[feature] Added openwisp_radius installation

.github/workflows/ci.yml

@@ -28,14 +28,12 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up Python
-        uses: actions/setup-python@v2
-        with:
-          python-version: '3.x'
+      - name: Set default python version
+        run: sudo update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.8 2
 
       - name: Install python dependencies
         run: |
-          pip install molecule[docker,ansible] yamllint ansible-lint docker openwisp-utils[qa]
+          sudo python3 -m pip install molecule[docker] yamllint ansible ansible-lint docker openwisp-utils[qa]
 
       - name: QA checks
         run: |

README.md

@@ -483,6 +483,49 @@ you will update the above playbook as follows:
       OPENWISP_FIRMWARE_UPGRADER_API: true
 ```
 
+Enabling the radius module
+--------------------------
+
+To enable the radius module you need to set `openwisp2_radius` to `true` in
+your `playbook.yml` file. Here's a short summary of how to do this:
+
+**Step 1**: [Install ansible](#install-ansible)
+
+**Step 2**: [Install this role](#install-this-role)
+
+**Step 3**: [Create inventory file](#create-inventory-file)
+
+**Step 4**: Create a playbook file with following contents:
+
+```yaml
+- hosts: openwisp2
+  become: "{{ become | default('yes') }}"
+  roles:
+    - openwisp.openwisp2
+  vars:
+    openwisp2_radius: true
+    openwisp2_freeradius_install: true
+    # set to false when you don't want to register openwisp-radius
+    # API endpoints.
+    openwisp2_radius_urls: true
+```
+
+**Note:** `openwisp2_freeradius_install` option provides a basic configuration of freeradius for openwisp,
+it sets up the [radius user token mechanism](https://openwisp-radius.readthedocs.io/en/latest/user/api.html#radius-user-token-recommended) if you want to use another mechanism or manage your freeradius separately,
+please disable this option by setting it to `false`.
+
+**Step 5**: [Run the playbook](#run-the-playbook)
+
+When the playbook is done running, if you got no errors you can login at:
+
+    https://openwisp2.mydomain.com/admin
+    username: admin
+    password: admin
+
+**Note:** for more information regarding radius configuration options,
+look for the word "radius" in the
+[Role variables](#role-variables) section of this document.
+
 Troubleshooting
 ===============
 
@@ -579,12 +622,22 @@ Below are listed all the variables you can customize (you may also want to take
     - openwisp.openwisp2
   vars:
     # openwisp-controler version
-    openwisp2_controller_version: "0.4"
+    openwisp2_controller_version: "0.8.2"
     # optional openwisp2 modules
     openwisp2_network_topology: false
-    openwisp2_network_topology_version: "0.4"
+    openwisp2_network_topology_version: "0.5.1"
     openwisp2_firmware_upgrader: false
     openwisp2_firmware_upgrader_version: "0.1"
+    openwisp2_radius_version: "0.2.1"
+    # Enable the modules you want to use
+    openwisp2_network_topology: false
+    openwisp2_firmware_upgrader: false
+    openwisp2_radius: false
+    # when openwisp2_radius_urls is set to false, the radius module
+    # is setup but it's urls are not added, which means API and social
+    # views cannot be used, this is helpful if you have an external
+    # radius instance.
+    openwisp2_radius_urls: "{{ openwisp2_radius }}"
     # you may replace the values of these variables with any URL
     # supported by pip (the python package installer)
     # use these to install forks, branches or development versions
@@ -598,6 +651,7 @@ Below are listed all the variables you can customize (you may also want to take
     openwisp2_netjsonconfig_pip: false
     openwisp2_network_topology_pip: false
     openwisp2_firmware_upgrader_pip: false
+    openwisp2_radius_pip: false
     # customize the app_path
     openwisp2_path: /opt/openwisp2
     # It is recommended that you change the value of this variable if you intend to use
@@ -761,6 +815,43 @@ Below are listed all the variables you can customize (you may also want to take
     postfix_smtpd_relay_restrictions_override: permit_mynetworks
     # allows overriding the default duration for keeping notifications
     openwisp2_notifications_delete_old_notifications: 10
+    openwisp2_users_auth_api: true
+    # used for SMS verification, the default is a dummy SMS backend
+    # which prints to standard output and hence does nothing
+    # one of the available providers from django-sendsms can be
+    # used or alternatively, you can write a backend class for your
+    # favorite SMS API gateway
+    openwisp2_radius_sms_backend: "sendsms.backends.console.SmsBackend"
+    openwisp2_radius_sms_token_max_ip_daily: 25
+    openwisp2_radius_delete_old_users: 365
+    openwisp2_radius_cleanup_stale_radacct: 365
+    openwisp2_radius_delete_old_postauth: 365
+    # days for which the radius accounting sessions (radacct) are retained,
+    # 0 means sessions are kept forever.
+    # we highly suggest to set this number according
+    # to the privacy regulation of your jurisdiction
+    openwisp2_radius_delete_old_radacct: 365
+    openwisp2_radius_allowed_hosts: ["127.0.0.1"]
+    # this role provides a default configuration of freeradius
+    # if you manage freeradius on a different machine or you need different configurations
+    # you can disable this default behavior
+    openwisp2_freeradius_install: true
+    # Set an account to expire T seconds after first login.
+    # This variable sets the value of T.
+    freeradius_expire_attr_after_seconds: 86400
+    freeradius_dir: /etc/freeradius/3.0
+    freeradius_mods_available_dir: "{{ freeradius_dir }}/mods-available"
+    freeradius_mods_enabled_dir: "{{ freeradius_dir }}/mods-enabled"
+    freeradius_sites_available_dir: "{{ freeradius_dir }}/sites-available"
+    freeradius_sites_enabled_dir: "{{ freeradius_dir }}/sites-enabled"
+    freeradius_rest:
+        url: "https://{{ inventory_hostname }}/api/v1/freeradius"
+    cron_delete_old_notifications: "'hour': 0, 'minute': 0"
+    cron_deactivate_expired_users: "'hour': 0, 'minute': 5"
+    cron_delete_old_users: "'hour': 0, 'minute': 10"
+    cron_cleanup_stale_radacct: "'hour': 0, 'minute': 20"
+    cron_delete_old_postauth: "'hour': 0, 'minute': 30"
+    cron_delete_old_radacct: "'hour': 1, 'minute': 30"
 ```
 
 Support

defaults/main.yml

@@ -4,9 +4,12 @@ openwisp2_python: python3
 ansible_python_interpreter: /usr/bin/python3
 openwisp2_network_topology: false
 openwisp2_firmware_upgrader: false
+openwisp2_radius: false
+openwisp2_radius_urls: "{{ openwisp2_radius }}"
 openwisp2_controller_version: "0.8.2"
 openwisp2_network_topology_version: "0.5.1"
 openwisp2_firmware_upgrader_version: "0.1"
+openwisp2_radius_version: "0.2.1"
 openwisp2_controller_pip: false
 openwisp2_notifications_pip: false
 openwisp2_users_pip: false
@@ -16,6 +19,7 @@ openwisp2_django_loci_pip: false
 openwisp2_netjsonconfig_pip: false
 openwisp2_network_topology_pip: false
 openwisp2_firmware_upgrader_pip: false
+openwisp2_radius_pip: false
 openwisp2_extra_python_packages: [bpython]
 openwisp2_extra_django_apps: []
 openwisp2_extra_django_settings: {}
@@ -106,3 +110,40 @@ openwisp2_celery_broker_max_tries: 10
 openwisp2_django_celery_logging: false
 openwisp2_postfix_install: true
 postfix_smtpd_relay_restrictions_override: "permit_sasl_authenticated, permit_mynetworks, check_relay_domains, reject_unauth_destination, reject"
+openwisp2_users_auth_api: true
+openwisp2_radius_sms_backend: "sendsms.backends.console.SmsBackend"
+openwisp2_radius_sms_token_max_ip_daily: 25
+openwisp2_radius_delete_old_users: 365
+openwisp2_radius_cleanup_stale_radacct: 365
+openwisp2_radius_delete_old_postauth: 365
+openwisp2_radius_delete_old_radacct: 365
+openwisp2_radius_allowed_hosts: ["127.0.0.1"]
+openwisp2_freeradius_install: true
+freeradius_dir: /etc/freeradius/3.0
+freeradius_mods_available_dir: "{{ freeradius_dir }}/mods-available"
+freeradius_mods_enabled_dir: "{{ freeradius_dir }}/mods-enabled"
+freeradius_mods_config_dir: "{{ freeradius_dir }}/mods-config"
+freeradius_sites_available_dir: "{{ freeradius_dir }}/sites-available"
+freeradius_sites_enabled_dir: "{{ freeradius_dir }}/sites-enabled"
+freeradius_db_map:
+    django.contrib.gis.db.backends.spatialite:
+        driver: rlm_sql_sqlite
+        dialect: sqlite
+    django.contrib.gis.db.backends.postgis:
+        driver: rlm_sql_postgresql
+        dialect: postgresql
+    django.contrib.gis.db.backends.mysql:
+        driver: rlm_sql_mysql
+        dialect: mysql
+freeradius_sql:
+    driver: "{{ freeradius_db_map[openwisp2_database.engine].driver }}"
+    dialect: "{{ freeradius_db_map[openwisp2_database.engine].dialect }}"
+freeradius_rest:
+    url: "https://{{ inventory_hostname }}/api/v1/freeradius"
+freeradius_expire_attr_after_seconds: 86400
+cron_delete_old_notifications: "'hour': 0, 'minute': 0"
+cron_deactivate_expired_users: "'hour': 0, 'minute': 5"
+cron_delete_old_users: "'hour': 0, 'minute': 10"
+cron_cleanup_stale_radacct: "'hour': 0, 'minute': 20"
+cron_delete_old_postauth: "'hour': 0, 'minute': 30"
+cron_delete_old_radacct: "'hour': 1, 'minute': 30"

handlers/main.yml

@@ -18,3 +18,11 @@
   service:
     name: redis
     state: started
+
+- name: update-ca-certificates
+  command: /usr/sbin/update-ca-certificates
+
+- name: restart freeradius
+  service:
+    name: freeradius
+    state: started

molecule/resources/converge.yml

@@ -7,10 +7,15 @@
   vars:
     openwisp2_network_topology: true
     openwisp2_firmware_upgrader: true
+    openwisp2_radius: true
+    # TODO: test help when openwisp-radius 0.3.0 is released!
+    # openwisp2_radius_allowed_hosts: ["0.0.0.0/0"]
 
   pre_tasks:
     - name: Update apt cache
-      apt: update_cache=true cache_valid_time=600
+      apt:
+        update_cache: true
+        cache_valid_time: 600
       when: ansible_os_family == 'Debian'
 
     - name: Remove the .dockerenv file

molecule/resources/verify.yml

@@ -64,3 +64,22 @@
         - name: Show OpenWisp log
           debug:
             var: openwisp_log
+
+    - name: Check Freeradius
+    # TODO: This test should work when openwisp-radius 0.3.0 is released!
+    #   block:
+    #     - name: Get radius-token for admin user
+    #       uri:
+    #         url: "https://{{ inventory_hostname }}/api/v1/default/account/token/"
+    #         validate_certs: false
+    #         method: POST
+    #         body_format: form-urlencoded
+    #         body:
+    #           username: admin
+    #           password: admin
+    #     - name: Check if freeradius is running
+    #       command: radtest admin admin localhost 0 testing123
+    #       register: freeradius_status
+    #       failed_when: '"Received Access-Accept" not in freeradius_status.stdout'
+      debug:
+        msg: "This test should work when openwisp-radius 0.3.0 is released!"

tasks/apt.yml

@@ -92,6 +92,26 @@
   until: result is success
   notify: reload systemd
 
+- name: Install postgresql client drivers
+  when: openwisp2_database.engine == "django.contrib.gis.db.backends.postgis"
+  apt:
+    name: libpq-dev
+  retries: 5
+  delay: 10
+  register: result
+  until: result is success
+
+- name: Install cairo
+  when: openwisp2_radius
+  apt:
+    name:
+      - libcairo2
+      - libpango-1.0-0
+      - libpangocairo-1.0-0
+      - libgdk-pixbuf2.0-0
+      - shared-mime-info
+  tags: [openwisp2, radius]
+
 - name: Install mod-spatialite (may fail on older linux distros)
   when: openwisp2_database.engine == "django.contrib.gis.db.backends.spatialite"
   apt: name=libsqlite3-mod-spatialite

tasks/django.yml

@@ -98,6 +98,9 @@
     group: "{{ www_group }}"
     mode: 0640
 
+- name: start redis for migration
+  meta: flush_handlers
+
 - name: migrate
   notify: reload supervisor
   become: true