From 647d239b5eeb90d60e7a63f9a54ab7bd680cb7ae Mon Sep 17 00:00:00 2001 From: Giles Bradshaw Date: Fri, 14 Aug 2020 12:31:34 +0100 Subject: [PATCH] ci: jsonnet drone --- .drone/drone-home.jsonnet | 101 ++++++++++++++++ .drone/drone-home.yml | 176 ++++++++++++++++++++++++++++ .drone/lib/build.libsonnet | 23 ++++ .drone/lib/images.libsonnet | 38 ++++++ .drone/lib/public-secrets.libsonnet | 8 ++ .drone/lib/secret-secrets.libsonnet | 6 + .drone/lib/settings.libsonnet | 11 ++ .drone/lib/util.libsonnet | 18 +++ .drone/package.json | 10 ++ .drone/yarn-error.log | 37 ++++++ .drone/yarn.lock | 13 ++ git-hooks/pre-commit | 3 + pull.sh | 1 + push.sh | 1 + 14 files changed, 446 insertions(+) create mode 100644 .drone/drone-home.jsonnet create mode 100644 .drone/drone-home.yml create mode 100644 .drone/lib/build.libsonnet create mode 100644 .drone/lib/images.libsonnet create mode 100644 .drone/lib/public-secrets.libsonnet create mode 100644 .drone/lib/secret-secrets.libsonnet create mode 100644 .drone/lib/settings.libsonnet create mode 100644 .drone/lib/util.libsonnet create mode 100644 .drone/package.json create mode 100644 .drone/yarn-error.log create mode 100644 .drone/yarn.lock create mode 100755 git-hooks/pre-commit create mode 100644 pull.sh create mode 100644 push.sh diff --git a/.drone/drone-home.jsonnet b/.drone/drone-home.jsonnet new file mode 100644 index 0000000..2caaffa --- /dev/null +++ b/.drone/drone-home.jsonnet @@ -0,0 +1,101 @@ +local build = import 'lib/build.libsonnet'; +local images = import 'lib/images.libsonnet'; +local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet'; +local secretSecrets = import 'lib/secret-secrets.libsonnet'; +local publicSecrets = import 'lib/public-secrets.libsonnet'; +local util = import 'lib/util.libsonnet'; +[ + { + kind: 'pipeline', + type: 'docker', + name: 'build', + clone: { + disable: false, + depth: 0, + }, + /*trigger: { + event: [ + 'tag', + ], + },*/ + services: [ + images.docker { + privileged: true, + volumes: [ + { + name: 'dockersock', + path: '/var/run', + }, + { + name: 'ca', + path: '/etc/docker/certs.d', + }, + ], + }, + ], + volumes: [ + { + name: 'dockersock', + temp: {}, + }, + { + name: 'ca', + host: { + path: '/etc/docker/certs.d', + }, + }, + ], + steps:[ + compose( + std.map( + function(secret) util.printEnv('env-drone', secret), + publicSecrets, + ) + ) + ( + images.ssh { + settings +: { + script: [ + 'rm -f env-drone', + ], + }, + }, + ) { + name: 'print env', + }, + images.scp( + '/stack/drone' + ), + images.wait(15), + build, + compose( + std.map( + function(secret) environment.envSet(secret), + publicSecrets + secretSecrets, + ), + )( + images.ssh { + name: 'deploy stack', + settings +: { + script +: + std.map( + function(secret) + 'export %(env)s=$${%(env)s}' % { + env: environment.environment(secret) + }, + secretSecrets + publicSecrets, + ) + + [ + 'set -e', + "cd /stack/drone", + 'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"', + 'sh pull.sh', + 'sh deploy.sh', + ] + } + }, + ), + ], + } +] diff --git a/.drone/drone-home.yml b/.drone/drone-home.yml new file mode 100644 index 0000000..a37bebf --- /dev/null +++ b/.drone/drone-home.yml @@ -0,0 +1,176 @@ +--- +kind: pipeline +type: docker +name: build + +platform: + os: linux + arch: amd64 + +steps: +- name: print env + image: appleboy/drone-ssh:1.6.2 + settings: + envs: + - drone_tag + - drone_commit + - drone_build_number + - drone_repo_name + - drone_repo_namespace + - drone_domain + - drone_gitea_client_id + - drone_gitea_server + - drone_server_host + - local_docker_registry + - drone_runner_environ + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + script: + - rm -f env-drone + - "echo \"export DRONE_DOMAIN='$${DRONE_DOMAIN}'\" >> env-drone # \"drone-domain\"" + - "echo \"export DRONE_GITEA_CLIENT_ID='$${DRONE_GITEA_CLIENT_ID}'\" >> env-drone # \"drone-gitea-client-id\"" + - "echo \"export DRONE_GITEA_SERVER='$${DRONE_GITEA_SERVER}'\" >> env-drone # \"drone-gitea-server\"" + - "echo \"export DRONE_SERVER_HOST='$${DRONE_SERVER_HOST}'\" >> env-drone # \"drone-server-host\"" + - "echo \"export LOCAL_DOCKER_REGISTRY='$${LOCAL_DOCKER_REGISTRY}'\" >> env-drone # \"local-docker-registry\"" + - "echo \"export DRONE_RUNNER_ENVIRON='$${DRONE_RUNNER_ENVIRON}'\" >> env-drone # \"drone-runner-environ\"" + username: + from_secret: ssh-user + environment: + DRONE_DOMAIN: + from_secret: drone-domain + DRONE_GITEA_CLIENT_ID: + from_secret: drone-gitea-client-id + DRONE_GITEA_SERVER: + from_secret: drone-gitea-server + DRONE_RUNNER_ENVIRON: + from_secret: drone-runner-environ + DRONE_SERVER_HOST: + from_secret: drone-server-host + LOCAL_DOCKER_REGISTRY: + from_secret: local-docker-registry + +- name: scp + image: appleboy/drone-scp:1.6.2 + settings: + command_timeout: 2m + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + source: + - . + target: /stack/drone + username: + from_secret: ssh-user + +- name: wait + image: alpine + commands: + - sleep 15 + +- name: "dockerbuild:" + image: docker:dind + commands: + - set -e + - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}" + - sh build.sh + - sh push.sh + - docker logout $${LOCAL_DOCKER_REGISTRY} + environment: + LOCAL_DOCKER_REGISTRY: + from_secret: local-docker-registry + REGISTRY_PASSWORD: + from_secret: registry-password + volumes: + - name: dockersock + path: /var/run + +- name: deploy stack + image: appleboy/drone-ssh:1.6.2 + settings: + envs: + - drone_tag + - drone_commit + - drone_build_number + - drone_repo_name + - drone_repo_namespace + - drone_domain + - drone_gitea_client_id + - drone_gitea_server + - drone_server_host + - local_docker_registry + - drone_runner_environ + - drone_convert_secret + - drone_gitea_client_secret + - drone_rpc_secret + - registry_password + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + script: + - export DRONE_CONVERT_SECRET=$${DRONE_CONVERT_SECRET} + - export DRONE_GITEA_CLIENT_SECRET=$${DRONE_GITEA_CLIENT_SECRET} + - export DRONE_RPC_SECRET=$${DRONE_RPC_SECRET} + - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD} + - export DRONE_DOMAIN=$${DRONE_DOMAIN} + - export DRONE_GITEA_CLIENT_ID=$${DRONE_GITEA_CLIENT_ID} + - export DRONE_GITEA_SERVER=$${DRONE_GITEA_SERVER} + - export DRONE_SERVER_HOST=$${DRONE_SERVER_HOST} + - export LOCAL_DOCKER_REGISTRY=$${LOCAL_DOCKER_REGISTRY} + - export DRONE_RUNNER_ENVIRON=$${DRONE_RUNNER_ENVIRON} + - set -e + - cd /stack/drone + - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}" + - sh pull.sh + - sh deploy.sh + username: + from_secret: ssh-user + environment: + DRONE_CONVERT_SECRET: + from_secret: drone-convert-secret + DRONE_DOMAIN: + from_secret: drone-domain + DRONE_GITEA_CLIENT_ID: + from_secret: drone-gitea-client-id + DRONE_GITEA_CLIENT_SECRET: + from_secret: drone-gitea-client-secret + DRONE_GITEA_SERVER: + from_secret: drone-gitea-server + DRONE_RPC_SECRET: + from_secret: drone-rpc-secret + DRONE_RUNNER_ENVIRON: + from_secret: drone-runner-environ + DRONE_SERVER_HOST: + from_secret: drone-server-host + LOCAL_DOCKER_REGISTRY: + from_secret: local-docker-registry + REGISTRY_PASSWORD: + from_secret: registry-password + +services: +- name: docker + image: docker:dind + privileged: true + volumes: + - name: dockersock + path: /var/run + - name: ca + path: /etc/docker/certs.d + +volumes: +- name: dockersock + temp: {} +- name: ca + host: + path: /etc/docker/certs.d + +... diff --git a/.drone/lib/build.libsonnet b/.drone/lib/build.libsonnet new file mode 100644 index 0000000..339609d --- /dev/null +++ b/.drone/lib/build.libsonnet @@ -0,0 +1,23 @@ +local images = import 'images.libsonnet'; +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; + + images.docker { + name +: 'build:', + environment +: environment.environmentSecrets([ + 'LOCAL_DOCKER_REGISTRY', + 'REGISTRY_PASSWORD', + ]), + volumes: [ + { + name: 'dockersock', + path: '/var/run', + }, + ], + commands: [ + 'set -e', + 'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"', + 'sh build.sh', + 'sh push.sh', + 'docker logout $${LOCAL_DOCKER_REGISTRY}', + ], + } \ No newline at end of file diff --git a/.drone/lib/images.libsonnet b/.drone/lib/images.libsonnet new file mode 100644 index 0000000..b67fc35 --- /dev/null +++ b/.drone/lib/images.libsonnet @@ -0,0 +1,38 @@ +local settings = import 'settings.libsonnet'; +{ + docker: { + name: 'docker', + image: 'docker:dind', + }, + scp(target): settings.ssh { + name: 'scp', + image: 'appleboy/drone-scp:1.6.2', + settings +: { + command_timeout: '2m', + target: target, + source: [ + '.', + ], + }, + }, + ssh: settings.ssh { + image: 'appleboy/drone-ssh:1.6.2', + settings +: { + envs: [ + 'drone_tag', + 'drone_commit', + 'drone_build_number', + 'drone_repo_name', + 'drone_repo_namespace', + ], + script: [], + }, + }, + wait(delay): { + image: 'alpine', + name: 'wait', + commands: [ + 'sleep %s' % delay, + ], + } +} \ No newline at end of file diff --git a/.drone/lib/public-secrets.libsonnet b/.drone/lib/public-secrets.libsonnet new file mode 100644 index 0000000..2a54358 --- /dev/null +++ b/.drone/lib/public-secrets.libsonnet @@ -0,0 +1,8 @@ +[ + 'drone-domain', + 'drone-gitea-client-id', + 'drone-gitea-server', + 'drone-server-host', + 'local-docker-registry', + 'drone-runner-environ', +] diff --git a/.drone/lib/secret-secrets.libsonnet b/.drone/lib/secret-secrets.libsonnet new file mode 100644 index 0000000..289382b --- /dev/null +++ b/.drone/lib/secret-secrets.libsonnet @@ -0,0 +1,6 @@ +[ + 'drone-convert-secret', + 'drone-gitea-client-secret', + 'drone-rpc-secret', + 'registry-password', +] diff --git a/.drone/lib/settings.libsonnet b/.drone/lib/settings.libsonnet new file mode 100644 index 0000000..c662633 --- /dev/null +++ b/.drone/lib/settings.libsonnet @@ -0,0 +1,11 @@ +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +{ + ssh: { + settings +: { + host: environment.fromSecret('ssh-host'), + port: environment.fromSecret('ssh-port'), + username: environment.fromSecret('ssh-user'), + password: environment.fromSecret('ssh-password'), + }, + }, +} \ No newline at end of file diff --git a/.drone/lib/util.libsonnet b/.drone/lib/util.libsonnet new file mode 100644 index 0000000..2596ab8 --- /dev/null +++ b/.drone/lib/util.libsonnet @@ -0,0 +1,18 @@ +local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet'; +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +{ + printEnv(file, env): function(step) compose([ + environment.envSet(env), + function(step) step { + settings +: { + script +: [ + 'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % { + environment: environment.environment(env), + file: file, + secret: environment.secret(env), + }, + ], + }, + }, + ])(step), +} \ No newline at end of file diff --git a/.drone/package.json b/.drone/package.json new file mode 100644 index 0000000..3869304 --- /dev/null +++ b/.drone/package.json @@ -0,0 +1,10 @@ +{ + "private": true, + "scripts": { + "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream" + }, + "dependencies": { + "@sigyl/jsonnet-compose": "^0.0.2", + "@sigyl/jsonnet-drone-environment": "0.0.5" + } +} diff --git a/.drone/yarn-error.log b/.drone/yarn-error.log new file mode 100644 index 0000000..55c6505 --- /dev/null +++ b/.drone/yarn-error.log @@ -0,0 +1,37 @@ +Arguments: + /usr/bin/node /home/giles/.yarn/bin/yarn.js + +PATH: + /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin + +Yarn version: + 1.22.4 + +Node version: + 11.14.0 + +Platform: + linux x64 + +Trace: + Error: self signed certificate in certificate chain + at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34) + at TLSSocket.emit (events.js:193:13) + at TLSSocket._finishInit (_tls_wrap.js:667:8) + +npm manifest: + { + "private": true, + "scripts": { + "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream" + }, + "dependencies": { + "@sigyl/jsonnet-compose": "^0.0.2" + } + } + +yarn manifest: + No manifest + +Lockfile: + No lockfile diff --git a/.drone/yarn.lock b/.drone/yarn.lock new file mode 100644 index 0000000..e9d5082 --- /dev/null +++ b/.drone/yarn.lock @@ -0,0 +1,13 @@ +# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. +# yarn lockfile v1 + + +"@sigyl/jsonnet-compose@^0.0.2": + version "0.0.2" + resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda" + integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA== + +"@sigyl/jsonnet-drone-environment@0.0.5": + version "0.0.5" + resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff" + integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw== diff --git a/git-hooks/pre-commit b/git-hooks/pre-commit new file mode 100755 index 0000000..7161ae2 --- /dev/null +++ b/git-hooks/pre-commit @@ -0,0 +1,3 @@ +drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \ +&& git add .drone/drone-home.yml \ +&& echo "jsonnet built" \ No newline at end of file diff --git a/pull.sh b/pull.sh new file mode 100644 index 0000000..6a6c921 --- /dev/null +++ b/pull.sh @@ -0,0 +1 @@ +docker pull ${LOCAL_DOCKER_REGISTRY}drone-starlark \ No newline at end of file diff --git a/push.sh b/push.sh new file mode 100644 index 0000000..3f84d7c --- /dev/null +++ b/push.sh @@ -0,0 +1 @@ +docker push ${LOCAL_DOCKER_REGISTRY}drone-starlark \ No newline at end of file