diff --git a/pillar/paas/docker.sls b/pillar/paas/docker.sls --- a/pillar/paas/docker.sls +++ b/pillar/paas/docker.sls @@ -58,7 +58,7 @@ - nasqueron/tommy # Sentry - - localhost:5000/sentry + - library/sentry - tianon/exim4 # ------------------------------------------------------------- @@ -351,17 +351,18 @@ host: mx.sentry.nasqueron.org sentry_worker: - sentry_worker_1: &sentry_links - postgresql_link: sentry_db - redis_link: sentry_redis - smtp_link: sentry_smtp + sentry_worker_1: + # As an instance is devided between a web, a cron and a worker + # containers, we need an identified to share a data volume. + realm: nasqueron sentry_cron: - sentry_cron: *sentry_links + sentry_cron: + realm: nasqueron sentry_web: sentry_web_1: - <<: *sentry_links + realm: nasqueron app_port: 26080 host: sentry.nasqueron.org diff --git a/pillar/saas/sentry.sls b/pillar/saas/sentry.sls new file mode 100644 --- /dev/null +++ b/pillar/saas/sentry.sls @@ -0,0 +1,20 @@ +# ------------------------------------------------------------- +# Salt — Sentry instances +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Project: Nasqueron +# Created: 2018-11-10 +# License: Trivial work, not eligible to copyright +# ------------------------------------------------------------- + +# ------------------------------------------------------------- +# Sentry realms +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +sentry_realms: + nasqueron: + links: + postgresql: sentry_db + redis: sentry_redis + smtp: sentry_smtp + credential: nasqueron.sentry.app_key + email_from: no-reply@sentry.nasqueron.org diff --git a/pillar/top.sls b/pillar/top.sls --- a/pillar/top.sls +++ b/pillar/top.sls @@ -28,6 +28,7 @@ - paas.docker - saas.jenkins - saas.phpbb + - saas.sentry ysul: - devserver.repos diff --git a/roles/paas-docker/containers/files/sentry/sentry.sh.jinja b/roles/paas-docker/containers/files/sentry/sentry.sh.jinja new file mode 100644 --- /dev/null +++ b/roles/paas-docker/containers/files/sentry/sentry.sh.jinja @@ -0,0 +1,26 @@ +#!/bin/sh + +# ------------------------------------------------------------- +# PaaS Docker +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Project: Nasqueron +# Created: 2018-11-10 +# License: Trivial work, not eligible to copyright +# Description: Wrapper for sentry command (local instance) +# Source file: roles/paas-docker/containers/files/sentry/sentry.sh.jinja +# ------------------------------------------------------------- +# +# +# This file is managed by our rOPS SaltStack repository. +# +# Changes to this file may cause incorrect behavior +# and will be lost if the state is redeployed. +# + +SECRET_KEY=$(zr getcredentials {{ credential_id }} token) + +docker run -it --rm \ + -e SENTRY_SECRET_KEY=$SECRET_KEY \ + --link {{ links.postgresql }}:postgres \ + --link {{ links.redis }}:redis \ + sentry "$@" diff --git a/roles/paas-docker/containers/sentry.sls b/roles/paas-docker/containers/sentry.sls new file mode 100644 --- /dev/null +++ b/roles/paas-docker/containers/sentry.sls @@ -0,0 +1,76 @@ +# ------------------------------------------------------------- +# Salt — Provision Docker engine +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Project: Nasqueron +# Created: 2016-12-15 +# License: Trivial work, not eligible to copyright +# ------------------------------------------------------------- + +{% set has_selinux = salt['grains.get']('selinux:enabled', False) %} +{% set containers = pillar['docker_containers'][grains['id']] %} + +# ------------------------------------------------------------- +# Data directory +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +{% for realm, args in pillar['sentry_realms'].items() %} + +/srv/sentry/{{ realm }}: + file.directory: + - user: 999 + - group: 999 + - makedirs: True + +/srv/sentry/{{ realm }}/bin/sentry: + file.managed: + - source: salt://roles/paas-docker/containers/files/sentry/sentry.sh.jinja + - template: jinja + - mode: 755 + - makedirs: True + - context: + links: {{ args['links'] }} + credential_id: {{ salt['zr.get_credential_id'](args['credential']) }} + +{% if has_selinux %} +selinux_context_{{ realm }}_sentry_data: + selinux.fcontext_policy_present: + - name: /srv/sentry/{{ realm }} + - sel_type: container_file_t + +selinux_context_{{ realm }}_sentry_data_applied: + selinux.fcontext_policy_applied: + - name: /srv/sentry/{{ realm }} +{% endif %} + +{% endfor %} + +# ------------------------------------------------------------- +# Web application +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +{% for instance, container in containers['sentry_web'].items() %} + +{% set args = pillar['sentry_realms'][container['realm']] %} + +{{ instance }}: + docker_container.running: + - detach: True + - interactive: True + - image: library/sentry + - binds: &binds /srv/sentry/{{ container['realm'] }}:/var/lib/sentry/files + - links: &links + - {{ args['links']['postgresql'] }}:postgres + - {{ args['links']['redis'] }}:redis + - {{ args['links']['smtp'] }}:smtp + - environment: &env + - SENTRY_SECRET_KEY: {{ salt['zr.get_token'](args['credential']) }} + - SENTRY_FILESTORE_DIR: + - SENTRY_USE_SSL: 1 + - SENTRY_SERVER_EMAIL: {{ args['email_from'] }} + - SENTRY_FILESTORE_DIR: /var/lib/sentry/files + - ports: + - 80 + - port_bindings: + - {{ container['app_port'] }}:9000 + +{% endfor %} diff --git a/roles/paas-docker/wrappers/files/sentry.sh b/roles/paas-docker/wrappers/files/sentry.sh new file mode 100644 --- /dev/null +++ b/roles/paas-docker/wrappers/files/sentry.sh @@ -0,0 +1,40 @@ +#!/bin/sh + +# ------------------------------------------------------------- +# PaaS Docker +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Project: Nasqueron +# Created: 2018-11-11 +# License: Trivial work, not eligible to copyright +# Source file: roles/paas-docker/wrappers/files/sentry.sh +# ------------------------------------------------------------- +# +# +# This file is managed by our rOPS SaltStack repository. +# +# Changes to this file may cause incorrect behavior +# and will be lost if the state is redeployed. +# + +if [ "$#" -lt 2 ]; then + echo "Usage: $0 [arguments]" 1>&2; + exit 1 +fi + +REALM=$1 +shift + +if [ ! -d "/srv/sentry/$REALM" ]; then + echo "Realm doesn't exist: $REALM" 1>&2; + exit 2 +fi + +DOCKER_RUN_SCRIPT=/srv/sentry/$REALM/bin/sentry + +if [ ! -f "$DOCKER_RUN_SCRIPT" ]; then + echo "File doesn't exist: $DOCKER_RUN_SCRIPT" 1>&2; + echo "You can generate it running 'deploy-container sentry' command on the Salt master. 1>&2;" + exit 4 +fi + +$DOCKER_RUN_SCRIPT "$@" diff --git a/roles/paas-docker/wrappers/init.sls b/roles/paas-docker/wrappers/init.sls --- a/roles/paas-docker/wrappers/init.sls +++ b/roles/paas-docker/wrappers/init.sls @@ -12,7 +12,7 @@ # Wrapper binaries # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -{% for command in ['certbot', 'phpbb', 'mysql'] %} +{% for command in ['certbot', 'phpbb', 'mysql', 'sentry'] %} {{ dirs.bin }}/{{ command }}: file.managed: - source: salt://roles/paas-docker/wrappers/files/{{ command }}.sh