ci: jsonnet drone

upgraded drone versions + specified other versions

.drone/drone-home.jsonnet

@@ -0,0 +1,101 @@
+local build = import 'lib/build.libsonnet';
+local images = import 'lib/images.libsonnet';
+local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
+local secretSecrets = import 'lib/secret-secrets.libsonnet';
+local publicSecrets = import 'lib/public-secrets.libsonnet';
+local util = import 'lib/util.libsonnet';
+[
+  {
+    kind: 'pipeline',
+    type: 'docker',
+    name: 'build',
+    clone: {
+      disable: false,
+      depth: 0,
+    },
+    /*trigger: {
+      event: [
+        'tag',
+      ],
+    },*/
+    services: [
+      images.docker {
+        privileged: true,
+        volumes: [
+          {
+            name: 'dockersock',
+            path: '/var/run',
+          },
+          {
+            name: 'ca',
+            path: '/etc/docker/certs.d',
+          },
+        ],
+      },
+    ],
+    volumes: [
+      {
+        name: 'dockersock',
+        temp: {},
+      },
+      {
+        name: 'ca',
+        host: {
+          path: '/etc/docker/certs.d',
+        },
+      },
+    ],
+    steps:[
+      compose(
+        std.map(
+          function(secret) util.printEnv('env-drone', secret),
+          publicSecrets,
+        )
+      )
+      (
+        images.ssh {
+          settings +: {
+            script: [
+              'rm -f env-drone',
+            ],
+          },
+        },
+      ) {
+        name: 'print env',
+      },
+      images.scp(
+        '/stack/drone'
+      ),
+      images.wait(15),
+      build,
+      compose(
+        std.map(
+          function(secret) environment.envSet(secret),
+          publicSecrets + secretSecrets,
+        ),
+      )(
+        images.ssh  {
+          name: 'deploy stack',
+          settings +: {
+            script +: 
+            std.map(
+              function(secret)
+                'export %(env)s=$${%(env)s}' % {
+                  env: environment.environment(secret)
+                },
+              secretSecrets + publicSecrets,
+            ) + 
+            [
+              'set -e',
+              "cd /stack/drone",
+              'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"',
+              'sh pull.sh',
+              'sh deploy.sh',
+            ]
+          }
+        },
+      ),
+    ],
+  }
+]

.drone/drone-home.yml

@@ -0,0 +1,176 @@
+---
+kind: pipeline
+type: docker
+name: build
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+- name: print env
+  image: appleboy/drone-ssh:1.6.2
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - drone_domain
+    - drone_gitea_client_id
+    - drone_gitea_server
+    - drone_server_host
+    - local_docker_registry
+    - drone_runner_environ
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    script:
+    - rm -f env-drone
+    - "echo \"export DRONE_DOMAIN='$${DRONE_DOMAIN}'\" >> env-drone # \"drone-domain\""
+    - "echo \"export DRONE_GITEA_CLIENT_ID='$${DRONE_GITEA_CLIENT_ID}'\" >> env-drone # \"drone-gitea-client-id\""
+    - "echo \"export DRONE_GITEA_SERVER='$${DRONE_GITEA_SERVER}'\" >> env-drone # \"drone-gitea-server\""
+    - "echo \"export DRONE_SERVER_HOST='$${DRONE_SERVER_HOST}'\" >> env-drone # \"drone-server-host\""
+    - "echo \"export LOCAL_DOCKER_REGISTRY='$${LOCAL_DOCKER_REGISTRY}'\" >> env-drone # \"local-docker-registry\""
+    - "echo \"export DRONE_RUNNER_ENVIRON='$${DRONE_RUNNER_ENVIRON}'\" >> env-drone # \"drone-runner-environ\""
+    username:
+      from_secret: ssh-user
+  environment:
+    DRONE_DOMAIN:
+      from_secret: drone-domain
+    DRONE_GITEA_CLIENT_ID:
+      from_secret: drone-gitea-client-id
+    DRONE_GITEA_SERVER:
+      from_secret: drone-gitea-server
+    DRONE_RUNNER_ENVIRON:
+      from_secret: drone-runner-environ
+    DRONE_SERVER_HOST:
+      from_secret: drone-server-host
+    LOCAL_DOCKER_REGISTRY:
+      from_secret: local-docker-registry
+
+- name: scp
+  image: appleboy/drone-scp:1.6.2
+  settings:
+    command_timeout: 2m
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    source:
+    - .
+    target: /stack/drone
+    username:
+      from_secret: ssh-user
+
+- name: wait
+  image: alpine
+  commands:
+  - sleep 15
+
+- name: "dockerbuild:"
+  image: docker:dind
+  commands:
+  - set -e
+  - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"
+  - sh build.sh
+  - sh push.sh
+  - docker logout $${LOCAL_DOCKER_REGISTRY}
+  environment:
+    LOCAL_DOCKER_REGISTRY:
+      from_secret: local-docker-registry
+    REGISTRY_PASSWORD:
+      from_secret: registry-password
+  volumes:
+  - name: dockersock
+    path: /var/run
+
+- name: deploy stack
+  image: appleboy/drone-ssh:1.6.2
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - drone_domain
+    - drone_gitea_client_id
+    - drone_gitea_server
+    - drone_server_host
+    - local_docker_registry
+    - drone_runner_environ
+    - drone_convert_secret
+    - drone_gitea_client_secret
+    - drone_rpc_secret
+    - registry_password
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    script:
+    - export DRONE_CONVERT_SECRET=$${DRONE_CONVERT_SECRET}
+    - export DRONE_GITEA_CLIENT_SECRET=$${DRONE_GITEA_CLIENT_SECRET}
+    - export DRONE_RPC_SECRET=$${DRONE_RPC_SECRET}
+    - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
+    - export DRONE_DOMAIN=$${DRONE_DOMAIN}
+    - export DRONE_GITEA_CLIENT_ID=$${DRONE_GITEA_CLIENT_ID}
+    - export DRONE_GITEA_SERVER=$${DRONE_GITEA_SERVER}
+    - export DRONE_SERVER_HOST=$${DRONE_SERVER_HOST}
+    - export LOCAL_DOCKER_REGISTRY=$${LOCAL_DOCKER_REGISTRY}
+    - export DRONE_RUNNER_ENVIRON=$${DRONE_RUNNER_ENVIRON}
+    - set -e
+    - cd /stack/drone
+    - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"
+    - sh pull.sh
+    - sh deploy.sh
+    username:
+      from_secret: ssh-user
+  environment:
+    DRONE_CONVERT_SECRET:
+      from_secret: drone-convert-secret
+    DRONE_DOMAIN:
+      from_secret: drone-domain
+    DRONE_GITEA_CLIENT_ID:
+      from_secret: drone-gitea-client-id
+    DRONE_GITEA_CLIENT_SECRET:
+      from_secret: drone-gitea-client-secret
+    DRONE_GITEA_SERVER:
+      from_secret: drone-gitea-server
+    DRONE_RPC_SECRET:
+      from_secret: drone-rpc-secret
+    DRONE_RUNNER_ENVIRON:
+      from_secret: drone-runner-environ
+    DRONE_SERVER_HOST:
+      from_secret: drone-server-host
+    LOCAL_DOCKER_REGISTRY:
+      from_secret: local-docker-registry
+    REGISTRY_PASSWORD:
+      from_secret: registry-password
+
+services:
+- name: docker
+  image: docker:dind
+  privileged: true
+  volumes:
+  - name: dockersock
+    path: /var/run
+  - name: ca
+    path: /etc/docker/certs.d
+
+volumes:
+- name: dockersock
+  temp: {}
+- name: ca
+  host:
+    path: /etc/docker/certs.d
+
+...

.drone/lib/build.libsonnet

@@ -0,0 +1,23 @@
+local images = import 'images.libsonnet';
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+
+  images.docker {
+    name +: 'build:',
+    environment +: environment.environmentSecrets([
+      'LOCAL_DOCKER_REGISTRY',
+      'REGISTRY_PASSWORD',
+    ]),
+    volumes: [
+      {
+        name: 'dockersock',
+        path: '/var/run',
+      },
+    ],
+    commands: [
+      'set -e',
+      'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"',
+      'sh build.sh',
+      'sh push.sh',
+      'docker logout $${LOCAL_DOCKER_REGISTRY}',
+    ],
+  }

.drone/lib/images.libsonnet

@@ -0,0 +1,38 @@
+local settings = import 'settings.libsonnet';
+{
+  docker: {
+    name: 'docker',
+    image: 'docker:dind',
+  },
+  scp(target): settings.ssh {
+    name: 'scp',
+    image: 'appleboy/drone-scp:1.6.2',
+    settings +: {
+      command_timeout: '2m',
+      target: target,
+      source: [
+        '.',
+      ],
+    },
+  },
+  ssh: settings.ssh {
+    image: 'appleboy/drone-ssh:1.6.2',    
+    settings +: {
+      envs: [
+        'drone_tag',
+        'drone_commit',
+        'drone_build_number',
+        'drone_repo_name',
+        'drone_repo_namespace',
+      ],
+      script: [],
+    },
+  },
+  wait(delay): {
+    image: 'alpine',
+    name: 'wait',
+    commands: [
+      'sleep %s' % delay,
+    ],
+  }
+}

.drone/lib/public-secrets.libsonnet

@@ -0,0 +1,8 @@
+[
+  'drone-domain',
+  'drone-gitea-client-id',
+  'drone-gitea-server',
+  'drone-server-host',
+  'local-docker-registry',
+  'drone-runner-environ',
+]

.drone/lib/secret-secrets.libsonnet

@@ -0,0 +1,6 @@
+[
+  'drone-convert-secret',
+  'drone-gitea-client-secret',
+  'drone-rpc-secret',
+  'registry-password',
+]

.drone/lib/settings.libsonnet

@@ -0,0 +1,11 @@
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  ssh: {
+    settings +: {
+      host: environment.fromSecret('ssh-host'),
+      port: environment.fromSecret('ssh-port'),
+      username: environment.fromSecret('ssh-user'),
+      password: environment.fromSecret('ssh-password'),  
+    },
+  },
+}

.drone/lib/util.libsonnet

@@ -0,0 +1,18 @@
+local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  printEnv(file, env): function(step) compose([
+    environment.envSet(env),
+    function(step) step {
+      settings +: {
+        script +: [
+          'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % {
+            environment: environment.environment(env),
+            file: file,
+            secret: environment.secret(env),
+          },
+        ],
+      },
+    },
+  ])(step),
+}

.drone/package.json

@@ -0,0 +1,10 @@
+{
+  "private": true,
+  "scripts": {
+    "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
+  },
+  "dependencies": {
+    "@sigyl/jsonnet-compose": "^0.0.2",
+    "@sigyl/jsonnet-drone-environment": "0.0.5"
+  }
+}

.drone/yarn-error.log

@@ -0,0 +1,37 @@
+Arguments: 
+  /usr/bin/node /home/giles/.yarn/bin/yarn.js
+
+PATH: 
+  /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
+
+Yarn version: 
+  1.22.4
+
+Node version: 
+  11.14.0
+
+Platform: 
+  linux x64
+
+Trace: 
+  Error: self signed certificate in certificate chain
+      at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
+      at TLSSocket.emit (events.js:193:13)
+      at TLSSocket._finishInit (_tls_wrap.js:667:8)
+
+npm manifest: 
+  {
+    "private": true,
+    "scripts": {
+      "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
+    },
+    "dependencies": {
+      "@sigyl/jsonnet-compose": "^0.0.2"
+    }
+  }
+
+yarn manifest: 
+  No manifest
+
+Lockfile: 
+  No lockfile

.drone/yarn.lock

@@ -0,0 +1,13 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@sigyl/jsonnet-compose@^0.0.2":
+  version "0.0.2"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
+  integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
+
+"@sigyl/jsonnet-drone-environment@0.0.5":
+  version "0.0.5"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
+  integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==

build.sh

@@ -0,0 +1 @@
+docker build drone-starlark -t ${LOCAL_DOCKER_REGISTRY}drone-starlark

docker-compose.yml

@@ -8,7 +8,7 @@ services:
       replicas: 1
       restart_policy:
         condition: any
-    image: drone/drone:1.7.0
+    image: drone/drone:1.9.0
     volumes:
       - drone:/var/lib/drone
       - drone-data:/data
@@ -39,7 +39,7 @@ services:
       replicas: 1
       restart_policy:
         condition: any
-    image: drone/drone-runner-docker:1
+    image: drone/drone-runner-docker:1.4.0
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
@@ -48,6 +48,7 @@ services:
       - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
       - DRONE_RUNNER_CAPACITY=8
       - DRONE_RUNNER_NAME="docker-runner"
+      - DRONE_RUNNER_ENVIRON=${DRONE_RUNNER_ENVIRON}
     networks:
       - appnet
   drone-starlark:

drone-starlark/repos/build-docker-folder.star

@@ -10,7 +10,7 @@ def buildDockerFolder(
     "name": "build-{name}".format(
       name = name,
     ),
-    "image": "docker:dind",
+    "image": "docker:stable-dind",
     "volumes": [
       {
         "name": "dockersock",

drone-starlark/repos/build-folder.star

@@ -5,7 +5,7 @@ def buildFolder(name, folder):
       folder=folder,
       name=name,
     ),
-    "image": "docker:dind",
+    "image": "docker:stable-dind",
     "volumes": [
       {
         "name": "dockersock",

drone-starlark/repos/build.star

@@ -3,7 +3,7 @@ load("@this//:environment.star", "environment")
 def build(name):
   return {
     "name": "build-{name}".format(name=name),
-    "image": "docker:dind",
+    "image": "docker:stable-dind",
     "volumes": [
       {
         "name": "dockersock",

drone-starlark/repos/clear.star

@@ -3,7 +3,7 @@ load("@this//:from-secret.star", "fromSecret")
 def clear(folder):   
   return {
     "name": "clear",
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "settings": {
       "host": fromSecret("ssh-host"),
       "port": fromSecret("ssh-port"),

drone-starlark/repos/deploy-from-registry.star

@@ -13,7 +13,7 @@ def deploy(
 ):
   return {
     "name": "deploy {name}".format(name = name),
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "environment": environment(secrets),
     "settings": {
       "envs": [x.replace("-", "_") for x in secrets ],

drone-starlark/repos/deploy.star

@@ -13,7 +13,7 @@ def deploy(
 ):
   return {
     "name": "deploy {name}".format(name = name),
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "environment": environment(secrets),
     "settings": {
       "envs": [x.replace("-", "_") for x in secrets ],

drone-starlark/repos/drone/public-secrets.star

@@ -4,4 +4,5 @@ publicSecrets = [
   "drone-gitea-server",
   "drone-server-host",
   "local-docker-registry",
+  "drone-runner-environ"
 ]

drone-starlark/repos/pipeline.star

@@ -13,7 +13,7 @@ def pipeline(
     "services": [
       {
         "name": "docker",
-        "image": "docker:dind",
+        "image": "docker:stable-dind",
         "privileged": True,
         "volumes": [
           {

drone-starlark/repos/print-secrets.star

@@ -8,7 +8,7 @@ load("@this//:echo-secret.star", "echoSecret")
 def printSecrets(filename, env, secretEnv):   
   return {
     "name": "print secrets",
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "environment": environment(env + secretEnv),
     "settings": {
       "envs": [x.replace("-", "_") for x in env + secretEnv ],

drone-starlark/repos/pull.star

@@ -13,7 +13,7 @@ def pull(
   ]
   return {
     "name": name,
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "environment": environment(secrets),
     "settings": {
       "envs": [x.replace("-", "_") for x in secrets ],

drone-starlark/repos/rescale.star

@@ -6,7 +6,7 @@ def rescale(
 ):
   return {
     "name": "rescale {service}".format(service=service),
-    "image": "appleboy/drone-ssh",
+    "image": "appleboy/drone-ssh:1.6.2",
     "settings": {
       "host": fromSecret("ssh-host"),
       "port": fromSecret("ssh-port"),

drone-starlark/repos/scp.star

@@ -1,7 +1,7 @@
 def scp(target):
   return {
     "name": "scp files",
-    "image": "appleboy/drone-scp",
+    "image": "appleboy/drone-scp:1.6.2",
     "settings": {
       "host": {
         "from_secret": "ssh-host",

drone-starlark/repos/wait.star

@@ -1,7 +1,7 @@
 def wait(delay, name): 
   return {
     "name": name,
-    "image": "alpine",
+    "image": "alpine:3.12.0",
     "commands": [
       "sleep {delay}".format(delay = delay),
     ],

git-hooks/pre-commit

@@ -0,0 +1,3 @@
+drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \
+&& git add .drone/drone-home.yml \
+&& echo "jsonnet built"

pull.sh

@@ -0,0 +1 @@
+docker pull ${LOCAL_DOCKER_REGISTRY}drone-starlark

push.sh

@@ -0,0 +1 @@
+docker push ${LOCAL_DOCKER_REGISTRY}drone-starlark