Upgrade to Pro — share decks privately, control downloads, hide ads and more …

突然のグループ一斉在宅勤務開始!!1に
おける働き方を変革する技術や仕組み

 突然のグループ一斉在宅勤務開始!!1に
おける働き方を変革する技術や仕組み

JulyTechFesta 2021 Winterにてペパボのテレワーク開始に伴う課題を解決した技術の話をしました。

Kazuhiko Yamashita

January 24, 2021
Tweet

More Decks by Kazuhiko Yamashita

Other Decks in Programming

Transcript

  1. ڥքϞσϧ ϓϥΠϕʔτ Ϋϥ΢υ ౦ژΦϑΟε ෱ԬΦϑΟε ࣛࣇౡΦϑΟε VPN FW VPN ίϩφՒʹ͓͍ͯ

    ഁ໓!!1 ӕͰ͢ɺ͜͜·Ͱ߽շʹഁ໓͓ͯ͠Βͣɺഁ໓͍͍͔͔ͬͯͨͬͨΒഁ໓ͬͯॻ͖·ͨ͠ɻ ഁ໓ɺϩυϦήε
  2. pam-google-web-oauth-rs SSHೝূΛެ։伴 + OAuthೝূͷଟཁૉೝূԽ͢ΔPAMϞδϡʔϧɻྨࣅʹ google/google-authenticator-libpam ͕͋Δ͕ɺͪ͜Β͸OTPํࣜɻϖύϘ͸G Suiteಋೖ͔ͭG Suiteࣗମ͕2FAඞਢͳͷͰ૊৫ʹϑΟοτ͢Διϑτ΢ΣΞΛ ॻ͍ͨ ݩʑ͸Go

    + CͰॻ͍͍͕ͯͨɺWEB + Linuxϓϩάϥϛϯάͷάϧʔݴޠͱ͠ ͯRustͰॻ͍ͨ΄͏͕εοΩϦॻ͚ͨͷͰษڧΛ݉Ͷͯॻ͖௚ͨ͠ ݱࡏϖύϘͰ͸ओʹ౿Έ୆αʔόʹΠϯετʔϧ͠ɺଟཁૉೝূΛར༻͍ͯ͠Δ
  3. oauth2-proxyΛར༻ͨ͠SSO nginx oauth2-proxy client server { location /oauth2/ { proxy_pass

    http://127.0.0.1:4180; ... } location = /oauth2/auth { proxy_pass http://127.0.0.1:4180; ... } location / { auth_request /oauth2/auth; error_page 401 = /oauth2/sign_in; ... } }
  4. oauth2-proxyΛར༻ͨ͠SSO nginx oauth2-proxy proxy_set_header X-User $user; proxy_set_header X-Email $email; App

    nginx͔ΒϓϩΩγ͢Δ৔߹ʹϦΫΤετϔομʹ ϢʔβʔID΍ϝʔϧΞυϨεΛຒΊࠐΊΔ HTTPϔομΛݩʹSSO͢Δ৔߹ɺ ඞͣΞΫηεݩͷIPΛνΣοΫ͢Δඞ ཁ͕͋Δɻෆਖ਼ͳதܧʹΑͬͯΞΧ΢ ϯτ͕৐ͬऔΒΕΔՄೳੑ͕͋Δɻ
  5. Vault by Hashicorp vault server api.pepabo.com consul-template client consul-template TLS҉߸Խ௨৴

    Vault͕෷͍ग़͢伴Λར༻ͯ͠ɺαʔό ʙ ΫϥΠΞϯτؒͷ ௨৴ΛTLSΫϥΠΞϯτೝূ&௨৴Ͱ҉߸Խ
  6. Vault by Hashicorp vault server api.pepabo.com consul-template client consul-template TLS҉߸Խ௨৴

    Vault͕෷͍ग़͢伴Λར༻ͯ͠ɺαʔό ʙ ΫϥΠΞϯτؒͷ ௨৴ΛTLSΫϥΠΞϯτೝূ&௨৴Ͱ҉߸Խ ΫϥΠΞϯτʹͲͷΑ͏ʹ伴Λ഑෍͢Δ ͷ͔͕େ͖ͳ՝୊ʹͳͬͨ
  7. ڥքϞσϧ ϓϥΠϕʔτ Ϋϥ΢υ ౦ژΦϑΟε ෱ԬΦϑΟε ࣛࣇౡΦϑΟε VPN FW VPN ίϩφՒʹ͓͍ͯ

    ഁ໓!!1 ӕͰ͢ɺ͜͜·Ͱ߽շʹഁ໓͓ͯ͠Βͣɺഁ໓͍͍͔͔ͬͯͨͬͨΒഁ໓ͬͯॻ͖·ͨ͠ɻ ഁ໓ɺϩυϦήε