diff --git a/PORTS b/PORTS index 1806994..9c2ee5c 100644 --- a/PORTS +++ b/PORTS @@ -1,13 +1,14 @@ paas-docker 5000 Docker registry HTTP 9090 Openfire HTTP 22220 Phabricator Aphlict (client) 22221 Phabricator Aphlict (admin) 24080 Tommy HTTP - CI 24180 Tommy HTTP - CD + 25080 Auth Grove HTTP 31080 Phabricator HTTP - DevCentral 34080 Etherpad 38080 Jenkins HTTP - CD 39080 Cachet HTTP 42080 Jenkins HTTP - CI 50000 Jenkins master's port for JNLP-based Jenkins agents - CD diff --git a/pillar/credentials/zr.sls b/pillar/credentials/zr.sls index 781ba71..0c7fe82 100644 --- a/pillar/credentials/zr.sls +++ b/pillar/credentials/zr.sls @@ -1,25 +1,29 @@ # ------------------------------------------------------------- # Salt configuration for Nasqueron servers # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # Project: Nasqueron # Created: 2018-09-12 # License: Trivial work, not eligible to copyright # ------------------------------------------------------------- zr_credentials: # # Credentials used by Nasqueron services # nasqueron: + # login.nasqueron.org + auth-grove: + mysql: 67 + # status.nasqueron.org cachet: mysql: 47 app_key: 126 # pad.nasqueron.org etherpad: # This API key is used by Wolfplex API to access to the pad lists api: 125 diff --git a/pillar/paas/docker.sls b/pillar/paas/docker.sls index fd1ffc9..fb0d52b 100644 --- a/pillar/paas/docker.sls +++ b/pillar/paas/docker.sls @@ -1,261 +1,271 @@ # ------------------------------------------------------------- # Salt — Provision Docker engine # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - # Project: Nasqueron # Created: 2018-03-10 # License: Trivial work, not eligible to copyright # ------------------------------------------------------------- docker_aliases: - &ipv4_equatower 51.255.124.10 # ------------------------------------------------------------- # Images # # You can append a :tag (by default, latest is used). # # It's not possible to specify Docker library images only by final name. # See https://docs.saltstack.com/en/latest/ref/states/all/salt.states.docker_image.html # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker_images: '*': - certbot/certbot dwellers: # Core services - nasqueron/rabbitmq # Infrastructure and development services - dereckson/cachet - nasqueron/notifications equatower: # Core services - library/registry - nasqueron/mysql + # Nasqueron services + - nasqueron/auth-grove + # Infrastructure and development services - nasqueron/aphlict - nasqueron/etherpad:production - nasqueron/phabricator # Continuous deployment jobs - jenkinsci/jenkins - nasqueron/jenkins-slave-php - nasqueron/jenkins-slave-rust - nasqueron/tommy # ------------------------------------------------------------- # Networks # # Containers can be grouped by network, instead to use links. # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker_networks: equatower: cd: subnet: 172.18.1.0/24 ci: subnet: 172.18.2.0/24 # ------------------------------------------------------------- # Docker engine configuration # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker_daemon: equatower: storage-driver: devicemapper storage-opts: - "dm.thinpooldev=/dev/mapper/wharf-thinpool" - "dm.use_deferred_removal=true" - "dm.use_deferred_deletion=true" docker_devicemapper: equatower: thinpool: wharf-thinpool # ------------------------------------------------------------- # Containers # # The docker_containers entry allow to declare # containers by image by servers # # The hierarchy is so as following. # # docker_containers: # server with the Docker engine: # service codename: # instance name: # container properties # # The service codename must match a state file in # the roles/paas-docker/containers/ directory. # # The container will be run with the specified instance name. # # **nginx** # # The container properties can also describe the information # needed to configure nginx with the host and app_port key. # # In such case, a matching vhost file should be declared as # roles/paas-docker/nginx/files/vhosts/.sls # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - docker_containers: # # Equatower is the current production engine # equatower: # # Core services # mysql: acquisitariat: {} phpbb_db: {} registry: registry: app_port: 5000 ip: 127.0.0.1 # # CI and CD # jenkins: jenkins_cd: realm: cd host: cd.nasqueron.org app_port: 38080 jnlp_port: 50000 jenkins_ci: realm: ci host: ci.nasqueron.org app_port: 42080 jnlp_port: 55000 jenkins_slave: # Slaves for CD apsile: &php_for_cd image: php realm: cd elapsi: *php_for_cd rust_brown: image: rust realm: cd zateki: &php_for_ci image: php realm: ci zenerre: *php_for_ci tommy: tommy_ci: app_port: 24080 host: builds.nasqueron.org aliases: - build.nasqueron.org jenkins_url: https://ci.nasqueron.org tommy_cd: # No host definition, as this dashboard is mounted on infra.nasqueron.org app_port: 24180 jenkins_url: https://cd.nasqueron.org # Infrastructure and development services phabricator: devcentral: app_port: 31080 host: devcentral.nasqueron.org aliases: - phabricator.nasqueron.org blogs: servers: host: servers.nasqueron.org aliases: - server.nasqueron.org - serveur.nasqueron.org - serveurs.nasqueron.org static_host: phabricator-files-for-devcentral-nasqueron.spacetechnology.net aphlict: aphlict: ports: client: 22280 admin: 22281 cachet: cachet: app_port: 39080 host: status.nasqueron.org credential: nasqueron.cachet.mysql app_key: nasqueron.cachet.app_key mysql_link: acquisitariat etherpad: pad: app_port: 34080 host: pad.nasqueron.org aliases: - pad.wolfplex.org - pad.wolfplex.be credential: nasqueron.etherpad.api mysql_link: acquisitariat + auth-grove: + login: + app_port: 25080 + host: login.nasqueron.org + credential: nasqueron.auth-grove.mysql + mysql_link: acquisitariat + # phpBB SaaS # The SaaS uses a MySQL instance, declared in the MySQL section. # Openfire openfire: openfire: ip: *ipv4_equatower app_port: 9090 host: xmpp.nasqueron.org # ------------------------------------------------------------- # Ports listened by XMPP # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - xmpp_ports: - 3478 - 5222 # Client to server - 5223 # Client to server (Encrypted (legacy-mode) connections) - 5262 # Connections managers - 5269 # Server to server - 5275 # External components - 5276 # External components (Encrypted (legacy-mode) connections) - 7070 # HTTP binding - 7443 # HTTP binding with TLS - 7777 # File transfer proxy - 9090 # Web administration server - 9091 # Web administration server with TLS # ------------------------------------------------------------- # Zemke-Rhyne clients # # This section should list all the Docker engines server # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - zr_clients: - key: 2 allowedConnectionFrom: - 172.27.26.49 - dwellers.nasqueron.drake - dwellers.nasqueron.org restrictCommand: comment: Zemke-Rhyne - key: 123 allowedConnectionFrom: - equatower.nasqueron.org restrictCommand: comment: Zemke-Rhyne diff --git a/roles/paas-docker/containers/auth-grove.sls b/roles/paas-docker/containers/auth-grove.sls new file mode 100644 index 0000000..14dc922 --- /dev/null +++ b/roles/paas-docker/containers/auth-grove.sls @@ -0,0 +1,65 @@ +# ------------------------------------------------------------- +# Salt — Provision Docker engine +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Project: Nasqueron +# Created: 2016-05-21 +# License: Trivial work, not eligible to copyright +# Description: SSO for Nasqueron services. +# Image: nasqueron/auth-grove +# Services used: MySQL server (acquisitariat) +# Docker volume (/data/login/storage) +# ------------------------------------------------------------- + +{% set has_selinux = salt['grains.get']('selinux:enabled', False) %} +{% set containers = pillar['docker_containers'][grains['id']] %} + +{% for instance, container in containers['auth-grove'].items() %} + +# ------------------------------------------------------------- +# Data directory +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +/srv/{{ instance }}/storage: + file.directory: + - user: 431 + - group: 433 + - makedirs: True + +{% if has_selinux %} +selinux_context_{{ instance }}_data: + selinux.fcontext_policy_present: + - name: /srv/{{ instance }}/storage + - sel_type: container_file_t + +selinux_context_{{ instance }}_data_applied: + selinux.fcontext_policy_applied: + - name: /srv/{{ instance }}/storage +{% endif %} + +# ------------------------------------------------------------- +# Container +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +{{ instance }}: + docker_container.running: + - detach: True + - interactive: True + - image: nasqueron/auth-grove + - links: {{ container['mysql_link'] }}:mysql + - environment: + - DB_DRIVER: mysql + - DB_HOST: mysql + - DB_PORT: 3306 + - DB_DATABASE: {{ instance }} + - DB_USERNAME: {{ salt['zr.get_username'](container['credential']) }} + - DB_PASSWORD: {{ salt['zr.get_password'](container['credential']) }} + + - CANONICAL_URL: https://{{ container['host'] }} + - TRUST_ALL_PROXIES: 1 + - binds: /srv/{{ instance }}/storage:/var/wwwroot/default/storage + - ports: + - 80 + - port_bindings: + - 127.0.0.1:{{ container['app_port'] }}:80 + +{% endfor %} diff --git a/roles/paas-docker/nginx/files/vhosts/auth-grove.conf b/roles/paas-docker/nginx/files/vhosts/auth-grove.conf new file mode 100644 index 0000000..f0e96a3 --- /dev/null +++ b/roles/paas-docker/nginx/files/vhosts/auth-grove.conf @@ -0,0 +1,43 @@ +# ------------------------------------------------------------- +# Configuration for Docker PaaS front-end nginx +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +# Author: Sébastien Santoro aka Dereckson +# Created: 2018-09-22 +# Source file: roles/paas-docker/nginx/files/vhosts/auth-grove.conf +# ------------------------------------------------------------- +# +# +# This file is managed by our rOPS SaltStack repository. +# +# Changes to this file may cause incorrect behavior +# and will be lost if the state is redeployed. +# + +server { + listen 80; + listen [::]:80; + server_name {{ fqdn }}; + + include includes/letsencrypt; + + return 301 https://$host$request_uri; +} + +server { + server_name {{ fqdn }}; + + include includes/tls; + ssl_certificate /srv/letsencrypt/etc/live/{{ fqdn }}/fullchain.pem; + ssl_certificate_key /srv/letsencrypt/etc/live/{{ fqdn }}/privkey.pem; + + include includes/letsencrypt; + + location / { + proxy_pass http://localhost:{{ app_port }}; + include includes/proxy_params; + } + + root /var/wwwroot-502/$server_name; + error_page 502 /502.html; + location /502.html {} +}