From 036f4bb2a9922005a2bf360b16de5ba703876aa8 Mon Sep 17 00:00:00 2001 From: Egor Matveev Date: Thu, 12 Jun 2025 22:12:08 +0300 Subject: [PATCH] fix --- .deploy-infra/deploy-dev.yaml | 18 ++++++ .deploy-infra/deploy-prod.yaml | 72 ++++++---------------- nginx copy/nginx-dev/Dockerfile | 15 ----- nginx copy/nginx-dev/config/nginx.conf | 24 -------- nginx copy/nginx-dev/fullchain.pem | 48 --------------- nginx copy/nginx-dev/prepare.py | 82 ------------------------- nginx copy/nginx-dev/privkey.pem | 5 -- nginx copy/nginx-dev/refre.sh | 11 ---- nginx copy/nginx-dev/run.sh | 4 -- nginx copy/nginx-prod/Dockerfile | 15 ----- nginx copy/nginx-prod/config/nginx.conf | 24 -------- nginx copy/nginx-prod/fullchain.pem | 47 -------------- nginx copy/nginx-prod/prepare.py | 82 ------------------------- nginx copy/nginx-prod/privkey.pem | 5 -- nginx copy/nginx-prod/refre.sh | 4 -- nginx copy/nginx-prod/run.sh | 4 -- prepare/run-development.sh | 2 + prepare/run-production.sh | 6 +- 18 files changed, 44 insertions(+), 424 deletions(-) delete mode 100644 nginx copy/nginx-dev/Dockerfile delete mode 100644 nginx copy/nginx-dev/config/nginx.conf delete mode 100644 nginx copy/nginx-dev/fullchain.pem delete mode 100644 nginx copy/nginx-dev/prepare.py delete mode 100644 nginx copy/nginx-dev/privkey.pem delete mode 100644 nginx copy/nginx-dev/refre.sh delete mode 100644 nginx copy/nginx-dev/run.sh delete mode 100644 nginx copy/nginx-prod/Dockerfile delete mode 100644 nginx copy/nginx-prod/config/nginx.conf delete mode 100644 nginx copy/nginx-prod/fullchain.pem delete mode 100644 nginx copy/nginx-prod/prepare.py delete mode 100644 nginx copy/nginx-prod/privkey.pem delete mode 100644 nginx copy/nginx-prod/refre.sh delete mode 100644 nginx copy/nginx-prod/run.sh diff --git a/.deploy-infra/deploy-dev.yaml b/.deploy-infra/deploy-dev.yaml index 1db0504..cdda175 100644 --- a/.deploy-infra/deploy-dev.yaml +++ b/.deploy-infra/deploy-dev.yaml @@ -26,6 +26,22 @@ services: update_config: parallelism: 1 # order: stop-first + + clickhouse: + image: clickhouse + networks: + - clickhouse-development + volumes: + - /sprint-data/clickhouse:/var/lib/clickhouse + deploy: + mode: replicated + replicas: 1 + restart_policy: + condition: any + placement: + constraints: [node.labels.stage == development] + update_config: + parallelism: 1 postgres: image: postgres:14-alpine3.19 @@ -169,3 +185,5 @@ networks: external: true configurator: external: true + clickhouse-development: + external: true diff --git a/.deploy-infra/deploy-prod.yaml b/.deploy-infra/deploy-prod.yaml index aef066d..baa5562 100644 --- a/.deploy-infra/deploy-prod.yaml +++ b/.deploy-infra/deploy-prod.yaml @@ -27,6 +27,22 @@ services: parallelism: 1 # order: start-first + clickhouse: + image: clickhouse + networks: + - clickhouse + volumes: + - /sprint-data/clickhouse:/var/lib/clickhouse + deploy: + mode: replicated + replicas: 1 + restart_policy: + condition: any + placement: + constraints: [node.labels.stage == production] + update_config: + parallelism: 1 + postgres: image: postgres:14-alpine3.19 volumes: @@ -79,29 +95,6 @@ services: parallelism: 1 order: start-first - rabbitmq: - image: rabbitmq:3.10.7-management - volumes: - - /sprint-data/rabbitmq:/var/lib/rabbitmq - ports: - - published: 5672 - target: 5672 - mode: host - - published: 15672 - target: 15672 - mode: host - environment: - RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD - deploy: - mode: replicated - restart_policy: - condition: any - placement: - constraints: [node.labels.stage == production] - update_config: - parallelism: 1 - order: start-first - redis: image: redis:alpine3.16 volumes: @@ -192,35 +185,6 @@ services: parallelism: 1 order: start-first - keycloak: - image: quay.io/keycloak/keycloak - ports: - - "8443:3000" - environment: - KC_DB: postgres - KC_DB_URL: jdbc:postgresql://0.0.0.0:5432/keycloak - KC_DB_USERNAME: postgres - KC_DB_PASSWORD: $DB_PASSWORD_PROD - KC_HOSTNAME: keycloak.sprinthub.ru - JAVA_OPTS_KC_HEAP: "-XX:MaxHeapFreeRatio=50 -XX:MaxRAMPercentage=65" - command: start - deploy: - mode: replicated - placement: - constraints: [node.labels.stage == production] - restart_policy: - condition: any - update_config: - parallelism: 1 - order: start-first - resources: - limits: - cpus: '1.0' - memory: 250M - reservations: - cpus: '0.50' - memory: 125M - volumes: minio_data: driver: local @@ -233,4 +197,6 @@ networks: common-infra-nginx: external: true configurator: - external: true \ No newline at end of file + external: true + clickhouse: + external: true diff --git a/nginx copy/nginx-dev/Dockerfile b/nginx copy/nginx-dev/Dockerfile deleted file mode 100644 index 9982f75..0000000 --- a/nginx copy/nginx-dev/Dockerfile +++ /dev/null @@ -1,15 +0,0 @@ -FROM nginx -RUN apt-get update -RUN apt-get install certbot --yes -RUN apt-get install python3-certbot-nginx python3-pip --yes -RUN pip3 install --break-system-packages minio -COPY ./config /etc/nginx -COPY ./fullchain.pem /etc/nginx/fullchain.pem -COPY ./privkey.pem /etc/nginx/privkey.pem -COPY prepare.py prepare.py -COPY run.sh run.sh -COPY refre.sh refre.sh -ENV PYTHONUNBUFFERED=1 -RUN chmod 777 run.sh -RUN chmod 777 refre.sh -ENTRYPOINT ["./run.sh"] \ No newline at end of file diff --git a/nginx copy/nginx-dev/config/nginx.conf b/nginx copy/nginx-dev/config/nginx.conf deleted file mode 100644 index d5e48ab..0000000 --- a/nginx copy/nginx-dev/config/nginx.conf +++ /dev/null @@ -1,24 +0,0 @@ -events {} - -http { - client_max_body_size 50m; - - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - server { - listen 80; - server_name *.develop.sprinthub.ru; - return 301 https://$host$request_uri; - } - - server { - listen 80; - server_name *.dev.chocomarsh.com; - return 301 https://$host$request_uri; - } - - include ./hosts.conf; -} \ No newline at end of file diff --git a/nginx copy/nginx-dev/fullchain.pem b/nginx copy/nginx-dev/fullchain.pem deleted file mode 100644 index b2ae57e..0000000 --- a/nginx copy/nginx-dev/fullchain.pem +++ /dev/null @@ -1,48 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDmTCCAx+gAwIBAgISBmM6pAg0qa3+cxLar5nvn27GMAoGCCqGSM49BAMDMDIx -CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF -NTAeFw0yNTA1MzAyMTEzMjZaFw0yNTA4MjgyMTEzMjVaMCExHzAdBgNVBAMMFiou -ZGV2ZWxvcC5zcHJpbnRodWIucnUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATy -YXxx4cfN6ga0duaq7STjZxNwtFQ7c0ZAO+D7ulmdf/jpK8Xfkj5d0KMX0jhTmTEg -DUwvBMsH/fpyuuEdHNPWo4ICJDCCAiAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW -MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT1 -FLWsp0ksteuVXXd3pZokXOhj2DAfBgNVHSMEGDAWgBSfK1/PPCFPnQS37SssxMZw -i9LXDTAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly9lNS5pLmxl -bmNyLm9yZy8wIQYDVR0RBBowGIIWKi5kZXZlbG9wLnNwcmludGh1Yi5ydTATBgNV -HSAEDDAKMAgGBmeBDAECATAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8vZTUuYy5s -ZW5jci5vcmcvNzEuY3JsMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYAEvFONL1T -ckyEBhnDjz96E/jntWKHiJxtMAWE6+WGJjoAAAGXI0B2OwAABAMARzBFAiBcMmQQ -PiKhuqhi3fs4yL6lfnQdZ1VlJTBifu8T6t4H3QIhAL/BdDUOafC+9nrlP7USrlCT -Oo1TA5JG/Yvxk5a/Oe1yAHYA7TxL1ugGwqSiAFfbyyTiOAHfUS/txIbFcA8g3bc+ -P+AAAAGXI0CF1gAABAMARzBFAiAHI0Z170KObyMHOQM6w/GhsazTzUpBilyQnv/b -Wr+kdwIhALS4DQNUNfiJoea0wszwoTxcnowGI7Whx8qH4Ut6st88MAoGCCqGSM49 -BAMDA2gAMGUCMGdO7CfUNB8wcMaHtED7/dy2ojOtofMze0kN0rzt2I/On55Ce84K -ZJ0Uj+Bcv/66qwIxAJ9YJTSJ1+owoICDbJekE+ejgzA+GgU2Z+RviZUTNXIdbWbX -etMXbXfP7WJPjxZ+ng== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw -WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK -a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO -VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw -gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD -ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw -i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB -AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g -BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu -Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C -2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+ -bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG -6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV -XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO -koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq -cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI -E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e -K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX -GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL -sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd -VQD9F6Na/+zmXCc= ------END CERTIFICATE----- \ No newline at end of file diff --git a/nginx copy/nginx-dev/prepare.py b/nginx copy/nginx-dev/prepare.py deleted file mode 100644 index 1f4671b..0000000 --- a/nginx copy/nginx-dev/prepare.py +++ /dev/null @@ -1,82 +0,0 @@ -import os -import sys -from minio import Minio -from urllib.request import urlopen -from json import loads - - -minio_client = Minio( - "minio.develop.sprinthub.ru:9000", - access_key="serviceminioadmin", - secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"), - secure=False, -) - - -def get(url): - with urlopen(url) as response: - data = response.read().decode("utf-8") - return loads(data) - - -try: - response = get( - "http://configurator/api/v1/fetch?project=certupdater&stage=development" - ) - hosts = response["configs"]["hosts"] -except Exception as e: - print(f"Error fetching config: {e}", file=sys.stderr) - sys.exit(1) - -config = "" -for host, params in hosts.items(): - config += """ - server {{ - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name {host}; - - ssl_certificate /etc/nginx/{host}/fullchain.pem; - ssl_certificate_key /etc/nginx/{host}/privkey.pem; - - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "no-refferer-when-downgrade" always; - add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always; - - location / {{ - resolver 127.0.0.11; - proxy_pass http://{target_host}:{port}$request_uri; - }} - }}\n\n - """.format( - host=host, target_host=params["host"], port=params["port"] - ) - try: - fullchain = minio_client.get_object( - "certupdater", f"certificates/{host}/fullchain.pem" - ) - privkey = minio_client.get_object( - "certupdater", f"certificates/{host}/privkey.pem" - ) - try: - os.makedirs(f"/etc/nginx/{host}", exist_ok=True) - except OSError as e: - print(f"Error creating directory: {e}", file=sys.stderr) - continue - - with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp: - fp.write(fullchain.data) - with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp: - fp.write(privkey.data) - except Exception as e: - print(f"Error processing host {host}: {e}", file=sys.stderr) - continue - -try: - with open("/etc/nginx/hosts.conf", "w") as fp: - fp.write(config) -except Exception as e: - print(f"Error writing config file: {e}", file=sys.stderr) - sys.exit(1) diff --git a/nginx copy/nginx-dev/privkey.pem b/nginx copy/nginx-dev/privkey.pem deleted file mode 100644 index 3d54748..0000000 --- a/nginx copy/nginx-dev/privkey.pem +++ /dev/null @@ -1,5 +0,0 @@ ------BEGIN EC PRIVATE KEY----- -MHcCAQEEIPtfut2MheT8iyX6/EXDHHDR9yvtYLxMUg34mLeCpngpoAoGCCqGSM49 -AwEHoUQDQgAE8mF8ceHHzeoGtHbmqu0k42cTcLRUO3NGQDvg+7pZnX/46SvF35I+ -XdCjF9I4U5kxIA1MLwTLB/36crrhHRzT1g== ------END EC PRIVATE KEY----- \ No newline at end of file diff --git a/nginx copy/nginx-dev/refre.sh b/nginx copy/nginx-dev/refre.sh deleted file mode 100644 index 8a566b8..0000000 --- a/nginx copy/nginx-dev/refre.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/bash - -if ! python3 prepare.py; then - echo "Error running prepare.py" >&2 - exit 1 -fi - -if ! nginx -s reload; then - echo "Error reloading nginx" >&2 - exit 1 -fi \ No newline at end of file diff --git a/nginx copy/nginx-dev/run.sh b/nginx copy/nginx-dev/run.sh deleted file mode 100644 index 55dfbaa..0000000 --- a/nginx copy/nginx-dev/run.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash - -python3 prepare.py -/docker-entrypoint.sh nginx -g 'daemon off;' \ No newline at end of file diff --git a/nginx copy/nginx-prod/Dockerfile b/nginx copy/nginx-prod/Dockerfile deleted file mode 100644 index 9982f75..0000000 --- a/nginx copy/nginx-prod/Dockerfile +++ /dev/null @@ -1,15 +0,0 @@ -FROM nginx -RUN apt-get update -RUN apt-get install certbot --yes -RUN apt-get install python3-certbot-nginx python3-pip --yes -RUN pip3 install --break-system-packages minio -COPY ./config /etc/nginx -COPY ./fullchain.pem /etc/nginx/fullchain.pem -COPY ./privkey.pem /etc/nginx/privkey.pem -COPY prepare.py prepare.py -COPY run.sh run.sh -COPY refre.sh refre.sh -ENV PYTHONUNBUFFERED=1 -RUN chmod 777 run.sh -RUN chmod 777 refre.sh -ENTRYPOINT ["./run.sh"] \ No newline at end of file diff --git a/nginx copy/nginx-prod/config/nginx.conf b/nginx copy/nginx-prod/config/nginx.conf deleted file mode 100644 index 6ca7786..0000000 --- a/nginx copy/nginx-prod/config/nginx.conf +++ /dev/null @@ -1,24 +0,0 @@ -events {} - -http { - client_max_body_size 50m; - - map $http_upgrade $connection_upgrade { - default upgrade; - '' close; - } - - server { - listen 80; - server_name *.sprinthub.ru; - return 301 https://$host$request_uri; - } - - server { - listen 80; - server_name *.chocomarsh.com; - return 301 https://$host$request_uri; - } - - include ./hosts.conf; -} \ No newline at end of file diff --git a/nginx copy/nginx-prod/fullchain.pem b/nginx copy/nginx-prod/fullchain.pem deleted file mode 100644 index f0ffc03..0000000 --- a/nginx copy/nginx-prod/fullchain.pem +++ /dev/null @@ -1,47 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDhzCCAw6gAwIBAgISBXELtGOqEI5IsXNFUC7cue03MAoGCCqGSM49BAMDMDIx -CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF -NTAeFw0yNTA1MzAyMTQ3MzZaFw0yNTA4MjgyMTQ3MzVaMBkxFzAVBgNVBAMMDiou -c3ByaW50aHViLnJ1MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoS3M+thgeup/ -F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9azdDRAp+c2OlzJqJQC+ZefswCB -2xvjNSoL2aOCAhswggIXMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEF -BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUu+3qfzUyaCAb -POu7GPUO6ZI2WfswHwYDVR0jBBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wMgYI -KwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTUuaS5sZW5jci5vcmcv -MBkGA1UdEQQSMBCCDiouc3ByaW50aHViLnJ1MBMGA1UdIAQMMAowCAYGZ4EMAQIB -MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy81Ni5jcmww -ggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sA -OhQSdgosrLvIKgAAAZcjX78RAAAEAwBHMEUCIDNC6e7jNcTXW1bti1nkseruXw84 -b8dsVzBt96FtE4+aAiEAr7ugvtozhmp6JdkIEfdHKecym9TxcL1h43j6rbKU3d8A -dQAaBP9J0FQdQK/2oMO/8djEZy9O7O4jQGiYaxdALtyJfQAAAZcjX8BoAAAEAwBG -MEQCIDezeAIFZ25OWXVV9hmtzEE5ujP0IyFaLxebyXAflYZMAiAy09hFLQXapebE -5YDtvqfmefapEsr4OaWyfusWjmeaiDAKBggqhkjOPQQDAwNnADBkAjAobO18Vk18 -BG7lBbXEQ0O8RYy+CEV/ef1ni2CBQp+MtmG/ZCWAbfEXFaj2WKng5Q0CMFRR9icx -p6/tLUixnJfAusGudEtD5Leh2foPDT2jzgazaROaVFVTrCJMGcdgVukuPQ== ------END CERTIFICATE----- ------BEGIN CERTIFICATE----- -MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw -TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh -cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw -WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg -RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK -a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO -VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw -gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD -ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw -i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB -AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g -BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu -Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C -2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+ -bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG -6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV -XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO -koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq -cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI -E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e -K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX -GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL -sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd -VQD9F6Na/+zmXCc= ------END CERTIFICATE----- \ No newline at end of file diff --git a/nginx copy/nginx-prod/prepare.py b/nginx copy/nginx-prod/prepare.py deleted file mode 100644 index d4ea956..0000000 --- a/nginx copy/nginx-prod/prepare.py +++ /dev/null @@ -1,82 +0,0 @@ -import os -import sys -from minio import Minio -from urllib.request import urlopen -from json import loads - - -minio_client = Minio( - "minio.sprinthub.ru:9000", - access_key="serviceminioadmin", - secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"), - secure=False, -) - - -def get(url): - with urlopen(url) as response: - data = response.read().decode("utf-8") - return loads(data) - - -try: - response = get( - "http://configurator/api/v1/fetch?project=certupdater&stage=production" - ) - hosts = response["configs"]["hosts"] -except Exception as e: - print(f"Error fetching config: {e}", file=sys.stderr) - sys.exit(1) - -config = "" -for host, params in hosts.items(): - config += """ - server {{ - listen 443 ssl http2; - listen [::]:443 ssl http2; - server_name {host}; - - ssl_certificate /etc/nginx/{host}/fullchain.pem; - ssl_certificate_key /etc/nginx/{host}/privkey.pem; - - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-XSS-Protection "1; mode=block" always; - add_header X-Content-Type-Options "nosniff" always; - add_header Referrer-Policy "no-refferer-when-downgrade" always; - add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always; - - location / {{ - resolver 127.0.0.11; - proxy_pass http://{target_host}:{port}$request_uri; - }} - }}\n\n - """.format( - host=host, target_host=params["host"], port=params["port"] - ) - try: - fullchain = minio_client.get_object( - "certupdater", f"certificates/{host}/fullchain.pem" - ) - privkey = minio_client.get_object( - "certupdater", f"certificates/{host}/privkey.pem" - ) - try: - os.makedirs(f"/etc/nginx/{host}", exist_ok=True) - except OSError as e: - print(f"Error creating directory: {e}", file=sys.stderr) - continue - - with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp: - fp.write(fullchain.data) - with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp: - fp.write(privkey.data) - except Exception as e: - print(f"Error processing host {host}: {e}", file=sys.stderr) - continue - -try: - with open("/etc/nginx/hosts.conf", "w") as fp: - fp.write(config) -except Exception as e: - print(f"Error writing config file: {e}", file=sys.stderr) - sys.exit(1) diff --git a/nginx copy/nginx-prod/privkey.pem b/nginx copy/nginx-prod/privkey.pem deleted file mode 100644 index 925be0a..0000000 --- a/nginx copy/nginx-prod/privkey.pem +++ /dev/null @@ -1,5 +0,0 @@ ------BEGIN EC PRIVATE KEY----- -MHcCAQEEIL0TAduonJLmbcDpRxDjSfa8bMIqLOh1KQcGQvAeQTIQoAoGCCqGSM49 -AwEHoUQDQgAEoS3M+thgeup/F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9az -dDRAp+c2OlzJqJQC+ZefswCB2xvjNSoL2Q== ------END EC PRIVATE KEY----- \ No newline at end of file diff --git a/nginx copy/nginx-prod/refre.sh b/nginx copy/nginx-prod/refre.sh deleted file mode 100644 index 584b723..0000000 --- a/nginx copy/nginx-prod/refre.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash - -python3 prepare.py -nginx -s reload \ No newline at end of file diff --git a/nginx copy/nginx-prod/run.sh b/nginx copy/nginx-prod/run.sh deleted file mode 100644 index 55dfbaa..0000000 --- a/nginx copy/nginx-prod/run.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash - -python3 prepare.py -/docker-entrypoint.sh nginx -g 'daemon off;' \ No newline at end of file diff --git a/prepare/run-development.sh b/prepare/run-development.sh index 2701a1e..86b2eae 100644 --- a/prepare/run-development.sh +++ b/prepare/run-development.sh @@ -4,6 +4,8 @@ mkdir /sprint-data/redis || true mkdir /sprint-data/rabbitmq || true mkdir /sprint-data/certs || true mkdir /sprint-data/gitea || true +mkdir /sprint-data/clickhouse || true chmod 777 /sprint-data/redis chmod 777 /sprint-data/rabbitmq chmod 777 /sprint-data/gitea +chmod 777 /sprint-data/clickhouse diff --git a/prepare/run-production.sh b/prepare/run-production.sh index 3eec08d..c28854d 100644 --- a/prepare/run-production.sh +++ b/prepare/run-production.sh @@ -6,11 +6,15 @@ docker network create -d overlay --attachable queues || true docker network create -d overlay --attachable queues-development || true docker network create -d overlay --attachable configurator || true docker network create -d overlay --attachable configurator-development || true +docker network create -d overlay --attachable clickhouse || true +docker network create -d overlay --attachable clickhouse-development || true mkdir /sprint-data/mongo || true mkdir /sprint-data/redis || true mkdir /sprint-data/rabbitmq || true mkdir /sprint-data/certs || true mkdir /sprint-data/gitea || true +mkdir /sprint-data/clickhouse || true chmod 777 /sprint-data/redis chmod 777 /sprint-data/rabbitmq -chmod 777 /sprint-data/gitea \ No newline at end of file +chmod 777 /sprint-data/gitea +chmod 777 /sprint-data/clickhouse