27 +94,10 @@ services:
- tcnet
ports:
- "6443:6443"
- build:
- context: traffic_ops
- dockerfile: Dockerfile-go
depends_on:
- db
- trafficops-perl
- # trafficops-init is a small container that uses admin credentials to add needed data to trafficops
- # after it has successfully started
- trafficops-init:
- build:
- context: traffic_ops
- dockerfile: Dockerfile-init
- depends_on:
- - trafficops
- domainname: cdn.local
- env_file:
- - variables.env
- networks:
- - tcnet
-
trafficportal:
build:
context: traffic_portal
@@ -133,7 +117,7 @@ services:
build:
context: traffic_monitor
args:
- TRAFFIC_PORTAL_RPM: traffic_monitor.rpm
+ TRAFFIC_MONITOR_RPM: traffic_monitor.rpm
domainname: cdn.local
env_file:
- variables.env
@@ -144,6 +128,20 @@ services:
ports:
- "80:80"
+ trafficvault:
+ build:
+ context: .
+ dockerfile: traffic_vault/Dockerfile
+ domainname: cdn.local
+ env_file:
+ - variables.env
+ hostname: trafficvault
+ image: trafficvault
+ networks:
+ - tcnet
+ ports:
+ - "80:80"
+
mid:
build:
context: mid
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db b/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db
index a7620fe..d98a5d3 100644
--- a/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db
+++ b/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db
@@ -21,4 +21,5 @@
FROM postgres:9.6.6
+ENV POSTGRES_PASSWORD=$POSTGRES_PASSWORD
COPY initdb.d /docker-entrypoint-initdb.d
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/10-create-roles.sh b/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/10-create-roles.sh
index 348a08b..ea33476 100755
--- a/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/10-create-roles.sh
+++ b/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/10-create-roles.sh
@@ -20,7 +20,12 @@
set -e
psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+ CREATE USER traffic_ops WITH ENCRYPTED PASSWORD '$POSTGRES_PASSWORD';
CREATE USER telegraf;
CREATE USER grafana;
EOSQL
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" \
+ -tc "SELECT 1 FROM pg_database WHERE datname = '$DB_NAME'" | grep -q 1 || \
+ psql -U postgres -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
+
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/90-load-dumps.sh b/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/90-load-dumps.sh
index dda281a..fe35383 100755
--- a/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/90-load-dumps.sh
+++ b/infrastructure/cdn-in-a-box/traffic_ops/initdb.d/90-load-dumps.sh
@@ -27,5 +27,5 @@ for dump in "$d"/*.dump; do
# convert to sql -- can't load a dump until db initialized, but sql works
echo "Restoring from $dump"
pg_restore -f "$t" $dump
- psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <"$t"
+ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$DB_NAME" <"$t"
done
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/run-go.sh b/infrastructure/cdn-in-a-box/traffic_ops/run-go.sh
index 0992805..27ce0c7 100755
--- a/infrastructure/cdn-in-a-box/traffic_ops/run-go.sh
+++ b/infrastructure/cdn-in-a-box/traffic_ops/run-go.sh
@@ -51,7 +51,7 @@ if [[ -x /config.sh ]]; then
/config.sh
fi
-while ! nc trafficops-perl 60443 </dev/null; do # &>/dev/null; do
+while ! nc trafficops-perl 60443 </dev/null 2>/dev/null; do
echo "waiting for trafficops-perl:60443"
sleep 3
done
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/run.sh b/infrastructure/cdn-in-a-box/traffic_ops/run.sh
index aa7a832..4535787 100755
--- a/infrastructure/cdn-in-a-box/traffic_ops/run.sh
+++ b/infrastructure/cdn-in-a-box/traffic_ops/run.sh
@@ -52,7 +52,7 @@ if [[ -r /config.sh ]]; then
. /config.sh
fi
-while ! nc $DB_SERVER $DB_PORT </dev/null; do # &>/dev/null; do
+while ! nc $DB_SERVER $DB_PORT </dev/null 2>/dev/null ; do
echo "waiting for $DB_SERVER $DB_PORT"
sleep 3
done
@@ -65,8 +65,7 @@ export PATH=/usr/local/go/bin:/opt/traffic_ops/go/bin:$PATH
export GOPATH=/opt/traffic_ops/go
cd $TO_DIR && \
- ./db/admin.pl --env=production reset && \
- ./db/admin.pl --env=production seed || echo "db setup failed!"
+ ./db/admin.pl --env=production upgrade || echo "db upgrade failed!"
# Add admin user -- all other users should be created using API
/adduser.pl $TO_ADMIN_USER $TO_ADMIN_PASSWORD admin | psql -U$DB_USER -h$DB_SERVER $DB_NAME || echo "adding traffic_ops admin user failed!"
diff --git a/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db b/infrastructure/cdn-in-a-box/traffic_vault/Dockerfile
similarity index 63%
copy from infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db
copy to infrastructure/cdn-in-a-box/traffic_vault/Dockerfile
index a7620fe..48b1dfc 100644
--- a/infrastructure/cdn-in-a-box/traffic_ops/Dockerfile-db
+++ b/infrastructure/cdn-in-a-box/traffic_vault/Dockerfile
@@ -16,9 +16,27 @@
# under the License.
############################################################
-# Dockerfile for trafficops db
+# Dockerfile to build Traffic Vault image
+# Based on CentOS 7.2
############################################################
+FROM centos:7
-FROM postgres:9.6.6
+ARG ADMIN_PASS
+ARG USER_PASS
-COPY initdb.d /docker-entrypoint-initdb.d
+# download and install Riak
+RUN curl -s https://packagecloud.io/install/repositories/basho/riak/script.rpm.sh | bash
+RUN yum -y install \
+ epel-release && \
+ yum -y install \
+ initscripts \
+ jq \
+ nmap-ncat \
+ riak && \
+ yum -y clean all && \
+ rm -rf /var/yum/cache
+
+EXPOSE 8098 8087 8088
+ADD to-access.sh /
+ADD traffic_vault/run.sh /
+ENTRYPOINT [ "./run.sh", "/to-access.sh" ]
diff --git a/infrastructure/cdn-in-a-box/traffic_vault/riak.conf b/infrastructure/cdn-in-a-box/traffic_vault/riak.conf
new file mode 100644
index 0000000..c8d6a0a
--- /dev/null
+++ b/infrastructure/cdn-in-a-box/traffic_vault/riak.conf
@@ -0,0 +1,684 @@
+## Where to emit the default log messages (typically at 'info'
+## severity):
+## off: disabled
+## file: the file specified by log.console.file
+## console: to standard output (seen when using `riak attach-direct`)
+## both: log.console.file and standard out.
+##
+## Default: file
+##
+## Acceptable values:
+## - one of: off, file, console, both
+log.console = file
+
+## The severity level of the console log, default is 'info'.
+##
+## Default: info
+##
+## Acceptable values:
+## - one of: debug, info, notice, warning, error, critical, alert, emergency, none
+log.console.level = info
+
+## When 'log.console' is set to 'file' or 'both', the file where
+## console messages will be logged.
+##
+## Default: $(platform_log_dir)/console.log
+##
+## Acceptable values:
+## - the path to a file
+log.console.file = $(platform_log_dir)/console.log
+
+## The file where error messages will be logged.
+##
+## Default: $(platform_log_dir)/error.log
+##
+## Acceptable values:
+## - the path to a file
+log.error.file = $(platform_log_dir)/error.log
+
+## When set to 'on', enables log output to syslog.
+##
+## Default: off
+##
+## Acceptable values:
+## - on or off
+log.syslog = off
+
+## Whether to enable the crash log.
+##
+## Default: on
+##
+## Acceptable values:
+## - on or off
+log.crash = on
+
+## If the crash log is enabled, the file where its messages will
+## be written.
+##
+## Default: $(platform_log_dir)/crash.log
+##
+## Acceptable values:
+## - the path to a file
+log.crash.file = $(platform_log_dir)/crash.log
+
+## Maximum size in bytes of individual messages in the crash log
+##
+## Default: 64KB
+##
+## Acceptable values:
+## - a byte size with units, e.g. 10GB
+log.crash.maximum_message_size = 64KB
+
+## Maximum size of the crash log in bytes, before it is rotated
+##
+## Default: 10MB
+##
+## Acceptable values:
+## - a byte size with units, e.g. 10GB
+log.crash.size = 10MB
+
+## The schedule on which to rotate the crash log. For more
+## information see:
+## https://github.com/basho/lager/blob/master/README.md#internal-log-rotation
+##
+## Default: $D0
+##
+## Acceptable values:
+## - text
+log.crash.rotation = $D0
+
+## The number of rotated crash logs to keep. When set to
+## 'current', only the current open log file is kept.
+##
+## Default: 5
+##
+## Acceptable values:
+## - an integer
+## - the text "current"
+log.crash.rotation.keep = 5
+
+## Name of the Erlang node
+##
+## Default: riak@127.0.0.1
+##
+## Acceptable values:
+## - text
+nodename = riak@0.0.0.0
+
+## Cookie for distributed node communication. All nodes in the
+## same cluster should use the same cookie or they will not be able to
+## communicate.
+##
+## Default: riak
+##
+## Acceptable values:
+## - text
+distributed_cookie = riak
+
+## Sets the number of threads in async thread pool, valid range
+## is 0-1024. If thread support is available, the default is 64.
+## More information at: http://erlang.org/doc/man/erl.html
+##
+## Default: 64
+##
+## Acceptable values:
+## - an integer
+erlang.async_threads = 64
+
+## The number of concurrent ports/sockets
+## Valid range is 1024-134217727
+##
+## Default: 262144
+##
+## Acceptable values:
+## - an integer
+erlang.max_ports = 262144
+
+## Set scheduler forced wakeup interval. All run queues will be
+## scanned each Interval milliseconds. While there are sleeping
+## schedulers in the system, one scheduler will be woken for each
+## non-empty run queue found. An Interval of zero disables this
+## feature, which also is the default.
+## This feature is a workaround for lengthy executing native code, and
+## native code that do not bump reductions properly.
+## More information: http://www.erlang.org/doc/man/erl.html#+sfwi
+##
+## Default: 500
+##
+## Acceptable values:
+## - an integer
+## erlang.schedulers.force_wakeup_interval = 500
+
+## Enable or disable scheduler compaction of load. By default
+## scheduler compaction of load is enabled. When enabled, load
+## balancing will strive for a load distribution which causes as many
+## scheduler threads as possible to be fully loaded (i.e., not run out
+## of work). This is accomplished by migrating load (e.g. runnable
+## processes) into a smaller set of schedulers when schedulers
+## frequently run out of work. When disabled, the frequency with which
+## schedulers run out of work will not be taken into account by the
+## load balancing logic.
+## More information: http://www.erlang.org/doc/man/erl.html#+scl
+##
+## Default: false
+##
+## Acceptable values:
+## - one of: true, false
+## erlang.schedulers.compaction_of_load = false
+
+## Enable or disable scheduler utilization balancing of load. By
+## default scheduler utilization balancing is disabled and instead
+## scheduler compaction of load is enabled which will strive for a
+## load distribution which causes as many scheduler threads as
+## possible to be fully loaded (i.e., not run out of work). When
+## scheduler utilization balancing is enabled the system will instead
+## try to balance scheduler utilization between schedulers. That is,
+## strive for equal scheduler utilization on all schedulers.
+## More information: http://www.erlang.org/doc/man/erl.html#+sub
+##
+## Acceptable values:
+## - one of: true, false
+## erlang.schedulers.utilization_balancing = true
+
+## Number of partitions in the cluster (only valid when first
+## creating the cluster). Must be a power of 2, minimum 8 and maximum
+## 1024.
+##
+## Default: 64
+##
+## Acceptable values:
+## - an integer
+## ring_size = 64
+
+## Number of concurrent node-to-node transfers allowed.
+##
+## Default: 2
+##
+## Acceptable values:
+## - an integer
+## transfer_limit = 2
+
+## Default cert location for https can be overridden
+## with the ssl config variable, for example:
+##
+## Acceptable values:
+## - the path to a file
+ssl.certfile = /etc/riak/certs/cert.pem
+
+## Default key location for https can be overridden with the ssl
+## config variable, for example:
+##
+## Acceptable values:
+## - the path to a file
+ssl.keyfile = /etc/riak/certs/key.pem
+
+## Default signing authority location for https can be overridden
+## with the ssl config variable, for example:
+##
+## Acceptable values:
+## - the path to a file
+ssl.cacertfile = /etc/riak/certs/cacertfile.pem
+
+## DTrace support Do not enable 'dtrace' unless your Erlang/OTP
+## runtime is compiled to support DTrace. DTrace is available in
+## R15B01 (supported by the Erlang/OTP official source package) and in
+## R14B04 via a custom source repository & branch.
+##
+## Default: off
+##
+## Acceptable values:
+## - on or off
+dtrace = off
+
+## Platform-specific installation paths (substituted by rebar)
+##
+## Default: /usr/sbin
+##
+## Acceptable values:
+## - the path to a directory
+platform_bin_dir = /usr/sbin
+
+##
+## Default: /var/lib/riak
+##
+## Acceptable values:
+## - the path to a directory
+platform_data_dir = /var/lib/riak
+
+##
+## Default: /etc/riak
+##
+## Acceptable values:
+## - the path to a directory
+platform_etc_dir = /etc/riak
+
+##
+## Default: /usr/lib64/riak/lib
+##
+## Acceptable values:
+## - the path to a directory
+platform_lib_dir = /usr/lib64/riak/lib
+
+##
+## Default: /var/log/riak
+##
+## Acceptable values:
+## - the path to a directory
+platform_log_dir = /var/log/riak
+
+## Enable consensus subsystem. Set to 'on' to enable the
+## consensus subsystem used for strongly consistent Riak operations.
+##
+## Default: off
+##
+## Acceptable values:
+## - on or off
+## strong_consistency = on
+
+## listener.http.<name> is an IP address and TCP port that the Riak
+## HTTP interface will bind.
+##
+## Default: 127.0.0.1:8098
+##
+## Acceptable values:
+## - an IP/port pair, e.g. 127.0.0.1:10011
+listener.http.internal = 0.0.0.0:8098
+
+## listener.protobuf.<name> is an IP address and TCP port that the Riak
+## Protocol Buffers interface will bind.
+##
+## Default: 127.0.0.1:8087
+##
+## Acceptable values:
+## - an IP/port pair, e.g. 127.0.0.1:10011
+listener.protobuf.internal = 0.0.0.0:8087
+
+## The maximum length to which the queue of pending connections
+## may grow. If set, it must be an integer > 0. If you anticipate a
+## huge number of connections being initialized *simultaneously*, set
+## this number higher.
+##
+## Default: 128
+##
+## Acceptable values:
+## - an integer
+## protobuf.backlog = 128
+
+## listener.https.<name> is an IP address and TCP port that the Riak
+## HTTPS interface will bind.
+##
+## Acceptable values:
+## - an IP/port pair, e.g. 127.0.0.1:10011
+listener.https.internal = 0.0.0.0:8088
+
+## How Riak will repair out-of-sync keys. Some features require
+## this to be set to 'active', including search.
+## * active: out-of-sync keys will be repaired in the background
+## * passive: out-of-sync keys are only repaired on read
+## * active-debug: like active, but outputs verbose debugging
+## information
+##
+## Default: active
+##
+## Acceptable values:
+## - one of: active, passive, active-debug
+anti_entropy = active
+
+## Specifies the storage engine used for Riak's key-value data
+## and secondary indexes (if supported).
+##
+## Default: bitcask
+##
+## Acceptable values:
+## - one of: bitcask, leveldb, memory, multi, prefix_multi
+storage_backend = bitcask
+
+## Simplify prefix_multi configuration for Riak CS. Keep this
+## commented out unless Riak is configured for Riak CS.
+##
+## Acceptable values:
+## - an integer
+## cs_version = 20000
+
+## Controls which binary representation of a riak value is stored
+## on disk.
+## * 0: Original erlang:term_to_binary format. Higher space overhead.
+## * 1: New format for more compact storage of small values.
+##
+## Default: 1
+##
+## Acceptable values:
+## - the integer 1
+## - the integer 0
+object.format = 1
+
+## Reading or writing objects bigger than this size will write a
+## warning in the logs.
+##
+## Default: 5MB
+##
+## Acceptable values:
+## - a byte size with units, e.g. 10GB
+object.size.warning_threshold = 5MB
+
+## Writing an object bigger than this will send a failure to the
+## client.
+##
+## Default: 50MB
+##
+## Acceptable values:
+## - a byte size with units, e.g. 10GB
+object.size.maximum = 50MB
+
+## Writing an object with more than this number of siblings will
+## generate a warning in the logs.
+##
+## Default: 25
+##
+## Acceptable values:
+## - an integer
+object.siblings.warning_threshold = 25
+
+## Writing an object with more than this number of siblings will
+## send a failure to the client.
+##
+## Default: 100
+##
+## Acceptable values:
+## - an integer
+object.siblings.maximum = 100
+
+## Whether to allow list buckets.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.list_buckets = enabled
+
+## Whether to allow streaming list buckets.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.stream_list_buckets = enabled
+
+## Whether to allow list keys.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.list_keys = enabled
+
+## Whether to allow streaming list keys.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.stream_list_keys = enabled
+
+## Whether to allow secondary index queries.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.secondary_index = enabled
+
+## Whether to allow streaming secondary index queries.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.stream_secondary_index = enabled
+
+## Whether to allow term-based map-reduce.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.map_reduce = enabled
+
+## Whether to allow JavaScript map-reduce.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_kv.map_reduce_js = enabled
+
+## A path under which bitcask data files will be stored.
+##
+## Default: $(platform_data_dir)/bitcask
+##
+## Acceptable values:
+## - the path to a directory
+bitcask.data_root = $(platform_data_dir)/bitcask
+
+## Configure how Bitcask writes data to disk.
+## erlang: Erlang's built-in file API
+## nif: Direct calls to the POSIX C API
+## The NIF mode provides higher throughput for certain
+## workloads, but has the potential to negatively impact
+## the Erlang VM, leading to higher worst-case latencies
+## and possible throughput collapse.
+##
+## Default: erlang
+##
+## Acceptable values:
+## - one of: erlang, nif
+bitcask.io_mode = erlang
+
+## Set to 'off' to disable the admin panel.
+##
+## Default: off
+##
+## Acceptable values:
+## - on or off
+riak_control = off
+
+## Authentication mode used for access to the admin panel.
+##
+## Default: off
+##
+## Acceptable values:
+## - one of: off, userlist
+riak_control.auth.mode = off
+
+## If riak control's authentication mode (riak_control.auth.mode)
+## is set to 'userlist' then this is the list of usernames and
+## passwords for access to the admin panel.
+## To create users with given names, add entries of the format:
+## riak_control.auth.user.USERNAME.password = PASSWORD
+## replacing USERNAME with the desired username and PASSWORD with the
+## desired password for that user.
+##
+## Acceptable values:
+## - text
+## riak_control.auth.user.admin.password = pass
+
+## This parameter defines the percentage of total server memory
+## to assign to LevelDB. LevelDB will dynamically adjust its internal
+## cache sizes to stay within this size. The memory size can
+## alternately be assigned as a byte count via leveldb.maximum_memory
+## instead.
+##
+## Default: 70
+##
+## Acceptable values:
+## - an integer
+leveldb.maximum_memory.percent = 70
+
+## Enables or disables the compression of data on disk.
+## Enabling (default) saves disk space. Disabling may reduce read
+## latency but increase overall disk activity. Option can be
+## changed at any time, but will not impact data on disk until
+## next time a file requires compaction.
+##
+## Default: on
+##
+## Acceptable values:
+## - on or off
+leveldb.compression = on
+
+## Selection of compression algorithms. snappy is
+## original compression supplied for leveldb. lz4 is new
+## algorithm that compresses to similar volume but averages twice
+## as fast on writes and four times as fast on reads.
+##
+## Acceptable values:
+## - one of: snappy, lz4
+leveldb.compression.algorithm = lz4
+
+##
+## Default: on
+##
+## Acceptable values:
+## - on or off
+## multi_backend.name.leveldb.compression = on
+
+##
+## Acceptable values:
+## - one of: snappy, lz4
+## multi_backend.name.leveldb.compression.algorithm = lz4
+
+## Whether to allow search queries.
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.riak_search.query = enabled
+
+## To enable Search set this 'on'.
+##
+## Default: off
+##
+## Acceptable values:
+## - on or off
+search = off
+
+## How long Riak will wait for Solr to start. The start sequence
+## will be tried twice. If both attempts timeout, then the Riak node
+## will be shutdown. This may need to be increased as more data is
+## indexed and Solr takes longer to start. Values lower than 1s will
+## be rounded up to the minimum 1s.
+##
+## Default: 30s
+##
+## Acceptable values:
+## - a time duration with units, e.g. '10s' for 10 seconds
+search.solr.start_timeout = 30s
+
+## The port number which Solr binds to.
+## NOTE: Binds on every interface.
+##
+## Default: 8093
+##
+## Acceptable values:
+## - an integer
+search.solr.port = 8093
+
+## The port number which Solr JMX binds to.
+## NOTE: Binds on every interface.
+##
+## Default: 8985
+##
+## Acceptable values:
+## - an integer
+search.solr.jmx_port = 8985
+
+## The options to pass to the Solr JVM. Non-standard options,
+## i.e. -XX, may not be portable across JVM implementations.
+## E.g. -XX:+UseCompressedStrings
+##
+## Default: -d64 -Xms1g -Xmx1g -XX:+UseStringCache -XX:+UseCompressedOops
+##
+## Acceptable values:
+## - text
+search.solr.jvm_options = -d64 -Xms1g -Xmx1g -XX:+UseStringCache -XX:+UseCompressedOops
+
+## The minimum batch size, in number of Riak objects. Any batches that
+## are smaller than this amount will not be immediately flushed to Solr,
+## but are guaranteed to be flushed within the
+## "search.queue.batch.flush_interval".
+##
+## Default: 10
+##
+## Acceptable values:
+## - an integer
+## search.queue.batch.minimum = 10
+
+## The maximum batch size, in number of Riak objects. Any batches that are
+## larger than this amount will be split, where the first
+## search.queue.batch.maximum set of objects will be flushed to Solr, and
+## the remaining objects enqueued for that index will be retained until the
+## next batch is delivered. This parameter ensures that at most
+## "search.queue.batch.maximum object" will be delivered into Solr in any
+## given request.
+##
+## Default: 500
+##
+## Acceptable values:
+## - an integer
+## search.queue.batch.maximum = 500
+
+## The maximum delay between notification to flush batches to Solr. This
+## setting is used to increase or decrease the frequency of batch delivery
+## into Solr, specifically for relatively low-volume input into Riak. This
+## setting ensures that data will be delivered into Solr in accordance with
+## the "search.queue.batch.minimum" and "search.queue.batch.maximum"
+## settings within the specified interval. Batches that are smaller than
+## "search.queue.batch.minimum" will be delivered to Solr within this
+## interval. This setting will generally hav no effect on heavily loaded
+## systems.
+##
+## Default: 500ms
+##
+## Acceptable values:
+## - a time duration with units, e.g. '10s' for 10 seconds
+## - the text "infinity"
+## search.queue.batch.flush_interval = 500ms
+
+## The queue high watermark. If the total number of queued messages in a
+## Solr Queue Worker instance exceeds this limit, then the calling vnode
+## will be blocked until the total number falls below this limit. This
+## parameter exercises flow control between Riak and the Riak
+## Search batching subsystem if writes into Solr start to fall behind.
+##
+## Default: 1000
+##
+## Acceptable values:
+## - an integer
+## search.queue.high_watermark = 1000
+
+## The strategy for how we handle purging when we hit the
+## search.queue.high_watermark.
+## - purge_one -> Removes the oldest item on the queue from an
+## erroring (references to fuses blown in the code) index in
+## order to get below the search.queue.high_watermark.
+## - purge_index -> Removes all items associated with one random
+## erroring (references to fuses blown in the code) index in
+## order to get below the search.queue.high_watermark.
+## - off -> purging is disabled
+##
+## Default: purge_one
+##
+## Acceptable values:
+## - one of: purge_one, purge_index, off
+## search.queue.high_watermark.purge_strategy = purge_one
+
+## Whether to allow Yokozuna queries on this node
+##
+## Default: enabled
+##
+## Acceptable values:
+## - enabled or disabled
+## cluster.job.yokozuna.query = enabled
+
+tls_protocols.tlsv1 = on
diff --git a/infrastructure/cdn-in-a-box/traffic_vault/run.sh b/infrastructure/cdn-in-a-box/traffic_vault/run.sh
new file mode 100755
index 0000000..7cc9625
--- /dev/null
+++ b/infrastructure/cdn-in-a-box/traffic_vault/run.sh
@@ -0,0 +1,125 @@
+#!/bin/bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Script for running the Dockerfile for Traffic Vault.
+# The Dockerfile sets up a Docker image which can be used for any new container;
+# This script, which should be run when the container is run (it's the ENTRYPOINT), will configure the container.
+#
+# The following environment variables must be set (ordinarily by `docker run -e` arguments):
+# ADMIN_PASS
+# USER_PASS
+# CERT_COUNTRY
+# CERT_STATE
+# CERT_CITY
+# CERT_COMPANY
+# TO_URI
+# TO_USER
+# TO_PASS
+# DOMAIN
+# IP
+# GATEWAY
+# CREATE_TO_DB_ENTRY (If set to yes, create the TO db entry for this server if set to no, assume it it already there)
+
+set -e -x
+if [[ -f $1 ]]; then
+ . "$1"
+else
+ echo "Missing function definition file"
+ exit 1
+fi
+
+start() {
+ tail -f /dev/null
+ /etc/init.d/riak restart
+ exec tail -f /var/log/riak/console.log
+}
+
+
+init() {
+ # Set the Riak certs in the config; generated in run.sh
+ sed -i \
+ -e 's%^## ssl.\(certfile\|keyfile\|cacertfile\) =%ssl.\1 =%' \
+ -e 's%^## \(listener.https.internal\)%\1%g' \
+ -e 's%$(platform_etc_dir)/%/etc/riak/certs/%' \
+ -e "s%127.0.0.1%$(hostname -f)%g" \
+ /etc/riak/riak.conf && \
+ echo 'tls_protocols.tlsv1 = on' >> /etc/riak/riak.conf
+
+ while ! nc $TO_HOST $TO_PORT </dev/null 2>/dev/null; do
+ echo "Waiting for $TO_HOST"
+ sleep 3
+ done
+
+ # test communication with traffic_ops
+ to-get api/1.2/cdns | jq -S .response
+# TMP_IP=$IP
+# TMP_DOMAIN=$DOMAIN
+# TMP_GATEWAY=$GATEWAY
+#
+# echo "Got IP: $TMP_IP"
+# echo "Got Domain: $TMP_DOMAIN"
+# echo "Got Gateway: $TMP_GATEWAY"
+#
+# if [ "$CREATE_TO_DB_ENTRY" = "YES" ] ; then
+# TMP_CACHEGROUP_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/cachegroups.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["name"]=="mid-east"]; print match[0]')"
+# echo "Got cachegroup ID: $TMP_CACHEGROUP_ID"
+#
+# TMP_SERVER_TYPE_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/types.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["name"]=="RIAK"]; print match[0]')"
+# echo "Got server type ID: $TMP_SERVER_TYPE_ID"
+#
+# TMP_SERVER_PROFILE_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/profiles.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["name"]=="RIAK_ALL"]; print match[0]')"
+# echo "Got server profile ID: $TMP_SERVER_PROFILE_ID"
+#
+# TMP_PHYS_LOCATION_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/phys_locations.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["name"]=="plocation-nyc-1"]; print match[0]')"
+# echo "Got phys location ID: $TMP_PHYS_LOCATION_ID"
+#
+# TMP_CDN_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/cdns.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["name"]=="cdn"]; print match[0]')"
+# echo "Got cdn ID: $TMP_CDN_ID"
+#
+# curl -v -k -X POST -H "Cookie: mojolicious=$TMP_TO_COOKIE" --data-urlencode "host_name=$HOSTNAME" --data-urlencode "domain_name=$TMP_DOMAIN" --data-urlencode "interface_name=eth0" --data-urlencode "ip_address=$TMP_IP" --data-urlencode "ip_netmask=255.255.0.0" --data-urlencode "ip_gateway=$TMP_GATEWAY" --data-urlencode "interface_mtu=9000" --data-urlencode "cdn=$TMP_CDN_ID" --data-urlencode "cachegroup=$TMP_CACHEGROUP_ID" --data-urlencode "phys_location=$TMP_PHYS_LOCATION_ID" --data-ur [...]
+#
+# fi
+#
+# TMP_SERVER_ID="$(curl -s -k -X GET -H "Cookie: mojolicious=$TMP_TO_COOKIE" $TRAFFIC_OPS_URI/api/1.2/servers.json | python -c 'import json,sys;obj=json.load(sys.stdin);match=[x["id"] for x in obj["response"] if x["hostName"]=="'"$HOSTNAME"'"]; print match[0]')"
+# echo "Got server ID: $TMP_SERVER_ID"
+#
+# curl -v -k -H "Content-Type: application/x-www-form-urlencoded" -H "Cookie: mojolicious=$TMP_TO_COOKIE" -X POST --data-urlencode "id=$TMP_SERVER_ID" --data-urlencode "status=ONLINE" $TRAFFIC_OPS_URI/server/updatestatus
+#
+# openssl req -newkey rsa:2048 -nodes -keyout /etc/riak/certs/server.key -x509 -days 365 -out /etc/riak/certs/server.crt -subj "/C=$CERT_COUNTRY/ST=$CERT_STATE/L=$CERT_CITY/O=$CERT_COMPANY"
+# cp /etc/riak/certs/server.crt /etc/riak/certs/ca-bundle.crt
+#
+# /etc/init.d/riak restart
+# riak-admin security enable
+# riak-admin security add-group admins
+# riak-admin security add-group keysusers
+# riak-admin security add-user admin password=$ADMIN_PASS groups=admins
+# riak-admin security add-user riakuser password=$USER_PASS groups=keysusers
+# riak-admin security add-source riakuser 0.0.0.0/0 password
+# riak-admin security add-source admin 0.0.0.0/0 password
+# riak-admin security grant riak_kv.list_buckets,riak_kv.list_keys,riak_kv.get,riak_kv.put,riak_kv.delete on any to admins
+# riak-admin security grant riak_kv.get,riak_kv.put,riak_kv.delete on default ssl to keysusers
+# riak-admin security grant riak_kv.get,riak_kv.put,riak_kv.delete on default dnssec to keysusers
+# riak-admin security grant riak_kv.get,riak_kv.put,riak_kv.delete on default url_sig_keys to keysusers
+#
+# echo "INITIALIZED=1" >> /etc/environment
+}
+
+source /etc/environment
+if [ -z "$INITIALIZED" ]; then init; fi
+start
+
diff --git a/infrastructure/cdn-in-a-box/variables.env b/infrastructure/cdn-in-a-box/variables.env
index 778ad54..e8ac7d3 100644
--- a/infrastructure/cdn-in-a-box/variables.env
+++ b/infrastructure/cdn-in-a-box/variables.env
@@ -27,7 +27,7 @@ DB_USER_PASS=twelve
DBIC_TRACE=0
DOMAIN=cdn.local
PGPASSWORD=twelve
-POSTGRES_USER=traffic_ops
+#POSTGRES_USER=traffic_ops
POSTGRES_PASSWORD=twelve
TM_PASSWORD=twelve
TM_USER=tmonitor
@@ -39,3 +39,4 @@ TO_PORT=6443
TO_SECRET=blahblah
TP_EMAIL=none
TP_HOST=trafficportal
+TV_HOST=trafficvault