From 730dfbf6122a1e46a8aed4e0cc7eb5d33c0d4bd0 Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Mon, 26 Jul 2021 13:51:46 +0200 Subject: [PATCH] ++stuff --- apps/.gitignore | 2 + apps/buildbot/.helmignore | 23 ++ apps/buildbot/Chart.yaml | 6 + apps/buildbot/README.md | 10 + apps/buildbot/templates/deployment.yaml | 233 ++++++++++++++++++ .../templates/tests/test-connection.yaml | 13 + apps/buildbot/values.yaml | 8 + apps/chartmuseum/templates/deployment.yaml | 1 + .../ungleich-chartmuseum-0.1.0.tgz | Bin 1633 -> 0 bytes 9 files changed, 296 insertions(+) create mode 100644 apps/.gitignore create mode 100644 apps/buildbot/.helmignore create mode 100644 apps/buildbot/Chart.yaml create mode 100644 apps/buildbot/README.md create mode 100644 apps/buildbot/templates/deployment.yaml create mode 100644 apps/buildbot/templates/tests/test-connection.yaml create mode 100644 apps/buildbot/values.yaml delete mode 100644 apps/chartmuseum/ungleich-chartmuseum-0.1.0.tgz diff --git a/apps/.gitignore b/apps/.gitignore new file mode 100644 index 0000000..eb05d79 --- /dev/null +++ b/apps/.gitignore @@ -0,0 +1,2 @@ +# Ignore helm packages +*.tgz diff --git a/apps/buildbot/.helmignore b/apps/buildbot/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/apps/buildbot/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/apps/buildbot/Chart.yaml b/apps/buildbot/Chart.yaml new file mode 100644 index 0000000..5912321 --- /dev/null +++ b/apps/buildbot/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: ungleich-buildbot +description: buildbot for ungleich infrastructure + +version: 0.1.0 +appVersion: "3.2.0" diff --git a/apps/buildbot/README.md b/apps/buildbot/README.md new file mode 100644 index 0000000..d2aac50 --- /dev/null +++ b/apps/buildbot/README.md @@ -0,0 +1,10 @@ +## Introduction + +[Buildbot](https://buildbot.net/) running on IPv6. + +## Todo + +* DB +* TLS +* Workers (2+) +* Build configuration diff --git a/apps/buildbot/templates/deployment.yaml b/apps/buildbot/templates/deployment.yaml new file mode 100644 index 0000000..1e66932 --- /dev/null +++ b/apps/buildbot/templates/deployment.yaml @@ -0,0 +1,233 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-gitea +spec: + selector: + matchLabels: + app: {{ .Release.Name }}-gitea + replicas: 1 + template: + metadata: + labels: + app: {{ .Release.Name }}-gitea + use-as-service: {{ .Release.Name }} + spec: + initContainers: + - name: wait-for-cert + image: busybox + command: + - sh + - -c + - until ls /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; do sleep 5; done + volumeMounts: + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + containers: + # This container will only start *after* the cert has been placed + - name: nginx + image: nginx:1.21-alpine + ports: + - containerPort: 443 + volumeMounts: + - name: nginx-config + mountPath: "/etc/nginx/conf.d/" + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + - name: postgres + image: postgres:13 + ports: + - containerPort: 5432 + envFrom: + - configMapRef: + name: {{ tpl .Values.identifier . }}-postgres-config + # Use subpath to avoid lost+found error + volumeMounts: + - name: postgres-data + mountPath: "/var/lib/postgresql/data" + subPath: postgres + - name: gitea + image: gitea/gitea:{{ .Chart.AppVersion }} + ports: + - containerPort: 22 + - containerPort: 3000 + securityContext: + capabilities: + add: + - SYS_CHROOT + env: + - name: USER_UID + value: "1000" + - name: USER_GID + value: "1000" + - name: GITEA__server__DOMAIN + value: "{{ tpl .Values.fqdn . }}" + - name: GITEA__server__ROOT_URL + value: "https://{{ tpl .Values.fqdn . }}" + - name: GITEA__database__DB_TYPE + value: "postgres" + - name: GITEA__database__HOST + value: "localhost" + - name: GITEA__database__NAME + valueFrom: + configMapKeyRef: + name: {{ tpl .Values.identifier . }}-postgres-config + key: POSTGRES_DB + - name: GITEA__database__USER + valueFrom: + configMapKeyRef: + name: {{ tpl .Values.identifier . }}-postgres-config + key: POSTGRES_USER + - name: GITEA__database__PASSWD + valueFrom: + configMapKeyRef: + name: {{ tpl .Values.identifier . }}-postgres-config + key: POSTGRES_PASSWORD + volumeMounts: + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + - name: data + mountPath: "/data" + volumes: + - name: etcletsencrypt + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs + - name: data + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-data + - name: postgres-data + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-postgres-data + - name: nginx-config + configMap: + name: {{ tpl .Values.identifier . }}-nginx-config + +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ tpl .Values.identifier . }} + labels: + app: {{ tpl .Values.identifier . }} +spec: + type: ClusterIP + ports: + - port: 22 + name: ssh + # Required for letsencrypt + - port: 80 + name: http + - port: 443 + name: https + selector: + use-as-service: {{ .Release.Name }} +# --- +# apiVersion: v1 +# kind: ConfigMap +# metadata: +# name: {{ tpl .Values.identifier . }}-giteaconfig +# data: +# {{ tpl (.Files.Glob "gitea/*").AsConfig . | indent 2 }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-letsencrypt-certs +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 50Mi + storageClassName: rook-cephfs +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-data +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 1Gi + storageClassName: rook-cephfs +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ tpl .Values.identifier . }}-postgres-data +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 500Mi + storageClassName: rook-ceph-block +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ tpl .Values.identifier . }}-getcert +spec: + template: + metadata: + labels: + app: certbot-letsencrypt-getcert + use-as-service: {{ .Release.Name }} + spec: + restartPolicy: Never + containers: + - name: certbot + image: ungleich/ungleich-certbot + ports: + - containerPort: 80 + env: + - name: DOMAIN + value: "{{ tpl .Values.fqdn . }}" + - name: EMAIL + value: "{{ .Values.email }}" + {{ if eq .Values.letsencryptStaging "no" }} + - name: STAGING + value: "no" + {{ end }} + volumeMounts: + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + volumes: + - name: etcletsencrypt + persistentVolumeClaim: + claimName: {{ tpl .Values.identifier . }}-letsencrypt-certs + backoffLimit: 3 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ tpl .Values.identifier . }}-nginx-config +data: + default.conf: | + server { + listen 443 ssl; + listen [::]:443 ssl; + + server_name {{ tpl .Values.fqdn . }}; + + ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem; + + client_max_body_size 256m; + + location / { + proxy_pass http://localhost:3000; + } + } +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ tpl .Values.identifier . }}-postgres-config +data: + POSTGRES_USER: gitea + POSTGRES_PASSWORD: aiJohtoqueeng0oosh8ohfoh1chahPh3 + POSTGRES_DB: gitea diff --git a/apps/buildbot/templates/tests/test-connection.yaml b/apps/buildbot/templates/tests/test-connection.yaml new file mode 100644 index 0000000..85cbdda --- /dev/null +++ b/apps/buildbot/templates/tests/test-connection.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ tpl .Values.identifier . }}-test-connection" + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['https://{{ tpl .Values.fqdn . }}'] + restartPolicy: Never diff --git a/apps/buildbot/values.yaml b/apps/buildbot/values.yaml new file mode 100644 index 0000000..aef81ae --- /dev/null +++ b/apps/buildbot/values.yaml @@ -0,0 +1,8 @@ +clusterDomain: c2.k8s.ooo +email: technik@ungleich.ch +letsencryptStaging: "yes" + +# This is how the service and the data volumes are named - i.e. the +# persistent thing +identifier: "{{ .Release.Name }}" +fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" diff --git a/apps/chartmuseum/templates/deployment.yaml b/apps/chartmuseum/templates/deployment.yaml index a0a6b3e..0c00a9a 100644 --- a/apps/chartmuseum/templates/deployment.yaml +++ b/apps/chartmuseum/templates/deployment.yaml @@ -84,6 +84,7 @@ spec: - port: 80 name: http - port: 443 + targetPort: 8080 name: https selector: use-as-service: {{ .Release.Name }} diff --git a/apps/chartmuseum/ungleich-chartmuseum-0.1.0.tgz b/apps/chartmuseum/ungleich-chartmuseum-0.1.0.tgz deleted file mode 100644 index d592a80b3cc083daf2878c93191fb1c399b447c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1633 zcmV-n2A=sJiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI<9Z`(NX&ue~)`P(o0@LxUHvE4$8!(QP8ivo2MBt`B;u`p!@V!rt(>KRSZ&QMB)&!dR-0!XMVv zbnclD&G{8-!VV3DPgFaEg+6rZI;pfxC&Ugh@E(uB(-g3by}hY%j4w0zD{N6@*s z0sjI8QiJ|SnjzfYcF6pXShmmk%`uZxR!*2DD<`k2z}zvq6#7?hK*d`Dai9YQttt1o||CVBMUC$2u`-gPcpPLrj|wo zpsMUG8N5^EO^(d1HYku;rQJI~MlDM}&>0F-4S>_RUmAeMTyREB1U&+1~)fg zbFoES2ioAn?QJkGgkUM<($6uwNA3bw4;7nhzFgp{Ar$4Z>2I~Am!Hlq-u-&IGY3%i zEfI8tVpMd##W?+NHh%YEdU1C4>E!*zJz}ckFm*voC5j9us*qowM5O>Nt9jj!oH@pG zYEvh@u|e(jx}g4+kX;ii^IAgiUaNAK_{O5NS0(RQP@e62#@x`yP0H7g@2=RFhv?N* zl(A*LvZLY7qiQc@H}Px>WtUYpx8vA1#FAYw*#OD6I5xOoS2;#7u9}ti=cJy&Uin_n z*UFgG+PpqL7#ugJO%qeU2e0nkm-DtGcmJ{{nNVy&y5KzQLc_-{R9=piobzNtbJDF<#V&lOcQWDf+GC{<(uF(j80WMQ)^}48 z{JR`;aj2K5;b#5mNR)f*0vC)CKYu;*If{OZw$ruwO4!ud*)(%oD0Uf)n7Ux&bIz#6 zYVb$u+0XY2pDu9qVBxi@wqrOG9HpIR^m;l|@oH-Lp9uZoXm^z>W0ork!OjMkz^T>s zYMN7HN=S%;psabRGB!F6!?5ni?fU(;?UuBs|F{mNC4>yN+vfeUk>MQj1Omj%N#|%^rHwG<->L z)3U6a=2>A@Gj+Y~y|auuyFb5hOJDr9xmUQ>7e2ozi)Iwuo2Dg$Mi&V7TnWxr5q!iY z>c7Fy3a$C?yHnzcR2m;c$G-d@9)I=w|8Q`)|33+J;hb8FS{kqlsxyZ#DN2|XT*O=^ zkW;px2^ybt;Zw>Dm?AG5SuiOI0f|tv>RQib@)Kwj)bb@lPHkEnr!pp8keF08?PacU z&aW|sFWjc^f3JKvlVSx*mYmKccRc{XCHllaxtv~FrIB=Dtg=i=xEfzV%(WqY!fjAK zEAxpz`%?$yb2E@8fqQH|%~A$;f@YL0iX7%#pdqh)^Cc&*{TW@5*S^i%yV5)%um3~3 za78s&g@N}cr-t~sR=*>!OKs^wb!PW+`|D#qYBz(;HTU!1->nVkAr{5U%H{{L^# z%>Th?G&tn{Q&6`H6K)Kb2_YWDGcd?BT1Zf$UT3ONx%uT4@!)du=^PAN%VlC9Sg$qk za{Dj9jB)}04_l7Y>s&eE;5u9bTvk7>lpQ3zjAuVV!Y$HQ#8vwVUCj_Q#szaMRzVNW fug1SThdesafev(_=SKex00960*|9nL03-kadSN%p