Compare commits

...

11 Commits

Author SHA1 Message Date
Giles Bradshaw b22b7d0321 chore(release): 0.0.8
continuous-integration/drone/push Build is passing Details
2020-08-28 22:10:30 +01:00
Giles Bradshaw f63c2060ae ci: jsonnet-drone@0.1.0
continuous-integration/drone/push Build is passing Details
2020-08-28 22:10:05 +01:00
Giles Bradshaw 1be8e8024a Merge branch 'master' of https://sigyl.com/git/stack/squid 2020-08-28 22:09:20 +01:00
Giles 1de1af14a8 empty
continuous-integration/drone/push Build is failing Details
2020-08-20 08:47:10 +01:00
Giles 68cec770fd ci: moved scripts 2020-08-20 00:28:42 +01:00
Giles Bradshaw 581abb7746 fix: rm stack 2020-08-13 12:47:14 +01:00
Giles Bradshaw 8233fe28be fix: wrong folder!
continuous-integration/drone/push Build is passing Details
2020-08-13 12:17:53 +01:00
Giles Bradshaw 8135c9c88c fix: no need for cd to myCA
continuous-integration/drone/push Build is failing Details
2020-08-13 12:10:03 +01:00
Giles Bradshaw eb113d091d fix: rename local_registry_password
continuous-integration/drone/push Build is passing Details
2020-08-13 12:05:28 +01:00
Giles Bradshaw 2e09f39cdc fix: rename local-registry-password to registry-password
continuous-integration/drone/push Build is passing Details
2020-08-13 12:02:01 +01:00
Giles Bradshaw 2be7f6b7ba ci: better specifcation of versions
continuous-integration/drone/push Build is passing Details
2020-08-13 11:48:56 +01:00
21 changed files with 215 additions and 343 deletions

2
.drone/build.sh Normal file
View File

@ -0,0 +1,2 @@
echo $CA_CRT > docker-dind/CA_crt.crt
docker build docker-dind -t ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

4
.drone/deploy.sh Normal file
View File

@ -0,0 +1,4 @@
docker stack rm squid
echo 'sleeping...zzz'
sleep 60
docker stack deploy -c docker-compose.yml squid

View File

@ -1,149 +1,31 @@
local images = import 'lib/images.libsonnet';
local environment = import 'node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
local compose = import 'node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
local secretSecrets = import 'lib/secret-secrets.libsonnet';
local publicSecrets = import 'lib/public-secrets.libsonnet';
local util = import 'lib/util.libsonnet';
local deploy = import 'node_modules/@sigyl/jsonnet-drone/deploy.libsonnet';
local register = import 'node_modules/@sigyl/jsonnet-drone/register.libsonnet';
[
{
kind: 'pipeline',
type: 'docker',
name: 'build',
clone: {
disable: false,
depth: 0,
},
/*trigger: {
event: [
'tag',
register,
deploy(
'squid',
'/stack/',
[],
publicSecrets,
secretSecrets,
[
'DOMAIN',
'REGISTRY_DOMAIN',
'REGISTRY_PORT',
'REGISTRY_PASSWORD',
],
) {
trigger +: {
event +: [
'promote',
],
},*/
services: [
images.docker {
privileged: true,
volumes: [
{
name: 'dockersock',
path: '/var/run',
},
{
name: 'ca',
path: '/etc/docker/certs.d',
},
],
},
],
volumes: [
{
name: 'dockersock',
temp: {},
},
{
name: 'ca',
host: {
path: '/etc/docker/certs.d',
},
},
],
steps:[
compose(
std.map(
function(secret) util.printEnv('env-squid', secret),
publicSecrets,
)
)
(
images.ssh {
settings +: {
script: [
'rm -f env-squid',
],
},
},
) {
name: 'print env',
},
images.scp(
'/stack/squid'
),
images.wait(15),
images.docker {
name +: 'build docker:dind image:',
environment +: environment.environmentSecrets([
'LOCAL_DOCKER_REGISTRY',
'LOCAL_REGISTRY_PASSWORD',
'CA_CRT'
]),
volumes: [
{
name: 'dockersock',
path: '/var/run',
},
],
commands: [
'set -e',
'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
'cd docker-dind',
'echo "$${CA_CRT}" > CA_crt.crt',
'docker build . -t $${LOCAL_DOCKER_REGISTRY}docker:dind',
'docker push $${LOCAL_DOCKER_REGISTRY}docker:dind',
'docker logout $${LOCAL_DOCKER_REGISTRY}',
],
}, /*
images.docker {
name +: 'build docker image:',
environment +: environment.environmentSecrets([
'LOCAL_DOCKER_REGISTRY',
'LOCAL_REGISTRY_PASSWORD',
]),
volumes: [
{
name: 'dockersock',
path: '/var/run',
},
],
commands: [
'set -e',
'pwd',
'sleep 15',
'cd docker',
'docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"',
'docker build . -t $${LOCAL_DOCKER_REGISTRY}squid',
'docker push $${LOCAL_DOCKER_REGISTRY}squid',
'docker logout $${LOCAL_DOCKER_REGISTRY}',
],
} */
compose([
environment.envSet('local-docker-registry'),
environment.envSet('local-registry-password'),
environment.envSet('ca-crt'),
environment.envSet('ca-key'),
])(
images.ssh {
name: 'deploy squid',
settings +: {
script +: [
'rm -f -R /stack/squid/.secrets',
'mkdir -p /stack/squid/.secrets',
'echo "$${CA_CRT}" > /stack/squid/.secrets/ca.crt',
'echo "$${CA_KEY}" > /stack/squid/.secrets/ca.key',
'set -e',
//"docker network prune -f",
"cd /stack/squid/myCA",
//'openssl genrsa -out CA_key.pem 2048',
//'openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=US/ST=California/L=Mountain View/O=Google/OU=Enterprise/CN=MyCA"',
'cd ..',
//"docker stack rm squid",
//"sleep 60",
// "docker volume rm squid_squid-cache",
"docker stack deploy -c docker-compose.yml squid",
]
}
},
),
],
image_pull_secrets: [
'dockerconfigjson'
]
}
target +: [
'production',
],
},
},
]

View File

@ -1,7 +1,24 @@
---
kind: pipeline
type: docker
name: build
name: register
platform:
os: linux
arch: amd64
clone:
disable: true
trigger:
event:
exclude:
- promote
---
kind: pipeline
type: docker
name: deploy
platform:
os: linux
@ -9,7 +26,7 @@ platform:
steps:
- name: print env
image: appleboy/drone-ssh
image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
settings:
envs:
- drone_tag
@ -17,123 +34,102 @@ steps:
- drone_build_number
- drone_repo_name
- drone_repo_namespace
- ssh_host
- ssh_user
- ssh_root_user
- local_docker_registry
- ca_crt
host:
from_secret: ssh-host
key:
from_secret: ssh-key
port:
from_secret: ssh-port
- local_domain
- ca_key
host: ${SSH_HOST}
key: ${SSH_KEY}
passphrase: ${SSH_PASSPHRASE}
port: ${SSH_PORT}
script:
- rm -f env-squid
- "echo \"export SSH_HOST='$${SSH_HOST}'\" >> env-squid # \"ssh-host\""
- "echo \"export SSH_USER='$${SSH_USER}'\" >> env-squid # \"ssh-user\""
- "echo \"export SSH_ROOT_USER='$${SSH_ROOT_USER}'\" >> env-squid # \"ssh-root-user\""
- "echo \"export LOCAL_DOCKER_REGISTRY='$${LOCAL_DOCKER_REGISTRY}'\" >> env-squid # \"local-docker-registry\""
- "echo \"export CA_CRT='$${CA_CRT}'\" >> env-squid # \"ca-crt\""
username:
from_secret: ssh-user
environment:
CA_CRT:
from_secret: ca-crt
LOCAL_DOCKER_REGISTRY:
from_secret: local-docker-registry
SSH_HOST:
from_secret: ssh-host
SSH_ROOT_USER:
from_secret: ssh-root-user
SSH_USER:
from_secret: ssh-user
- name: scp
image: appleboy/drone-scp
settings:
command_timeout: 2m
host:
from_secret: ssh-host
key:
from_secret: ssh-key
port:
from_secret: ssh-port
source:
- .
target: /stack/squid
username:
from_secret: ssh-user
- name: wait
image: alpine
commands:
- sleep 15
- name: "dockerbuild docker:dind image:"
image: docker:dind
commands:
- set -e
- docker login $${LOCAL_DOCKER_REGISTRY} --username client --password "$${LOCAL_REGISTRY_PASSWORD}"
- cd docker-dind
- echo "$${CA_CRT}" > CA_crt.crt
- docker build . -t $${LOCAL_DOCKER_REGISTRY}docker:dind
- docker push $${LOCAL_DOCKER_REGISTRY}docker:dind
- docker logout $${LOCAL_DOCKER_REGISTRY}
environment:
CA_CRT:
from_secret: ca-crt
LOCAL_DOCKER_REGISTRY:
from_secret: local-docker-registry
LOCAL_REGISTRY_PASSWORD:
from_secret: local-registry-password
volumes:
- name: dockersock
path: /var/run
- name: deploy squid
image: appleboy/drone-ssh
settings:
envs:
- drone_tag
- drone_commit
- drone_build_number
- drone_repo_name
- drone_repo_namespace
- local_docker_registry
- local_registry_password
- ca_crt
- ca_key
host:
from_secret: ssh-host
key:
from_secret: ssh-key
port:
from_secret: ssh-port
script:
- rm -f -R /stack/squid/.secrets
- mkdir -p /stack/squid/.secrets
- echo "$${CA_CRT}" > /stack/squid/.secrets/ca.crt
- echo "$${CA_KEY}" > /stack/squid/.secrets/ca.key
- set -e
- cd /stack/squid/myCA
- cd ..
- docker stack deploy -c docker-compose.yml squid
username:
from_secret: ssh-user
- "echo \"export LOCAL_DOMAIN='$${LOCAL_DOMAIN}'\" >> env-squid # \"local-domain\""
- "echo \"export CA_KEY='$${CA_KEY}'\" >> env-squid # \"ca-key\""
username: ${SSH_USER}
environment:
CA_CRT:
from_secret: ca-crt
CA_KEY:
from_secret: ca-key
LOCAL_DOCKER_REGISTRY:
from_secret: local-docker-registry
LOCAL_REGISTRY_PASSWORD:
from_secret: local-registry-password
LOCAL_DOMAIN:
from_secret: local-domain
- name: scp
image: appleboy/drone-scp:1.6.2@sha256:bd37a55f4b97e7742b0de7333669b96220b3cc422d366e1fa8c34059b736ab47
settings:
command_timeout: 2m
host: ${SSH_HOST}
key: ${SSH_KEY}
passphrase: ${SSH_PASSPHRASE}
port: ${SSH_PORT}
source:
- .
target: /stack/squid
username: ${SSH_USER}
- name: wait
image: alpine:3.12.0@sha256:90baa0922fe90624b05cb5766fa5da4e337921656c2f8e2b13bd3c052a0baac1
commands:
- sleep 15
- name: "dockerbuild:"
image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
commands:
- set -e
- sh .drone/login.sh
- sh .drone/build.sh
- sh .drone/push.sh
- sh .drone/logout.sh
volumes:
- name: dockersock
path: /var/run
- name: deploy
image: appleboy/drone-ssh:1.6.2@sha256:b801dc2cd238c192b6e99acfa7bc3f5b9a03f312bd2feb1e10b3a7a28a1b80ea
settings:
envs:
- drone_tag
- drone_commit
- drone_build_number
- drone_repo_name
- drone_repo_namespace
- domain
- registry_domain
- registry_port
- registry_password
- ca_crt
- local_domain
- ca_key
host: ${SSH_HOST}
key: ${SSH_KEY}
passphrase: ${SSH_PASSPHRASE}
port: ${SSH_PORT}
script:
- export CA_KEY=$${CA_KEY}
- export CA_CRT=$${CA_CRT}
- export LOCAL_DOMAIN=$${LOCAL_DOMAIN}
- export DOMAIN=$${DOMAIN}
- export REGISTRY_DOMAIN=$${REGISTRY_DOMAIN}
- export REGISTRY_PORT=$${REGISTRY_PORT}
- export REGISTRY_PASSWORD=$${REGISTRY_PASSWORD}
- set -e
- cd /stack/squid
- sh .drone/login.sh
- sh .drone/pull.sh
- sh .drone/deploy.sh
username: ${SSH_USER}
environment:
CA_CRT:
from_secret: ca-crt
CA_KEY:
from_secret: ca-key
LOCAL_DOMAIN:
from_secret: local-domain
services:
- name: docker
image: docker:dind
image: docker:19.03.12-dind@sha256:8dded163e463f4a59bf305b3dca98e312b2cfb89a43da3872e48f95a7554c48f
privileged: true
volumes:
- name: dockersock
@ -148,7 +144,10 @@ volumes:
host:
path: /etc/docker/certs.d
image_pull_secrets:
- dockerconfigjson
trigger:
event:
- promote
target:
- production
...

View File

@ -1,38 +0,0 @@
local settings = import 'settings.libsonnet';
{
docker: {
name: 'docker',
image: 'docker:dind',
},
scp(target): settings.ssh {
name: 'scp',
image: 'appleboy/drone-scp',
settings +: {
command_timeout: '2m',
target: target,
source: [
'.',
],
},
},
ssh: settings.ssh {
image: 'appleboy/drone-ssh',
settings +: {
envs: [
'drone_tag',
'drone_commit',
'drone_build_number',
'drone_repo_name',
'drone_repo_namespace',
],
script: [],
},
},
wait(delay): {
image: 'alpine',
name: 'wait',
commands: [
'sleep %s' % delay,
],
}
}

View File

@ -1,7 +1,4 @@
[
'ssh-host',
'ssh-user',
'ssh-root-user',
'local-docker-registry',
'ca-crt',
'local-domain'
]

View File

@ -1,6 +1,3 @@
[
'ssh-password',
'ssh-key',
'local-registry-password',
'ca-key',
]

View File

@ -1,11 +0,0 @@
local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
{
ssh: {
settings +: {
host: environment.fromSecret('ssh-host'),
port: environment.fromSecret('ssh-port'),
username: environment.fromSecret('ssh-user'),
key: environment.fromSecret('ssh-key'),
},
},
}

View File

@ -1,18 +0,0 @@
local compose = import '../node_modules/@sigyl/jsonnet-compose/compose.libsonnet';
local environment = import '../node_modules/@sigyl/jsonnet-drone-environment/environment.libsonnet';
{
printEnv(file, env): function(step) compose([
environment.envSet(env),
function(step) step {
settings +: {
script +: [
'echo "export %(environment)s=\'$${%(environment)s}\'" >> %(file)s # "%(secret)s"' % {
environment: environment.environment(env),
file: file,
secret: environment.secret(env),
},
],
},
},
])(step),
}

1
.drone/login.sh Normal file
View File

@ -0,0 +1 @@
docker login ${REGISTRY_DOMAIN}:${REGISTRY_PORT} --username client --password "${REGISTRY_PASSWORD}"

1
.drone/logout.sh Normal file
View File

@ -0,0 +1 @@
docker logout ${REGISTRY_DOMAIN}:${REGISTRY_PORT}

View File

@ -4,7 +4,6 @@
"build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
},
"dependencies": {
"@sigyl/jsonnet-compose": "^0.0.2",
"@sigyl/jsonnet-drone-environment": "0.0.5"
"@sigyl/jsonnet-drone": "^0.1.0"
}
}

1
.drone/pull.sh Normal file
View File

@ -0,0 +1 @@
docker pull ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

1
.drone/push.sh Normal file
View File

@ -0,0 +1 @@
docker push ${REGISTRY_DOMAIN}:${REGISTRY_PORT}/docker-dind

View File

@ -1,23 +1,21 @@
Arguments:
/usr/bin/node /home/giles/.yarn/bin/yarn.js
/usr/local/Cellar/node/11.9.0/bin/node /usr/local/Cellar/yarn/1.13.0/libexec/bin/yarn.js
PATH:
/home/giles/.yarn/bin:/home/giles/.config/yarn/global/node_modules/.bin:/home/giles/.cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/usr/local/go/bin
/Users/giles/.cargo/bin:/Users/giles/.local/bin:/Users/giles/Library/Python/3.7/bin:/Library/Frameworks/Python.framework/Versions/3.7/bin:/opt/local/bin:/opt/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/share/dotnet:/usr/local/share/dotnet/sdk:/usr/local/share/dotnet/sdk/2.2.101:/opt/X11/bin:~/.dotnet/tools:/usr/local/bin:/usr/local/Cellar/openssl/1.0.2j/bin/openssl
Yarn version:
1.22.4
1.13.0
Node version:
11.14.0
12.13.1
Platform:
linux x64
darwin x64
Trace:
Error: self signed certificate in certificate chain
at TLSSocket.onConnectSecure (_tls_wrap.js:1176:34)
at TLSSocket.emit (events.js:193:13)
at TLSSocket._finishInit (_tls_wrap.js:667:8)
Error: getaddrinfo ENOTFOUND registry.yarnpkg.com
at GetAddrInfoReqWrap.onlookup [as oncomplete] (dns.js:60:26)
npm manifest:
{
@ -26,7 +24,7 @@ npm manifest:
"build": "drone jsonnet --source drone-home.jsonnet --target drone-home.yml --stream"
},
"dependencies": {
"@sigyl/jsonnet-compose": "^0.0.2"
"@sigyl/jsonnet-drone": "^0.0.3"
}
}
@ -34,4 +32,24 @@ yarn manifest:
No manifest
Lockfile:
No lockfile
# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
# yarn lockfile v1
"@sigyl/jsonnet-compose@^0.0.2":
version "0.0.2"
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-compose/-/jsonnet-compose-0.0.2.tgz#8900a21e8cd8109929b6042703f8645aacb9bcda"
integrity sha512-wWS3CgPeNi/o1pcS6n/4pafxlMD0KC9/RKMZr/ySmzeGNRW++sPuKuxajYse2TNd47uNDdeUSnk4aEeEIKL0zA==
"@sigyl/jsonnet-drone-environment@0.0.5":
version "0.0.5"
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
"@sigyl/jsonnet-drone@^0.0.2":
version "0.0.2"
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.0.2.tgz#64572524155eaa2c2b8bda6102f238a0269cafbb"
integrity sha512-1/EZR5Vbo8oKAm+R31XIzsS6VZxcEIcRLyrLi53JQ0+z+CWLPvrUwiq0homBysYJhqk1XRzYF6+ctwbbmmzxrA==
dependencies:
"@sigyl/jsonnet-compose" "^0.0.2"
"@sigyl/jsonnet-drone-environment" "0.0.5"

View File

@ -11,3 +11,11 @@
version "0.0.5"
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone-environment/-/jsonnet-drone-environment-0.0.5.tgz#9ea85e08904777bd21a3e4b30b0b91461d0285ff"
integrity sha512-xVGmdMO1pOyozAWUbJm6mzKBgsLPJ+1hWnGCK3AxPkr7kkDh18hu30+TLzlcQtqq76s5jUfvJUztezsGj/mIcw==
"@sigyl/jsonnet-drone@^0.1.0":
version "0.1.0"
resolved "https://registry.yarnpkg.com/@sigyl/jsonnet-drone/-/jsonnet-drone-0.1.0.tgz#feda1797e8e9ef799cad72e65f7163ca26a9e3a5"
integrity sha512-QY/ngucxFOtLfL8Mt0f2bxN4fQDUOGOFtaRpSH2cNyg84xADkzehT0ORZtbLitr+AwhyF5KN/zAGvzkyNAoqPw==
dependencies:
"@sigyl/jsonnet-compose" "^0.0.2"
"@sigyl/jsonnet-drone-environment" "0.0.5"

2
.gitignore vendored
View File

@ -1 +1,3 @@
node_modules
*.log
.secrets

View File

@ -2,6 +2,17 @@
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
### [0.0.8](https://sigyl.com/git/stack/squid/compare/v0.0.7...v0.0.8) (2020-08-28)
### Bug Fixes
* no need for cd to myCA ([8135c9c](https://sigyl.com///commit/8135c9c88c18e864d5b2084d79523dc116cd356d))
* rename local_registry_password ([eb113d0](https://sigyl.com///commit/eb113d091d1c2ae1f35ad986d924f081d7f0e5cc))
* rename local-registry-password to registry-password ([2e09f39](https://sigyl.com///commit/2e09f39cdc99314e90f2f78ce02ff5e094fb0bd5))
* rm stack ([581abb7](https://sigyl.com///commit/581abb7746a33dbff8cf94668d8b49e8d89f1311))
* wrong folder! ([8233fe2](https://sigyl.com///commit/8233fe28be8e25a36d0ffaa1bba54e3314729333))
### [0.0.7](https://sigyl.com/git/stack/squid/compare/v0.0.6...v0.0.7) (2020-08-12)

View File

@ -11,7 +11,23 @@ openssl genrsa -out CA_key.pem 2048
openssl req -x509 -days 600 -new -nodes -key CA_key.pem -out CA_crt.pem -extensions v3_ca -config openssl.cnf -subj "/C=UK/ST=Devon/L=Rose Ash/O=Google/OU=SiGyl/CN=Proxy-ca"
```
then set secrets ca-crt and ca-key to the created files
then set drone secrets ca-crt and ca-key to the created files
## making dockerconfigjson
the drone secret dockerconfigjson allows images to be pulled from the local docker repository
if you login to this repository with:
```shell
docker login $LOCAL_DOCKER_REGISTRY --username client --password $REGISTRY_PASSWORD
```
then you will find the required content with:
```shell
cat ~/.docker/config.json
```
## releasing

View File

@ -13,7 +13,7 @@ services:
- HTTP_PORT=3128
- MITM_CERT=/run/secrets/ca.crt
- MITM_KEY=/run/secrets/ca.key
- VISIBLE_HOSTNAME=git.local-domain
- VISIBLE_HOSTNAME=$LOCAL_DOMAIN
- >
EXTRA_CONFIG1=tls_outgoing_options
capath=/etc/ssl/certs

View File

@ -1,6 +1,6 @@
{
"private": true,
"version": "0.0.7",
"version": "0.0.8",
"scripts": {
"release": "standard-version",
"release:message": "standard-version --releaseCommitMessageFormat",