.
continuous-integration/drone/push Build is failing Details

This commit is contained in:
Giles Bradshaw 2020-05-01 23:07:26 +01:00
parent 40aa95d2a9
commit 676611abbf
6 changed files with 120 additions and 15 deletions

View File

@ -0,0 +1,43 @@
version: "3.7"
services:
letsencrypt-registry:
deploy:
placement:
constraints: [node.labels.com.sigyl.git-stack == yes]
replicas: 0
restart_policy:
condition: any
image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-git
environment:
- CERTBOT_EMAIL=${CERTBOT_EMAIL}
- SERVER_NAME=${GIT_DOMAIN}
- REGISTRY_PROXY_PASS=http://registry:5000
volumes:
- letsencrypt-registry:/etc/letsencrypt
networks:
- appnet
ports:
- 5004:5004
registry:
# internal registry #1 (why?)
deploy:
placement:
constraints: [node.labels.com.sigyl.git-stack == yes]
replicas: 1
restart_policy:
condition: any
image: registry:2
volumes:
- registry-data:/var/lib/registry
environment:
- REGISTRY_HTTP_ADDR=0.0.0.0:5000
networks:
- appnet
volumes:
registry-data:
letsencrypt-nginx:
networks:
appnet:
driver: overlay
#external: true

View File

@ -35,8 +35,6 @@ services:
- letsencrypt-git:/etc/letsencrypt - letsencrypt-git:/etc/letsencrypt
networks: networks:
- appnet - appnet
depends_on:
- gitea
ports: ports:
- 80:80 - 80:80
- 443:443 - 443:443
@ -59,8 +57,6 @@ services:
- letsencrypt-drone:/etc/letsencrypt - letsencrypt-drone:/etc/letsencrypt
networks: networks:
- appnet - appnet
depends_on:
- drone-server
gitea: gitea:
# gitea application # gitea application
deploy: deploy:
@ -111,8 +107,6 @@ services:
- BLOG_DOMAIN=${BLOG_DOMAIN} - BLOG_DOMAIN=${BLOG_DOMAIN}
- CHAT_DOMAIN=${CHAT_DOMAIN} - CHAT_DOMAIN=${CHAT_DOMAIN}
- NGROK_AUTH_TOKEN=${NGROK_AUTH_TOKEN} - NGROK_AUTH_TOKEN=${NGROK_AUTH_TOKEN}
depends_on:
- gitea
networks: networks:
- appnet - appnet
drone-server: drone-server:
@ -127,8 +121,6 @@ services:
volumes: volumes:
- drone:/var/lib/drone - drone:/var/lib/drone
- drone-data:/data - drone-data:/data
depends_on:
- gitea
environment: environment:
- DRONE_LOGS_DEBUG=true - DRONE_LOGS_DEBUG=true
- DRONE_LOGS_PRETTY=true - DRONE_LOGS_PRETTY=true
@ -155,8 +147,6 @@ services:
restart_policy: restart_policy:
condition: any condition: any
image: drone/drone-runner-docker:1 image: drone/drone-runner-docker:1
depends_on:
- drone-server
volumes: volumes:
- /var/run/docker.sock:/var/run/docker.sock - /var/run/docker.sock:/var/run/docker.sock
environment: environment:
@ -363,8 +353,6 @@ services:
- appnet - appnet
portainer-agent: portainer-agent:
image: portainer/agent:1.5.1 image: portainer/agent:1.5.1
depends_on:
- portainer
environment: environment:
# REQUIRED: Should be equal to the service name prefixed by "tasks." when # REQUIRED: Should be equal to the service name prefixed by "tasks." when
# deployed inside an overlay network # deployed inside an overlay network

View File

@ -56,6 +56,13 @@ def drone(
"letsencrypt-nginx", "letsencrypt-nginx",
"drone", "drone",
), ),
buildDockerFolder(
"Dockerfile.registry",
"$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
"$${LOCAL_DOCKER_REGISTRY}letsencrypt-registry",
"letsencrypt-nginx",
"registry",
),
scp(base), scp(base),
pull( pull(
"pull images", "pull images",
@ -69,6 +76,12 @@ def drone(
"guacamole-postgresql", "guacamole-postgresql",
], ],
), ),
pull(
"pull registry",
[
"letsencrypt-registry",
],
),
deploy( deploy(
"docker-compose.yml", "docker-compose.yml",
name, name,
@ -77,6 +90,14 @@ def drone(
commands, commands,
ctx ctx
), ),
deploy(
"docker-compose-registry.yml",
'registry',
base,
publicSecrets + secretSecrets,
commands,
ctx
),
], ],
[], [],
[ [

View File

@ -1,6 +1,3 @@
ARG image ARG image
FROM $image FROM $image
COPY website /www/data
COPY ./conf/git.conf /etc/nginx/user.conf.d/server._conf COPY ./conf/git.conf /etc/nginx/user.conf.d/server._conf
COPY git.sh /
CMD sh /git.sh

View File

@ -0,0 +1,3 @@
ARG image
FROM $image
COPY ./conf/registry.conf /etc/nginx/user.conf.d/server._conf

View File

@ -0,0 +1,53 @@
## Set a variable to help us decide if we need to add the
## 'Docker-Distribution-Api-Version' header.
## The registry always sets this header.
## In the case of nginx performing auth, the header is unset
## since nginx is auth-ing before proxying.
map ${DOLLAR}upstream_http_docker_distribution_api_version ${DOLLAR}docker_distribution_api_version {
'' 'registry/2.0';
}
server {
# resolver 127.0.0.11 valid=30s; ## internal docker dns
#listen [::]:3011 default ipv6only=on; ## listen for ipv6
# listen 444
listen 5004 ssl;
# this should allow large docs
client_header_timeout 120s;
client_body_timeout 120s;
client_max_body_size 0;
ssl_certificate /etc/letsencrypt/live/${SERVER_NAME}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${SERVER_NAME}/privkey.pem;
# save logs here
#access_log /var/log/nginx/access.log compression;
# Recommendations from https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
ssl_protocols TLSv1.1 TLSv1.2;
ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
# required to avoid HTTP 411: see Issue #1486 (https://github.com/moby/moby/issues/1486)
chunked_transfer_encoding on;
server_name ${SERVER_NAME};
location /v2/ {
# Do not allow connections from docker 1.5 and earlier
# docker pre-1.6.0 did not properly set the user agent on ping, catch "Go *" user agents
if (${DOLLAR}http_user_agent ~ "^(docker\/1\.(3|4|5(?!\.[0-9]-dev))|Go ).*$" ) {
return 404;
}
add_header 'Docker-Distribution-Api-Version' ${DOLLAR}docker_distribution_api_version always;
proxy_set_header Host ${DOLLAR}http_host;
proxy_set_header X-Real-IP ${DOLLAR}remote_addr;
proxy_set_header X-Forwarded-For ${DOLLAR}proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto ${DOLLAR}scheme;
proxy_buffering off;
proxy_pass ${REGISTRY_PROXY_PASS};
}
}