enable wellknown acme challenge

.drone-home.star

@@ -10,9 +10,9 @@ def main(ctx):
     stackRoot,
     stackName,
     [
-      "docker service scale {name}_ngrok=1".format(name=stackName),
+      "docker service scale proxy_ngrok=1".format(name=stackName),
       "docker service scale {name}_chat=1".format(name=stackName),
-      "docker service scale {name}_letsencrypt-drone=1".format(name=stackName),
+      "docker service scale proxy_letsencrypt-drone=1".format(name=stackName),
     ]
   )
   

docker-compose-proxy.yml

@@ -0,0 +1,166 @@
+version: "3.7"
+services:
+  letsencrypt-git:
+    # nginx reverse proxy for all apps (except drone in a subdomain)
+    # automatically obtains and refreshes ssl certificates with letsencrypt
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack == yes]
+      replicas: 1
+      restart_policy:
+        condition: any
+    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-git
+    environment:
+      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
+      - SERVER_NAME=${GIT_DOMAIN}
+      - GIT_PROXY_PASS=http://${SIGYL_STACK_NAME}_gitea:3000/
+      - BLOG_PROXY_PASS=http://${SIGYL_STACK_NAME}_ghost:2368/
+      - CHAT_PROXY_PASS=http://${SIGYL_STACK_NAME}_chat:3000/
+      - COMMENTO_PROXY_PASS=http://${SIGYL_STACK_NAME}_commento:8080/
+      - REMOTE_PROXY_PASS=http://${SIGYL_STACK_NAME}_guacamole:8080/guacamole/
+      - DRONE_PROXY_PASS=http://${SIGYL_STACK_NAME}_drone-server:8080/
+      - REGISTRY_PROXY_PASS=http://registry-1:5000
+      - PORTAINER_PROXY_PASS=http://${SIGYL_STACK_NAME}_portainer:9000/
+      - PORTAINER_LOCATION=/portainer/
+      - MATOMO_PROXY_PASS=http://${SIGYL_STACK_NAME}_matomo-web/
+      - MATOMO_LOCATION=/analytics/
+      - NAGIOS_PROXY_PASS=http://${SIGYL_STACK_NAME}_nagios/
+      - NAGIOS_LOCATION=/nagios/
+      - ZABBIX_PROXY_PASS=http://${SIGYL_STACK_NAME}_zabbix-web:8080/
+      - ZABBIX_LOCATION=/zabbix/
+      - GIT_LOCATION=/git/
+      - BLOG_LOCATION=/
+      - CHAT_LOCATION=/chat/
+      - COMMENTO_LOCATION=/comment/
+      - REMOTE_LOCATION=/remote/
+      - TITLE=$TITLE
+      - DESCRIPTION=$DESCRIPTION
+      - DRONE_REPO_LINK=$DRONE_REPO_LINK
+      - DRONE_COMMIT=$DRONE_COMMIT   
+    volumes:
+      - letsencrypt-git:/etc/letsencrypt
+    networks:
+      - externalnet
+      - appnet
+    ports:
+      - 80:80
+      - 443:443
+      - 5000:5000
+      - 5001:5001
+      - 5005:5005
+  letsencrypt-drone:
+    # reverse proxy for drone in a subdomain
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack-data == yes]
+      replicas: 0
+      restart_policy:
+        condition: any
+    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-drone
+    environment:
+      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
+      - SERVER_NAME=${DRONE_DOMAIN}
+      - PROXY_PASS=http://${SIGYL_STACK_NAME}_drone-server:8080/
+    volumes:
+      - letsencrypt-drone:/etc/letsencrypt
+    networks:
+      - appnet
+      - externalnet
+  ngrok:
+    # ngrok tunnel client
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack == yes]
+      replicas: 0
+      restart_policy:
+        condition: any
+    image: ${LOCAL_DOCKER_REGISTRY}ngrok-gitea
+    ports:
+      - "4040:4040"
+    environment:
+      - GIT_DOMAIN=${GIT_DOMAIN}
+      - DRONE_DOMAIN=${DRONE_DOMAIN}
+      - REMOTE_DOMAIN=${REMOTE_DOMAIN}
+      - BLOG_DOMAIN=${BLOG_DOMAIN}
+      - CHAT_DOMAIN=${CHAT_DOMAIN}
+      - NGROK_AUTH_TOKEN=${NGROK_AUTH_TOKEN}
+    networks:
+      - appnet
+  registry:
+    # internal registry
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack == yes]
+      replicas: 1
+      restart_policy:
+        condition: any
+    image: registry:2
+    volumes:
+      - registry-data:/var/lib/registry
+    environment:
+      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
+      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
+      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
+    networks:
+      - appnet
+    secrets:
+      - registry-cert
+      - registry-key
+    ports:
+      - 5003:5000
+  registry-cache:
+    # registry cache (used?)
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack == yes]
+      replicas: 1
+      restart_policy:
+        condition: any
+    image: registry:2
+    ports:
+      - 5002:5001
+    volumes:
+      - registry-cache-data:/var/lib/registry
+    environment:
+      - REGISTRY_HTTP_ADDR=0.0.0.0:5001
+      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
+      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
+      - REGISTRY_PROXY_REMOTEURL=http://registry-1.docker.io
+    networks:
+      - appnet
+    secrets:
+      - registry-cert
+      - registry-key  
+  registry-1:
+    deploy:
+      placement:
+        constraints: [node.labels.com.sigyl.git-stack == yes]
+      replicas: 1
+      restart_policy:
+        condition: any
+    image: registry:2
+    volumes:
+      - registry-data:/var/lib/registry
+    environment:
+      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
+    networks:
+      - appnet
+      - externalnet
+volumes:
+  letsencrypt-git:
+  letsencrypt-drone:
+  registry-data:
+  registry-cache-data:
+
+networks:
+  appnet:
+    driver: overlay
+    #external: true
+  externalnet:
+    driver: overlay
+    external: true
+secrets:
+  'registry-cert':
+    file: .certificates/registry.crt
+  'registry-key':
+    file: .certificates/registry.key

docker-compose-registry.yml

@@ -1,43 +0,0 @@
-version: "3.7"
-services:
-  letsencrypt-registry:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-registry
-    environment:
-      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
-      - SERVER_NAME=${GIT_DOMAIN}
-      - REGISTRY_PROXY_PASS=http://registry:5000
-    volumes:
-      - letsencrypt-registry:/etc/letsencrypt
-    networks:
-      - appnet
-    ports:
-      - 5004:5004
-  registry:
-    # internal registry #1 (why?)
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: registry:2
-    volumes:
-      - registry-data:/var/lib/registry
-    environment:
-      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
-    networks:
-      - appnet
-volumes:
-  registry-data:
-  letsencrypt-registry:
-
-networks:
-  appnet:
-    driver: overlay
-    #external: true

docker-compose.yml

@@ -1,345 +1,5 @@
 version: "3.7"
 services:
-  letsencrypt-git:
-    # nginx reverse proxy for all apps (except drone in a subdomain)
-    # automatically obtains and refreshes ssl certificates with letsencrypt
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-git
-    environment:
-      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
-      - SERVER_NAME=${GIT_DOMAIN}
-      - GIT_PROXY_PASS=http://gitea:3000/
-      - BLOG_PROXY_PASS=http://ghost:2368/
-      - CHAT_PROXY_PASS=http://chat:3000/
-      - COMMENTO_PROXY_PASS=http://commento:8080/
-      - REMOTE_PROXY_PASS=http://guacamole:8080/guacamole/
-      - DRONE_PROXY_PASS=http://drone-server:8080/
-      - REGISTRY_PROXY_PASS=http://registry-1:5000
-      - PORTAINER_PROXY_PASS=http://portainer:9000/
-      - PORTAINER_LOCATION=/portainer/
-      - MATOMO_PROXY_PASS=http://matomo-web/
-      - MATOMO_LOCATION=/analytics/
-      - NAGIOS_PROXY_PASS=http://nagios/
-      - NAGIOS_LOCATION=/nagios/
-      - ZABBIX_PROXY_PASS=http://zabbix-web:8080/
-      - ZABBIX_LOCATION=/zabbix/
-      - GIT_LOCATION=/git/
-      - BLOG_LOCATION=/
-      - CHAT_LOCATION=/chat/
-      - COMMENTO_LOCATION=/comment/
-      - REMOTE_LOCATION=/remote/
-      - DRONE_SERVER_HOST=$DRONE_SERVER_HOST
-      - TITLE=$TITLE
-      - DESCRIPTION=$DESCRIPTION
-      - DRONE_REPO_LINK=$DRONE_REPO_LINK
-      - DRONE_COMMIT=$DRONE_COMMIT
-      
-    volumes:
-      - letsencrypt-git:/etc/letsencrypt
-    networks:
-      - appnet
-    ports:
-      - 80:80
-      - 443:443
-      - 5000:5000
-      - 5001:5001
-      - 5005:5005
-  letsencrypt-drone:
-    # reverse proxy for drone in a subdomain
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 0
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}letsencrypt-drone
-    environment:
-      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
-      - SERVER_NAME=${DRONE_DOMAIN}
-      - PROXY_PASS=http://drone-server:8080/
-    volumes:
-      - letsencrypt-drone:/etc/letsencrypt
-    networks:
-      - appnet
-  gitea:
-    # gitea application
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}gitea
-    environment:
-      - USER_UID=1000
-      - USER_GID=1000
-      - ROOT_URL=https://${GIT_DOMAIN}/git
-      - SSH_DOMAIN=${GIT_DOMAIN}
-      - GITEA_APP_NAME=${GITEA_APP_NAME}
-      - GIT_DOMAIN=${GIT_DOMAIN}
-      - GITEA_SERVER_LFS_JWT_SECRET=$GITEA_SERVER_LFS_JWT_SECRET
-      - GITEA_SECURITY_SECRET_KEY=$GITEA_SECURITY_SECRET_KEY
-      - GITEA_SECURITY_INTERNAL_TOKEN=$GITEA_SECURITY_INTERNAL_TOKEN
-      - GITEA_OAUTH2_JWT_SECRET=$GITEA_OAUTH2_JWT_SECRET
-      - GITEA_MAILER_HOST=$GITEA_MAILER_HOST
-      - GITEA_MAILER_USER=$GITEA_MAILER_USER
-      - GITEA_MAILER_FROM=$GITEA_MAILER_FROM
-      - GITEA_MAILER_PASSWD=$GITEA_MAILER_PASSWD
-
-    volumes:
-      - gitea-app:/data
-    ports:
-      - 3000:3000
-      - 22:22
-    networks:
-      - appnet
-  ngrok:
-    # ngrok tunnel client
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 0
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}ngrok-gitea
-    ports:
-      - "4040:4040"
-    environment:
-      - GIT_DOMAIN=${GIT_DOMAIN}
-      - DRONE_DOMAIN=${DRONE_DOMAIN}
-      - REMOTE_DOMAIN=${REMOTE_DOMAIN}
-      - BLOG_DOMAIN=${BLOG_DOMAIN}
-      - CHAT_DOMAIN=${CHAT_DOMAIN}
-      - NGROK_AUTH_TOKEN=${NGROK_AUTH_TOKEN}
-    networks:
-      - appnet
-  drone-server:
-    # drone server application
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: drone/drone:1.7.0
-    volumes:
-      - drone:/var/lib/drone
-      - drone-data:/data
-    environment:
-      - DRONE_LOGS_DEBUG=true
-      - DRONE_LOGS_PRETTY=true
-      - DRONE_GITEA_SERVER=${DRONE_GITEA_SERVER}
-      - DRONE_GITEA_CLIENT_ID=${DRONE_GITEA_CLIENT_ID}
-      - DRONE_GITEA_CLIENT_SECRET=${DRONE_GITEA_CLIENT_SECRET}
-      - DRONE_SERVER_HOST=${DRONE_SERVER_HOST} # tunnel hostname       
-      - DRONE_ADMIN=giles
-      - DRONE_SERVER_PROTO=https # tunnel adds https on top
-      - DRONE_SERVER_PORT=:8080
-      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
-      - DRONE_USER_CREATE=username:giles,admin:true
-      - DRONE_AGENTS_ENABLED=true
-      - DRONE_CONVERT_PLUGIN_ENDPOINT=http://drone-starlark:3000
-      - DRONE_CONVERT_PLUGIN_SECRET=${DRONE_CONVERT_SECRET}
-    networks:
-      - appnet
-  drone-docker-runner:
-    # drone runner performs builds
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: drone/drone-runner-docker:1
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-    environment:
-      - DRONE_RPC_PROTO=https
-      - DRONE_RPC_HOST=${DRONE_SERVER_HOST}
-      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
-      - DRONE_RUNNER_CAPACITY=8
-      - DRONE_RUNNER_NAME="docker-runner"
-  drone-starlark:
-    # drone starlark server converts starlark to yaml
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}drone-starlark
-    environment:
-      - DRONE_DEBUG=true
-      - DRONE_SECRET=${DRONE_CONVERT_SECRET}
-      - DRONE_STARLARK_REPO_PATHS=this:/repos
-      - SIGYL_STACK_NAME=$SIGYL_STACK_NAME
-      - SIGYL_STACK_ROOT=$SIGYL_STACK_ROOT
-    networks:
-      - appnet
-  registry:
-    # internal registry
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: registry:2
-    volumes:
-      - registry-data:/var/lib/registry
-    environment:
-      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
-      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
-      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
-    networks:
-      - appnet
-    secrets:
-      - registry-cert
-      - registry-key
-    ports:
-      - 5003:5000
-  registry-1:
-    # internal registry #1 (why?)
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: registry:2
-    volumes:
-      - registry-data:/var/lib/registry
-    environment:
-      - REGISTRY_HTTP_ADDR=0.0.0.0:5000
-    networks:
-      - appnet
-  registry-cache:
-    # registry cache (used?)
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: registry:2
-    ports:
-      - 5002:5001
-    volumes:
-      - registry-cache-data:/var/lib/registry
-    environment:
-      - REGISTRY_HTTP_ADDR=0.0.0.0:5001
-      - REGISTRY_HTTP_TLS_CERTIFICATE="/run/secrets/registry-cert"
-      - REGISTRY_HTTP_TLS_KEY="/run/secrets/registry-key"
-      - REGISTRY_PROXY_REMOTEURL=http://registry-1.docker.io
-    networks:
-      - appnet
-    secrets:
-      - registry-cert
-      - registry-key  
-  ghost:
-    # ghost blog
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}ghost
-    volumes:
-      - ghost-content-images:/var/lib/ghost/content/images
-      - ghost-content-settings:/var/lib/ghost/content/settings
-      - ghost-content-adapters:/var/lib/ghost/content/adapters
-      - ghost-content-data:/var/lib/ghost/content/data
-      - ghost-content-logs:/var/lib/ghost/content/logs
-      
-    environment:
-      - GIT_DOMAIN=$GIT_DOMAIN
-      - GHOST-MAIL-SERVICE=$GHOST-MAIL-SERVICE
-      - GHOST-MAIL-USER=$GHOST-MAIL-USER
-      - GHOST-MAIL-PASSWORD=$GHOST-MAIL-PASSWORD
-      - COMMENTO_ORIGIN=$COMMENTO_ORIGIN
-      - database__client=mysql
-      - database__connection__host=ghost-mysql
-      - database__connection__user=root
-      - database__connection__password=$GHOST_MYSQL_ROOT_PASSWORD
-      - database__connection__database=ghost
-    networks:
-      - appnet
-  ghost-mysql:
-    image: mysql:5.7
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    volumes:
-      - ghost-data:/var/lib/mysql
-    environment:
-      MYSQL_ROOT_PASSWORD: $GHOST_MYSQL_ROOT_PASSWORD
-    networks:
-      - appnet
-
-  commento:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: registry.gitlab.com/commento/commento:latest
-    environment:
-      COMMENTO_ORIGIN: $COMMENTO_ORIGIN
-      COMMENTO_SMTP_PASSWORD: $COMMENTO_SMTP_PASSWORD
-      COMMENTO_ASKIMET_KEY: $COMMENTO_ASKIMET_KEY
-      COMMENTO_SMTP_HOST: $COMMENTO_SMTP_HOST
-      COMMENTO_SMTP_PORT: $COMMENTO_SMTP_PORT
-      COMMENTO_SMTP_USERNAME: $COMMENTO_SMTP_USERNAME
-      COMMENTO_SMTP_FROM_ADDRESS: $COMMENTO_SMTP_FROM_ADDRESS
-      COMMENTO_GITHUB_KEY: $COMMENTO_GITHUB_KEY
-      COMMENTO_GITHUB_SECRET: $COMMENTO_GITHUB_SECRET
-      COMMENTO_FORBID_NEW_OWNERS: $COMMENTO_FORBID_NEW_OWNERS
-      COMMENTO_PORT: 8080
-      COMMENTO_POSTGRES: postgres://${COMMENTO_POSTGRES_USER}:${COMMENTO_POSTGRES_PASSWORD}@commento-postgres:5432/${COMMENTO_POSTGRES_DB}?sslmode=disable
-    networks:
-      - appnet
-  commento-postgres:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: postgres:11-alpine
-    environment:
-      POSTGRES_DB: ${COMMENTO_POSTGRES_DB}
-      POSTGRES_USER: ${COMMENTO_POSTGRES_USER}
-      POSTGRES_PASSWORD: ${COMMENTO_POSTGRES_PASSWORD}
-    networks:
-      - appnet
-    volumes:
-      - commento-postgresql-data:/var/lib/postgresql/data
-  guacamole-postgresql:
-    # database for guacamole
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: ${LOCAL_DOCKER_REGISTRY}guacamole-postgresql:latest
-    environment:
-      POSTGRES_PASSWORD: ${GUACAMOLE_POSTGRES_PASSWORD}
-      POSTGRES_DB: ${GUACAMOLE_POSTGRES_DB}
-    volumes:
-      - guacamole-postgresql-data:/var/lib/postgresql/data
-    networks:
-      - appnet
   nagios:
     image: jasonrivers/nagios:latest
     deploy:
@@ -356,244 +16,12 @@ services:
       - ./nagios/contacts/contacts.cfg:/opt/nagios/etc/objects/contacts.cfg
     networks:
       - appnet
-  matomo:
+      - externalnet
-    image: matomo:fpm-alpine
+  
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    volumes:
-#      - ./config:/var/www/html/config:rw
-#      - ./logs:/var/www/html/logs
-      - matomo:/var/www/html
-    environment:
-      - MATOMO_DATABASE_HOST=matomo-mariadb
-      - MYSQL_PASSWORD=${MATOMO_MYSQL_PASSWORD}
-      - MYSQL_DATABASE=matomo
-      - MYSQL_USER=matomo
-      - MATOMO_DATABASE_ADAPTER=mysql
-      - MATOMO_DATABASE_TABLES_PREFIX=matomo_
-      - MATOMO_DATABASE_USERNAME=matomo
-      - MATOMO_DATABASE_PASSWORD=${MATOMO_MYSQL_PASSWORD}
-      - MATOMO_DATABASE_DBNAME=matomo
-    networks:
-      - appnet
-  matomo-web:
-    image: nginx:alpine
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    volumes:
-      - matomo:/var/www/html:ro
-      # see https://github.com/matomo-org/matomo-nginx
-      - ./matomo/matomo.conf:/etc/nginx/conf.d/default.conf:ro
-    networks:
-      - appnet
-  matomo-mariadb:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: mariadb:10
-    command: --max-allowed-packet=128MB
-    networks:
-      - appnet
-    volumes:
-      - matomo-mariadb:/var/lib/mysql
-    environment:
-      MYSQL_ROOT_PASSWORD: ${MATOMO_MYSQL_ROOT_PASSWORD}
-      MYSQL_USER: matomo
-      MYSQL_DATABASE: matomo
-      MYSQL_PASSWORD: ${MATOMO_MYSQL_PASSWORD}
-  zabbix-mariadb:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: mariadb:10
-    command: --max-allowed-packet=128MB
-    networks:
-      - appnet
-    volumes:
-      - zabbix-mariadb:/var/lib/mysql
-    environment:
-      MYSQL_ROOT_PASSWORD: ${ZABBIX_MYSQL_ROOT_PASSWORD}
-      MYSQL_USER: zabbix
-      MYSQL_DATABASE: zabbix
-      MYSQL_PASSWORD: ${ZABBIX_MYSQL_PASSWORD}
-  zabbix-server:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: zabbix/zabbix-server-mysql
-    networks:
-      - appnet
-    environment:
-      DB_SERVER_HOST: zabbix-mariadb
-      MYSQL_USER: zabbix
-      MYSQL_PASSWORD: ${ZABBIX_MYSQL_PASSWORD}
-    networks:
-      - appnet
-    ports:
-      - 10050:10050
-      - 10051:10051
-  zabbix-web:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: zabbix/zabbix-web-nginx-mysql
-    networks:
-      - appnet
-    environment:
-      DB_SERVER_HOST: zabbix-mariadb
-      MYSQL_USER: zabbix
-      MYSQL_PASSWORD: ${ZABBIX_MYSQL_PASSWORD}
-      ZBX_SERVER_HOST: zabbix-server
-      PHP_TZ: Europe/London
-  # The backend guacamole server.
-  guacd:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: guacamole/guacd:latest
-    networks:
-      - appnet
-
-  guacamole:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: guacamole/guacamole:latest
-    environment:
-      - POSTGRES_HOSTNAME=guacamole-postgresql
-      - POSTGRES_PORT=5432
-      - POSTGRES_USER=${GUACAMOLE_POSTGRES_USER}
-      - POSTGRES_PASSWORD=${GUACAMOLE_POSTGRES_PASSWORD}
-      - POSTGRES_DATABASE=${GUACAMOLE_POSTGRES_DB}
-      - GUACD_HOSTNAME=guacd
-    networks:
-      - appnet
-  chat:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack == yes]
-      replicas: 0 # will scale after mongo initated
-      restart_policy:
-        condition: any
-    image: rocketchat/rocket.chat:3.0.7
-    networks:
-      - appnet
-    environment:
-      - MONGO_OPLOG_URL=mongodb://chat-mongo:27017/local
-      - ROOT_URL=https://${GIT_DOMAIN}/chat
-      - PORT=3000
-      - MONGO_URL=mongodb://chat-mongo:27017/rocketchat
-      - ADMIN_USERNAME=${CHAT_ADMIN_NAME}
-      - ADMIN_PASS=${CHAT_ADMIN_PASSWORD}
-      - ADMIN_EMAIL=${CHAT_ADMIN_EMAIL}
-    volumes:
-      - chat-uploads:/app/uploads
-  chat-mongo:
-    deploy:
-      placement:
-        constraints: [node.labels.com.sigyl.git-stack-data == yes]
-      replicas: 1
-      restart_policy:
-        condition: any
-    image: mongo:4.0
-    networks:
-      - appnet
-    environment:
-      - MONGO_DATA_DIR=/data/db
-      - MONGO_LOG_DIR=/dev/null
-    volumes:
-      - mongo-chat:/data/db
-    command: mongod --smallfiles --replSet rs0 --oplogSize 128
-  portainer:
-    image: portainer/portainer:1.23.2
-    command: -H tcp://tasks.portainer-agent:9001 --tlsskipverify
-    # command: -H unix:///var/run/docker.sock
-    deploy:
-      replicas: 1
-      placement:
-        constraints: [node.role == manager]
-      restart_policy:
-        condition: any
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - portainer-data:/data
-    networks:
-      #- proxy
-      - appnet
-  portainer-agent:
-    image: portainer/agent:1.5.1
-    environment:
-      # REQUIRED: Should be equal to the service name prefixed by "tasks." when
-      # deployed inside an overlay network
-      AGENT_CLUSTER_ADDR: tasks.portainer-agent
-      # AGENT_PORT: 9001
-      # LOG_LEVEL: debug
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-    networks:
-      - appnet
-    deploy:
-      mode: global
-      placement:
-        constraints: [node.platform.os == linux]
-volumes:
-  gitea-app:
-  drone:
-  drone-data:
-  registry-data:
-  registry-cache-data:
-  guacamole-postgresql-data:
-  commento-postgresql-data:
-  letsencrypt-git:
-  letsencrypt-drone:
-  ghost-content:
-  ghost-data:
-  ghost-content-adapters:
-  ghost-content-settings:
-  ghost-content-images:
-  ghost-content-data:
-  ghost-content-logs:
-  mongo-chat:
-  chat-uploads:
-  portainer-data:
-  matomo:
-  matomo-mariadb:
-  zabbix-mariadb:
-
 networks:
   appnet:
     driver: overlay
     #external: true
-secrets:
+  externalnet:
-  'registry-cert':
+    driver: overlay
-    file: .certificates/registry.crt
+    external: true
-  'registry-key':
-    file: .certificates/registry.key
-  

drone-starlark/repos/drone/drone.star

@@ -0,0 +1,81 @@
+load("@this//:from-secret.star", "fromSecret")
+load("@this//:print-secrets.star", "printSecrets")
+
+load("@this//:map.star", "map")
+load("@this//:environment.star", "environment")
+load("@this//:echo.star", "echo")
+load("@this//:export.star", "export")
+load("@this//:echo-secret.star", "echoSecret")
+load("@this//:wait.star", "wait")
+load("@this//:build.star", "build")
+load("@this//:scp.star", "scp")
+load("@this//drone:public-secrets.star", "publicSecrets")
+load("@this//drone:secret-secrets.star", "secretSecrets")
+load("@this//:rescale.star", "rescale")
+load("@this//:pull.star", "pull")
+load("@this//:deploy.star", "deploy")
+load("@this//:build-folder.star", "buildFolder")
+load("@this//:build-docker-folder.star", "buildDockerFolder")
+load("@this//:pipeline.star", "pipeline")
+
+def drone(
+  ctx,
+  branch,
+  base,
+  name,
+  commands,
+):
+  if ctx.build.branch == branch:
+    return [
+      pipeline(
+        branch,
+        [
+          wait(15, "wait"),
+          build("drone-starlark"),
+          printSecrets(
+            "env-drone",
+            publicSecrets,
+            secretSecrets,
+          ),
+          scp(base),
+          pull(
+            "pull images",
+            [
+              "drone-starlark",
+            ],
+          ),
+          deploy(
+            "docker-compose.yml",
+            name,
+            base,
+            publicSecrets + secretSecrets,
+            commands,
+            ctx
+          ),
+        ],
+        [],
+        [
+          {
+            "name": "ca",
+            "host": {
+              "path": "/etc/docker/certs.d",
+            },
+          }
+        ],
+        [
+          {
+            "name": "ca",
+            "path": "/etc/docker/certs.d",
+          },
+        ]
+      ),
+    ]
+  else:
+    return pipeline(
+      ctx.build.branch,
+      [],
+      [],
+      [],
+      [],
+    )
+      

drone-starlark/repos/drone/public-secrets.star

@@ -0,0 +1,34 @@
+publicSecrets = [
+  "title",
+  "description",
+  "certbot-email",
+  "drone-domain",
+  "drone-gitea-client-id",
+  "drone-gitea-server",
+  "drone-server-host",
+  "git-domain",
+  "local-docker-registry",
+  "ssh-host",
+  "guacamole-postgres-db",
+  "guacamole-postgres-user",
+  "sigyl-stack-root",
+  "sigyl-stack-name",
+  "ghost-mail-service",
+  "ghost-mail-user",
+  "chat-admin-name",
+  "chat-admin-email",
+  "gitea-mailer-host",
+  "gitea-mailer-from",
+  "gitea-mailer-user",
+  "gitea-app-name",
+  "commento-origin",
+  "commento-smtp-host",
+  "commento-smtp-port",
+  "commento-smtp-username",
+  "commento-smtp-from-address",
+  "commento-forbid-new-owners",
+  "commento-postgres-db",
+  "commento-postgres-user",
+  "commento-github-key", 
+  "nagios-admin-user",
+]

drone-starlark/repos/drone/secret-secrets.star

@@ -0,0 +1,24 @@
+secretSecrets = [
+  "drone-convert-secret",
+  "drone-gitea-client-secret",
+  "drone-rpc-secret",
+  "guacamole-postgres-password",
+  "ngrok-auth-token",
+  "ghost-mail-password",
+  "ghost-mysql-root-password",
+  "chat-admin-password",
+  "gitea-server-lfs-jwt-secret",
+  "gitea-security-secret-key",
+  "gitea-security-internal-token",
+  "gitea-oauth2-jwt-secret",
+  "gitea-mailer-passwd",
+  "commento-smtp-password",
+  "commento-askimet-key",
+  "commento-postgres-password",
+  "commento-github-secret",
+  "matomo-mysql-root-password",
+  "matomo-mysql-password",
+  "nagios-admin-password",
+  "zabbix-mysql-root-password",
+  "zabbix-mysql-password",
+]

drone-starlark/repos/drone/stack-name._star

@@ -0,0 +1 @@
+stackName='drone'

drone-starlark/repos/drone/stack-root._star

@@ -0,0 +1 @@
+stackRoot='/stack/drone'

drone-starlark/repos/proxy/drone.star

@@ -0,0 +1,98 @@
+load("@this//:from-secret.star", "fromSecret")
+load("@this//:print-secrets.star", "printSecrets")
+
+load("@this//:map.star", "map")
+load("@this//:environment.star", "environment")
+load("@this//:echo.star", "echo")
+load("@this//:export.star", "export")
+load("@this//:echo-secret.star", "echoSecret")
+load("@this//:wait.star", "wait")
+load("@this//:build.star", "build")
+load("@this//:scp.star", "scp")
+load("@this//proxy:public-secrets.star", "publicSecrets")
+load("@this//proxy:secret-secrets.star", "secretSecrets")
+load("@this//:rescale.star", "rescale")
+load("@this//:pull.star", "pull")
+load("@this//:deploy.star", "deploy")
+load("@this//:build-folder.star", "buildFolder")
+load("@this//:build-docker-folder.star", "buildDockerFolder")
+load("@this//:pipeline.star", "pipeline")
+
+def drone(
+  ctx,
+  branch,
+  base,
+  name,
+  commands,
+):
+  if ctx.build.branch == branch:
+    return [
+      pipeline(
+        branch,
+        [
+          wait(15, "wait"),
+          printSecrets(
+            "env-proxy",
+            publicSecrets,
+            secretSecrets,
+          ),
+          build("ngrok-gitea"),
+          build("letsencrypt-nginx"),
+          buildDockerFolder(
+            "Dockerfile.git",
+            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
+            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-git",
+            "letsencrypt-nginx",
+            "git",
+          ),
+          buildDockerFolder(
+            "Dockerfile.drone",
+            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
+            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-drone",
+            "letsencrypt-nginx",
+            "drone",
+          ),
+          scp(base),
+          pull(
+            "pull images",
+            [
+              "ngrok-gitea",
+              "letsencrypt-git",
+              "letsencrypt-drone",
+            ],
+          ),
+          deploy(
+            "docker-compose.yml",
+            name,
+            base,
+            publicSecrets + secretSecrets,
+            commands,
+            ctx
+          ),
+        ],
+        [],
+        [
+          {
+            "name": "ca",
+            "host": {
+              "path": "/etc/docker/certs.d",
+            },
+          }
+        ],
+        [
+          {
+            "name": "ca",
+            "path": "/etc/docker/certs.d",
+          },
+        ]
+      ),
+    ]
+  else:
+    return pipeline(
+      ctx.build.branch,
+      [],
+      [],
+      [],
+      [],
+    )
+      

drone-starlark/repos/proxy/public-secrets.star

@@ -0,0 +1,34 @@
+publicSecrets = [
+  "title",
+  "description",
+  "certbot-email",
+  "drone-domain",
+  "drone-gitea-client-id",
+  "drone-gitea-server",
+  "drone-server-host",
+  "git-domain",
+  "local-docker-registry",
+  "ssh-host",
+  "guacamole-postgres-db",
+  "guacamole-postgres-user",
+  "sigyl-stack-root",
+  "sigyl-stack-name",
+  "ghost-mail-service",
+  "ghost-mail-user",
+  "chat-admin-name",
+  "chat-admin-email",
+  "gitea-mailer-host",
+  "gitea-mailer-from",
+  "gitea-mailer-user",
+  "gitea-app-name",
+  "commento-origin",
+  "commento-smtp-host",
+  "commento-smtp-port",
+  "commento-smtp-username",
+  "commento-smtp-from-address",
+  "commento-forbid-new-owners",
+  "commento-postgres-db",
+  "commento-postgres-user",
+  "commento-github-key", 
+  "nagios-admin-user",
+]

drone-starlark/repos/proxy/secret-secrets.star

@@ -0,0 +1,24 @@
+secretSecrets = [
+  "drone-convert-secret",
+  "drone-gitea-client-secret",
+  "drone-rpc-secret",
+  "guacamole-postgres-password",
+  "ngrok-auth-token",
+  "ghost-mail-password",
+  "ghost-mysql-root-password",
+  "chat-admin-password",
+  "gitea-server-lfs-jwt-secret",
+  "gitea-security-secret-key",
+  "gitea-security-internal-token",
+  "gitea-oauth2-jwt-secret",
+  "gitea-mailer-passwd",
+  "commento-smtp-password",
+  "commento-askimet-key",
+  "commento-postgres-password",
+  "commento-github-secret",
+  "matomo-mysql-root-password",
+  "matomo-mysql-password",
+  "nagios-admin-password",
+  "zabbix-mysql-root-password",
+  "zabbix-mysql-password",
+]

drone-starlark/repos/proxy/stack-name._star

@@ -0,0 +1 @@
+stackName='proxy'

drone-starlark/repos/proxy/stack-root._star

@@ -0,0 +1 @@
+stackRoot='/stack/proxy'

drone-starlark/repos/stack/drone.star

@@ -39,30 +39,7 @@ def drone(
           ),
           build("gitea"),
           build("guacamole-postgresql"),
-          build("ngrok-gitea"),
-          build("letsencrypt-nginx"),
           build("ghost"),
-          buildDockerFolder(
-            "Dockerfile.git",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-git",
-            "letsencrypt-nginx",
-            "git",
-          ),
-          buildDockerFolder(
-            "Dockerfile.drone",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-drone",
-            "letsencrypt-nginx",
-            "drone",
-          ),
-          buildDockerFolder(
-            "Dockerfile.registry",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-nginx",
-            "$${LOCAL_DOCKER_REGISTRY}letsencrypt-registry",
-            "letsencrypt-nginx",
-            "registry",
-          ),
           scp(base),
           pull(
             "pull images",
@@ -70,26 +47,9 @@ def drone(
               "drone-starlark",
               "gitea",
               "ghost",
-              "ngrok-gitea",
-              "letsencrypt-git",
-              "letsencrypt-drone",
               "guacamole-postgresql",
             ],
           ),
-          #pull(
-          #  "pull registry",
-          #  [
-          #    "letsencrypt-registry",
-          #  ],
-          #),
-          #deploy(
-          #  "docker-compose-registry.yml",
-          #  'registry',
-          #  base,
-          #  publicSecrets + secretSecrets,
-          #  commands,
-          #  ctx
-          #),
           deploy(
             "docker-compose.yml",
             name,
@@ -104,7 +64,7 @@ def drone(
           {
             "name": "ca",
             "host": {
-              "path": "{base}/.ca".format(base = base),
+              "path": "/etc/docker/certs.d",
             },
           }
         ],

drone-starlark/run.sh

@@ -1,3 +1,5 @@
 envsubst < /repos/stack/stack-name._star > /repos/stack/stack-name.star
 envsubst < /repos/stack/stack-root._star > /repos/stack/stack-root.star
+envsubst < /repos/stack/stack-name._star > /repos/proxy/stack-name.star
+envsubst < /repos/stack/stack-root._star > /repos/proxy/stack-root.star
 /bin/drone-convert-starlark

letsencrypt-nginx/conf/git.conf

@@ -16,6 +16,11 @@ server {
   client_max_body_size 200m;
   # save logs here
   server_name ${SERVER_NAME};
+  # Pass this particular URL off to certbot, to authenticate HTTPS certificates
+  location '/.well-known/acme-challenge' {
+      default_type "text/plain";
+      proxy_pass http://localhost:1337;
+  }
   location / {
     return 301 https://${DOLLAR}host${DOLLAR}request_uri;
   }

letsencrypt-nginx/conf/registry.conf

@@ -6,6 +6,24 @@
         map ${DOLLAR}upstream_http_docker_distribution_api_version ${DOLLAR}docker_distribution_api_version {
              '' 'registry/2.0';
         }
+server {
+  # resolver 127.0.0.11 valid=30s; ## internal docker dns
+  #listen   [::]:3011 default ipv6only=on; ## listen for ipv6
+  listen 80;
+  client_header_timeout 120s;
+  client_body_timeout 120s;
+  client_max_body_size 200m;
+  # save logs here
+  server_name ${SERVER_NAME};
+  # Pass this particular URL off to certbot, to authenticate HTTPS certificates
+  location '/.well-known/acme-challenge' {
+      default_type "text/plain";
+      proxy_pass http://localhost:1337;
+  }
+  location / {
+    return 301 https://${DOLLAR}host${DOLLAR}request_uri;
+  }
+}
 
     server {
         # resolver 127.0.0.11 valid=30s; ## internal docker dns