Compare commits
No commits in common. "master" and "home-deploy" have entirely different histories.
master
...
home-deplo
|
|
@ -1,2 +0,0 @@
|
|||
echo "${CA_CRT}" > docker-dind/CA_crt.crt
|
||||
docker build docker-dind -t ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
docker stack rm squid
|
||||
echo 'sleeping...zzz'
|
||||
sleep 60
|
||||
mkdir -p .secrets
|
||||
echo "${CA_CRT}" > .secrets/ca.crt
|
||||
echo "${CA_KEY}" > .secrets/ca.key
|
||||
docker stack deploy -c docker-compose.yml squid
|
||||
|
|
@ -1,33 +1,96 @@
|
|||
|
||||
local images = import 'lib/images.libsonnet';
|
||||
local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
|
||||
local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
|
||||
local secretSecrets = import 'lib/secret-secrets.libsonnet';
|
||||
local publicSecrets = import 'lib/public-secrets.libsonnet';
|
||||
|
||||
local deploy = import 'node_modules/@sigyl/jsonnet-drone/deploy.libsonnet';
|
||||
local register = import 'node_modules/@sigyl/jsonnet-drone/register.libsonnet';
|
||||
[
|
||||
register,
|
||||
deploy(
|
||||
'squid',
|
||||
'/stack/',
|
||||
[
|
||||
'CA_CRT',
|
||||
],
|
||||
publicSecrets,
|
||||
secretSecrets,
|
||||
[
|
||||
'DOMAIN',
|
||||
'REGISTRY_DOMAIN',
|
||||
'REGISTRY_PORT',
|
||||
'REGISTRY_PASSWORD',
|
||||
],
|
||||
) {
|
||||
trigger +: {
|
||||
event +: [
|
||||
'promote',
|
||||
],
|
||||
target +: [
|
||||
'production',
|
||||
{
|
||||
kind: 'pipeline',
|
||||
type: 'docker',
|
||||
name: 'build',
|
||||
clone: {
|
||||
disable: false,
|
||||
depth: 0,
|
||||
},
|
||||
services: [
|
||||
images.docker {
|
||||
privileged: true,
|
||||
volumes: [
|
||||
{
|
||||
name: 'dockersock',
|
||||
path: '/var/run',
|
||||
},
|
||||
{
|
||||
name: 'ca',
|
||||
path: '/etc/docker/certs.d',
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
volumes: [
|
||||
{
|
||||
name: 'dockersock',
|
||||
temp: {},
|
||||
},
|
||||
{
|
||||
name: 'ca',
|
||||
host: {
|
||||
path: '/etc/docker/certs.d',
|
||||
},
|
||||
},
|
||||
],
|
||||
steps:[
|
||||
images.scp(
|
||||
'/stack/squid'
|
||||
),
|
||||
images.wait(15),
|
||||
images.docker {
|
||||
name +: 'build docker image:',
|
||||
environment +: environment.environmentSecrets([
|
||||
'LOCAL_DOCKER_REGISTRY',
|
||||
'LOCAL_REGISTRY_PASSWORD',
|
||||
]),
|
||||
volumes: [
|
||||
{
|
||||
name: 'dockersock',
|
||||
path: '/var/run',
|
||||
},
|
||||
],
|
||||
commands: [
|
||||
'set -e',
|
||||
'pwd',
|
||||
'sleep 15',
|
||||
'cd docker',
|
||||
'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
|
||||
'docker build . -t $${LOCAL_DOCKER_REGISTRY}squid',
|
||||
'docker push $${LOCAL_DOCKER_REGISTRY}squid',
|
||||
'docker logout $${LOCAL_DOCKER_REGISTRY}',
|
||||
],
|
||||
},
|
||||
compose([
|
||||
environment.envSet('local-docker-registry'),
|
||||
environment.envSet('local-registry-password'),
|
||||
])(
|
||||
images.ssh {
|
||||
name: 'deploy squid',
|
||||
settings +: {
|
||||
script +: [
|
||||
'set -e',
|
||||
"docker network prune -f",
|
||||
"cd /stack/squid/myCA",
|
||||
'openssl genrsa -out CA_key.pem 2048',
|
||||
'openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"',
|
||||
'cd ..',
|
||||
"docker stack rm squid",
|
||||
"sleep 31",
|
||||
'export SQUID_IMAGE=$${LOCAL_DOCKER_REGISTRY}squid',
|
||||
'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
|
||||
'docker pull $${SQUID_IMAGE}',
|
||||
"docker stack deploy -c docker-compose.yml squid",
|
||||
]
|
||||
}
|
||||
},
|
||||
),
|
||||
],
|
||||
}
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,97 +1,56 @@
|
|||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: register
|
||||
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
clone:
|
||||
disable: true
|
||||
|
||||
trigger:
|
||||
event:
|
||||
exclude:
|
||||
- promote
|
||||
|
||||
---
|
||||
kind: pipeline
|
||||
type: docker
|
||||
name: deploy
|
||||
name: build
|
||||
|
||||
platform:
|
||||
os: linux
|
||||
arch: amd64
|
||||
|
||||
steps:
|
||||
- name: print env
|
||||
image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
|
||||
settings:
|
||||
envs:
|
||||
- drone_tag
|
||||
- drone_commit
|
||||
- drone_build_number
|
||||
- drone_repo_name
|
||||
- drone_repo_namespace
|
||||
- ca_crt
|
||||
- ca_crt
|
||||
- local_domain
|
||||
- ca_key
|
||||
host: ${SSH_HOST}
|
||||
key: ${SSH_KEY}
|
||||
passphrase: ${SSH_PASSPHRASE}
|
||||
port: ${SSH_PORT}
|
||||
script:
|
||||
- rm -f env-squid
|
||||
- "echo \"export CA_CRT='$${CA_CRT}'\" >> env-squid # \"ca-crt\""
|
||||
- "echo \"export CA_CRT='$${CA_CRT}'\" >> env-squid # \"ca-crt\""
|
||||
- "echo \"export LOCAL_DOMAIN='$${LOCAL_DOMAIN}'\" >> env-squid # \"local-domain\""
|
||||
- "echo \"export CA_KEY='$${CA_KEY}'\" >> env-squid # \"ca-key\""
|
||||
username: ${SSH_USER}
|
||||
environment:
|
||||
CA_CRT:
|
||||
from_secret: ca-crt
|
||||
CA_KEY:
|
||||
from_secret: ca-key
|
||||
LOCAL_DOMAIN:
|
||||
from_secret: local-domain
|
||||
|
||||
- name: scp
|
||||
image: appleboy/drone-scp:1.6.2@sha256:bd37a55f4b97e7742b0de7333669b96220b3cc422d366e1fa8c34059b736ab47
|
||||
image: appleboy/drone-scp
|
||||
settings:
|
||||
command_timeout: 2m
|
||||
host: ${SSH_HOST}
|
||||
key: ${SSH_KEY}
|
||||
passphrase: ${SSH_PASSPHRASE}
|
||||
port: ${SSH_PORT}
|
||||
host:
|
||||
from_secret: ssh-host
|
||||
key:
|
||||
from_secret: ssh-key
|
||||
port:
|
||||
from_secret: ssh-port
|
||||
source:
|
||||
- .
|
||||
target: /stack/squid
|
||||
username: ${SSH_USER}
|
||||
username:
|
||||
from_secret: ssh-user
|
||||
|
||||
- name: wait
|
||||
image: alpine:3.12.0@sha256:90baa0922fe90624b05cb5766fa5da4e337921656c2f8e2b13bd3c052a0baac1
|
||||
image: alpine
|
||||
commands:
|
||||
- sleep 15
|
||||
|
||||
- name: "dockerbuild:"
|
||||
image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
|
||||
- name: "dockerbuild docker image:"
|
||||
image: docker:dind
|
||||
commands:
|
||||
- set -e
|
||||
- sh .drone/login.sh
|
||||
- sh .drone/build.sh
|
||||
- sh .drone/push.sh
|
||||
- sh .drone/logout.sh
|
||||
- pwd
|
||||
- sleep 15
|
||||
- cd docker
|
||||
- docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"
|
||||
- docker build . -t $${LOCAL_DOCKER_REGISTRY}squid
|
||||
- docker push $${LOCAL_DOCKER_REGISTRY}squid
|
||||
- docker logout $${LOCAL_DOCKER_REGISTRY}
|
||||
environment:
|
||||
CA_CRT:
|
||||
from_secret: ca-crt
|
||||
LOCAL_DOCKER_REGISTRY:
|
||||
from_secret: local-docker-registry
|
||||
LOCAL_REGISTRY_PASSWORD:
|
||||
from_secret: local-registry-password
|
||||
volumes:
|
||||
- name: dockersock
|
||||
path: /var/run
|
||||
|
||||
- name: deploy
|
||||
image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
|
||||
- name: deploy squid
|
||||
image: appleboy/drone-ssh
|
||||
settings:
|
||||
envs:
|
||||
- drone_tag
|
||||
|
|
@ -99,44 +58,38 @@ steps:
|
|||
- drone_build_number
|
||||
- drone_repo_name
|
||||
- drone_repo_namespace
|
||||
- domain
|
||||
- registry_domain
|
||||
- registry_port
|
||||
- registry_password
|
||||
- ca_crt
|
||||
- local_domain
|
||||
- ca_key
|
||||
- ca_crt
|
||||
host: ${SSH_HOST}
|
||||
key: ${SSH_KEY}
|
||||
passphrase: ${SSH_PASSPHRASE}
|
||||
port: ${SSH_PORT}
|
||||
- local_docker_registry
|
||||
- local_registry_password
|
||||
host:
|
||||
from_secret: ssh-host
|
||||
key:
|
||||
from_secret: ssh-key
|
||||
port:
|
||||
from_secret: ssh-port
|
||||
script:
|
||||
- export CA_KEY=$${CA_KEY}
|
||||
- export CA_CRT=$${CA_CRT}
|
||||
- export LOCAL_DOMAIN=$${LOCAL_DOMAIN}
|
||||
- export CA_CRT=$${CA_CRT}
|
||||
- export DOMAIN=$${DOMAIN}
|
||||
- export REGISTRY_DOMAIN=$${REGISTRY_DOMAIN}
|
||||
- export REGISTRY_PORT=$${REGISTRY_PORT}
|
||||
- export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
|
||||
- set -e
|
||||
- cd /stack/squid
|
||||
- sh .drone/login.sh
|
||||
- sh .drone/pull.sh
|
||||
- sh .drone/deploy.sh
|
||||
username: ${SSH_USER}
|
||||
- docker network prune -f
|
||||
- cd /stack/squid/myCA
|
||||
- openssl genrsa -out CA_key.pem 2048
|
||||
- openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"
|
||||
- cd ..
|
||||
- docker stack rm squid
|
||||
- sleep 31
|
||||
- export SQUID_IMAGE=$${LOCAL_DOCKER_REGISTRY}squid
|
||||
- docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"
|
||||
- docker pull $${SQUID_IMAGE}
|
||||
- docker stack deploy -c docker-compose.yml squid
|
||||
username:
|
||||
from_secret: ssh-user
|
||||
environment:
|
||||
CA_CRT:
|
||||
from_secret: ca-crt
|
||||
CA_KEY:
|
||||
from_secret: ca-key
|
||||
LOCAL_DOMAIN:
|
||||
from_secret: local-domain
|
||||
LOCAL_DOCKER_REGISTRY:
|
||||
from_secret: local-docker-registry
|
||||
LOCAL_REGISTRY_PASSWORD:
|
||||
from_secret: local-registry-password
|
||||
|
||||
services:
|
||||
- name: docker
|
||||
image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
|
||||
image: docker:dind
|
||||
privileged: true
|
||||
volumes:
|
||||
- name: dockersock
|
||||
|
|
@ -151,10 +104,4 @@ volumes:
|
|||
host:
|
||||
path: /etc/docker/certs.d
|
||||
|
||||
trigger:
|
||||
event:
|
||||
- promote
|
||||
target:
|
||||
- production
|
||||
|
||||
...
|
||||
|
|
|
|||
|
|
@ -0,0 +1,38 @@
|
|||
local settings = import 'settings.libsonnet';
|
||||
{
|
||||
docker: {
|
||||
name: 'docker',
|
||||
image: 'docker:dind',
|
||||
},
|
||||
scp(target): settings.ssh {
|
||||
name: 'scp',
|
||||
image: 'appleboy/drone-scp',
|
||||
settings +: {
|
||||
command_timeout: '2m',
|
||||
target: target,
|
||||
source: [
|
||||
'.',
|
||||
],
|
||||
},
|
||||
},
|
||||
ssh: settings.ssh {
|
||||
image: 'appleboy/drone-ssh',
|
||||
settings +: {
|
||||
envs: [
|
||||
'drone_tag',
|
||||
'drone_commit',
|
||||
'drone_build_number',
|
||||
'drone_repo_name',
|
||||
'drone_repo_namespace',
|
||||
],
|
||||
script: [],
|
||||
},
|
||||
},
|
||||
wait(delay): {
|
||||
image: 'alpine',
|
||||
name: 'wait',
|
||||
commands: [
|
||||
'sleep %s' % delay,
|
||||
],
|
||||
}
|
||||
}
|
||||
|
|
@ -1,4 +1,6 @@
|
|||
[
|
||||
'ca-crt',
|
||||
'local-domain'
|
||||
'ssh-host',
|
||||
'ssh-user',
|
||||
'ssh-root-user',
|
||||
'local-docker-registry',
|
||||
]
|
||||
|
|
|
|||
|
|
@ -1,3 +1,5 @@
|
|||
[
|
||||
'ca-key',
|
||||
'ssh-password',
|
||||
'ssh-key',
|
||||
'local-registry-password',
|
||||
]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
|
||||
{
|
||||
ssh: {
|
||||
settings +: {
|
||||
host: environment.fromSecret('ssh-host'),
|
||||
port: environment.fromSecret('ssh-port'),
|
||||
username: environment.fromSecret('ssh-user'),
|
||||
key: environment.fromSecret('ssh-key'),
|
||||
},
|
||||
},
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
|
||||
local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
|
||||
{
|
||||
printEnv(file, env): function(step) compose([
|
||||
environment.envSet(env),
|
||||
function(step) step {
|
||||
settings +: {
|
||||
script +: [
|
||||
'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % {
|
||||
environment: environment.environment(env),
|
||||
file: file,
|
||||
secret: environment.secret(env),
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
])(step),
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
docker login ${REGISTRY_DOMAIN}:${REGISTRY_PORT} --username client --password "${REGISTRY_PASSWORD}"
|
||||
|
|
@ -1 +0,0 @@
|
|||
docker logout ${REGISTRY_DOMAIN}:${REGISTRY_PORT}
|
||||
|
|
@ -4,6 +4,7 @@
|
|||
"build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
|
||||
},
|
||||
"dependencies": {
|
||||
"@sigyl/jsonnet-drone": "^0.1.0"
|
||||
"@sigyl/jsonnet-compose": "^0.0.2",
|
||||
"@sigyl/jsonnet-drone-environment": "0.0.5"
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
docker pull ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind
|
||||
|
|
@ -1 +0,0 @@
|
|||
docker push ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind
|
||||
|
|
@ -1,21 +1,23 @@
|
|||
Arguments:
|
||||
/usr/local/Cellar/node/11.9.0/bin/node /usr/local/Cellar/yarn/1.13.0/libexec/bin/yarn.js
|
||||
/usr/bin/node /home/giles/.yarn/bin/yarn.js
|
||||
|
||||
PATH:
|
||||
/Users/giles/.cargo/bin:/Users/giles/.local/bin:/Users/giles/Library/Python/3.7/bin:/Library/Frameworks/Python.framework/Versions/3.7/bin:/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/share/dotnet:/usr/local/share/dotnet/sdk:/usr/local/share/dotnet/sdk/2.2.101:/opt/X11/bin:~/.dotnet/tools:/usr/local/bin:/usr/local/Cellar/openssl/1.0.2j/bin/openssl
|
||||
/home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
|
||||
|
||||
Yarn version:
|
||||
1.13.0
|
||||
1.22.4
|
||||
|
||||
Node version:
|
||||
12.13.1
|
||||
11.14.0
|
||||
|
||||
Platform:
|
||||
darwin x64
|
||||
linux x64
|
||||
|
||||
Trace:
|
||||
Error: getaddrinfo ENOTFOUND registry.yarnpkg.com
|
||||
at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:60:26)
|
||||
Error: self signed certificate in certificate chain
|
||||
at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
|
||||
at TLSSocket.emit (events.js:193:13)
|
||||
at TLSSocket._finishInit (_tls_wrap.js:667:8)
|
||||
|
||||
npm manifest:
|
||||
{
|
||||
|
|
@ -24,7 +26,7 @@ npm manifest:
|
|||
"build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
|
||||
},
|
||||
"dependencies": {
|
||||
"@sigyl/jsonnet-drone": "^0.0.3"
|
||||
"@sigyl/jsonnet-compose": "^0.0.2"
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -32,24 +34,4 @@ yarn manifest:
|
|||
No manifest
|
||||
|
||||
Lockfile:
|
||||
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
|
||||
# yarn lockfile v1
|
||||
|
||||
|
||||
"@sigyl/jsonnet-compose@^0.0.2":
|
||||
version "0.0.2"
|
||||
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
|
||||
integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
|
||||
|
||||
"@sigyl/jsonnet-drone-environment@0.0.5":
|
||||
version "0.0.5"
|
||||
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
|
||||
integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
|
||||
|
||||
"@sigyl/jsonnet-drone@^0.0.2":
|
||||
version "0.0.2"
|
||||
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.0.2.tgz#64572524155eaa2c2b8bda6102f238a0269cafbb"
|
||||
integrity sha512-1/EZR5Vbo8oKAm+R31XIzsS6VZxcEIcRLyrLi53JQ0+z+CWLPvrUwiq0homBysYJhqk1XRzYF6+ctwbbmmzxrA==
|
||||
dependencies:
|
||||
"@sigyl/jsonnet-compose" "^0.0.2"
|
||||
"@sigyl/jsonnet-drone-environment" "0.0.5"
|
||||
No lockfile
|
||||
|
|
|
|||
|
|
@ -11,11 +11,3 @@
|
|||
version "0.0.5"
|
||||
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
|
||||
integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
|
||||
|
||||
"@sigyl/jsonnet-drone@^0.1.0":
|
||||
version "0.1.0"
|
||||
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.1.0.tgz#feda1797e8e9ef799cad72e65f7163ca26a9e3a5"
|
||||
integrity sha512-QY/ngucxFOtLfL8Mt0f2bxN4fQDUOGOFtaRpSH2cNyg84xADkzehT0ORZtbLitr+AwhyF5KN/zAGvzkyNAoqPw==
|
||||
dependencies:
|
||||
"@sigyl/jsonnet-compose" "^0.0.2"
|
||||
"@sigyl/jsonnet-drone-environment" "0.0.5"
|
||||
|
|
|
|||
|
|
@ -1,3 +1,2 @@
|
|||
myCA/*.pem
|
||||
node_modules
|
||||
*.log
|
||||
.secrets
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
{
|
||||
"compareUrlFormat": "{{repoUrl}}/compare/{{previousTag}}...{{currentTag}}"
|
||||
}
|
||||
45
CHANGELOG.md
45
CHANGELOG.md
|
|
@ -2,51 +2,6 @@
|
|||
|
||||
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
|
||||
|
||||
### [0.0.8](https://sigyl.com/git/stack/squid/compare/v0.0.7...v0.0.8) (2020-08-28)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* no need for cd to myCA ([8135c9c](https://sigyl.com///commit/8135c9c88c18e864d5b2084d79523dc116cd356d))
|
||||
* rename local_registry_password ([eb113d0](https://sigyl.com///commit/eb113d091d1c2ae1f35ad986d924f081d7f0e5cc))
|
||||
* rename local-registry-password to registry-password ([2e09f39](https://sigyl.com///commit/2e09f39cdc99314e90f2f78ce02ff5e094fb0bd5))
|
||||
* rm stack ([581abb7](https://sigyl.com///commit/581abb7746a33dbff8cf94668d8b49e8d89f1311))
|
||||
* wrong folder! ([8233fe2](https://sigyl.com///commit/8233fe28be8e25a36d0ffaa1bba54e3314729333))
|
||||
|
||||
### [0.0.7](https://sigyl.com/git/stack/squid/compare/v0.0.6...v0.0.7) (2020-08-12)
|
||||
|
||||
|
||||
### Features
|
||||
|
||||
* pre-commit hook to build jsonnet ([2377c54](https://sigyl.com///commit/2377c542e3a7f6e026239a1655d1c50c9d87e019))
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* change file mode ([c03054a](https://sigyl.com///commit/c03054a23c227305c7b1dfb943241c2b5ac16677))
|
||||
* git-hooks ([0d61cf5](https://sigyl.com///commit/0d61cf53ca9db5b10b9800f9af4628612cd4950f))
|
||||
|
||||
### [0.0.6](https://sigyl.com/git/stack/squid/compare/v0.0.5...v0.0.6) (2020-08-12)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* sigyl/squid-4 v 1.1.0 ([69b2292](https://sigyl.com///commit/69b229280c19fb536f2648aca325381cb26b22ad))
|
||||
* squid-4 ([55175d4](https://sigyl.com///commit/55175d4cb56dc218541ea1ceb295f09aba06359c))
|
||||
|
||||
### [0.0.5](https://sigyl.com/git/stack/squid/compare/v0.0.4...v0.0.5) (2020-08-06)
|
||||
|
||||
|
||||
### Bug Fixes
|
||||
|
||||
* added dhparam.pem ([bd1e63d](https://sigyl.com///commit/bd1e63d3c23fedb951c96b0ed378ab7489e0b033))
|
||||
|
||||
### [0.0.4](https://sigyl.com/git/stack/squid/compare/v0.0.3...v0.0.4) (2020-08-05)
|
||||
|
||||
### [0.0.3](https://sigyl.com/git/stack/squid/compare/v0.0.2...v0.0.3) (2020-08-05)
|
||||
|
||||
### [0.0.2](https://sigyl.com/git/stack/squid/compare/v0.0.1...v0.0.2) here tis (2020-08-05)
|
||||
|
||||
### 0.0.1 (2020-08-05)
|
||||
|
||||
|
||||
|
|
|
|||
21
README.md
21
README.md
|
|
@ -7,26 +7,9 @@ inspired by https://github.com/salrashid123/squid_proxy
|
|||
## making a CA
|
||||
|
||||
```shell
|
||||
cd myCA
|
||||
openssl genrsa -out CA_key.pem 2048
|
||||
openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=UK/ST=Devon/L=Rose Ash/O=Google/OU=SiGyl/CN=Proxy-ca"
|
||||
```
|
||||
|
||||
then set drone secrets ca-crt and ca-key to the created files
|
||||
|
||||
## making dockerconfigjson
|
||||
|
||||
the drone secret dockerconfigjson allows images to be pulled from the local docker repository
|
||||
|
||||
if you login to this repository with:
|
||||
|
||||
```shell
|
||||
docker login $LOCAL_DOCKER_REGISTRY --username client --password $REGISTRY_PASSWORD
|
||||
```
|
||||
|
||||
then you will find the required content with:
|
||||
|
||||
```shell
|
||||
cat ~/.docker/config.json
|
||||
openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"
|
||||
```
|
||||
|
||||
## releasing
|
||||
|
|
|
|||
|
|
@ -1,39 +1,23 @@
|
|||
version: "3.7"
|
||||
services:
|
||||
squid-4:
|
||||
squid:
|
||||
deploy:
|
||||
placement:
|
||||
constraints: [node.labels.com.sigyl.git-stack == yes]
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
image: sigyl/squid-4:1.1.0
|
||||
environment:
|
||||
- MITM_PROXY=yes
|
||||
- HTTP_PORT=3128
|
||||
- MITM_CERT=/run/secrets/ca.crt
|
||||
- MITM_KEY=/run/secrets/ca.key
|
||||
- VISIBLE_HOSTNAME=$LOCAL_DOMAIN
|
||||
- >
|
||||
EXTRA_CONFIG1=tls_outgoing_options
|
||||
capath=/etc/ssl/certs
|
||||
options=NO_SSLv3,NO_TLSv1 min-version=1.2
|
||||
# - EXTRA_CONFIG2=sslproxy_cipher ECDHE+ECDSA+AESGCM:ECDHE+RSA+AESGCM:EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM #:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS
|
||||
# these are basically to make everything canched
|
||||
- 'EXTRA_CONFIG2=refresh_pattern ^http: 999999999 1000000000% 999999999 override-expire'
|
||||
- 'EXTRA_CONFIG3=refresh_pattern ^https: 999999999 1000000000% 999999999 override-expire'
|
||||
- EXTRA_CONFIG4= acl no_cache_domains dstdomain auth.docker.io
|
||||
- EXTRA_CONFIG5=cache deny no_cache_domains
|
||||
image: ${SQUID_IMAGE}
|
||||
volumes:
|
||||
- squid-4-cache:/var/cache/squid4
|
||||
- squid-cache:/apps/squid/var/cache/squid
|
||||
#- ./squid.intercept.conf:/etc/squid/squid.conf
|
||||
- ./myCA/CA_crt.pem:/apps/CA_crt.pem
|
||||
- ./myCA/CA_key.pem:/apps/CA_key.pem
|
||||
ports:
|
||||
- 3128:3128
|
||||
networks:
|
||||
- appnet
|
||||
- externalnet
|
||||
secrets:
|
||||
- ca.crt
|
||||
- ca.key
|
||||
squid-deb:
|
||||
deploy:
|
||||
placement:
|
||||
|
|
@ -41,7 +25,7 @@ services:
|
|||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
image: sigyl/squid-deb-proxy:1.0.0
|
||||
image: mikepurvis/squid-deb-proxy:latest
|
||||
volumes:
|
||||
- squid-deb-cache:/cachedir
|
||||
ports:
|
||||
|
|
@ -50,7 +34,7 @@ services:
|
|||
- appnet
|
||||
- externalnet
|
||||
volumes:
|
||||
squid-4-cache:
|
||||
squid-cache:
|
||||
squid-deb-cache:
|
||||
|
||||
networks:
|
||||
|
|
@ -59,9 +43,3 @@ networks:
|
|||
externalnet:
|
||||
driver: overlay
|
||||
external: true
|
||||
|
||||
secrets:
|
||||
'ca.crt':
|
||||
file: .secrets/ca.crt
|
||||
'ca.key':
|
||||
file: .secrets/ca.key
|
||||
|
|
|
|||
|
|
@ -1,3 +0,0 @@
|
|||
FROM docker:18.06.0-dind
|
||||
COPY ./CA_crt.crt /usr/local/share/ca-certificates/CA_crt.crt
|
||||
RUN update-ca-certificates
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
FROM debian:8
|
||||
RUN apt-get -y update
|
||||
RUN apt-get install -y curl supervisor git openssl build-essential libssl-dev wget vim curl
|
||||
RUN mkdir -p /var/log/supervisor
|
||||
WORKDIR /apps/
|
||||
RUN wget -O - http://www.squid-cache.org/Versions/v3/3.5/squid-3.5.27.tar.gz | tar zxfv - \
|
||||
&& CPU=$(( `nproc --all`-1 )) \
|
||||
&& cd /apps/squid-3.5.27/ \
|
||||
&& ./configure --prefix=/apps/squid --enable-icap-client --enable-ssl --with-openssl --enable-ssl-crtd --enable-auth --enable-basic-auth-helpers="NCSA" \
|
||||
&& make -j$CPU \
|
||||
&& make install \
|
||||
&& cd /apps \
|
||||
&& rm -rf /apps/squid-3.5.27
|
||||
ADD . /apps/
|
||||
|
||||
RUN chown -R nobody:nogroup /apps/
|
||||
RUN mkdir -p /apps/squid/var/lib/
|
||||
RUN /apps/squid/libexec/ssl_crtd -c -s /apps/squid/var/lib/ssl_db -M 4MB
|
||||
RUN /apps/squid/sbin/squid -N -f /apps/squid.cache.conf -z
|
||||
RUN chown -R nobody:nogroup /apps/
|
||||
|
||||
EXPOSE 3128
|
||||
ENTRYPOINT ["/apps/squid/sbin/squid", "-NsY", "-f"]
|
||||
CMD ["/apps/squid.intercept.conf"]
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
cache_dir aufs /apps/squid/var/cache/squid 10000 16 256
|
||||
|
||||
coredump_dir /apps/squid/var/cache
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
always_direct allow all
|
||||
|
||||
acl localhost src 127.0.0.1/32
|
||||
acl to_localhost dst 127.0.0.0/8
|
||||
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
|
||||
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
|
||||
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
|
||||
acl SSL_ports port 443
|
||||
acl Safe_ports port 80 # http
|
||||
acl Safe_ports port 21 # ftp
|
||||
acl Safe_ports port 443 # https
|
||||
acl Safe_ports port 70 # gopher
|
||||
acl Safe_ports port 210 # wais
|
||||
acl Safe_ports port 1025-65535 # unregistered ports
|
||||
acl Safe_ports port 280 # http-mgmt
|
||||
acl Safe_ports port 488 # gss-http
|
||||
acl Safe_ports port 591 # filemaker
|
||||
acl Safe_ports port 777 # multiling http
|
||||
acl CONNECT method CONNECT
|
||||
|
||||
http_access allow all
|
||||
http_access allow manager localhost
|
||||
http_access deny manager
|
||||
|
||||
htcp_access allow localnet
|
||||
htcp_access deny all
|
||||
|
||||
|
||||
visible_hostname git.local-domain
|
||||
|
||||
http_port 3128 ssl-bump generate-host-certificates=on cert=/apps/CA_crt.pem key=/apps/CA_key.pem
|
||||
|
||||
always_direct allow all
|
||||
acl excluded_sites ssl::server_name .wellsfargo.com
|
||||
ssl_bump splice excluded_sites
|
||||
ssl_bump bump all
|
||||
|
||||
sslproxy_cert_error deny all
|
||||
sslcrtd_program /apps/squid/libexec/ssl_crtd -s /apps/squid/var/lib/ssl_db -M 4MB sslcrtd_children 8 startup=1 idle=1
|
||||
|
||||
icap_enable on
|
||||
icap_preview_enable on
|
||||
icap_preview_size 128
|
||||
icap_send_client_ip on
|
||||
|
||||
adaptation_access url_check allow all
|
||||
|
||||
access_log /apps/squid/var/logs/access.log squid
|
||||
|
||||
# these are basically to make everything canched
|
||||
refresh_pattern ^http: 999999999 1000000000% 999999999 ignore-no-cache override-expire ignore-reload
|
||||
refresh_pattern ^https: 999999999 1000000000% 999999999 ignore-no-cache override-expire ignore-reload
|
||||
|
||||
debug_options 11,2 22,10
|
||||
|
||||
refresh_pattern ^ftp: 1440 20% 10080
|
||||
refresh_pattern ^gopher: 1440 0% 1440
|
||||
refresh_pattern (cgi-bin|\?) 0 0% 0
|
||||
refresh_pattern . 0 20% 4320
|
||||
|
||||
icp_port 3130
|
||||
|
||||
|
||||
coredump_dir /apps/squid/var/cache
|
||||
|
||||
|
||||
cache_mem 1000 MB
|
||||
|
||||
maximum_object_size 4096 MB
|
||||
cache_dir aufs /apps/squid/var/cache/squid 10000 16 256
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream \
|
||||
&& git add .drone/drone-home.yml \
|
||||
&& echo "jsonnet built"
|
||||
|
|
@ -1,12 +1,11 @@
|
|||
{
|
||||
"private": true,
|
||||
"version": "0.0.8",
|
||||
"version": "0.0.1",
|
||||
"scripts": {
|
||||
"release": "standard-version",
|
||||
"release:message": "standard-version --releaseCommitMessageFormat",
|
||||
"jsonnet:home": "drone jsonnet --source .drone/drone-home.jsonnet --target .drone/drone-home.yml --stream"
|
||||
},
|
||||
"devDependencies": {
|
||||
"standard-version": "https://github.com/gilesbradshaw/standard-version"
|
||||
"standard-version": "^8.0.2"
|
||||
}
|
||||
}
|
||||
|
|
@ -1327,9 +1327,10 @@ split@^1.0.0:
|
|||
dependencies:
|
||||
through "2"
|
||||
|
||||
"standard-version@https://github.com/gilesbradshaw/standard-version":
|
||||
version "9.0.0"
|
||||
resolved "https://github.com/gilesbradshaw/standard-version#708c6e4385c16f772812eed72f07fc033c3e7200"
|
||||
standard-version@^8.0.2:
|
||||
version "8.0.2"
|
||||
resolved "https://registry.yarnpkg.com/standard-version/-/standard-version-8.0.2.tgz#02ed7131f83046bd04358dc54f97d42c4b2fd828"
|
||||
integrity sha512-L8X9KFq2SmVmaeZgUmWHFJMOsEWpjgFAwqic6yIIoveM1kdw1vH4Io03WWxUDjypjGqGU6qUtcJoR8UvOv5w3g==
|
||||
dependencies:
|
||||
chalk "^2.4.2"
|
||||
conventional-changelog "3.1.21"
|
||||
|
|
|
|||
Loading…
Reference in New Issue