.deploy-nginx/deploy-dev.yaml

@@ -6,9 +6,6 @@ services:
     image: mathwave/sprint-repo:sprint-infra-nginx-dev
     networks:
       - common-infra-nginx-development
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
       - published: 80
         target: 80
@@ -30,5 +27,3 @@ services:
 networks:
   common-infra-nginx-development:
     external: true
-  configurator:
-    external: true

.deploy-nginx/deploy-prod.yaml

@@ -6,9 +6,6 @@ services:
     image: mathwave/sprint-repo:sprint-infra-nginx-prod
     networks:
       - common-infra-nginx
-      - configurator
-    environment:
-      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
     ports:
       - published: 80
         target: 80
@@ -30,5 +27,3 @@ services:
 networks:
   common-infra-nginx:
     external: true
-  configurator:
-    external: true

nginx/nginx-dev/Dockerfile

@@ -2,14 +2,12 @@ FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages minio
+RUN pip3 install --break-system-packages requests minio
 COPY ./config /etc/nginx
 COPY ./fullchain.pem /etc/nginx/fullchain.pem
 COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
-COPY refre.sh refre.sh
 ENV PYTHONUNBUFFERED=1
 RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
 ENTRYPOINT ["./run.sh"]

nginx/nginx-dev/prepare.py

@@ -1,36 +1,22 @@
+from requests import get
 import os
-import sys
 from minio import Minio
-from urllib.request import urlopen
-from json import loads
 
 
 minio_client = Minio(
     "minio.develop.sprinthub.ru:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
+    secure=False
 )
 
 
-def get(url):
+hosts = get('http://configurator/api/v1/fetch?project=certupdater&stage=development').json()['configs']['hosts']
-    with urlopen(url) as response:
+hosts = {**hosts, 'platform.develop.sprinthub.ru': {'host': 'platform-nginx', 'port': 1238}}
-        data = response.read().decode("utf-8")
-        return loads(data)
 
-
+config = ''
-try:
-    response = get(
-        "http://configurator/api/v1/fetch?project=certupdater&stage=development"
-    )
-    hosts = response["configs"]["hosts"]
-except Exception as e:
-    print(f"Error fetching config: {e}", file=sys.stderr)
-    sys.exit(1)
-
-config = ""
 for host, params in hosts.items():
-    config += """
+    config += '''
         server {{
             listen      443 ssl http2;
             listen      [::]:443 ssl http2;
@@ -50,33 +36,14 @@ for host, params in hosts.items():
                 proxy_pass http://{target_host}:{port}$request_uri;
             }}
         }}\n\n
-    """.format(
+    '''.format(host=host, target_host=params['host'], port=params['port'])
-        host=host, target_host=params["host"], port=params["port"]
+    fullchain = minio_client.get_object("certupdater", f'certificates/{host}/fullchain.pem')
-    )
+    privkey = minio_client.get_object("certupdater", f'certificates/{host}/privkey.pem')
-    try:
+    os.mkdir(f'/etc/nginx/{host}')
-        fullchain = minio_client.get_object(
+    with open(f"/etc/nginx/{host}/fullchain.pem", 'wb') as fp:
-            "certupdater", f"certificates/{host}/fullchain.pem"
-        )
-        privkey = minio_client.get_object(
-            "certupdater", f"certificates/{host}/privkey.pem"
-        )
-        try:
-            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-        except OSError as e:
-            print(f"Error creating directory: {e}", file=sys.stderr)
-            continue
-
-        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
         fp.write(fullchain.data)
-        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
+    with open(f"/etc/nginx/{host}/privkey.pem", 'wb') as fp:
         fp.write(privkey.data)
-    except Exception as e:
-        print(f"Error processing host {host}: {e}", file=sys.stderr)
-        continue
 
-try:
+with open('/etc/nginx/hosts.conf', 'w') as fp:
-    with open("/etc/nginx/hosts.conf", "w") as fp:
     fp.write(config)
-except Exception as e:
-    print(f"Error writing config file: {e}", file=sys.stderr)
-    sys.exit(1)

nginx/nginx-dev/refre.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-if ! python3 prepare.py; then
-    echo "Error running prepare.py" >&2
-    exit 1
-fi
-
-if ! nginx -s reload; then
-    echo "Error reloading nginx" >&2
-    exit 1
-fi

nginx/nginx-prod/Dockerfile

@@ -8,8 +8,6 @@ COPY ./fullchain.pem /etc/nginx/fullchain.pem
 COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
-COPY refre.sh refre.sh
 ENV PYTHONUNBUFFERED=1
 RUN chmod 777 run.sh
-RUN chmod 777 refre.sh
 ENTRYPOINT ["./run.sh"]

nginx/nginx-prod/prepare.py

@@ -7,17 +7,16 @@ minio_client = Minio(
     "minio.sprinthub.ru:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
-    secure=False,
+    secure=False
 )
 
 
-hosts = get(
+hosts = get('http://configurator/api/v1/fetch?project=certupdater&stage=production').json()['configs']['hosts']
-    "http://configurator/api/v1/fetch?project=certupdater&stage=production"
+hosts = {**hosts, 'platform.sprinthub.ru': {'host': 'platform-nginx', 'port': 1238}}
-).json()["configs"]["hosts"]
 
-config = ""
+config = ''
 for host, params in hosts.items():
-    config += """
+    config += '''
         server {{
             listen      443 ssl http2;
             listen      [::]:443 ssl http2;
@@ -37,21 +36,14 @@ for host, params in hosts.items():
                 proxy_pass http://{target_host}:{port}$request_uri;
             }}
         }}\n\n
-    """.format(
+    '''.format(host=host, target_host=params['host'], port=params['port'])
-        host=host, target_host=params["host"], port=params["port"]
+    fullchain = minio_client.get_object("certupdater", f'certificates/{host}/fullchain.pem')
-    )
+    privkey = minio_client.get_object("certupdater", f'certificates/{host}/privkey.pem')
-    fullchain = minio_client.get_object(
+    os.mkdir(f'/etc/nginx/{host}')
-        "certupdater", f"certificates/{host}/fullchain.pem"
+    with open(f"/etc/nginx/{host}/fullchain.pem", 'wb') as fp:
-    )
-    privkey = minio_client.get_object("certupdater", f"certificates/{host}/privkey.pem")
-    try:
-        os.mkdir(f"/etc/nginx/{host}")
-    except FileExistsError:
-        ...
-    with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
         fp.write(fullchain.data)
-    with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
+    with open(f"/etc/nginx/{host}/privkey.pem", 'wb') as fp:
         fp.write(privkey.data)
 
-with open("/etc/nginx/hosts.conf", "w") as fp:
+with open('/etc/nginx/hosts.conf', 'w') as fp:
     fp.write(config)

nginx/nginx-prod/refre.sh

@@ -1,4 +0,0 @@
-#!/bin/bash
-
-python3 prepare.py
-nginx -s reload