Initial deploy
This commit is contained in:
Reactorcoremeltdown
@@ -0,0 +1,26 @@
|
||||
---
|
||||
when:
|
||||
- path:
|
||||
include:
|
||||
- 'config/variables/server.values.yaml'
|
||||
- '.woodpecker/build.yaml'
|
||||
- 'Makefile'
|
||||
- 'VERSION'
|
||||
- 'Dockerfile'
|
||||
- '*.go'
|
||||
event: push
|
||||
labels:
|
||||
role: production
|
||||
skip_clone: true
|
||||
steps:
|
||||
clone:
|
||||
image: bash
|
||||
commands:
|
||||
- git clone --depth=1 ${CI_REPO_CLONE_SSH_URL}
|
||||
build:
|
||||
image: bash
|
||||
commands:
|
||||
- cd ${CI_REPO_NAME} && echo $GIT_SUDO | sudo -S make build-server
|
||||
environment:
|
||||
GIT_SUDO:
|
||||
from_secret: git_sudo
|
||||
@@ -0,0 +1,28 @@
|
||||
---
|
||||
when:
|
||||
- path:
|
||||
include:
|
||||
- 'config/variables/server.values.yaml'
|
||||
- '.woodpecker/deploy.yaml'
|
||||
- 'Makefile'
|
||||
- 'VERSION'
|
||||
- 'Dockerfile'
|
||||
- '*.go'
|
||||
event: push
|
||||
labels:
|
||||
role: homeserver
|
||||
depends_on:
|
||||
- build
|
||||
skip_clone: true
|
||||
steps:
|
||||
clone:
|
||||
image: bash
|
||||
commands:
|
||||
- git clone --depth=1 ${CI_REPO_CLONE_SSH_URL}
|
||||
deploy:
|
||||
image: bash
|
||||
commands:
|
||||
- cd ${CI_REPO_NAME} && echo $GIT_SUDO | sudo -S make deploy-server
|
||||
environment:
|
||||
GIT_SUDO:
|
||||
from_secret: git_sudo
|
||||
@@ -27,6 +27,7 @@ HOST_CLIENT := $(BUILD)/$(HOSTOS)-$(HOSTARCH)/keeporg
|
||||
HOST_SERVER := $(BUILD)/$(HOSTOS)-$(HOSTARCH)/keeporgd
|
||||
|
||||
.DEFAULT_GOAL := help
|
||||
APP_NAME := keeporg
|
||||
|
||||
# ---------------------------------------------------------------- developing
|
||||
|
||||
@@ -230,3 +231,21 @@ run-server: $(HOST_SERVER) ## run a server on 127.0.0.1:8765 with data in ./.dev
|
||||
.PHONY: run-client
|
||||
run-client: $(HOST_CLIENT) ## run the sync agent with the local configuration
|
||||
$(HOST_CLIENT) run
|
||||
|
||||
nginx:
|
||||
cat config/variables/main.json | tpl -f config/nginx/$(APP_NAME).conf.tmpl > /etc/nginx/sites-available/$(APP_NAME).conf
|
||||
ln -sf /etc/nginx/sites-available/$(APP_NAME).conf /etc/nginx/sites-enabled/$(APP_NAME).conf
|
||||
nginx -t
|
||||
systemctl restart nginx
|
||||
|
||||
build-server: nginx
|
||||
podman build \
|
||||
--build-arg APP_VERSION=${VERSION} \
|
||||
--platform=linux/arm64 \
|
||||
-t repo.rcmd.space/$(APP_NAME):$(VERSION) \
|
||||
.
|
||||
podman push repo.rcmd.space/$(APP_NAME):$(VERSION)
|
||||
podman image prune -f
|
||||
|
||||
deploy-server:
|
||||
helm upgrade --install --namespace "apps" --create-namespace $(APP_NAME) rcmd/rcmd-base -f ./config/variables/server.values.yaml --set "image.version=$(VERSION)"
|
||||
|
||||
@@ -0,0 +1,86 @@
|
||||
### Deployed by https://git.rcmd.space/sloperated/{{ }}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
server_name keeporg.tiredsysadmin.cc;
|
||||
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
|
||||
access_log /var/log/nginx/keeporg.tiredsysadmin.cc_access.log json;
|
||||
error_log /var/log/nginx/keeporg.tiredsysadmin.cc_error.log;
|
||||
|
||||
### SSL cert files ###
|
||||
ssl_certificate {{ .nginx.variables.blog_ssl_certificate }};
|
||||
ssl_certificate_key {{ .nginx.variables.blog_ssl_certificate_key }};
|
||||
|
||||
client_max_body_size 8192M;
|
||||
|
||||
server_name keeporg.tiredsysadmin.cc;
|
||||
|
||||
location = /validate {
|
||||
proxy_pass http://127.0.0.1:30021/validate;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_pass_request_body off;
|
||||
proxy_set_header Content-Length "";
|
||||
auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user;
|
||||
auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt;
|
||||
auth_request_set $auth_resp_err $upstream_http_x_vouch_err;
|
||||
auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount;
|
||||
}
|
||||
error_page 401 = @error401;
|
||||
location @error401 {
|
||||
return 302 https://auth.tiredsysadmin.cc/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err;
|
||||
}
|
||||
|
||||
location / {
|
||||
auth_request /validate;
|
||||
proxy_set_header X-Vouch-User $auth_resp_x_vouch_user;
|
||||
proxy_pass http://10.200.1.3:32970;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_redirect off;
|
||||
|
||||
# disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause)
|
||||
proxy_request_buffering off;
|
||||
|
||||
# set timeout
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
send_timeout 600s;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
location /api {
|
||||
proxy_pass http://10.200.1.3:32970;
|
||||
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
|
||||
proxy_http_version 1.1;
|
||||
proxy_redirect off;
|
||||
|
||||
# disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause)
|
||||
proxy_request_buffering off;
|
||||
|
||||
# set timeout
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
send_timeout 600s;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{
|
||||
"nginx": {
|
||||
"variables": {
|
||||
"ssl_certificate": "/etc/letsencrypt/live/it-the-drote.tk/fullchain.pem",
|
||||
"ssl_certificate_key": "/etc/letsencrypt/live/it-the-drote.tk/privkey.pem",
|
||||
"blog_ssl_certificate": "/etc/letsencrypt/live/tiredsysadmin.cc/fullchain.pem",
|
||||
"blog_ssl_certificate_key": "/etc/letsencrypt/live/tiredsysadmin.cc/privkey.pem",
|
||||
"new_ssl_certificate": "/etc/letsencrypt/live/rcmd.space/fullchain.pem",
|
||||
"new_ssl_certificate_key": "/etc/letsencrypt/live/rcmd.space/privkey.pem",
|
||||
"ssl_ciphers": "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4"
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
namespace: "apps"
|
||||
environment:
|
||||
- name: "KEEPORG_MASTER_KEY_FILE"
|
||||
value: "/etc/keeporg/config.txt"
|
||||
image:
|
||||
name: "repo.rcmd.space/keeporg"
|
||||
version: "v0.1.0"
|
||||
network:
|
||||
ports:
|
||||
- name: "main"
|
||||
node: 32970
|
||||
source: 8765
|
||||
destination: 8765
|
||||
mounts:
|
||||
- name: "db"
|
||||
source: "/var/lib/keeporg"
|
||||
destination: "/var/lib/keeporg"
|
||||
secrets:
|
||||
- name: "keeporg-encryption"
|
||||
destination: "/etc/keeporg"
|
||||
Reference in New Issue
Block a user