lazy-cartesian-product.py

import math
from bigfloat import *

class LazyCartesianProduct:
    def __init__(self, sets, context):
        self.sets = sets
        self.context = context
        self.divs = []
        self.mods = []
        self.maxSize = BigFloat.exact(1)
        self.precompute()

    def precompute(self):
        for i in self.sets:
            self.maxSize = mul(self.maxSize, BigFloat.exact(len(i)), context=self.context)
        factor = BigFloat.exact(1)
        for i in range((len(self.sets) - 1), -1, -1):
            items = BigFloat.exact(str(len(self.sets[i])), precision=self.context.precision)
            self.divs.insert(0, factor)
            self.mods.insert(0, items)
            factor = mul(factor, items, context=self.context)

    def entryAt(self, n):
        if less(n, BigFloat.exact(0)) or greaterequal(n, self.maxSize):
            raise IndexError
        combination = []
        for i in range(0, len(self.sets)):
            d = div(n, self.divs[i], context=self.context)
            m = mod(floor(d, context=self.context), self.mods[i], context=self.context)
            combination.append(int(m))
        return combination

I use this to automate the steps, part of a cloud-init script I made.

#!/bin/bash
apt-update
apt-get upgrade -yq > /dev/null 2>&1
apt-get install -yq apt-transport-https ca-certificates curl gnupg-agent software-properties-common > /dev/null 2>&1
apt-get install -yq apache2-utils wget libnss3-tools ccze jq > /dev/null 2>&1

mkdir -p /etc/systemd/system/docker.service.d/
mkdir /root/.docker
mkdir /etc/docker/certs.d/

curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssl_1.4.1_linux_amd64 -o cfssl
chmod +x cfssl
mv cfssl /usr/local/bin/cfssl
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssljson_1.4.1_linux_amd64 -o cfssljson
chmod +x cfssljson
mv cfssljson /usr/local/bin/cfssljson
curl -L https://github.com/cloudflare/cfssl/releases/download/v1.4.1/cfssl-certinfo_1.4.1_linux_amd64 -o cfssl-certinfo
chmod +x cfssl-certinfo
mv cfssl-certinfo /usr/local/bin/cfssl-certinfo

cat > /root/.docker/ca-config.json <<EOF
{
    "signing": {
        "default": {
            "expiry": "8760h"
        },
        "profiles": {
            "server": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "server auth"
                ]
            },
            "client": {
                "expiry": "8760h",
                "usages": [
                    "signing",
                    "key encipherment",
                    "client auth"
                ]
            }
        }
    }
}
EOF

cat > /root/.docker/ca-csr.json <<EOF
{
    "CN": "localdomain",
    "hosts": [
        "localhost",
        "localhost.localdomain"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 521
    },
    "names": [
        {
            "C": "US",
            "ST": "CA",
            "L": "San Francisco",
            "OU": "CA",
            "O": "<organization>"
        }
    ]
}
EOF

cd /root/.docker
cfssl gencert -initca ca-csr.json | cfssljson -bare ca

cat > /root/.docker/server-csr.json <<EOF
{
    "CN": "server",
    "hosts": [
        "localhost.localdomain",
        "localhost",
        "docker.internal",
        "127.0.0.1",
        "127.0.1.1",
        "172.17.0.1",
        "172.20.20.1"
    ],
    "key": {
        "algo": "ecdsa",
        "size": 521
    },
    "names": [
        {
            "C": "US",
            "ST": "CA",
            "L": "San Francisco",
            "OU": "Server",
            "O": "<organization"
        }
    ]
}
EOF

cat > /root/.docker/client-csr.json <<EOF
{
    "CN": "client",
    "hosts": [""],
    "key": {
        "algo": "ecdsa",
        "size": 521
    },
    "names": [
        {
            "C": "US",
            "ST": "CA",
            "L": "San Francisco",
            "OU": "Client",
            "O": "<organization>"
        }
    ]
}
EOF

cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
--config=ca-config.json \
-profile=server \
server-csr.json | cfssljson -bare server

cfssl gencert \
-ca=ca.pem \
-ca-key=ca-key.pem \
-config=ca-config.json \
-profile=client \
client-csr.json | cfssljson -bare client

cp ca.pem /etc/docker/certs.d/ca.crt
cp client.pem /etc/docker/certs.d/client.pem
cp client-key.pem /etc/docker/certs.d/client.key
chmod -R 600 /etc/docker/certs.d/
chmod 444 /etc/docker/certs.d/ca.crt
chmod 444 /etc/docker/certs.d/client.pem
chmod 400 /etc/docker/certs.d/client.key
chown -R root:docker /etc/docker/certs.d/
chmod 400 ca-key.pem
chmod 444 ca.pem
chmod 400 server-key.pem
chmod 444 server.pem
chmod 400 client-key.pem
chmod 444 client.pem

cp ca.pem /usr/local/share/ca-certificates/localhost.crt
update-ca-certificates

cat > /etc/systemd/system/docker.service.d/override.conf <<EOF
[Unit]
Description=Docker Application Container Engine
Documentation=http://docs.docker.io

[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H tcp://0.0.0.0:2376 --tlsverify --tlscacert /root/.docker/ca.pem --tlscert /root/.docker/server.pem --tlskey /root/.docker/server-key.pem -H unix:///var/run/docker.sock
 
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

echo 'export DOCKER_CERT_PATH=/etc/docker/certs.d/' >> /etc/profile
echo 'export DOCKER_HOST=tcp://127.0.0.1:2376'>> /etc/profile 
echo 'export DOCKER_TLS_VERIFY=1' >> /etc/profile

systemctl daemon-reload
systemctl restart docker