ci: jsonnet

.drone/drone-home.jsonnet

@@ -0,0 +1,106 @@
+local build = import 'lib/build.libsonnet';
+local images = import 'lib/images.libsonnet';
+local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
+local secretSecrets = import 'lib/secret-secrets.libsonnet';
+local publicSecrets = import 'lib/public-secrets.libsonnet';
+local util = import 'lib/util.libsonnet';
+[
+  {
+    kind: 'pipeline',
+    type: 'docker',
+    name: 'build',
+    clone: {
+      disable: false,
+      depth: 0,
+    },
+    /*trigger: {
+      event: [
+        'tag',
+      ],
+    },*/
+    services: [
+      images.docker {
+        privileged: true,
+        volumes: [
+          {
+            name: 'dockersock',
+            path: '/var/run',
+          },
+          {
+            name: 'ca',
+            path: '/etc/docker/certs.d',
+          },
+        ],
+      },
+    ],
+    volumes: [
+      {
+        name: 'dockersock',
+        temp: {},
+      },
+      {
+        name: 'ca',
+        host: {
+          path: '/etc/docker/certs.d',
+        },
+      },
+    ],
+    steps:[
+      compose(
+        std.map(
+          function(secret) util.printEnv('env-gitea', secret),
+          publicSecrets,
+        )
+      )
+      (
+        images.ssh {
+          settings +: {
+            script: [
+              'rm -f env-gitea',
+            ],
+          },
+        },
+      ) {
+        name: 'print env',
+      },
+      images.scp(
+        '/stack/gitea'
+      ),
+      images.wait(15),
+      //build,
+      compose(
+        std.map(
+          function(secret) environment.envSet(secret),
+          publicSecrets + secretSecrets,
+        ),
+      )(
+        images.ssh  {
+          name: 'deploy stack',
+          settings +: {
+            script +: 
+            std.map(
+              function(secret)
+                'export %(env)s=$${%(env)s}' % {
+                  env: environment.environment(secret)
+                },
+              secretSecrets + publicSecrets,
+            ) + 
+            [
+              //'rm -f -R /stack/squid/.secrets',
+              //'mkdir -p /stack/squid/.secrets',
+              //'echo "$${CA_CRT}" > /stack/squid/.secrets/ca.crt',
+              //'echo "$${CA_KEY}" > /stack/squid/.secrets/ca.key',
+              'set -e',
+              "cd /stack/gitea",
+              'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"',
+              'sh pull.sh',
+              'sh deploy.sh',
+              // 'docker logout $${LOCAL_DOCKER_REGISTRY}',
+            ]
+          }
+        },
+      ),
+    ],
+  }
+]

.drone/drone-home.yml

@@ -0,0 +1,167 @@
+---
+kind: pipeline
+type: docker
+name: build
+
+platform:
+  os: linux
+  arch: amd64
+
+steps:
+- name: print env
+  image: appleboy/drone-ssh:1.6.2
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - git_domain
+    - local_docker_registry
+    - gitea_mailer_host
+    - gitea_mailer_from
+    - gitea_mailer_user
+    - gitea_app_name
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    script:
+    - rm -f env-gitea
+    - "echo \"export GIT_DOMAIN='$${GIT_DOMAIN}'\" >> env-gitea # \"git-domain\""
+    - "echo \"export LOCAL_DOCKER_REGISTRY='$${LOCAL_DOCKER_REGISTRY}'\" >> env-gitea # \"local-docker-registry\""
+    - "echo \"export GITEA_MAILER_HOST='$${GITEA_MAILER_HOST}'\" >> env-gitea # \"gitea-mailer-host\""
+    - "echo \"export GITEA_MAILER_FROM='$${GITEA_MAILER_FROM}'\" >> env-gitea # \"gitea-mailer-from\""
+    - "echo \"export GITEA_MAILER_USER='$${GITEA_MAILER_USER}'\" >> env-gitea # \"gitea-mailer-user\""
+    - "echo \"export GITEA_APP_NAME='$${GITEA_APP_NAME}'\" >> env-gitea # \"gitea-app-name\""
+    username:
+      from_secret: ssh-user
+  environment:
+    GITEA_APP_NAME:
+      from_secret: gitea-app-name
+    GITEA_MAILER_FROM:
+      from_secret: gitea-mailer-from
+    GITEA_MAILER_HOST:
+      from_secret: gitea-mailer-host
+    GITEA_MAILER_USER:
+      from_secret: gitea-mailer-user
+    GIT_DOMAIN:
+      from_secret: git-domain
+    LOCAL_DOCKER_REGISTRY:
+      from_secret: local-docker-registry
+
+- name: scp
+  image: appleboy/drone-scp:1.6.2
+  settings:
+    command_timeout: 2m
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    source:
+    - .
+    target: /stack/gitea
+    username:
+      from_secret: ssh-user
+
+- name: wait
+  image: alpine
+  commands:
+  - sleep 15
+
+- name: deploy stack
+  image: appleboy/drone-ssh:1.6.2
+  settings:
+    envs:
+    - drone_tag
+    - drone_commit
+    - drone_build_number
+    - drone_repo_name
+    - drone_repo_namespace
+    - git_domain
+    - local_docker_registry
+    - gitea_mailer_host
+    - gitea_mailer_from
+    - gitea_mailer_user
+    - gitea_app_name
+    - gitea_server_lfs_jwt_secret
+    - gitea_security_secret_key
+    - gitea_security_internal_token
+    - gitea_oauth2_jwt_secret
+    - gitea_mailer_passwd
+    - registry_password
+    host:
+      from_secret: ssh-host
+    password:
+      from_secret: ssh-password
+    port:
+      from_secret: ssh-port
+    script:
+    - export GITEA_SERVER_LFS_JWT_SECRET=$${GITEA_SERVER_LFS_JWT_SECRET}
+    - export GITEA_SECURITY_SECRET_KEY=$${GITEA_SECURITY_SECRET_KEY}
+    - export GITEA_SECURITY_INTERNAL_TOKEN=$${GITEA_SECURITY_INTERNAL_TOKEN}
+    - export GITEA_OAUTH2_JWT_SECRET=$${GITEA_OAUTH2_JWT_SECRET}
+    - export GITEA_MAILER_PASSWD=$${GITEA_MAILER_PASSWD}
+    - export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
+    - export GIT_DOMAIN=$${GIT_DOMAIN}
+    - export LOCAL_DOCKER_REGISTRY=$${LOCAL_DOCKER_REGISTRY}
+    - export GITEA_MAILER_HOST=$${GITEA_MAILER_HOST}
+    - export GITEA_MAILER_FROM=$${GITEA_MAILER_FROM}
+    - export GITEA_MAILER_USER=$${GITEA_MAILER_USER}
+    - export GITEA_APP_NAME=$${GITEA_APP_NAME}
+    - set -e
+    - cd /stack/gitea
+    - docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"
+    - sh pull.sh
+    - sh deploy.sh
+    username:
+      from_secret: ssh-user
+  environment:
+    GITEA_APP_NAME:
+      from_secret: gitea-app-name
+    GITEA_MAILER_FROM:
+      from_secret: gitea-mailer-from
+    GITEA_MAILER_HOST:
+      from_secret: gitea-mailer-host
+    GITEA_MAILER_PASSWD:
+      from_secret: gitea-mailer-passwd
+    GITEA_MAILER_USER:
+      from_secret: gitea-mailer-user
+    GITEA_OAUTH2_JWT_SECRET:
+      from_secret: gitea-oauth2-jwt-secret
+    GITEA_SECURITY_INTERNAL_TOKEN:
+      from_secret: gitea-security-internal-token
+    GITEA_SECURITY_SECRET_KEY:
+      from_secret: gitea-security-secret-key
+    GITEA_SERVER_LFS_JWT_SECRET:
+      from_secret: gitea-server-lfs-jwt-secret
+    GIT_DOMAIN:
+      from_secret: git-domain
+    LOCAL_DOCKER_REGISTRY:
+      from_secret: local-docker-registry
+    REGISTRY_PASSWORD:
+      from_secret: registry-password
+
+services:
+- name: docker
+  image: docker:dind
+  privileged: true
+  volumes:
+  - name: dockersock
+    path: /var/run
+  - name: ca
+    path: /etc/docker/certs.d
+
+volumes:
+- name: dockersock
+  temp: {}
+- name: ca
+  host:
+    path: /etc/docker/certs.d
+
+...

.drone/lib/build.libsonnet

@@ -0,0 +1,23 @@
+local images = import 'images.libsonnet';
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+
+  images.docker {
+    name +: 'build:',
+    environment +: environment.environmentSecrets([
+      'LOCAL_DOCKER_REGISTRY',
+      'REGISTRY_PASSWORD',
+    ]),
+    volumes: [
+      {
+        name: 'dockersock',
+        path: '/var/run',
+      },
+    ],
+    commands: [
+      'set -e',
+      'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${REGISTRY_PASSWORD}"',
+      'sh build.sh',
+      'sh push.sh',
+      'docker logout $${LOCAL_DOCKER_REGISTRY}',
+    ],
+  }

.drone/lib/images.libsonnet

@@ -0,0 +1,38 @@
+local settings = import 'settings.libsonnet';
+{
+  docker: {
+    name: 'docker',
+    image: 'docker:dind',
+  },
+  scp(target): settings.ssh {
+    name: 'scp',
+    image: 'appleboy/drone-scp:1.6.2',
+    settings +: {
+      command_timeout: '2m',
+      target: target,
+      source: [
+        '.',
+      ],
+    },
+  },
+  ssh: settings.ssh {
+    image: 'appleboy/drone-ssh:1.6.2',    
+    settings +: {
+      envs: [
+        'drone_tag',
+        'drone_commit',
+        'drone_build_number',
+        'drone_repo_name',
+        'drone_repo_namespace',
+      ],
+      script: [],
+    },
+  },
+  wait(delay): {
+    image: 'alpine',
+    name: 'wait',
+    commands: [
+      'sleep %s' % delay,
+    ],
+  }
+}

.drone/lib/public-secrets.libsonnet

@@ -0,0 +1,8 @@
+[
+  'git-domain',
+  'local-docker-registry',
+  'gitea-mailer-host',
+  'gitea-mailer-from',
+  'gitea-mailer-user',
+  'gitea-app-name',
+]

.drone/lib/secret-secrets.libsonnet

@@ -0,0 +1,8 @@
+[
+  'gitea-server-lfs-jwt-secret',
+  'gitea-security-secret-key',
+  'gitea-security-internal-token',
+  'gitea-oauth2-jwt-secret',
+  'gitea-mailer-passwd',
+  'registry-password',
+]

.drone/lib/settings.libsonnet

@@ -0,0 +1,11 @@
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  ssh: {
+    settings +: {
+      host: environment.fromSecret('ssh-host'),
+      port: environment.fromSecret('ssh-port'),
+      username: environment.fromSecret('ssh-user'),
+      password: environment.fromSecret('ssh-password'),  
+    },
+  },
+}

.drone/lib/util.libsonnet

@@ -0,0 +1,18 @@
+local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
+local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
+{
+  printEnv(file, env): function(step) compose([
+    environment.envSet(env),
+    function(step) step {
+      settings +: {
+        script +: [
+          'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % {
+            environment: environment.environment(env),
+            file: file,
+            secret: environment.secret(env),
+          },
+        ],
+      },
+    },
+  ])(step),
+}

.drone/package.json

@@ -0,0 +1,10 @@
+{
+  "private": true,
+  "scripts": {
+    "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
+  },
+  "dependencies": {
+    "@sigyl/jsonnet-compose": "^0.0.2",
+    "@sigyl/jsonnet-drone-environment": "0.0.5"
+  }
+}

.drone/yarn-error.log

@@ -0,0 +1,37 @@
+Arguments: 
+  /usr/bin/node /home/giles/.yarn/bin/yarn.js
+
+PATH: 
+  /home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
+
+Yarn version: 
+  1.22.4
+
+Node version: 
+  11.14.0
+
+Platform: 
+  linux x64
+
+Trace: 
+  Error: self signed certificate in certificate chain
+      at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
+      at TLSSocket.emit (events.js:193:13)
+      at TLSSocket._finishInit (_tls_wrap.js:667:8)
+
+npm manifest: 
+  {
+    "private": true,
+    "scripts": {
+      "build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
+    },
+    "dependencies": {
+      "@sigyl/jsonnet-compose": "^0.0.2"
+    }
+  }
+
+yarn manifest: 
+  No manifest
+
+Lockfile: 
+  No lockfile

.drone/yarn.lock

@@ -0,0 +1,13 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+
+"@sigyl/jsonnet-compose@^0.0.2":
+  version "0.0.2"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
+  integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
+
+"@sigyl/jsonnet-drone-environment@0.0.5":
+  version "0.0.5"
+  resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
+  integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==

.gitignore

@@ -1,2 +1,2 @@
-.certificates
+
 node_modules

git-hooks/pre-commit

@@ -0,0 +1,3 @@
+drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \
+&& git add .drone/drone-home.yml \
+&& echo "jsonnet built"

node_modules/.yarn-integrity

@@ -1,5 +1,5 @@
 {
-  "systemParams": "linux-x64-67",
+  "systemParams": "darwin-x64-72",
   "modulesFolders": [
     "node_modules"
   ],

pull.sh

@@ -0,0 +1 @@
+docker pull ${LOCAL_DOCKER_REGISTRY}gitea

push.sh

@@ -0,0 +1 @@
+docker push ${LOCAL_DOCKER_REGISTRY}gitea