Create a Self-Registering Relay with Chef
While our Relay Guide walks you through setting up an individual relay, you might want to have a self-managed set of relays/gateways that will spin up and down without you needing to generate a token for each one. This Chef recipe will walk you through generating a reusable admin token, which you can reuse, that brings up its own relay or gateway token to register itself to your strongDM organization.
Generating the token
You can generate an admin token that has only one function: creating relay/gateway tokens. Do this in the Admin UI under Settings / Admin Tokens. Select Create under Relays then click the Create button. Copy the token that is printed to screen as you will need it later, and you cannot get it back.
For more detailed information on creating admin tokens, check out the admin token guide.
Creating the recipe
The recipe requires a folder structure like this:
strong-dm├── recipes│ └── default.rb└── templates└── default└── init.sh.erb
There are two files in there, which we'll look at in turn.
template '/usr/local/bin/sdm-init.sh' dosource 'init.sh.erb'variables(myip: node['ec2']['local_ipv4'],admin_token: Chef::EncryptedDataBagItem.load('strongdm', 'admin-token')['content'])mode '0500'owner 'ubuntu'notifies :run, 'execute[sdm-init]', :immediatelyaction :create_if_missingendexecute 'sdm-init' docommand '/usr/local/bin/sdm-init.sh'action :nothingend
Note here that you'll need to have the admin token generated above located in a Chef encrypted data bag.
#!/bin/shsudo -icd /tmpmkdir sdmcd sdmcurl -J -O -L https://app.strongdm.com/releases/cli/linuxunzip *.zipexport SDM_ADMIN_TOKEN=<%= @admin_token %>export SDM_RELAY_TOKEN=`./sdm relay create-gateway <%= @myip %>:5000 0.0.0.0:5000`rm /root/.sdm/*unset SDM_ADMIN_TOKENexport SUDO_USER=ubuntuexport SUDO_UID=1000export USERNAME=rootexport USER=rootexport HOME=/rootexport LOGNAME=rootexport SUDO_GID=1000./sdm install --relay
This script creates a gateway. To make a relay instead, change the
SDM_RELAY_TOKEN line to
./sdm relay create.
Of note here:
- set the correct unprivileged user under
- set the correct port for the gateway to listen on under
- you can optionally name the relay/gateway by adding the
--name <name>flag to the
Verify your new relay/gateway
Log into the Admin UI. In that section, the relay or gateway you created should appear Online, with a heartbeat.
If any errors occur or if the relay does not report "online" status, please contact firstname.lastname@example.org for assistance.