Page MenuHomeDevCentral
Files F3786086

D2004.diff
No OneTemporary
Actions

D2004.diff
View Options

diff --git a/pillar/paas/docker.sls b/pillar/paas/docker.sls
--- a/pillar/paas/docker.sls
+++ b/pillar/paas/docker.sls
@@ -58,7 +58,7 @@
- nasqueron/tommy
# Sentry
- - localhost:5000/sentry
+ - library/sentry
- tianon/exim4
# -------------------------------------------------------------
@@ -351,17 +351,18 @@
host: mx.sentry.nasqueron.org
sentry_worker:
- sentry_worker_1: &sentry_links
- postgresql_link: sentry_db
- redis_link: sentry_redis
- smtp_link: sentry_smtp
+ sentry_worker_1:
+ # As an instance is devided between a web, a cron and a worker
+ # containers, we need an identified to share a data volume.
+ realm: nasqueron
sentry_cron:
- sentry_cron: *sentry_links
+ sentry_cron:
+ realm: nasqueron
sentry_web:
sentry_web_1:
- <<: *sentry_links
+ realm: nasqueron
app_port: 26080
host: sentry.nasqueron.org
diff --git a/pillar/saas/sentry.sls b/pillar/saas/sentry.sls
new file mode 100644
--- /dev/null
+++ b/pillar/saas/sentry.sls
@@ -0,0 +1,20 @@
+# -------------------------------------------------------------
+# Salt — Sentry instances
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Created: 2018-11-10
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+# -------------------------------------------------------------
+# Sentry realms
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+sentry_realms:
+ nasqueron:
+ links:
+ postgresql: sentry_db
+ redis: sentry_redis
+ smtp: sentry_smtp
+ credential: nasqueron.sentry.app_key
+ email_from: no-reply@sentry.nasqueron.org
diff --git a/pillar/top.sls b/pillar/top.sls
--- a/pillar/top.sls
+++ b/pillar/top.sls
@@ -28,6 +28,7 @@
- paas.docker
- saas.jenkins
- saas.phpbb
+ - saas.sentry
ysul:
- devserver.repos
diff --git a/roles/paas-docker/containers/files/sentry/sentry.sh.jinja b/roles/paas-docker/containers/files/sentry/sentry.sh.jinja
new file mode 100644
--- /dev/null
+++ b/roles/paas-docker/containers/files/sentry/sentry.sh.jinja
@@ -0,0 +1,26 @@
+#!/bin/sh
+
+# -------------------------------------------------------------
+# PaaS Docker
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Created: 2018-11-10
+# License: Trivial work, not eligible to copyright
+# Description: Wrapper for sentry command (local instance)
+# Source file: roles/paas-docker/containers/files/sentry/sentry.sh.jinja
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+SECRET_KEY=$(zr getcredentials {{ credential_id }} token)
+
+docker run -it --rm \
+ -e SENTRY_SECRET_KEY=$SECRET_KEY \
+ --link {{ links.postgresql }}:postgres \
+ --link {{ links.redis }}:redis \
+ sentry "$@"
diff --git a/roles/paas-docker/containers/sentry.sls b/roles/paas-docker/containers/sentry.sls
new file mode 100644
--- /dev/null
+++ b/roles/paas-docker/containers/sentry.sls
@@ -0,0 +1,76 @@
+# -------------------------------------------------------------
+# Salt — Provision Docker engine
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Created: 2016-12-15
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}
+{% set containers = pillar['docker_containers'][grains['id']] %}
+
+# -------------------------------------------------------------
+# Data directory
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% for realm, args in pillar['sentry_realms'].items() %}
+
+/srv/sentry/{{ realm }}:
+ file.directory:
+ - user: 999
+ - group: 999
+ - makedirs: True
+
+/srv/sentry/{{ realm }}/bin/sentry:
+ file.managed:
+ - source: salt://roles/paas-docker/containers/files/sentry/sentry.sh.jinja
+ - template: jinja
+ - mode: 755
+ - makedirs: True
+ - context:
+ links: {{ args['links'] }}
+ credential_id: {{ salt['zr.get_credential_id'](args['credential']) }}
+
+{% if has_selinux %}
+selinux_context_{{ realm }}_sentry_data:
+ selinux.fcontext_policy_present:
+ - name: /srv/sentry/{{ realm }}
+ - sel_type: container_file_t
+
+selinux_context_{{ realm }}_sentry_data_applied:
+ selinux.fcontext_policy_applied:
+ - name: /srv/sentry/{{ realm }}
+{% endif %}
+
+{% endfor %}
+
+# -------------------------------------------------------------
+# Web application
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% for instance, container in containers['sentry_web'].items() %}
+
+{% set args = pillar['sentry_realms'][container['realm']] %}
+
+{{ instance }}:
+ docker_container.running:
+ - detach: True
+ - interactive: True
+ - image: library/sentry
+ - binds: &binds /srv/sentry/{{ container['realm'] }}:/var/lib/sentry/files
+ - links: &links
+ - {{ args['links']['postgresql'] }}:postgres
+ - {{ args['links']['redis'] }}:redis
+ - {{ args['links']['smtp'] }}:smtp
+ - environment: &env
+ - SENTRY_SECRET_KEY: {{ salt['zr.get_token'](args['credential']) }}
+ - SENTRY_FILESTORE_DIR:
+ - SENTRY_USE_SSL: 1
+ - SENTRY_SERVER_EMAIL: {{ args['email_from'] }}
+ - SENTRY_FILESTORE_DIR: /var/lib/sentry/files
+ - ports:
+ - 80
+ - port_bindings:
+ - {{ container['app_port'] }}:9000
+
+{% endfor %}
diff --git a/roles/paas-docker/wrappers/files/sentry.sh b/roles/paas-docker/wrappers/files/sentry.sh
new file mode 100644
--- /dev/null
+++ b/roles/paas-docker/wrappers/files/sentry.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# -------------------------------------------------------------
+# PaaS Docker
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Created: 2018-11-11
+# License: Trivial work, not eligible to copyright
+# Source file: roles/paas-docker/wrappers/files/sentry.sh
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+if [ "$#" -lt 2 ]; then
+ echo "Usage: $0 <realm> <command> [arguments]" 1>&2;
+ exit 1
+fi
+
+REALM=$1
+shift
+
+if [ ! -d "/srv/sentry/$REALM" ]; then
+ echo "Realm doesn't exist: $REALM" 1>&2;
+ exit 2
+fi
+
+DOCKER_RUN_SCRIPT=/srv/sentry/$REALM/bin/sentry
+
+if [ ! -f "$DOCKER_RUN_SCRIPT" ]; then
+ echo "File doesn't exist: $DOCKER_RUN_SCRIPT" 1>&2;
+ echo "You can generate it running 'deploy-container sentry' command on the Salt master. 1>&2;"
+ exit 4
+fi
+
+$DOCKER_RUN_SCRIPT "$@"
diff --git a/roles/paas-docker/wrappers/init.sls b/roles/paas-docker/wrappers/init.sls
--- a/roles/paas-docker/wrappers/init.sls
+++ b/roles/paas-docker/wrappers/init.sls
@@ -12,7 +12,7 @@
# Wrapper binaries
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-{% for command in ['certbot', 'phpbb', 'mysql'] %}
+{% for command in ['certbot', 'phpbb', 'mysql', 'sentry'] %}
{{ dirs.bin }}/{{ command }}:
file.managed:
- source: salt://roles/paas-docker/wrappers/files/{{ command }}.sh

File Metadata

Mime Type
text/plain
Expires
Wed, Nov 27, 12:34 (21 h, 58 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2266899
Default Alt Text
D2004.diff (7 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator