24.6. Clustered JBoss EAP 6

1. Go to the VPC tab in the AWS console.
2. Subscribe to the service if needed.
3. Click on "Create new VPC".
4. Choose a VPC with one public and one private subnet.
   1. Set the public subnet to be 10.0.0.0/24.
   2. Set the private subnet to be 10.0.1.0/24.
5. Go to Elastic IPs.
6. Create an elastic IP for use by the mod_cluster proxy/NAT instance.
7. Go to Security groups and create a security group to allow all traffic in and out.
8. Go to Network ACLs
   1. Create an ACL to allow all traffic in and out.
   2. Create an ACL to allow all traffic out and traffic in on only TCP ports 22, 8009, 8080, 8443, 9443, 9990 and 16163.

Procedure 24.8. Launch an Apache HTTP server Instance to Serve as a mod_cluster proxy and a NAT Instance for the VPC

1. Create an elastic IP for this instance.
2. Select an AMI.
3. Go to Security Group and allow all traffic (use Red Hat Enterprise Linux's built-in firewall capabilities to restrict access if desired).
4. Select "running" in the public subnet of the VPC.
5. Select a static IP (e.g. 10.0.0.4).
6. Put the following in the User Data: field:

   JBOSSCONF=disabled
   
   cat > $USER_SCRIPT << "EOS"
   
   echo 1 > /proc/sys/net/ipv4/ip_forward
   echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
   echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
   
   iptables -I INPUT 4 -s 10.0.1.0/24 -p tcp --dport 7654 -j ACCEPT
   iptables -I INPUT 4 -p tcp --dport 80 -j ACCEPT
   
   iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
   iptables -I FORWARD -s 10.0.1.0/24 -j ACCEPT
   iptables -t nat -A POSTROUTING -o eth0 ! -s 10.0.0.4 -j MASQUERADE
   
   # balancer module incompatible with mod_cluster
   sed -i -e 's/LoadModule proxy_balancer_module/#\0/' /etc/httpd/conf/httpd.conf
   
   cat > /etc/httpd/conf.d/mod_cluster.conf << "EOF"
   #LoadModule proxy_module modules/mod_proxy.so
   #LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
   LoadModule slotmem_module modules/mod_slotmem.so
   LoadModule manager_module modules/mod_manager.so
   LoadModule proxy_cluster_module modules/mod_proxy_cluster.so
   LoadModule advertise_module modules/mod_advertise.so
   
   Listen 7654
   
   # workaround JBPAPP-4557
   MemManagerFile /var/cache/mod_proxy/manager
   
   <VirtualHost *:7654>
      <Location /mod_cluster-manager>
         SetHandler mod_cluster-manager
         Order deny,allow
         Deny from all
         Allow from 127.0.0.1
      </Location>
   
      <Location />
         Order deny,allow
         Deny from all
         Allow from 10.
         Allow from 127.0.0.1
      </Location>
   
      KeepAliveTimeout 60
      MaxKeepAliveRequests 0
      ManagerBalancerName mycluster
      ServerAdvertise Off
      EnableMCPMReceive
   </VirtualHost>
   EOF
   
   echo "`hostname | sed -e 's/ip-//' -e 'y/-/./'`        `hostname`" >> /etc/hosts
   
   semanage port -a -t http_port_t -p tcp 7654 #add port in the apache port list for the below to work
   setsebool -P httpd_can_network_relay 1 #for mod_proxy_cluster to work
   chcon -t httpd_config_t -u system_u /etc/httpd/conf.d/mod_cluster.conf
   
   #### Uncomment the following line when launching a managed domain ####
   # setsebool -P httpd_can_network_connect 1
   
   service httpd start
   
   EOS
   

7. Disable the Amazon EC2 cloud source/destination checking for this instance so it can act as a router.
   1. Right-click on the running Apache HTTP server instance and choose "Change Source/Dest check".
   2. Click on Yes, Disable.
8. Assign the elastic IP to this instance.

Procedure 24.9. Configure the VPC Private Subnet Default Route

1. Navigate to the Apache HTTP server instance in the Amazon AWS console.
2. Navigate to the VPC route tables.
3. Click on the routing table used by the private subnet.
4. In the field for a new route enter 0.0.0.0/0.
5. Click on "Select a target".
6. Select "Enter Instance ID".
7. Choose the ID of the running Apache HTTP server instance.

Procedure 24.10. Configure IAM Setup

1. Go to the IAM tab in the AWS console.
2. Click on users.
3. Select Create New Users.
4. Choose a name, and ensure the Generate an access key for each User option is checked.
5. Select Download credentials, and save them in a secure location.
6. Close the window.
7. Click on the newly created user.
8. Make note of the User ARM value. This value is required to set up the S3 bucket, documented here: Section 24.6.9, “Configure S3 Bucket Setup”.

Procedure 24.11. Configure S3 Bucket Setup

1. Open the S3 tab in the AWS console.
2. Click on Create Bucket.
3. Choose a name for the bucket and click Create.

   Note

   Bucket names are unique across the entire S3. Names cannot be reused.
4. Right click on the new bucket and select Properties.
5. Click Add bucket policy in the permissions tab.
6. Click New policy to open the policy creation wizard.
   1. Copy the following content into the new policy, replacing arn:aws:iam::05555555555:user/jbosscluster* with the value defined here: Section 24.6.7, “Configure IAM Setup”. Change both instances of clusterbucket123 to the name of the bucket defined in step 3 of this procedure.

      {
          "Version": "2008-10-17",
          "Id": "Policy1312228794320",
          "Statement": [
              {
                  "Sid": "Stmt1312228781799",
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": [
                          "arn:aws:iam::055555555555:user/jbosscluster"
                      ]
                  },
                  "Action": [
                      "s3:ListBucketVersions",
                      "s3:GetObjectVersion",
                      "s3:ListBucket",
                      "s3:PutBucketVersioning",
                      "s3:DeleteObject",
                      "s3:DeleteObjectVersion",
                      "s3:GetObject",
                      "s3:ListBucketMultipartUploads",
                      "s3:ListMultipartUploadParts",
                      "s3:PutObject",
                      "s3:GetBucketVersioning"
                  ],
                  "Resource": [
                      "arn:aws:s3:::clusterbucket123/*",
                      "arn:aws:s3:::clusterbucket123"
                  ]
              }
          ]
      }