init Enterprise Quickstart

docs/.vuepress/config.js

@@ -193,11 +193,21 @@ module.exports = {
           title: "Enterprise",
           type: "group",
           collapsable: false,
-          sidebarDepth: 0,
+          sidebarDepth: 2,
+          path: "/enterprise/",
           children: [
             //"",
             "about",
-            "install",
+            {
+              title: "Install",
+              type: "group",
+              collapsable: false,
+              path: "install/",
+              sidebarDepth: 2,
+              children: [
+                "install/quickstart",
+              ],
+            },
             "concepts",
           ],
         },

docs/enterprise/concepts.md

@@ -8,6 +8,10 @@ description: Learn how the Pomerium Enterprise Console works.
 
 ## Namespaces
 
+## Folders
+
+## Service Accounts
+
 ## Routes
 
 ## Policies

docs/enterprise/install.md

@@ -1,32 +0,0 @@
----
-title: Installation
-sidebarDepth: 1
-description: How to install Pomerium Enterprise
----
-
-# Install Pomerium Enterprise
-
-## Before You Begin
-
-## Binaries
-
-:::: tabs
- 
-::: tab deb
-__markdown content__
-:::
- 
- 
-::: tab rpm
-
-:::
-
-::: tab source
-
-:::
-
-::::
-
-### System Service
-
-## Initial Configuration

docs/enterprise/install/quickstart.md

@@ -0,0 +1,183 @@
+---
+title: Quickstart
+sidebarDepth: 1
+description: Demo Pomerium Enterprise
+---
+
+# Pomerium Enterprise Quickstart
+
+## Before You Begin
+
+This guide assumes:
+
+- A non-conainerized environment, either your local computer or a virtual machine (**vm**). While Pomerium is designed to scale with your production environment, we'll leave containerization and infrastructure as code (**IaC**) out for now, to focus on learning how Pomerium Enterprise works.
+   - `root` or `sudo` privlidges on the host.
+- You already have the open-source Pomerium base installed. If not, follow [this doc](/docs/quick-start/binary.md) before you continue.
+   - While an existing route is not required, we suggest implementing one test route to validate your identity provider (**IdP**) configuration.
+- Pomerium Enterprise requires a reltational database. Postgres 9+ and MySQL 5.8+ are supported.
+   - Securing the database connection with TLS may not be required, especially for a local installation, but is strongly recommended for production deployments. Therefor, this guide will assume a TLS-secured database connection.
+- A supported databroker backend. Currently we support Redis.
+   - As with the database, TLS encryption is strongly recommended for production deployments.
+
+## Requirements
+
+For a proof-of-concept local or vm installation, we suggest:
+
+<!-- @travis what specs? -->
+
+For an production deploument, we require:
+
+### System
+
+- The Pomerium Enterprise Console requires Linux amd64/x86_64. It can manage Pomerium instances on other platforms, however.
+- Each Console instance should have at least:
+    - 2 vCPUs
+    - 8G RAM
+    - 100G of disk wherever logs are stored
+- Each Postgres / MySQL instance should have at least:
+    - 4 vCPUs
+    - 8G RAM
+    - 20G for data files
+- Each Redis instance should have at least:
+    - 2 vCPUs
+    - 4G RAM
+    - 20G for data file
+
+### Network
+
+- Layer 4 or Layer 7 load balancers to provide high availability across instances of Pomerium Enterprise Console
+- Layer 4 or Layer 7 load balancers to provide high availability across instances of the Pomerium Cache service from the console
+    - If using Layer 7, your load balancers must support HTTP2
+    - DNS RR can be used in place of load balancers, if L4 or HTTP2 support is not possible
+- Pomerium Enterprise Console must be able to reach the Pomerium Cache service
+- Pomerium Enterprise Console must be able to reach a supported database instance
+- Pomerium Proxy service must be able to forward traffic to the Pomerium Enterprise Console
+
+## Install Pomerium Enterprise Console
+
+Pomerium publishes standard OS packages for RPM and DEB based systems. The repositories require authentication via username and access key. These credentials will be issued to you during the onboarding process.
+
+:::: tabs
+ 
+::: tab deb
+
+1. To automatically configure the repository for Debian and Ubuntu distributions, run the following command replacing `[access-key]`:
+
+   ```bash
+   curl -1sLf \
+   'https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/setup.deb.sh' \
+   | sudo -E bash
+   ```
+
+   Or to manually configure, you can manually import the apt key, then create a new `.list` file in `/etc/apt/source.list.d`. Make sure to replace the distro and version:
+
+   ```bash
+   curl -1sLf 'https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/gpg.B1D0324399CB9BC3.key' | apt-key add -
+
+   echo "deb https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/deb/debian buster main" | sudo tee /apt/sources.list.d/pomerium-console.list
+   ```
+
+1. Update `apt` and install the Pomerium Enterprise Console:
+
+   ```bash
+   sudo apt update; sudo apt install pomerium-console
+   ```
+
+:::
+ 
+ 
+::: tab yum
+
+1. To automatically configure the repository for RHEL based distributions, run the following command replacing `[access-key]`:
+
+   ```bash
+   curl -1sLf \
+   'https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/setup.rpm.sh' \
+   | sudo -E bash
+   ```
+
+   Or to manually configure:
+
+   ```bash
+   yum install yum-utils pygpgme
+   rpm --import 'https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/gpg.B1D0324399CB9BC3.key'
+   curl -1sLf 'https://dl.cloudsmith.io/[access-key]/pomerium/enterprise/config.rpm.txt?distro=el&codename=8' > /tmp/pomerium-enterprise.repo
+   yum-config-manager --add-repo '/tmp/pomerium-enterprise.repo'
+   yum -q makecache -y --disablerepo='*' --enablerepo='pomerium-enterprise'
+   ```
+
+1. Update refresh and install:
+
+   ```bash
+   need to confirm the RHEL commands here
+   ```
+
+:::
+
+::::
+
+### System Service
+
+Once the package is installed, enable and start the system service:
+
+```bash
+sudo systemcrt enable --now pomerium-console
+```
+
+## Initial Configuration
+
+Like the open-source Pomerium base, the Pomerium Enterprise Console is configured through a single config file, located at `/etc/pomerium-console/config.yaml`.
+
+### External Services
+
+First configure the Console to communicate with the database and databroker service:
+
+```yaml
+database_url: pg://user:pass@dbhost.internal.mydomain.com/pomerium?sslmode=require
+databroker_service_url: https://pomerium-cache.internal.mydomain.com
+shared_secret: XXXXXXXXXXXXXXXXXXX
+database_encryption_key: YYYYYYYYYYYYYYYYYYYYYY
+```
+
+For database uri options (especially TLS settings) see the documentation of your particular database driver:
+
+ - [PostgreSQL SSL Support](https://www.postgresql.org/docs/9.1/libpq-ssl.html)
+
+ - [MySQL Connector/ODBC Connection Parameters](https://dev.mysql.com/doc/connector-odbc/en/connector-odbc-configuration-connection-parameters.html)
+
+### Administrators
+
+As a first-time setup step, you must also configure at least one administrator for console access. This user (or users) can then configure additional administrators in the console UI.
+
+```yaml
+administrators: [you@mydomain.com](mailto:you@mydomain.com)
+```
+
+Once you have set permissions in the console UI, you should remove this configuration.
+
+### TLS
+
+Communication between the Pomerium Enterprise Console and Pomerium Core components should always be secured via TLS. You should provide a certificate and key for the console service and may optionally provide a custom CA to verify the *`databroker_service_url`* connection:
+
+```yaml
+tls_ca_file: /etc/pomerium-console/ca.pem
+tls_cert_file: /etc/pomerium-console/cert.pem
+tls_key_file: /etc/pomerium-console/key.pem
+```
+
+
+Once complete, your `/etc/pomerium-console/config.yaml` file should look something like this:
+
+```yaml
+database_url: pg://user:pass@dbhost.internal.mydomain.com/pomerium?sslmode=require
+databroker_service_url: https://pomerium-cache.internal.mydomain.com
+shared_secret: XXXXXXXXXXXXXXXXXXX
+database_encryption_key: YYYYYYYYYYYYYYYYYYYYYY
+
+# change / remove this after initial setup
+administrators: you@mydomain.com
+
+tls_ca_file: /etc/pomerium-console/ca.pem
+tls_cert_file: /etc/pomerium-console/cert.pem
+tls_key_file: /etc/pomerium-console/key.pem
+```

docs/enterprise/install/readme.md

@@ -0,0 +1,7 @@
+---
+title: Install
+lang: en-US
+meta:
+  - name: keywords
+    content: pomerium identity-access-proxy oidc docker reverse-proxy containers install enterprise console
+---

docs/readme.md

@@ -1,2 +1,7 @@
 <!-- Simply redirect back to docs! -->
 <Redirect to="/docs/" />
+
+
+<!--
+The docs project is currently only confirmed to work with Node version 14.17.3 (LTS).
+ -->