nginx copy/nginx-dev/Dockerfile

@@ -1,15 +0,0 @@
-FROM nginx
-RUN apt-get update
-RUN apt-get install certbot --yes
-RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages minio
-COPY ./config /etc/nginx
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY ./privkey.pem /etc/nginx/privkey.pem
-COPY prepare.py prepare.py
-COPY run.sh run.sh
-COPY refre.sh refre.sh
-ENV PYTHONUNBUFFERED=1
-RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
-ENTRYPOINT ["./run.sh"]

nginx copy/nginx-dev/config/nginx.conf

@@ -1,24 +0,0 @@
-events {}
-
-http {
-    client_max_body_size 50m;
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        '' close;
-    }
-
-    server {
-        listen 80;
-        server_name *.develop.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.dev.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
-    
-    include ./hosts.conf;
-}

nginx copy/nginx-dev/prepare.py

@@ -1,82 +0,0 @@
-import os
-import sys
-from minio import Minio
-from urllib.request import urlopen
-from json import loads
-
-
-minio_client = Minio(
-    "minio.develop.sprinthub.ru:9000",
-    access_key="serviceminioadmin",
-    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
-)
-
-
-def get(url):
-    with urlopen(url) as response:
-        data = response.read().decode("utf-8")
-        return loads(data)
-
-
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=development"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
-
-config = ""
-for host, params in hosts.items():
-    config += """
-        server {{
-            listen      443 ssl http2;
-            listen      [::]:443 ssl http2;
-            server_name {host};
-
-            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
-            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
-
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-            location / {{
-                resolver 127.0.0.11;
-                proxy_pass http://{target_host}:{port}$request_uri;
-            }}
-        }}\n\n
-    """.format(
-        host=host, target_host=params["host"], port=params["port"]
-    )
-    try:
-        fullchain = minio_client.get_object(
-            "certupdater", f"certificates/{host}/fullchain.pem"
-        )
-        privkey = minio_client.get_object(
-            "certupdater", f"certificates/{host}/privkey.pem"
-        )
-        try:
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
-
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
-            fp.write(fullchain.data)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-            fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
-
-try:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
-        fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)

nginx copy/nginx-dev/refre.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if ! python3 prepare.py; then
-    echo "Error running prepare.py" >&2
-    exit 1
-fi
-
-if ! nginx -s reload; then
-    echo "Error reloading nginx" >&2
-    exit 1
-fi

nginx copy/nginx-dev/run.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-/docker-entrypoint.sh nginx -g 'daemon off;'

nginx copy/nginx-prod/Dockerfile

@@ -1,15 +0,0 @@
-FROM nginx
-RUN apt-get update
-RUN apt-get install certbot --yes
-RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages minio
-COPY ./config /etc/nginx
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY ./privkey.pem /etc/nginx/privkey.pem
-COPY prepare.py prepare.py
-COPY run.sh run.sh
-COPY refre.sh refre.sh
-ENV PYTHONUNBUFFERED=1
-RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
-ENTRYPOINT ["./run.sh"]

nginx copy/nginx-prod/config/nginx.conf

@@ -1,24 +0,0 @@
-events {}
-
-http {
-    client_max_body_size 50m;
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        '' close;
-    }
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
-    
-    include ./hosts.conf;
-}

nginx copy/nginx-prod/prepare.py

@@ -1,82 +0,0 @@
-import os
-import sys
-from minio import Minio
-from urllib.request import urlopen
-from json import loads
-
-
-minio_client = Minio(
-    "minio.sprinthub.ru:9000",
-    access_key="serviceminioadmin",
-    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
-)
-
-
-def get(url):
-    with urlopen(url) as response:
-        data = response.read().decode("utf-8")
-        return loads(data)
-
-
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
-
-config = ""
-for host, params in hosts.items():
-    config += """
-        server {{
-            listen      443 ssl http2;
-            listen      [::]:443 ssl http2;
-            server_name {host};
-
-            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
-            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
-
-            add_header X-Frame-Options "SAMEORIGIN" always;
-            add_header X-XSS-Protection "1; mode=block" always;
-            add_header X-Content-Type-Options "nosniff" always;
-            add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-            location / {{
-                resolver 127.0.0.11;
-                proxy_pass http://{target_host}:{port}$request_uri;
-            }}
-        }}\n\n
-    """.format(
-        host=host, target_host=params["host"], port=params["port"]
-    )
-    try:
-        fullchain = minio_client.get_object(
-            "certupdater", f"certificates/{host}/fullchain.pem"
-        )
-        privkey = minio_client.get_object(
-            "certupdater", f"certificates/{host}/privkey.pem"
-        )
-        try:
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
-
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
-            fp.write(fullchain.data)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-            fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
-
-try:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
-        fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)

nginx copy/nginx-prod/refre.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-nginx -s reload

nginx copy/nginx-prod/run.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-/docker-entrypoint.sh nginx -g 'daemon off;'

nginx/nginx-dev/Dockerfile

@@ -4,6 +4,8 @@ RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
 RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
+COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
 COPY refre.sh refre.sh

nginx/nginx-prod/Dockerfile

@@ -2,8 +2,10 @@ FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages minio
+RUN pip3 install --break-system-packages requests minio
 COPY ./config /etc/nginx
+COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
 COPY refre.sh refre.sh

nginx/nginx-prod/config/nginx.conf

@@ -7,18 +7,7 @@ http {
         default upgrade;
         '' close;
     }
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen 80;
-        server_name *.chocomarsh.com;
-        return 301 https://$host$request_uri;
-    }
     
     include ./hosts.conf;
+    include ./sprinthub.conf;
 }

nginx/nginx-prod/config/sprinthub.conf

@@ -0,0 +1,96 @@
+
+    server {
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name swarmpit.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:888/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name portainer.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:8888/;
+        }
+
+        location /api/websocket/ {
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name minio.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:9001/;
+        }
+    }
+
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name gitea.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:3000/;
+        }
+    }

nginx/nginx-prod/prepare.py

@@ -1,8 +1,6 @@
+from requests import get
 import os
-import sys
 from minio import Minio
-from urllib.request import urlopen
-from json import loads
 
 
 minio_client = Minio(
@@ -13,20 +11,9 @@ minio_client = Minio(
 )
 
 
-def get(url):
+hosts = get(
-    with urlopen(url) as response:
+    "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-        data = response.read().decode("utf-8")
+).json()["configs"]["hosts"]
-        return loads(data)
-
-
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
 
 config = ""
 for host, params in hosts.items():
@@ -53,30 +40,18 @@ for host, params in hosts.items():
     """.format(
         host=host, target_host=params["host"], port=params["port"]
     )
+    fullchain = minio_client.get_object(
+        "certupdater", f"certificates/{host}/fullchain.pem"
+    )
+    privkey = minio_client.get_object("certupdater", f"certificates/{host}/privkey.pem")
     try:
-        fullchain = minio_client.get_object(
+        os.mkdir(f"/etc/nginx/{host}")
-            "certupdater", f"certificates/{host}/fullchain.pem"
+    except FileExistsError:
-        )
+        ...
-        privkey = minio_client.get_object(
+    with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
-            "certupdater", f"certificates/{host}/privkey.pem"
+        fp.write(fullchain.data)
-        )
+    with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-        try:
+        fp.write(privkey.data)
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
 
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
+with open("/etc/nginx/hosts.conf", "w") as fp:
-            fp.write(fullchain.data)
+    fp.write(config)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
-            fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
-
-try:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
-        fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)