From c72e205ae68a2c1167089ab9a495b28c21b080ce Mon Sep 17 00:00:00 2001 From: Giles Date: Thu, 13 Aug 2020 19:36:40 +0100 Subject: [PATCH] ci: jsonnet --- .drone/drone-home.jsonnet | 106 ++++++++++++++++++ .drone/drone-home.yml | 167 ++++++++++++++++++++++++++++ .drone/lib/build.libsonnet | 23 ++++ .drone/lib/images.libsonnet | 38 +++++++ .drone/lib/public-secrets.libsonnet | 8 ++ .drone/lib/secret-secrets.libsonnet | 8 ++ .drone/lib/settings.libsonnet | 11 ++ .drone/lib/util.libsonnet | 18 +++ .drone/package.json | 10 ++ .drone/yarn-error.log | 37 ++++++ .drone/yarn.lock | 13 +++ .gitignore | 2 +- git-hooks/pre-commit | 3 + node_modules/.yarn-integrity | 2 +- pull.sh | 1 + push.sh | 1 + 16 files changed, 446 insertions(+), 2 deletions(-) create mode 100644 .drone/drone-home.jsonnet create mode 100644 .drone/drone-home.yml create mode 100644 .drone/lib/build.libsonnet create mode 100644 .drone/lib/images.libsonnet create mode 100644 .drone/lib/public-secrets.libsonnet create mode 100644 .drone/lib/secret-secrets.libsonnet create mode 100644 .drone/lib/settings.libsonnet create mode 100644 .drone/lib/util.libsonnet create mode 100644 .drone/package.json create mode 100644 .drone/yarn-error.log create mode 100644 .drone/yarn.lock create mode 100755 git-hooks/pre-commit create mode 100644 pull.sh create mode 100644 push.sh diff --git a/.drone/drone-home.jsonnet b/.drone/drone-home.jsonnet new file mode 100644 index 0000000..3c38890 --- /dev/null +++ b/.drone/drone-home.jsonnet @@ -0,0 +1,106 @@ +local build = import 'lib/build.libsonnet'; +local images = import 'lib/images.libsonnet'; +local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet'; +local secretSecrets = import 'lib/secret-secrets.libsonnet'; +local publicSecrets = import 'lib/public-secrets.libsonnet'; +local util = import 'lib/util.libsonnet'; +[ + { + kind: 'pipeline', + type: 'docker', + name: 'build', + clone: { + disable: false, + depth: 0, + }, + /*trigger: { + event: [ + 'tag', + ], + },*/ + services: [ + images.docker { + privileged: true, + volumes: [ + { + name: 'dockersock', + path: '/var/run', + }, + { + name: 'ca', + path: '/etc/docker/certs.d', + }, + ], + }, + ], + volumes: [ + { + name: 'dockersock', + temp: {}, + }, + { + name: 'ca', + host: { + path: '/etc/docker/certs.d', + }, + }, + ], + steps:[ + compose( + std.map( + function(secret) util.printEnv('env-gitea', secret), + publicSecrets, + ) + ) + ( + images.ssh { + settings +: { + script: [ + 'rm -f env-gitea', + ], + }, + }, + ) { + name: 'print env', + }, + images.scp( + '/stack/gitea' + ), + images.wait(15), + //build, + compose( + std.map( + function(secret) environment.envSet(secret), + publicSecrets + secretSecrets, + ), + )( + images.ssh { + name: 'deploy stack', + settings +: { + script +: + std.map( + function(secret) + 'export %(env)s=$${%(env)s}' % { + env: environment.environment(secret) + }, + secretSecrets + publicSecrets, + ) + + [ + //'rm -f -R /stack/squid/.secrets', + //'mkdir -p /stack/squid/.secrets', + //'echo "$${CA_CRT}" > /stack/squid/.secrets/ca.crt', + //'echo "$${CA_KEY}" > /stack/squid/.secrets/ca.key', + 'set -e', + "cd /stack/gitea", + 'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"', + 'sh pull.sh', + 'sh deploy.sh', + // 'docker logout $${LOCAL_DOCKER_REGISTRY}', + ] + } + }, + ), + ], + } +] diff --git a/.drone/drone-home.yml b/.drone/drone-home.yml new file mode 100644 index 0000000..73dfcc5 --- /dev/null +++ b/.drone/drone-home.yml @@ -0,0 +1,167 @@ +--- +kind: pipeline +type: docker +name: build + +platform: + os: linux + arch: amd64 + +steps: +- name: print env + image: appleboy/drone-ssh:1.6.2 + settings: + envs: + - drone_tag + - drone_commit + - drone_build_number + - drone_repo_name + - drone_repo_namespace + - git_domain + - local_docker_registry + - gitea_mailer_host + - gitea_mailer_from + - gitea_mailer_user + - gitea_app_name + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + script: + - rm -f env-gitea + - "echo \"export GIT_DOMAIN='$${GIT_DOMAIN}'\" >> env-gitea # \"git-domain\"" + - "echo \"export LOCAL_DOCKER_REGISTRY='$${LOCAL_DOCKER_REGISTRY}'\" >> env-gitea # \"local-docker-registry\"" + - "echo \"export GITEA_MAILER_HOST='$${GITEA_MAILER_HOST}'\" >> env-gitea # \"gitea-mailer-host\"" + - "echo \"export GITEA_MAILER_FROM='$${GITEA_MAILER_FROM}'\" >> env-gitea # \"gitea-mailer-from\"" + - "echo \"export GITEA_MAILER_USER='$${GITEA_MAILER_USER}'\" >> env-gitea # \"gitea-mailer-user\"" + - "echo \"export GITEA_APP_NAME='$${GITEA_APP_NAME}'\" >> env-gitea # \"gitea-app-name\"" + username: + from_secret: ssh-user + environment: + GITEA_APP_NAME: + from_secret: gitea-app-name + GITEA_MAILER_FROM: + from_secret: gitea-mailer-from + GITEA_MAILER_HOST: + from_secret: gitea-mailer-host + GITEA_MAILER_USER: + from_secret: gitea-mailer-user + GIT_DOMAIN: + from_secret: git-domain + LOCAL_DOCKER_REGISTRY: + from_secret: local-docker-registry + +- name: scp + image: appleboy/drone-scp:1.6.2 + settings: + command_timeout: 2m + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + source: + - . + target: /stack/gitea + username: + from_secret: ssh-user + +- name: wait + image: alpine + commands: + - sleep 15 + +- name: deploy stack + image: appleboy/drone-ssh:1.6.2 + settings: + envs: + - drone_tag + - drone_commit + - drone_build_number + - drone_repo_name + - drone_repo_namespace + - git_domain + - local_docker_registry + - gitea_mailer_host + - gitea_mailer_from + - gitea_mailer_user + - gitea_app_name + - gitea_server_lfs_jwt_secret + - gitea_security_secret_key + - gitea_security_internal_token + - gitea_oauth2_jwt_secret + - gitea_mailer_passwd + - registry_password + host: + from_secret: ssh-host + password: + from_secret: ssh-password + port: + from_secret: ssh-port + script: + - export GITEA_SERVER_LFS_JWT_SECRET=$${GITEA_SERVER_LFS_JWT_SECRET} + - export GITEA_SECURITY_SECRET_KEY=$${GITEA_SECURITY_SECRET_KEY} + - export GITEA_SECURITY_INTERNAL_TOKEN=$${GITEA_SECURITY_INTERNAL_TOKEN} + - export GITEA_OAUTH2_JWT_SECRET=$${GITEA_OAUTH2_JWT_SECRET} + - export GITEA_MAILER_PASSWD=$${GITEA_MAILER_PASSWD} + - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD} + - export GIT_DOMAIN=$${GIT_DOMAIN} + - export LOCAL_DOCKER_REGISTRY=$${LOCAL_DOCKER_REGISTRY} + - export GITEA_MAILER_HOST=$${GITEA_MAILER_HOST} + - export GITEA_MAILER_FROM=$${GITEA_MAILER_FROM} + - export GITEA_MAILER_USER=$${GITEA_MAILER_USER} + - export GITEA_APP_NAME=$${GITEA_APP_NAME} + - set -e + - cd /stack/gitea + - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}" + - sh pull.sh + - sh deploy.sh + username: + from_secret: ssh-user + environment: + GITEA_APP_NAME: + from_secret: gitea-app-name + GITEA_MAILER_FROM: + from_secret: gitea-mailer-from + GITEA_MAILER_HOST: + from_secret: gitea-mailer-host + GITEA_MAILER_PASSWD: + from_secret: gitea-mailer-passwd + GITEA_MAILER_USER: + from_secret: gitea-mailer-user + GITEA_OAUTH2_JWT_SECRET: + from_secret: gitea-oauth2-jwt-secret + GITEA_SECURITY_INTERNAL_TOKEN: + from_secret: gitea-security-internal-token + GITEA_SECURITY_SECRET_KEY: + from_secret: gitea-security-secret-key + GITEA_SERVER_LFS_JWT_SECRET: + from_secret: gitea-server-lfs-jwt-secret + GIT_DOMAIN: + from_secret: git-domain + LOCAL_DOCKER_REGISTRY: + from_secret: local-docker-registry + REGISTRY_PASSWORD: + from_secret: registry-password + +services: +- name: docker + image: docker:dind + privileged: true + volumes: + - name: dockersock + path: /var/run + - name: ca + path: /etc/docker/certs.d + +volumes: +- name: dockersock + temp: {} +- name: ca + host: + path: /etc/docker/certs.d + +... diff --git a/.drone/lib/build.libsonnet b/.drone/lib/build.libsonnet new file mode 100644 index 0000000..339609d --- /dev/null +++ b/.drone/lib/build.libsonnet @@ -0,0 +1,23 @@ +local images = import 'images.libsonnet'; +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; + + images.docker { + name +: 'build:', + environment +: environment.environmentSecrets([ + 'LOCAL_DOCKER_REGISTRY', + 'REGISTRY_PASSWORD', + ]), + volumes: [ + { + name: 'dockersock', + path: '/var/run', + }, + ], + commands: [ + 'set -e', + 'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"', + 'sh build.sh', + 'sh push.sh', + 'docker logout $${LOCAL_DOCKER_REGISTRY}', + ], + } \ No newline at end of file diff --git a/.drone/lib/images.libsonnet b/.drone/lib/images.libsonnet new file mode 100644 index 0000000..b67fc35 --- /dev/null +++ b/.drone/lib/images.libsonnet @@ -0,0 +1,38 @@ +local settings = import 'settings.libsonnet'; +{ + docker: { + name: 'docker', + image: 'docker:dind', + }, + scp(target): settings.ssh { + name: 'scp', + image: 'appleboy/drone-scp:1.6.2', + settings +: { + command_timeout: '2m', + target: target, + source: [ + '.', + ], + }, + }, + ssh: settings.ssh { + image: 'appleboy/drone-ssh:1.6.2', + settings +: { + envs: [ + 'drone_tag', + 'drone_commit', + 'drone_build_number', + 'drone_repo_name', + 'drone_repo_namespace', + ], + script: [], + }, + }, + wait(delay): { + image: 'alpine', + name: 'wait', + commands: [ + 'sleep %s' % delay, + ], + } +} \ No newline at end of file diff --git a/.drone/lib/public-secrets.libsonnet b/.drone/lib/public-secrets.libsonnet new file mode 100644 index 0000000..46c9f60 --- /dev/null +++ b/.drone/lib/public-secrets.libsonnet @@ -0,0 +1,8 @@ +[ + 'git-domain', + 'local-docker-registry', + 'gitea-mailer-host', + 'gitea-mailer-from', + 'gitea-mailer-user', + 'gitea-app-name', +] diff --git a/.drone/lib/secret-secrets.libsonnet b/.drone/lib/secret-secrets.libsonnet new file mode 100644 index 0000000..282e720 --- /dev/null +++ b/.drone/lib/secret-secrets.libsonnet @@ -0,0 +1,8 @@ +[ + 'gitea-server-lfs-jwt-secret', + 'gitea-security-secret-key', + 'gitea-security-internal-token', + 'gitea-oauth2-jwt-secret', + 'gitea-mailer-passwd', + 'registry-password', +] diff --git a/.drone/lib/settings.libsonnet b/.drone/lib/settings.libsonnet new file mode 100644 index 0000000..c662633 --- /dev/null +++ b/.drone/lib/settings.libsonnet @@ -0,0 +1,11 @@ +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +{ + ssh: { + settings +: { + host: environment.fromSecret('ssh-host'), + port: environment.fromSecret('ssh-port'), + username: environment.fromSecret('ssh-user'), + password: environment.fromSecret('ssh-password'), + }, + }, +} \ No newline at end of file diff --git a/.drone/lib/util.libsonnet b/.drone/lib/util.libsonnet new file mode 100644 index 0000000..2596ab8 --- /dev/null +++ b/.drone/lib/util.libsonnet @@ -0,0 +1,18 @@ +local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet'; +local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet'; +{ + printEnv(file, env): function(step) compose([ + environment.envSet(env), + function(step) step { + settings +: { + script +: [ + 'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % { + environment: environment.environment(env), + file: file, + secret: environment.secret(env), + }, + ], + }, + }, + ])(step), +} \ No newline at end of file diff --git a/.drone/package.json b/.drone/package.json new file mode 100644 index 0000000..3869304 --- /dev/null +++ b/.drone/package.json @@ -0,0 +1,10 @@ +{ + "private": true, + "scripts": { + "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream" + }, + "dependencies": { + "@sigyl/jsonnet-compose": "^0.0.2", + "@sigyl/jsonnet-drone-environment": "0.0.5" + } +} diff --git a/.drone/yarn-error.log b/.drone/yarn-error.log new file mode 100644 index 0000000..55c6505 --- /dev/null +++ b/.drone/yarn-error.log @@ -0,0 +1,37 @@ +Arguments: + /usr/bin/node /home/giles/.yarn/bin/yarn.js + +PATH: + /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin + +Yarn version: + 1.22.4 + +Node version: + 11.14.0 + +Platform: + linux x64 + +Trace: + Error: self signed certificate in certificate chain + at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34) + at TLSSocket.emit (events.js:193:13) + at TLSSocket._finishInit (_tls_wrap.js:667:8) + +npm manifest: + { + "private": true, + "scripts": { + "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream" + }, + "dependencies": { + "@sigyl/jsonnet-compose": "^0.0.2" + } + } + +yarn manifest: + No manifest + +Lockfile: + No lockfile diff --git a/.drone/yarn.lock b/.drone/yarn.lock new file mode 100644 index 0000000..e9d5082 --- /dev/null +++ b/.drone/yarn.lock @@ -0,0 +1,13 @@ +# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY. +# yarn lockfile v1 + + +"@sigyl/jsonnet-compose@^0.0.2": + version "0.0.2" + resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda" + integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA== + +"@sigyl/jsonnet-drone-environment@0.0.5": + version "0.0.5" + resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff" + integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw== diff --git a/.gitignore b/.gitignore index 53b5da5..e212594 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -.certificates + node_modules diff --git a/git-hooks/pre-commit b/git-hooks/pre-commit new file mode 100755 index 0000000..7161ae2 --- /dev/null +++ b/git-hooks/pre-commit @@ -0,0 +1,3 @@ +drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \ +&& git add .drone/drone-home.yml \ +&& echo "jsonnet built" \ No newline at end of file diff --git a/node_modules/.yarn-integrity b/node_modules/.yarn-integrity index c018c70..d12e3be 100644 --- a/node_modules/.yarn-integrity +++ b/node_modules/.yarn-integrity @@ -1,5 +1,5 @@ { - "systemParams": "linux-x64-67", + "systemParams": "darwin-x64-72", "modulesFolders": [ "node_modules" ], diff --git a/pull.sh b/pull.sh new file mode 100644 index 0000000..d9fc1e2 --- /dev/null +++ b/pull.sh @@ -0,0 +1 @@ +docker pull ${LOCAL_DOCKER_REGISTRY}gitea diff --git a/push.sh b/push.sh new file mode 100644 index 0000000..aaafed6 --- /dev/null +++ b/push.sh @@ -0,0 +1 @@ +docker push ${LOCAL_DOCKER_REGISTRY}gitea