Compare commits

..

2 commits

Author SHA1 Message Date
3ba4ec5dad update versions, point everything to new docker repo 2022-06-25 10:19:15 -04:00
38b2f1c661 Replace nexus with docker-repo 2022-06-25 10:03:10 -04:00
24 changed files with 144 additions and 204 deletions

View file

@ -7,11 +7,11 @@ admin_email_address: amarpreet@minhas.io
hashi_arch: amd64
# consul
consul_version: 1.10.1
consul_version: 1.12.2
consul_domain: masked.name
# vault
vault_version: 1.8.1
vault_version: 1.10.4
vault_pki_policy: masked-dot-name
vault_ca_cert_name: MaskedName_Root_CA.crt
vault_ca_cert_payload: |
@ -60,12 +60,12 @@ vault_ca_cert_payload: |
-----END CERTIFICATE-----
# nomad
nomad_version: 1.1.3
nomad_version: 1.3.1
nomad_podman_driver_version: 0.3.0
# lnd
lnd_version: 0.14.2-beta
lnd_version: 0.15.0-beta
# lego
lego_version: 4.4.0
lego_version: 4.7.0
...

View file

@ -3,5 +3,5 @@ hashi_arch: arm
consul_arch: arm64
nomad_arch: arm64
docker_arch: arm64
k3s_version: v1.23.4+k3s1
k3s_version: v1.24.1+k3s1
k3s_role: 'client'

View file

@ -1,6 +1,6 @@
---
hashi_arch: arm
consul_arch: armhfv6
consul_arch: arm
lnd_arch: armv7
bitcoind_disk: /dev/sda1

View file

@ -23,7 +23,7 @@ hardtack[1:7].minhas.io
[lnd]
redwingcherokee.minhas.io
[nexus]
[docker-repo]
ivyking.minhas.io
[nomad_client]

View file

@ -0,0 +1,5 @@
---
- hosts: docker-repo
roles:
- role: docker-repo
...

View file

@ -1,5 +0,0 @@
---
- hosts: nexus
roles:
- role: nexus
...

View file

@ -6,7 +6,7 @@
- import_playbook: docker.yml
- import_playbook: nomad.yml
- import_playbook: k3s.yml
- import_playbook: nexus.yml
- import_playbook: docker-repo.yml
- import_playbook: lnd.yml
- import_playbook: wekan.yml
- import_playbook: haproxy.yml

View file

@ -0,0 +1,2 @@
---
docker_repo_storage: /mnt/raid/docker-repo

View file

@ -0,0 +1,12 @@
services {
id = "docker-repo"
name = "docker-repo"
port = 5000
checks = [
{
args = ["nc", "-z", "-v", "localhost", "5000"]
interval = "5s"
timeout = "20s"
}
]
}

View file

@ -4,8 +4,8 @@
name: consul
state: reloaded
- name: restart nexus
- name: restart docker
docker_container:
name: nexus
image: sonatype/nexus3
name: docker-repo
image: registry:2
restart: True

View file

@ -0,0 +1,94 @@
---
- name: ensure docker repo cert directory exists
file:
path: /etc/docker-repo/certs
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: ensure docker data directory exists
file:
path: '{{ docker_repo_storage }}'
recurse: True
state: directory
owner: root
group: root
mode: 0755
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/docker-repo/certs/docker-repo.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=docker-repo.service.{{ consul_domain }} alt_names=docker-repo.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: https://vault.service.masked.name:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/docker-repo/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
register: cert_written
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/docker-repo.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "certs/docker-repo.key",
mode: "0600"
}
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure docker repo data dir exists
file:
path: "{{ docker_repo_storage }}"
state: directory
mode: 0755
- name: run docker-repo
docker_container:
name: docker-repo
image: registry:2
env:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/docker-repo.crt
REGISTRY_HTTP_TLS_KEY: /certs/docker-repo.key
ports:
- "5000:5000"
volumes:
- "{{ docker_repo_storage }}:/data"
- "/etc/docker-repo/certs:/certs"
restart_policy: always
- name: ensure docker repo service config exists
copy:
src: files/docker-repo.hcl
dest: /etc/consul.d/docker-repo.hcl
mode: 0750
owner: consul
group: consul
notify: reload consul
...

View file

@ -0,0 +1,5 @@
---
- name: restart k3s
systemd:
name: k3s
state: restarted

View file

@ -1,4 +1,10 @@
---
- name: get dependencies
apt:
name:
- apparmor
- apparmor-utils
- name: check k3s version
shell:
cmd: "k3s --version | grep k3s | cut -d' ' -f3"
@ -16,6 +22,7 @@
owner: root
group: root
when: installed_k3s_version.stdout != k3s_version
notify: restart k3s
- name: link k3s
file:

View file

@ -1,24 +0,0 @@
services {
id = "nexus"
name = "nexus"
port = 8081
checks = [
{
args = ["nc", "-z", "-v", "localhost", "8081"]
interval = "5s"
timeout = "20s"
}
]
}
services {
id = "docker"
name = "docker"
port = 8082
checks = [
{
args = ["nc", "-z", "-v", "localhost", "8082"]
interval = "5s"
timeout = "20s"
}
]
}

View file

@ -1,12 +0,0 @@
# Jetty section
application-port-ssl=8081
application-host=0.0.0.0
nexus-args=${jetty.etc}/jetty.xml,${jetty.etc}/jetty-https.xml,${jetty.etc}/jetty-requestlog.xml
ssl.etc=/opt/sonatype/nexus/etc/ssl/
# nexus-context-path=/${NEXUS_CONTEXT}
# Nexus section
# nexus-edition=nexus-pro-edition
# nexus-features=\
# nexus-pro-feature
# nexus.clustered=false

View file

@ -1,143 +0,0 @@
---
- name: ensure pexpect exists
pip:
name: pexpect
state: present
- name: check if server cert is expiring in the next 5 days
shell: "openssl x509 -checkend 432000 -noout -in /etc/pki/certs/nexus.crt"
args:
executable: /bin/bash
failed_when: False
check_mode: False
changed_when: False
register: exp
- name: get cert
shell: "vault write pki_int/issue/{{ vault_pki_policy }} common_name=nexus.service.{{ consul_domain }} alt_names=nexus.service.{{ main_dc_name }}.{{ consul_domain }},docker.service.{{ consul_domain }},docker.service.{{ main_dc_name }}.{{ consul_domain }} ttl=43200m"
args:
executable: /bin/bash
environment:
VAULT_ADDR: https://vault.service.masked.name:8200
VAULT_TOKEN: "{{ lookup('file', lookup('env', 'HOME') + '/.vault-token') }}"
VAULT_FORMAT: json
register: cert_data
when: exp.rc != 0
- name: write cert data to server
copy:
content: "{{ item.content }}"
dest: "/etc/pki/{{ item.path }}"
mode: '{{ item.mode }}'
owner: root
group: root
when: cert_data.changed
register: cert_written
loop:
- {
content: "{{ (cert_data.stdout | from_json).data.certificate }}",
path: "certs/nexus.crt",
mode: "0755"
}
- {
content: "{{ (cert_data.stdout | from_json).data.private_key }}",
path: "keys/nexus.key",
mode: "0600"
}
# I hate this
- name: create cert for keystore
shell: for i in nexus.crt MaskedName_Root_CA.pem; do (cat "/etc/pki/certs/${i}"; echo) >> /tmp/keystore.crt; done
args:
executable: /bin/bash
when: cert_written.changed
- name: write keystore
expect:
command: "openssl pkcs12 -inkey /etc/pki/keys/nexus.key -in /tmp/keystore.crt -export -out {{ nexus_config_dir }}/etc/ssl/keystore.jks"
responses:
Enter Export Password:
- password
Verifying - Enter Export Password:
- password
when: cert_written.changed
notify: restart nexus
- name: remove tmp keystore
file:
path: /tmp/keystore.crt
state: absent
when: cert_written.changed
- name: ensure python-docker is installed
apt:
name: python3-docker
state: present
- name: ensure nexus group exists
group:
name: nexus
state: present
gid: 200
- name: ensure nexus user exists
user:
name: nexus
group: nexus
uid: 200
create_home: False
- name: ensure nexus data dir exists
file:
path: "{{ nexus_storage }}"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: ensure nexus data dir exists
file:
path: "{{ nexus_config_dir }}"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: ensure nexus keystore dir exists
file:
path: "{{ nexus_config_dir }}/etc/ssl/"
state: directory
owner: nexus
group: nexus
mode: 0755
- name: copy nexus.properties
copy:
src: files/nexus.properties
dest: "{{ nexus_storage }}/etc/nexus.properties"
- name: run nexus3
docker_container:
name: nexus
image: sonatype/nexus3:latest
env:
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/nexus.crt
REGISTRY_HTTP_TLS_KEY: /certs/nexus.key
REGISTRY_HTTP_SECRET: "{{ lookup('hashi_vault', 'secret=kv/data/nexus:data')['REGISTRY_HTTP_SECRET'] }}"
ports:
- "8081:8081"
- "8082:8082"
volumes:
- "{{ nexus_storage }}:/nexus-data"
- "{{ nexus_config_dir }}/etc/ssl:/opt/sonatype/nexus/etc/ssl/"
restart_policy: always
- name: ensure nexus consul service config exists
copy:
src: files/nexus.hcl
dest: /etc/consul.d/nexus.hcl
mode: 0750
owner: consul
group: consul
notify: reload consul
...

View file

@ -1,5 +1,4 @@
---
- import_tasks: podman.yml
- import_tasks: nomad.yml
- import_tasks: client_setup.yml
...

View file

@ -1,4 +1,4 @@
FROM nextcloud:23.0-apache
FROM nextcloud:24.0-apache
# Copy masked.name root cert
COPY files/MaskedName_Root_CA.crt /usr/local/share/ca-certificates/MaskedName_Root_CA.crt

View file

@ -1,4 +1,4 @@
FROM wallabag/wallabag:2.4.2
FROM wallabag/wallabag:2.5.1
# add ca-certificates package
RUN apk add --no-cache ca-certificates

View file

@ -23,7 +23,7 @@ job "freshrss" {
}
driver = "docker"
config {
image = "docker.service.masked.name:8082/freshrss"
image = "docker-repo.service.masked.name:5000/freshrss"
ports = ["http"]
volumes = [
"/mnt/raid/rss:/var/www/FreshRSS/data"

View file

@ -23,7 +23,7 @@ job "gitea" {
}
driver = "docker"
config {
image = "docker.service.masked.name:8082/gitea:latest"
image = "docker-repo.service.masked.name:5000/gitea:latest"
ports = ["http"]
volumes = [
"/mnt/raid/gitea:/data"

View file

@ -23,7 +23,7 @@ job "nextcloud" {
}
driver = "docker"
config {
image = "docker.service.masked.name:8082/nextcloud:latest"
image = "docker-repo.service.masked.name:5000/nextcloud:latest"
ports = ["nextcloud"]
volumes = [
"/mnt/raid/nextcloud/:/var/www/html"

View file

@ -24,7 +24,7 @@ job "sudoscientist-go-backend" {
}
driver = "docker"
config {
image = "docker.service.masked.name:8082/sudoscientist-go-backend"
image = "docker-repo.service.masked.name:5000/sudoscientist-go-backend"
ports = ["http"]
}

View file

@ -18,7 +18,7 @@ job "wallabag" {
}
driver = "docker"
config {
image = "docker.service.masked.name:8082/wallabag"
image = "docker-repo.service.masked.name:5000/wallabag"
ports = ["http"]
}