Differential D2862 Diff 7316 pillar/paas/docker.sls

Changeset View

Standalone View

pillar/paas/docker.sls

# -------------------------------------------------------------		# -------------------------------------------------------------
# Salt — Provision Docker engine		# Salt — Provision Docker engine
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -		# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Nasqueron		# Project: Nasqueron
# Created: 2018-03-10		# Created: 2018-03-10
# License: Trivial work, not eligible to copyright		# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------		# -------------------------------------------------------------

docker_aliases:
- &ipv4_docker002 51.255.124.9
- &ipv4_docker002_restricted 172.27.27.5

# -------------------------------------------------------------
# Images
#
# You can append a :tag (by default, latest is used).
#
# It's not possible to specify Docker library images only by final name.
# See https://docs.saltstack.com/en/latest/ref/states/all/salt.states.docker_image.html
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

docker_images:
'*':
- certbot/certbot

dwellers:
# Core services
- nasqueron/mysql:5.7

docker-002:
# Core services
- library/postgres
- library/redis:3.2-alpine
- library/registry
- nasqueron/mysql
- nasqueron/rabbitmq

# ACME DNS server
- joohoi/acme-dns

# Nasqueron services
- nasqueron/auth-grove

# Nasqueron API microservices
- nasqueron/docker-registry-api
- nasqueron/api-datasources

# Infrastructure and development services
- nasqueron/aphlict
- nasqueron/cachet
- nasqueron/etherpad:production
- nasqueron/notifications
- nasqueron/phabricator
- ghcr.io/hound-search/hound

# Continuous deployment jobs
- jenkins/jenkins
- nasqueron/jenkins-agent-node
- nasqueron/jenkins-agent-php
- nasqueron/jenkins-agent-php:7.4.23
- nasqueron/jenkins-agent-rust
- nasqueron/tommy

# Pixelfed
- nasqueron/pixelfed

# Sentry
- library/sentry
- tianon/exim4

# Hauk
- bilde2910/hauk

# -------------------------------------------------------------
# Networks
#
# Containers can be grouped by network, instead to use links.
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

docker_networks:
dwellers:
bugzilla:
subnet: 172.21.3.0/24
jenkinsTest:
subnet: 172.21.5.0/24
docker-002:
cd:
subnet: 172.18.1.0/24
ci:
subnet: 172.18.2.0/24
sentry:
subnet: 172.18.3.0/24

# -------------------------------------------------------------
# Docker engine configuration
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

docker_daemon:
docker-002:
data-root: /srv/docker
dwellers:
data-root: /srv/docker
group: nasqueron-dev-docker

# -------------------------------------------------------------
# Containers
#
# The docker_containers entry allow to declare
# containers by image by servers
#
# The hierarchy is so as following.
#
# docker_containers:
# server with the Docker engine:
# service codename:
# instance name:
# container properties
#
# The service codename must match a state file in
# the roles/paas-docker/containers/ directory.
#
# The container will be run with the specified instance name.
#
# nginx
#
# The container properties can also describe the information
# needed to configure nginx with the host and app_port key.
#
# In such case, a matching vhost file should be declared as
# roles/paas-docker/nginx/files/vhosts/<service codename>.sls
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

docker_containers:

#
# Dwellers is the engine for Mastodon and CI intelligent bus services
#
dwellers:

#
# Core services
#

mysql:
bugzilla_db:
network: bugzilla
version: 5.7
credentials:
root: espacewin.bugzilla.mysql_root

#
# Bugzilla
#

bugzilla:
ew_bugzilla:
host: bugzilla.espace-win.org
app_port: 33080
network: bugzilla
mysql:
host: bugzilla_db
db: EspaceWin_Bugs
credential: espacewin.bugzilla.mysql

#
# Jenkins
#

jenkins:
jenkins_test:
realm: test
host: jenkins.test.nasqueron.org
app_port: 47080
jnlp_port: 52000

jenkins_agent:
zosso:
image_flavour: php
realm: test

#
# Mastodon
#

# Mastodon is currently deployed manually through docker-compose
# and not yet integrated to the platform. This declaration is
# currently only used for extra utilities deployment.

mastodon_sidekiq:
mastodon_sidekiq_1:
realm: nasqueron

#
# Production engine
#
docker-002:

#
# Core services
#

mysql:
acquisitariat:
credentials:
root: nasqueron.acquisitariat.mysql
phpbb_db:
credentials:
root: espacewin.phpbb.mysql_root

postgresql:
sentry_db:
image: nasqueron/postgres-sentry
credential: nasqueron.sentry.postgresql

memcached:
sentry_memcached:
version: 1.6.9-alpine
network: sentry

redis:
sentry_redis:
network: sentry
pixelfed_redis: {}

registry:
registry:
host: registry.nasqueron.org
app_port: 5000
allowed_ips:
# Localhost
- 127.0.0.1

# Dwellers
- 172.27.27.4

# docker-002
- 172.27.27.5

rabbitmq:
white-rabbit:
ip: *ipv4_docker002_restricted
host: white-rabbit.nasqueron.org
app_port: 15672
credentials:
erlang_cookie: nasqueron/rabbitmq/white-rabbit/erlang-cookie
root: nasqueron/rabbitmq/white-rabbit/root

#
# Phabricator
#

phabricator:
# Nasqueron instance
devcentral:
app_port: 31080
host: devcentral.nasqueron.org
aliases:
- phabricator.nasqueron.org
blogs:
servers:
host: servers.nasqueron.org
aliases:
- server.nasqueron.org
- serveur.nasqueron.org
- serveurs.nasqueron.org
mailer: mailgun
credentials:
mysql: zed.phabricator.mysql
static_host: devcentral.nasqueron-user-content.org
title: Nasqueron DevCentral
mysql_link: acquisitariat
skip_container: True

# Private instance for Dereckson
river_sector:
app_port: 23080
host: river-sector.dereckson.be
static_host: river-sector.nasqueron-user-content.org
mailer: _
credentials:
mysql: dereckson.phabricator.mysql
storage:
namespace: river_sector
title: River Sector
mysql_link: acquisitariat

# Wolfplex instance
wolfplex_phab:
app_port: 35080
host: phabricator.wolfplex.org
aliases:
- phabricator.wolfplex.be
static_host: wolfplex.phabricator.nasqueron-user-content.org
mailer: mailgun
credentials:
mailgun: wolfplex.phabricator.mailgun
mysql: wolfplex.phabricator.mysql
storage:
namespace: wolfphab
title: Wolfplex Phabricator
mysql_link: acquisitariat

# Zed instance
zed_code:
app_port: 36080
host: code.zed.dereckson.be
static_host: zed.phabricator.nasqueron-user-content.org
mailer: sendgrid
credentials:
mysql: zed.phabricator.mysql
sendgrid: zed.phabricator.sendgrid
storage:
namespace: zedphab
title: Zed
mysql_link: acquisitariat

aphlict:
aphlict:
ports:
client: 22280
admin: 22281

#
# Notifications center
#

notifications:
notifications:
host: notifications.nasqueron.org
app_port: 37080
broker_link: white-rabbit
credentials:
broker: nasqueron.notifications.broker
mailgun: nasqueron.notifications.mailgun
sentry:
realm: nasqueron
project_id: 2
credential: nasqueron.notifications.sentry

#
# Community and development services
#

etherpad:
pad:
app_port: 34080
host: pad.nasqueron.org
aliases:
- pad.wolfplex.org
- pad.wolfplex.be
credential: nasqueron.etherpad.api
mysql_link: acquisitariat

# Hauk
hauk:
hauk:
app_port: 43080
host: geo.nasqueron.org
api_entry_point: /hauk

#
# Let's Encrypt
#

acme_dns:
acme:
ip: *ipv4_docker002
app_port: 41080
host: acme.nasqueron.org
nsadmin: ops.nasqueron.org

#
# CI and CD
#

jenkins:
jenkins_cd:
realm: cd
host: cd.nasqueron.org
app_port: 38080
jnlp_port: 50000
jenkins_ci:
realm: ci
host: ci.nasqueron.org
app_port: 42080
jnlp_port: 55000

jenkins_agent:
# Agents for CD

apsile: &php_for_cd
image_flavour: php
realm: cd

elapsi: *php_for_cd

rust_brown:
image_flavour: rust
realm: cd

yarabokin:
image_flavour: node
realm: cd

# Agents for CI

zateki: &php_for_ci
image_flavour: php
realm: ci

zenerre:
<<: *php_for_ci
version: 7.4.23

tommy:
tommy_ci:
app_port: 24080
host: builds.nasqueron.org
aliases:
- build.nasqueron.org
jenkins_url: https://ci.nasqueron.org
jenkins_multi_branch: True

tommy_cd:
# No host definition, as this dashboard is mounted on infra.nasqueron.org
app_port: 24180
jenkins_url: https://cd.nasqueron.org

#
# Infrastructure and development services
#

hound:
hound:
app_port: 44080
host: code.nasqueron.org
github_account: nasqueron

cachet:
cachet:
app_port: 39080
host: status.nasqueron.org
credential: nasqueron.cachet.mysql
app_key: nasqueron.cachet.app_key
mysql_link: acquisitariat

auth-grove:
login:
app_port: 25080
host: login.nasqueron.org
credential: nasqueron.auth-grove.mysql
mysql_link: acquisitariat

# API microservices

docker-registry-api:
api-docker-registry:
app_port: 20080
api_entry_point: /docker/registry
registry_instance: registry

api-datasources:
api-datasources:
app_port: 19080
api_entry_point: /datasources

# phpBB SaaS
# The SaaS uses a MySQL instance, declared in the MySQL section.

# Openfire
openfire:
openfire:
ip: *ipv4_docker002
app_port: 9090
host: xmpp.nasqueron.org

# Other subservices for XMPP
# listening to their own subdomain
aliases:
- conference.nasqueron.org

# Pixelfed
pixelfed:
pixelfed:
app_port: 30080
host: photos.nasqueron.org
aliases:
- photo.nasqueron.org
links:
mysql: acquisitariat
redis: pixelfed_redis
credentials:
app_key: nasqueron.pixelfed.app_key
mailgun: nasqueron.pixelfed.mailgun
mysql: nasqueron.pixelfed.mysql
app:
title: Nasqueron Photos
max_album_length: 16

# Sentry
# The Sentry instance uses a Redis and a PostgreSQL instance,
# declared above.
exim:
sentry_smtp:
mailname: mx.sentry.nasqueron.org
network: sentry

sentry:
sentry_web_1:
app_port: 26080
host: sentry.nasqueron.org

# As an instance is divided between a web, a cron and a worker
# containers, we need an identified to share a data volume.
realm: nasqueron
network: sentry

sentry_worker:
sentry_worker_1:
realm: nasqueron
network: sentry

sentry_cron:
sentry_cron:
realm: nasqueron
network: sentry

# -------------------------------------------------------------		# -------------------------------------------------------------
# Monitoring		# Monitoring
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -		# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

docker_containers_monitoring:		docker_containers_monitoring:

# Go to URL, check it's an HTTP 200 response		# Go to URL, check it's an HTTP 200 response
check_http_200:		check_http_200:
Show All 39 Lines	rabbitmq_ports:
#		#
# - 1883 # MQTT		# - 1883 # MQTT
# - 8883 # MQTT with TLS		# - 8883 # MQTT with TLS
# - 15674 # STOMP over a WebSocket connection (rabbitmq_web_stomp plugin port)		# - 15674 # STOMP over a WebSocket connection (rabbitmq_web_stomp plugin port)
# - 15675 # MQTT over a WebSocket connection (rabbitmq_web_mqtt plugin port)		# - 15675 # MQTT over a WebSocket connection (rabbitmq_web_mqtt plugin port)
# - 15692 # Prometheus metrics (rabbitmq_prometheus plugin port)		# - 15692 # Prometheus metrics (rabbitmq_prometheus plugin port)
# - 61613 # STOMP		# - 61613 # STOMP
# - 61614 # STOMP with TLS		# - 61614 # STOMP with TLS

xmpp_ports:
- 3478
- 5222 # Client to server
- 5223 # Client to server (Encrypted (legacy-mode) connections)
- 5229 # Flash Cross Domain
- 5262 # Connections managers
- 5269 # Server to server
- 5270 # Server to server (Encrypted (legacy-mode) connections)
- 5275 # External components
- 5276 # External components (Encrypted (legacy-mode) connections)
- 7070 # HTTP binding
- 7443 # HTTP binding with TLS
- 7777 # File transfer proxy
- 9090 # Web administration server
- 9091 # Web administration server with TLS