M02_V2 Install TTS through Docker

[toc]

1. Environmental preparation

1.1 Install Certificate Tool

    apt install golang-cfssl

1.2 Install docker-compose

1.2.1 The following two methods are the same, but the github network in some regions is slower, and the other one will be faster.

    wget https://github.com/docker/compose/releases/download/v2.2.2/docker-compose-linux-aarch64 
    or
    wget http://minerback.heltec.cn/download/docker-compose-linux-aarch64

    chmod +x docker-compose-linux-aarch64
    cp docker-compose-linux-aarch64 /usr/bin/docker-compose

2. Configure TTS

2.1 Configure the docker-compose.yml file.

2.1.1 Create a folder to save the docker-compose.yml file.

    mkdir /root/tts
    cd /root/tts  

2.1.2 Enter the TTS installation document interface to download the docker-compose.yml file, or use the following statement to download.

    cd /root/tts  
    wget https://www.thethingsindustries.com/docs/getting-started/installation/configuration/docker-compose-open-source.yml -O docker-compose.yml

Note: When downloading, select the configuration file of the open source project to download. You cannot download the enterprise user configuration file.

2.1.3 Postgres currently has no version requirements. It can be configured as a relatively new and stable version. Here is the selected 15.

    image: postgres:15

2.1.4 Redis currently requires version 6.2, so you can select 6.2 directly.

    image: redis:6.2

2.1.5 The current version of stack is modified directly by 3.22.2. Then because it is used locally, the encryption certificate file is also used locally, so it needs to be commented out # - ./acme:/var/lib/acme. And will be opened with local certificates.

	image: thethingsnetwork/lorawan-stack:3.22.2

    # - ./acme:/var/lib/acme

   secrets:
      - ca.pem
      - cert.pem
      - key.pem

    secrets:
        ca.pem:
            file: ./ca.pem
        cert.pem:
            file: ./cert.pem
        key.pem:
            file: ./key.pem

Note: The above modifications are made in the docker-compose.yml file.

2.2 Configure ttn-lw-stack-docker.yml file

2.2.1 Create a folder to save the ttn-lw-stack-docker.ymll file.

    mkdir -p /root/tts/config/stack
    cd  /root/tts/config/stack

2.2.2 Enter the TTS installation document interface to download the ttn-lw-stack-docker.yml file, or use the following statement to download.

    cd  /root/tts/config/stack
    wget https://www.thethingsindustries.com/docs/getting-started/installation/configuration/ttn-lw-stack-docker-open-source.yml -O ttn-lw-stack-docker.yml

2.2.3 Complete block-key: and hash-key: in # HTTP server configuration. 2.2.3.1 Execute the following command in the shell interface to generate the key.

    openssl rand -hex 32               # generate 32 bytes 
    openssl rand -hex 64               # generate 64 bytes

2.2.3.2 Save the key generated above to the following file.

# HTTP server configuration
http:
  cookie:
    block-key: 'f3043ef59511de9cee7e306718d9cd77e435e5d7f8627a87e2867ce9e438dc63'      # generate 32 bytes (openssl rand -hex 32)
    hash-key: '20ef7adcc58c6ec4fe5cb1e9890c9c48cb68183732948e4e87a9edf0d663e4846022a6225ceae23001fdeae76bd74523e253dac8aeab39875eef3a10579f4c36'   # generate 64 bytes (openssl rand -hex 64)

2.2.4 Modify the encryption file used.

# If using custom certificates:
tls:
   source: file
   root-ca: /run/secrets/ca.pem
   certificate: /run/secrets/cert.pem
   key: /run/secrets/key.pem

# Let's encrypt for "thethings.example.com"
#tls:
# source: 'acme'
# acme:
#   dir: '/var/lib/acme'
#   email: 'you@thethings.example.com'
#   hosts: ['thethings.example.com']
#   default-host: 'thethings.example.com'

2.2.5 Add a dcs in the console.

console:
    dcs:
      base-url: 'https://thethings.example.com/api/v3'

2.2.6 Replace all domain names with LAN IP addresses.
2.2.6.1 Get the LAN IP.

    ifconfig

2.2.6.2 Replace the domain name with the acquired LAN IP.

    identity-server-url: 'https://thethings.example.com/oauth' #Before replacement
    identity-server-url: 'https://192.168.2.106/oauth'         #After replacement

Note：

When replacing, only the domain name can be replaced, and https:// should be reserved.

After each IP transformation, it needs to be replaced again, otherwise it cannot be accessed normally.

Each domain name of the ttn-lw-stack-docker.yml file needs to be replaced.

3. Certificate generation

3.1 Generate ca.pem

3.1.1 Create ca.json and add the data.

    cd /root/tts
    vim ca.json

The following data is used for filling.

{
    "names": [
    {"C": "NL", "ST": "Noord-Holland", "L": "Amsterdam", "O": "The Things Demo"}
    ]
}

3.1.2 Execute the following command to generate.

    cfssl genkey -initca ca.json | cfssljson -bare ca

3.2 Generate key.pem cert.pem

3.2.1 Create cert.json and add the data.

    cd /root/tts
    vim cert.json

The following is the data for filling. The IP address in it needs to be replaced with its own LAN IP.

{
    "hosts": ["192.168.2.106"],
    "names": [
    {"C": "NL", "ST": "Noord-Holland", "L": "Amsterdam", "O": "The Things Demo"}
    ]
}

3.2.2 Execute the following command to generate.

    cfssl gencert -ca ca.pem -ca-key ca-key.pem cert.json | cfssljson -bare cert

3.2.3 you’ll need to rename cert-key.pem to key.pem.

    cp -f cert-key.pem  key.pem

4. Run TTS

4.1 Download image file

    cd /root/tts
    docker-compose pull 

4.2 The database of Identity Server needs to be initialized.

    docker-compose run --rm stack is-db migrate

4.3 You must create an initial administrator user and make sure you give it a good password.

    docker-compose run --rm stack is-db create-admin-user \
    --id admin \
    --email your@email.com

4.4 The command line interface needs to be registered as an OAuth client.

    docker-compose run --rm stack is-db create-oauth-client \
        --id cli \
        --name "Command Line Interface" \
        --owner admin \
        --no-secret \
        --redirect-uri "local-callback" \
        --redirect-uri "code"

4.5 The OAuth client of Console and Network Operations Center needs to be created in Identity Server so that they can use the login function.

    SERVER_ADDRESS="192.168.2.106"
    ID="console"
    NAME="Console"
    CLIENT_SECRET="console"
    REDIRECT_URI="${SERVER_ADDRESS}/console/oauth/callback"
    REDIRECT_PATH="/console/oauth/callback"
    LOGOUT_REDIRECT_URI="${SERVER_ADDRESS}/console"
    LOGOUT_REDIRECT_PATH="/console"
    
    docker-compose run --rm stack is-db create-oauth-client \
        --id ${ID} \
        --name "${NAME}" \
        --owner admin \
        --secret "${CLIENT_SECRET}" \
        --redirect-uri "${REDIRECT_URI}" \
        --redirect-uri "${REDIRECT_PATH}" \
        --logout-redirect-uri "${LOGOUT_REDIRECT_URI}" \
        --logout-redirect-uri "${LOGOUT_REDIRECT_PATH}"

Note: These parameters need to be quoted, and the service address needs to be changed to its own IP address.

4.6 Running The Things Stack

    docker-compose up