From da503eac2a7296034510052e34947c183d2a0671 Mon Sep 17 00:00:00 2001 From: Reactorcoremeltdown Date: Fri, 30 Oct 2026 10:01:11 +0100 Subject: [PATCH] Initial deploy --- .woodpecker/build.yaml | 26 +++++++++ .woodpecker/deploy.yaml | 28 ++++++++++ Makefile | 19 +++++++ config/nginx/keeporg.conf.tmpl | 86 +++++++++++++++++++++++++++++ config/variables/main.json | 13 +++++ config/variables/server.values.yaml | 21 +++++++ 6 files changed, 193 insertions(+) create mode 100644 .woodpecker/build.yaml create mode 100644 .woodpecker/deploy.yaml create mode 100644 config/nginx/keeporg.conf.tmpl create mode 100644 config/variables/main.json create mode 100644 config/variables/server.values.yaml diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml new file mode 100644 index 0000000..d6e3ffa --- /dev/null +++ b/.woodpecker/build.yaml @@ -0,0 +1,26 @@ +--- +when: + - path: + include: + - 'config/variables/server.values.yaml' + - '.woodpecker/build.yaml' + - 'Makefile' + - 'VERSION' + - 'Dockerfile' + - '*.go' + event: push +labels: + role: production +skip_clone: true +steps: + clone: + image: bash + commands: + - git clone --depth=1 ${CI_REPO_CLONE_SSH_URL} + build: + image: bash + commands: + - cd ${CI_REPO_NAME} && echo $GIT_SUDO | sudo -S make build-server + environment: + GIT_SUDO: + from_secret: git_sudo diff --git a/.woodpecker/deploy.yaml b/.woodpecker/deploy.yaml new file mode 100644 index 0000000..75b6205 --- /dev/null +++ b/.woodpecker/deploy.yaml @@ -0,0 +1,28 @@ +--- +when: + - path: + include: + - 'config/variables/server.values.yaml' + - '.woodpecker/deploy.yaml' + - 'Makefile' + - 'VERSION' + - 'Dockerfile' + - '*.go' + event: push +labels: + role: homeserver +depends_on: + - build +skip_clone: true +steps: + clone: + image: bash + commands: + - git clone --depth=1 ${CI_REPO_CLONE_SSH_URL} + deploy: + image: bash + commands: + - cd ${CI_REPO_NAME} && echo $GIT_SUDO | sudo -S make deploy-server + environment: + GIT_SUDO: + from_secret: git_sudo diff --git a/Makefile b/Makefile index 1af496a..5065b10 100644 --- a/Makefile +++ b/Makefile @@ -27,6 +27,7 @@ HOST_CLIENT := $(BUILD)/$(HOSTOS)-$(HOSTARCH)/keeporg HOST_SERVER := $(BUILD)/$(HOSTOS)-$(HOSTARCH)/keeporgd .DEFAULT_GOAL := help +APP_NAME := keeporg # ---------------------------------------------------------------- developing @@ -230,3 +231,21 @@ run-server: $(HOST_SERVER) ## run a server on 127.0.0.1:8765 with data in ./.dev .PHONY: run-client run-client: $(HOST_CLIENT) ## run the sync agent with the local configuration $(HOST_CLIENT) run + +nginx: + cat config/variables/main.json | tpl -f config/nginx/$(APP_NAME).conf.tmpl > /etc/nginx/sites-available/$(APP_NAME).conf + ln -sf /etc/nginx/sites-available/$(APP_NAME).conf /etc/nginx/sites-enabled/$(APP_NAME).conf + nginx -t + systemctl restart nginx + +build-server: nginx + podman build \ + --build-arg APP_VERSION=${VERSION} \ + --platform=linux/arm64 \ + -t repo.rcmd.space/$(APP_NAME):$(VERSION) \ + . + podman push repo.rcmd.space/$(APP_NAME):$(VERSION) + podman image prune -f + +deploy-server: + helm upgrade --install --namespace "apps" --create-namespace $(APP_NAME) rcmd/rcmd-base -f ./config/variables/server.values.yaml --set "image.version=$(VERSION)" diff --git a/config/nginx/keeporg.conf.tmpl b/config/nginx/keeporg.conf.tmpl new file mode 100644 index 0000000..9a589be --- /dev/null +++ b/config/nginx/keeporg.conf.tmpl @@ -0,0 +1,86 @@ +### Deployed by https://git.rcmd.space/sloperated/{{ }} + +server { + listen 80; + listen [::]:80; + server_name keeporg.tiredsysadmin.cc; + + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + + access_log /var/log/nginx/keeporg.tiredsysadmin.cc_access.log json; + error_log /var/log/nginx/keeporg.tiredsysadmin.cc_error.log; + + ### SSL cert files ### + ssl_certificate {{ .nginx.variables.blog_ssl_certificate }}; + ssl_certificate_key {{ .nginx.variables.blog_ssl_certificate_key }}; + + client_max_body_size 8192M; + + server_name keeporg.tiredsysadmin.cc; + + location = /validate { + proxy_pass http://127.0.0.1:30021/validate; + proxy_set_header Host $http_host; + proxy_pass_request_body off; + proxy_set_header Content-Length ""; + auth_request_set $auth_resp_x_vouch_user $upstream_http_x_vouch_user; + auth_request_set $auth_resp_jwt $upstream_http_x_vouch_jwt; + auth_request_set $auth_resp_err $upstream_http_x_vouch_err; + auth_request_set $auth_resp_failcount $upstream_http_x_vouch_failcount; + } + error_page 401 = @error401; + location @error401 { + return 302 https://auth.tiredsysadmin.cc/login?url=$scheme://$http_host$request_uri&vouch-failcount=$auth_resp_failcount&X-Vouch-Token=$auth_resp_jwt&error=$auth_resp_err; + } + + location / { + auth_request /validate; + proxy_set_header X-Vouch-User $auth_resp_x_vouch_user; + proxy_pass http://10.200.1.3:32970; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_redirect off; + + # disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause) + proxy_request_buffering off; + + # set timeout + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } + location /api { + proxy_pass http://10.200.1.3:32970; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_redirect off; + + # disable buffering uploads to prevent OOM on reverse proxy server and make uploads twice as fast (no pause) + proxy_request_buffering off; + + # set timeout + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + } +} diff --git a/config/variables/main.json b/config/variables/main.json new file mode 100644 index 0000000..2a8afeb --- /dev/null +++ b/config/variables/main.json @@ -0,0 +1,13 @@ +{ + "nginx": { + "variables": { + "ssl_certificate": "/etc/letsencrypt/live/it-the-drote.tk/fullchain.pem", + "ssl_certificate_key": "/etc/letsencrypt/live/it-the-drote.tk/privkey.pem", + "blog_ssl_certificate": "/etc/letsencrypt/live/tiredsysadmin.cc/fullchain.pem", + "blog_ssl_certificate_key": "/etc/letsencrypt/live/tiredsysadmin.cc/privkey.pem", + "new_ssl_certificate": "/etc/letsencrypt/live/rcmd.space/fullchain.pem", + "new_ssl_certificate_key": "/etc/letsencrypt/live/rcmd.space/privkey.pem", + "ssl_ciphers": "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4" + } + } +} diff --git a/config/variables/server.values.yaml b/config/variables/server.values.yaml new file mode 100644 index 0000000..e6c1ab7 --- /dev/null +++ b/config/variables/server.values.yaml @@ -0,0 +1,21 @@ +--- +namespace: "apps" +environment: +- name: "KEEPORG_MASTER_KEY_FILE" + value: "/etc/keeporg/config.txt" +image: + name: "repo.rcmd.space/keeporg" + version: "v0.1.0" +network: + ports: + - name: "main" + node: 32970 + source: 8765 + destination: 8765 +mounts: + - name: "db" + source: "/var/lib/keeporg" + destination: "/var/lib/keeporg" +secrets: + - name: "keeporg-encryption" + destination: "/etc/keeporg"