commit
a24c79752d
@ -26,6 +26,22 @@ services:
|
||||
update_config:
|
||||
parallelism: 1
|
||||
# order: stop-first
|
||||
|
||||
clickhouse:
|
||||
image: clickhouse
|
||||
networks:
|
||||
- clickhouse-development
|
||||
volumes:
|
||||
- /sprint-data/clickhouse:/var/lib/clickhouse
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
placement:
|
||||
constraints: [node.labels.stage == development]
|
||||
update_config:
|
||||
parallelism: 1
|
||||
|
||||
postgres:
|
||||
image: postgres:14-alpine3.19
|
||||
@ -169,3 +185,5 @@ networks:
|
||||
external: true
|
||||
configurator:
|
||||
external: true
|
||||
clickhouse-development:
|
||||
external: true
|
||||
|
@ -27,6 +27,22 @@ services:
|
||||
parallelism: 1
|
||||
# order: start-first
|
||||
|
||||
clickhouse:
|
||||
image: clickhouse
|
||||
networks:
|
||||
- clickhouse
|
||||
volumes:
|
||||
- /sprint-data/clickhouse:/var/lib/clickhouse
|
||||
deploy:
|
||||
mode: replicated
|
||||
replicas: 1
|
||||
restart_policy:
|
||||
condition: any
|
||||
placement:
|
||||
constraints: [node.labels.stage == production]
|
||||
update_config:
|
||||
parallelism: 1
|
||||
|
||||
postgres:
|
||||
image: postgres:14-alpine3.19
|
||||
volumes:
|
||||
@ -79,29 +95,6 @@ services:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
|
||||
rabbitmq:
|
||||
image: rabbitmq:3.10.7-management
|
||||
volumes:
|
||||
- /sprint-data/rabbitmq:/var/lib/rabbitmq
|
||||
ports:
|
||||
- published: 5672
|
||||
target: 5672
|
||||
mode: host
|
||||
- published: 15672
|
||||
target: 15672
|
||||
mode: host
|
||||
environment:
|
||||
RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
|
||||
deploy:
|
||||
mode: replicated
|
||||
restart_policy:
|
||||
condition: any
|
||||
placement:
|
||||
constraints: [node.labels.stage == production]
|
||||
update_config:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
|
||||
redis:
|
||||
image: redis:alpine3.16
|
||||
volumes:
|
||||
@ -192,35 +185,6 @@ services:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
|
||||
keycloak:
|
||||
image: quay.io/keycloak/keycloak
|
||||
ports:
|
||||
- "8443:3000"
|
||||
environment:
|
||||
KC_DB: postgres
|
||||
KC_DB_URL: jdbc:postgresql://0.0.0.0:5432/keycloak
|
||||
KC_DB_USERNAME: postgres
|
||||
KC_DB_PASSWORD: $DB_PASSWORD_PROD
|
||||
KC_HOSTNAME: keycloak.sprinthub.ru
|
||||
JAVA_OPTS_KC_HEAP: "-XX:MaxHeapFreeRatio=50 -XX:MaxRAMPercentage=65"
|
||||
command: start
|
||||
deploy:
|
||||
mode: replicated
|
||||
placement:
|
||||
constraints: [node.labels.stage == production]
|
||||
restart_policy:
|
||||
condition: any
|
||||
update_config:
|
||||
parallelism: 1
|
||||
order: start-first
|
||||
resources:
|
||||
limits:
|
||||
cpus: '1.0'
|
||||
memory: 250M
|
||||
reservations:
|
||||
cpus: '0.50'
|
||||
memory: 125M
|
||||
|
||||
volumes:
|
||||
minio_data:
|
||||
driver: local
|
||||
@ -233,4 +197,6 @@ networks:
|
||||
common-infra-nginx:
|
||||
external: true
|
||||
configurator:
|
||||
external: true
|
||||
external: true
|
||||
clickhouse:
|
||||
external: true
|
||||
|
@ -1,15 +0,0 @@
|
||||
FROM nginx
|
||||
RUN apt-get update
|
||||
RUN apt-get install certbot --yes
|
||||
RUN apt-get install python3-certbot-nginx python3-pip --yes
|
||||
RUN pip3 install --break-system-packages minio
|
||||
COPY ./config /etc/nginx
|
||||
COPY ./fullchain.pem /etc/nginx/fullchain.pem
|
||||
COPY ./privkey.pem /etc/nginx/privkey.pem
|
||||
COPY prepare.py prepare.py
|
||||
COPY run.sh run.sh
|
||||
COPY refre.sh refre.sh
|
||||
ENV PYTHONUNBUFFERED=1
|
||||
RUN chmod 777 run.sh
|
||||
RUN chmod 777 refre.sh
|
||||
ENTRYPOINT ["./run.sh"]
|
@ -1,24 +0,0 @@
|
||||
events {}
|
||||
|
||||
http {
|
||||
client_max_body_size 50m;
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name *.develop.sprinthub.ru;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name *.dev.chocomarsh.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
include ./hosts.conf;
|
||||
}
|
@ -1,48 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDmTCCAx+gAwIBAgISBmM6pAg0qa3+cxLar5nvn27GMAoGCCqGSM49BAMDMDIx
|
||||
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
|
||||
NTAeFw0yNTA1MzAyMTEzMjZaFw0yNTA4MjgyMTEzMjVaMCExHzAdBgNVBAMMFiou
|
||||
ZGV2ZWxvcC5zcHJpbnRodWIucnUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATy
|
||||
YXxx4cfN6ga0duaq7STjZxNwtFQ7c0ZAO+D7ulmdf/jpK8Xfkj5d0KMX0jhTmTEg
|
||||
DUwvBMsH/fpyuuEdHNPWo4ICJDCCAiAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
|
||||
MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT1
|
||||
FLWsp0ksteuVXXd3pZokXOhj2DAfBgNVHSMEGDAWgBSfK1/PPCFPnQS37SssxMZw
|
||||
i9LXDTAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly9lNS5pLmxl
|
||||
bmNyLm9yZy8wIQYDVR0RBBowGIIWKi5kZXZlbG9wLnNwcmludGh1Yi5ydTATBgNV
|
||||
HSAEDDAKMAgGBmeBDAECATAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8vZTUuYy5s
|
||||
ZW5jci5vcmcvNzEuY3JsMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYAEvFONL1T
|
||||
ckyEBhnDjz96E/jntWKHiJxtMAWE6+WGJjoAAAGXI0B2OwAABAMARzBFAiBcMmQQ
|
||||
PiKhuqhi3fs4yL6lfnQdZ1VlJTBifu8T6t4H3QIhAL/BdDUOafC+9nrlP7USrlCT
|
||||
Oo1TA5JG/Yvxk5a/Oe1yAHYA7TxL1ugGwqSiAFfbyyTiOAHfUS/txIbFcA8g3bc+
|
||||
P+AAAAGXI0CF1gAABAMARzBFAiAHI0Z170KObyMHOQM6w/GhsazTzUpBilyQnv/b
|
||||
Wr+kdwIhALS4DQNUNfiJoea0wszwoTxcnowGI7Whx8qH4Ut6st88MAoGCCqGSM49
|
||||
BAMDA2gAMGUCMGdO7CfUNB8wcMaHtED7/dy2ojOtofMze0kN0rzt2I/On55Ce84K
|
||||
ZJ0Uj+Bcv/66qwIxAJ9YJTSJ1+owoICDbJekE+ejgzA+GgU2Z+RviZUTNXIdbWbX
|
||||
etMXbXfP7WJPjxZ+ng==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
|
||||
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
|
||||
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
|
||||
WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
|
||||
RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
|
||||
a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
|
||||
VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
|
||||
gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
|
||||
ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
|
||||
i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
|
||||
AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
|
||||
BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
|
||||
Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
|
||||
2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
|
||||
bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
|
||||
6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
|
||||
XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
|
||||
koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
|
||||
cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
|
||||
E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
|
||||
K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
|
||||
GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
|
||||
sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
|
||||
VQD9F6Na/+zmXCc=
|
||||
-----END CERTIFICATE-----
|
@ -1,82 +0,0 @@
|
||||
import os
|
||||
import sys
|
||||
from minio import Minio
|
||||
from urllib.request import urlopen
|
||||
from json import loads
|
||||
|
||||
|
||||
minio_client = Minio(
|
||||
"minio.develop.sprinthub.ru:9000",
|
||||
access_key="serviceminioadmin",
|
||||
secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
|
||||
secure=False,
|
||||
)
|
||||
|
||||
|
||||
def get(url):
|
||||
with urlopen(url) as response:
|
||||
data = response.read().decode("utf-8")
|
||||
return loads(data)
|
||||
|
||||
|
||||
try:
|
||||
response = get(
|
||||
"http://configurator/api/v1/fetch?project=certupdater&stage=development"
|
||||
)
|
||||
hosts = response["configs"]["hosts"]
|
||||
except Exception as e:
|
||||
print(f"Error fetching config: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
config = ""
|
||||
for host, params in hosts.items():
|
||||
config += """
|
||||
server {{
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name {host};
|
||||
|
||||
ssl_certificate /etc/nginx/{host}/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/{host}/privkey.pem;
|
||||
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-refferer-when-downgrade" always;
|
||||
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
|
||||
|
||||
location / {{
|
||||
resolver 127.0.0.11;
|
||||
proxy_pass http://{target_host}:{port}$request_uri;
|
||||
}}
|
||||
}}\n\n
|
||||
""".format(
|
||||
host=host, target_host=params["host"], port=params["port"]
|
||||
)
|
||||
try:
|
||||
fullchain = minio_client.get_object(
|
||||
"certupdater", f"certificates/{host}/fullchain.pem"
|
||||
)
|
||||
privkey = minio_client.get_object(
|
||||
"certupdater", f"certificates/{host}/privkey.pem"
|
||||
)
|
||||
try:
|
||||
os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
|
||||
except OSError as e:
|
||||
print(f"Error creating directory: {e}", file=sys.stderr)
|
||||
continue
|
||||
|
||||
with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
|
||||
fp.write(fullchain.data)
|
||||
with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
|
||||
fp.write(privkey.data)
|
||||
except Exception as e:
|
||||
print(f"Error processing host {host}: {e}", file=sys.stderr)
|
||||
continue
|
||||
|
||||
try:
|
||||
with open("/etc/nginx/hosts.conf", "w") as fp:
|
||||
fp.write(config)
|
||||
except Exception as e:
|
||||
print(f"Error writing config file: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
@ -1,5 +0,0 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIPtfut2MheT8iyX6/EXDHHDR9yvtYLxMUg34mLeCpngpoAoGCCqGSM49
|
||||
AwEHoUQDQgAE8mF8ceHHzeoGtHbmqu0k42cTcLRUO3NGQDvg+7pZnX/46SvF35I+
|
||||
XdCjF9I4U5kxIA1MLwTLB/36crrhHRzT1g==
|
||||
-----END EC PRIVATE KEY-----
|
@ -1,11 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
if ! python3 prepare.py; then
|
||||
echo "Error running prepare.py" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! nginx -s reload; then
|
||||
echo "Error reloading nginx" >&2
|
||||
exit 1
|
||||
fi
|
@ -1,4 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
python3 prepare.py
|
||||
/docker-entrypoint.sh nginx -g 'daemon off;'
|
@ -1,15 +0,0 @@
|
||||
FROM nginx
|
||||
RUN apt-get update
|
||||
RUN apt-get install certbot --yes
|
||||
RUN apt-get install python3-certbot-nginx python3-pip --yes
|
||||
RUN pip3 install --break-system-packages minio
|
||||
COPY ./config /etc/nginx
|
||||
COPY ./fullchain.pem /etc/nginx/fullchain.pem
|
||||
COPY ./privkey.pem /etc/nginx/privkey.pem
|
||||
COPY prepare.py prepare.py
|
||||
COPY run.sh run.sh
|
||||
COPY refre.sh refre.sh
|
||||
ENV PYTHONUNBUFFERED=1
|
||||
RUN chmod 777 run.sh
|
||||
RUN chmod 777 refre.sh
|
||||
ENTRYPOINT ["./run.sh"]
|
@ -1,24 +0,0 @@
|
||||
events {}
|
||||
|
||||
http {
|
||||
client_max_body_size 50m;
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name *.sprinthub.ru;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name *.chocomarsh.com;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
include ./hosts.conf;
|
||||
}
|
@ -1,47 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDhzCCAw6gAwIBAgISBXELtGOqEI5IsXNFUC7cue03MAoGCCqGSM49BAMDMDIx
|
||||
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
|
||||
NTAeFw0yNTA1MzAyMTQ3MzZaFw0yNTA4MjgyMTQ3MzVaMBkxFzAVBgNVBAMMDiou
|
||||
c3ByaW50aHViLnJ1MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoS3M+thgeup/
|
||||
F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9azdDRAp+c2OlzJqJQC+ZefswCB
|
||||
2xvjNSoL2aOCAhswggIXMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEF
|
||||
BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUu+3qfzUyaCAb
|
||||
POu7GPUO6ZI2WfswHwYDVR0jBBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wMgYI
|
||||
KwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTUuaS5sZW5jci5vcmcv
|
||||
MBkGA1UdEQQSMBCCDiouc3ByaW50aHViLnJ1MBMGA1UdIAQMMAowCAYGZ4EMAQIB
|
||||
MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy81Ni5jcmww
|
||||
ggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sA
|
||||
OhQSdgosrLvIKgAAAZcjX78RAAAEAwBHMEUCIDNC6e7jNcTXW1bti1nkseruXw84
|
||||
b8dsVzBt96FtE4+aAiEAr7ugvtozhmp6JdkIEfdHKecym9TxcL1h43j6rbKU3d8A
|
||||
dQAaBP9J0FQdQK/2oMO/8djEZy9O7O4jQGiYaxdALtyJfQAAAZcjX8BoAAAEAwBG
|
||||
MEQCIDezeAIFZ25OWXVV9hmtzEE5ujP0IyFaLxebyXAflYZMAiAy09hFLQXapebE
|
||||
5YDtvqfmefapEsr4OaWyfusWjmeaiDAKBggqhkjOPQQDAwNnADBkAjAobO18Vk18
|
||||
BG7lBbXEQ0O8RYy+CEV/ef1ni2CBQp+MtmG/ZCWAbfEXFaj2WKng5Q0CMFRR9icx
|
||||
p6/tLUixnJfAusGudEtD5Leh2foPDT2jzgazaROaVFVTrCJMGcdgVukuPQ==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
|
||||
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
|
||||
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
|
||||
WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
|
||||
RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
|
||||
a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
|
||||
VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
|
||||
gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
|
||||
ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
|
||||
i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
|
||||
AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
|
||||
BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
|
||||
Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
|
||||
2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
|
||||
bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
|
||||
6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
|
||||
XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
|
||||
koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
|
||||
cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
|
||||
E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
|
||||
K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
|
||||
GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
|
||||
sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
|
||||
VQD9F6Na/+zmXCc=
|
||||
-----END CERTIFICATE-----
|
@ -1,82 +0,0 @@
|
||||
import os
|
||||
import sys
|
||||
from minio import Minio
|
||||
from urllib.request import urlopen
|
||||
from json import loads
|
||||
|
||||
|
||||
minio_client = Minio(
|
||||
"minio.sprinthub.ru:9000",
|
||||
access_key="serviceminioadmin",
|
||||
secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
|
||||
secure=False,
|
||||
)
|
||||
|
||||
|
||||
def get(url):
|
||||
with urlopen(url) as response:
|
||||
data = response.read().decode("utf-8")
|
||||
return loads(data)
|
||||
|
||||
|
||||
try:
|
||||
response = get(
|
||||
"http://configurator/api/v1/fetch?project=certupdater&stage=production"
|
||||
)
|
||||
hosts = response["configs"]["hosts"]
|
||||
except Exception as e:
|
||||
print(f"Error fetching config: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
||||
|
||||
config = ""
|
||||
for host, params in hosts.items():
|
||||
config += """
|
||||
server {{
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name {host};
|
||||
|
||||
ssl_certificate /etc/nginx/{host}/fullchain.pem;
|
||||
ssl_certificate_key /etc/nginx/{host}/privkey.pem;
|
||||
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header Referrer-Policy "no-refferer-when-downgrade" always;
|
||||
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
|
||||
|
||||
location / {{
|
||||
resolver 127.0.0.11;
|
||||
proxy_pass http://{target_host}:{port}$request_uri;
|
||||
}}
|
||||
}}\n\n
|
||||
""".format(
|
||||
host=host, target_host=params["host"], port=params["port"]
|
||||
)
|
||||
try:
|
||||
fullchain = minio_client.get_object(
|
||||
"certupdater", f"certificates/{host}/fullchain.pem"
|
||||
)
|
||||
privkey = minio_client.get_object(
|
||||
"certupdater", f"certificates/{host}/privkey.pem"
|
||||
)
|
||||
try:
|
||||
os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
|
||||
except OSError as e:
|
||||
print(f"Error creating directory: {e}", file=sys.stderr)
|
||||
continue
|
||||
|
||||
with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
|
||||
fp.write(fullchain.data)
|
||||
with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
|
||||
fp.write(privkey.data)
|
||||
except Exception as e:
|
||||
print(f"Error processing host {host}: {e}", file=sys.stderr)
|
||||
continue
|
||||
|
||||
try:
|
||||
with open("/etc/nginx/hosts.conf", "w") as fp:
|
||||
fp.write(config)
|
||||
except Exception as e:
|
||||
print(f"Error writing config file: {e}", file=sys.stderr)
|
||||
sys.exit(1)
|
@ -1,5 +0,0 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIL0TAduonJLmbcDpRxDjSfa8bMIqLOh1KQcGQvAeQTIQoAoGCCqGSM49
|
||||
AwEHoUQDQgAEoS3M+thgeup/F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9az
|
||||
dDRAp+c2OlzJqJQC+ZefswCB2xvjNSoL2Q==
|
||||
-----END EC PRIVATE KEY-----
|
@ -1,4 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
python3 prepare.py
|
||||
nginx -s reload
|
@ -1,4 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
python3 prepare.py
|
||||
/docker-entrypoint.sh nginx -g 'daemon off;'
|
@ -4,6 +4,8 @@ mkdir /sprint-data/redis || true
|
||||
mkdir /sprint-data/rabbitmq || true
|
||||
mkdir /sprint-data/certs || true
|
||||
mkdir /sprint-data/gitea || true
|
||||
mkdir /sprint-data/clickhouse || true
|
||||
chmod 777 /sprint-data/redis
|
||||
chmod 777 /sprint-data/rabbitmq
|
||||
chmod 777 /sprint-data/gitea
|
||||
chmod 777 /sprint-data/clickhouse
|
||||
|
@ -6,11 +6,15 @@ docker network create -d overlay --attachable queues || true
|
||||
docker network create -d overlay --attachable queues-development || true
|
||||
docker network create -d overlay --attachable configurator || true
|
||||
docker network create -d overlay --attachable configurator-development || true
|
||||
docker network create -d overlay --attachable clickhouse || true
|
||||
docker network create -d overlay --attachable clickhouse-development || true
|
||||
mkdir /sprint-data/mongo || true
|
||||
mkdir /sprint-data/redis || true
|
||||
mkdir /sprint-data/rabbitmq || true
|
||||
mkdir /sprint-data/certs || true
|
||||
mkdir /sprint-data/gitea || true
|
||||
mkdir /sprint-data/clickhouse || true
|
||||
chmod 777 /sprint-data/redis
|
||||
chmod 777 /sprint-data/rabbitmq
|
||||
chmod 777 /sprint-data/gitea
|
||||
chmod 777 /sprint-data/gitea
|
||||
chmod 777 /sprint-data/clickhouse
|
||||
|
Loading…
Reference in New Issue
Block a user