fix

Reviewed-on: #32

.deploy-infra/deploy-dev.yaml

@@ -5,20 +5,46 @@ services:
   nginx:
     image: mathwave/sprint-repo:sprint-infra-nginx-dev
     networks:
-      - common-infra-nginx
+      - common-infra-nginx-development
+      - configurator
+    environment:
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
-      - "80:80"
+      - published: 80
-      - "443:443"
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
+      update_config:
+        parallelism: 1
+        # order: stop-first
+  
+  clickhouse:
+    image: clickhouse
+    networks:
+      - clickhouse-development
+      - common-infra-nginx-development
+    volumes:
+      - /sprint-data/clickhouse:/var/lib/clickhouse
+    environment:
+      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_DEV
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
-        order: start-first
 
   postgres:
     image: postgres:14-alpine3.19
@@ -33,13 +59,15 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - "5432:5432"
+      - published: 5432
+        target: 5432
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -52,13 +80,15 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_DEV
     ports:
-      - "27017:27017"
+      - published: 27017
+        target: 27017
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first 
@@ -68,8 +98,12 @@ services:
     volumes:
       - /sprint-data/rabbitmq:/var/lib/rabbitmq
     ports:
-      - "5672:5672"
+      - published: 5672
-      - "15672:15672"
+        target: 5672
+        mode: host
+      - published: 15672
+        target: 15672
+        mode: host
     environment:
       RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
     deploy:
@@ -77,7 +111,7 @@ services:
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -87,14 +121,16 @@ services:
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - "6379:6379"
+      - published: 6379
+        target: 6379
+        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_DEV
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -107,12 +143,16 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_DEV
     ports:
-      - "9000:9000"
+      - published: 9000
-      - "9001:9001"
+        target: 9000
+        mode: host
+      - published: 9001
+        target: 9001
+        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       restart_policy:
         condition: any
       update_config:
@@ -132,7 +172,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       restart_policy:
         condition: any
       update_config:
@@ -144,7 +184,9 @@ volumes:
     driver: local
 
 networks:
-  net:
+  common-infra-nginx-development:
-    driver: overlay
+    external: true
-  common-infra-nginx:
+  configurator:
+    external: true
+  clickhouse-development:
     external: true

.deploy-infra/deploy-prod.yaml

@@ -6,19 +6,125 @@ services:
     image: mathwave/sprint-repo:sprint-infra-nginx-prod
     networks:
       - common-infra-nginx
+      - configurator
+    environment:
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
     ports:
-      - "80:80"
+      - published: 80
-      - "443:443"
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
-        order: start-first
+        # order: start-first
+  
+  zitadel:
+    image: ghcr.io/zitadel/zitadel:latest
+    networks:
+      - common-infra-nginx
+    command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
+    environment:
+      ZITADEL_DATABASE_POSTGRES_HOST: pg.sprinthub.ru
+      ZITADEL_DATABASE_POSTGRES_PORT: 5432
+      ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
+      ZITADEL_DATABASE_POSTGRES_USER_USERNAME: postgres
+      ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: $DB_PASSWORD_PROD
+      ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
+      ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
+      ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: $DB_PASSWORD_PROD
+      ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
+      ZITADEL_EXTERNALSECURE: "false"
+      ZITADEL_EXTERNALDOMAIN: zitadel.chocomarsh.com
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      update_config:
+        parallelism: 1
+    
+  # authelia:
+  #   image: mathwave/sprint-repo:authelia
+  #   networks:
+  #     - common-infra-nginx
+  #   environment:
+  #     AUTHELIA_JWT_SECRET: $AUTHTHELIA_JWT_SECRET
+  #     AUTHELIA_SESSION_SECRET: $AUTHTHELIA_SESSION_SECRET
+  #     AUTHELIA_STORAGE_ENCRYPTION_KEY: $AUTHELIA_STORAGE_ENCRYPTION_KEY
+  #     AUTHELIA_STORAGE_POSTGRES_PORT: "5432"
+  #     AUTHELIA_STORAGE_POSTGRES_DATABASE: "authelia"
+  #     AUTHELIA_STORAGE_POSTGRES_USERNAME: "postgres"
+  #     AUTHELIA_STORAGE_POSTGRES_PASSWORD: $DB_PASSWORD_PROD
+  #     AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY: "one_factor"
+  #     AUTHELIA_NOTIFIER_SMTP_ENABLED: "false"
+  #   volumes:
+  #     - /sprint-data/authelia/data:/var/lib/authelia
+  #   deploy:
+  #     mode: replicated
+  #     replicas: 1
+  #     restart_policy:
+  #       condition: any
+  #     placement:
+  #       constraints: [node.labels.stage == production]
+  #     update_config:
+  #       parallelism: 1
+
+  grafana:
+    image: grafana/grafana
+    networks:
+      - common-infra-nginx
+      - clickhouse
+    volumes:
+      - /sprint-data/grafana:/var/lib/grafana
+    environment:
+      GF_SERVER_ROOT_URL: https://grafana.chocomarsh.com
+      GF_CORS_ENABLED: "false"
+      GF_AUTH_DISABLE_LOGIN_FORM: "false"
+      GF_CORS_ALLOW_ORIGINS: "*"
+      GF_SECURITY_CONTENT_SECURITY_POLICY: "false"
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+
+  clickhouse:
+    image: clickhouse
+    networks:
+      - clickhouse
+    volumes:
+      - /sprint-data/clickhouse:/var/lib/clickhouse
+    environment:
+      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_PROD
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+      resources:
+        limits:
+          memory: 2048M
+          cpus: '2.0'
+        reservations:
+          memory: 1024M
+          cpus: '1.0'
 
   postgres:
     image: postgres:14-alpine3.19
@@ -33,13 +139,15 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - "5432:5432"
+      - published: 5432
+        target: 5432
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first
@@ -57,32 +165,15 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_PROD
     ports:
-      - "27017:27017"
+      - published: 27017
+        target: 27017
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
-      update_config:
-        parallelism: 1
-        order: start-first 
-
-  rabbitmq:
-    image: rabbitmq:3.10.7-management
-    volumes:
-      - /sprint-data/rabbitmq:/var/lib/rabbitmq
-    ports:
-      - "5672:5672"
-      - "15672:15672"
-    environment:
-      RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
-    deploy:
-      mode: replicated
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.role == manager]
       update_config:
         parallelism: 1
         order: start-first 
@@ -92,14 +183,16 @@ services:
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - "6379:6379"
+      - published: 6379
+        target: 6379
+        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_PROD
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first
@@ -112,12 +205,16 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_PROD
     ports:
-      - "9000:9000"
+      - published: 9000
-      - "9001:9001"
+        target: 9000
+        mode: host
+      - published: 9001
+        target: 9001
+        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
@@ -144,7 +241,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
@@ -164,7 +261,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
@@ -182,3 +279,7 @@ networks:
     driver: overlay
   common-infra-nginx:
     external: true
+  configurator:
+    external: true
+  clickhouse:
+    external: true

.deploy-nginx/deploy-dev.yaml

@@ -0,0 +1,34 @@
+version: "3.6"
+
+services:
+
+  nginx:
+    image: mathwave/sprint-repo:sprint-infra-nginx-dev
+    networks:
+      - common-infra-nginx-development
+      - configurator
+    environment:
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
+    ports:
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == development]
+      update_config:
+        parallelism: 1
+        # order: stop-first
+
+networks:
+  common-infra-nginx-development:
+    external: true
+  configurator:
+    external: true

.deploy-nginx/deploy-prod.yaml

@@ -0,0 +1,34 @@
+version: "3.6"
+
+services:
+
+  nginx:
+    image: mathwave/sprint-repo:sprint-infra-nginx-prod
+    networks:
+      - common-infra-nginx
+      - configurator
+    environment:
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
+    ports:
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+        # order: start-first
+
+networks:
+  common-infra-nginx:
+    external: true
+  configurator:
+    external: true

.deploy-portainer/deploy-dev.yaml

@@ -1,39 +0,0 @@
-version: '3.2'
-
-services:
-  agent:
-    image: portainer/agent:2.11.1
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-    networks:
-      - agent_network
-    deploy:
-      mode: global
-      placement:
-        constraints: [node.platform.os == linux]
-
-  portainer:
-    image: portainer/portainer-ce:2.11.1
-    command: -H tcp://tasks.agent:9001 --tlsskipverify
-    ports:
-      - "9443:9443"
-      - "8888:9000"
-      - "8000:8000"
-    volumes:
-      - portainer_data:/data
-    networks:
-      - agent_network
-    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints: [node.role == manager]
-
-networks:
-  agent_network:
-    driver: overlay
-    attachable: true
-
-volumes:
-  portainer_data:

.deploy-portainer/deploy-prod.yaml

@@ -28,7 +28,7 @@ services:
       mode: replicated
       replicas: 1
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
 
 networks:
   agent_network:

.deploy-swarmpit/deploy-dev.yaml

@@ -1,83 +0,0 @@
-version: '3.3'
-
-services:
-  app:
-    image: swarmpit/swarmpit:latest
-    environment:
-      - SWARMPIT_DB=http://db:5984
-      - SWARMPIT_INFLUXDB=http://influxdb:8086
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080"]
-      interval: 60s
-      timeout: 10s
-      retries: 3
-    networks:
-      - net
-    ports:
-      - "888:8080"
-    deploy:
-      resources:
-        limits:
-          memory: 1024M
-        reservations:
-          memory: 512M
-      placement:
-        constraints:
-          - node.role == manager
-  db:
-    image: treehouses/couchdb:2.3.1
-    volumes:
-      - db-data:/opt/couchdb/data
-    networks:
-      - net
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-        reservations:
-          memory: 128M
-
-  influxdb:
-    image: influxdb:1.7
-    volumes:
-      - influx-data:/var/lib/influxdb
-    networks:
-      - net
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-        reservations:
-          memory: 128M
-
-  agent:
-    image: swarmpit/agent:latest
-    environment:
-      - DOCKER_API_VERSION=1.35
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - net
-    deploy:
-      mode: global
-      labels:
-        swarmpit.agent: 'true'
-      resources:
-        limits:
-          memory: 64M
-        reservations:
-          memory: 32M
-
-networks:
-  net:
-    driver: overlay
-  swarmpit-nginx:
-    external: true
-
-volumes:
-  db-data:
-    driver: local
-  influx-data:
-    driver: local

.deploy-swarmpit/deploy-prod.yaml

@@ -24,12 +24,10 @@ services:
         reservations:
           memory: 512M
       placement:
-        constraints:
+        constraints: [node.labels.stage == production]
-          - node.role == manager
+
   db:
     image: treehouses/couchdb:2.3.1
-    volumes:
-      - db-data:/opt/couchdb/data
     networks:
       - net
     deploy:
@@ -41,8 +39,6 @@ services:
 
   influxdb:
     image: influxdb:1.7
-    volumes:
-      - influx-data:/var/lib/influxdb
     networks:
       - net
     deploy:
@@ -73,11 +69,3 @@ services:
 networks:
   net:
     driver: overlay
-  swarmpit-nginx:
-    external: true
-
-volumes:
-  db-data:
-    driver: local
-  influx-data:
-    driver: local

.gitea/workflows/deploy-dev.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -23,15 +23,15 @@ jobs:
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     needs: build
     steps:
       - name: push nginx dev
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-dev
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
-  deploy-dev:
+  prepare:
-    name: Deploy dev
+    name: prepare
     runs-on: [dev]
     needs: push
     steps:
@@ -41,16 +41,27 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: dev
-      - name: deploy swarmpit
+      - name: prepare
-        run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-dev.yaml swarmpit
+        run: chmod 777 ./prepare/run-development.sh && ./prepare/run-development.sh
-      - name: deploy portainer
+  deploy-dev:
-        run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-dev.yaml portainer
+    name: Deploy dev
+    runs-on: [prod]
+    needs: prepare
+    steps:
+      - name: login
+        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: dev
       - name: deploy infra
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
           DB_PASSWORD_DEV: ${{ secrets.POSTGRES_PASSWORD_DEV }}
+          CLICKHOUSE_PASSWORD_DEV: ${{ secrets.CLICKHOUSE_PASSWORD_DEV }}
           MINIO_PASSWORD_DEV: ${{ secrets.MINIO_PASSWORD_DEV }}
+          MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
           REDIS_PASSWORD_DEV: ${{ secrets.REDIS_PASSWORD_DEV }}
           RABBITMQ_PASSWORD_DEV: ${{ secrets.RABBITMQ_PASSWORD_DEV }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
-        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra
+        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra-development

.gitea/workflows/deploy-prod.yaml

@@ -9,27 +9,44 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: checkout
         uses: actions/checkout@v4
         with:
-          ref: dev
+          ref: prod
       - name: build nginx prod
         run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-prod nginx/nginx-prod
       - name: build gitea runner
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
+      - name: build authelia
+        run: docker build -t mathwave/sprint-repo:authelia authelia
   push:
     name: Push
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     needs: build
     steps:
       - name: push nginx prod
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-prod
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
+      - name: push authelia
+        run: docker push mathwave/sprint-repo:authelia
+  prepare:
+    name: prepare
+    runs-on: [prod]
+    needs: push
+    steps:
+      - name: login
+        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: prod
+      - name: prepare
+        run: chmod 777 ./prepare/run-production.sh && ./prepare/run-production.sh
   deploy-prod:
     name: Deploy prod
     runs-on: [prod]
@@ -49,8 +66,13 @@ jobs:
         env:
           MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
           DB_PASSWORD_PROD: ${{ secrets.POSTGRES_PASSWORD_PROD }}
+          CLICKHOUSE_PASSWORD_PROD: ${{ secrets.CLICKHOUSE_PASSWORD_PROD }}
           MINIO_PASSWORD_PROD: ${{ secrets.MINIO_PASSWORD_PROD }}
+          MINIO_SECRET_KEY_PROD: ${{ secrets.MINIO_SECRET_KEY_PROD }}
           REDIS_PASSWORD_PROD: ${{ secrets.REDIS_PASSWORD_PROD }}
           RABBITMQ_PASSWORD_PROD: ${{ secrets.RABBITMQ_PASSWORD_PROD }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
+          AUTHTHELIA_JWT_SECRET: ${{ secrets.AUTHTHELIA_JWT_SECRET }}
+          AUTHTHELIA_SESSION_SECRET: ${{ secrets.AUTHTHELIA_SESSION_SECRET }}
+          AUTHELIA_STORAGE_ENCRYPTION_KEY: ${{ secrets.AUTHELIA_STORAGE_ENCRYPTION_KEY }}
         run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-prod.yaml infra

authelia/Dockerfile

@@ -0,0 +1,3 @@
+FROM authelia/authelia
+COPY configuration.yml /config/configuration.yml
+COPY users.yml /config/users.yml

authelia/configuration.yml

@@ -0,0 +1,44 @@
+theme: dark
+
+jwt_secret: secret-jwt-will-be-overridden-by-env
+
+server:
+  host: 0.0.0.0
+  port: 9091
+
+log:
+  level: info
+
+authentication_backend:
+  file:
+    path: /config/users.yml
+
+access_control:
+  default_policy: one_factor
+  rules:
+    - domain: "*.chocomarsh.com"
+      policy: one_factor
+
+session:
+  name: authelia_session
+  expiration: 1h
+  inactivity: 5m
+  remember_me_duration: 1w
+  cookies:
+    - domain: chocomarsh.com
+      authelia_url: https://auth.chocomarsh.com
+      default_redirection_url: https://login.chocomarsh.com
+
+storage:
+  encryption_key: "a_very_long_secret_32_characters_minimum"
+  postgres:
+    host: pg.sprinthub.ru
+    port: 5432
+    database: authelia
+    schema: public
+    username: postgres
+    password: autheliapass  # also override with env if preferred
+
+notifier:
+  filesystem:
+    filename: /config/notification.txt

authelia/users.yml

@@ -0,0 +1,5 @@
+users:
+  emmatveev:
+    password: "$argon2id$v=19$m=65536,t=1,p=4$CixMXaAilVof3yk1rtghwg$V/kcl1HNDWeybrV3SrVjjdI00D1lFtuvLldkwAklSOE"
+    displayname: "Egor Matveev"
+    email: emmtvv@gmail.com

gitlab-runner/Dockerfile

@@ -1,14 +0,0 @@
-FROM gitlab/gitlab-runner
-
-
-RUN apt-get update
-RUN apt-get install --yes ca-certificates curl gnupg lsb-release
-RUN mkdir -p /etc/apt/keyrings
-RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-RUN echo \
-  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
-  $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
-RUN apt-get update --yes
-RUN apt-get install --yes docker-ce docker-ce-cli containerd.io docker-compose-plugin
-RUN mkdir /etc/builds/
-RUN chmod 777 /etc/builds

nginx/nginx-dev/Dockerfile

@@ -1,4 +1,13 @@
 FROM nginx
+RUN apt-get update
+RUN apt-get install certbot --yes
+RUN apt-get install python3-certbot-nginx python3-pip --yes
+RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
-COPY ./privkey.pem /etc/nginx/privkey.pem
+COPY prepare.py prepare.py
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY run.sh run.sh
+COPY refre.sh refre.sh
+ENV PYTHONUNBUFFERED=1
+RUN chmod 777 run.sh
+RUN chmod 777 refre.sh
+ENTRYPOINT ["./run.sh"]

nginx/nginx-dev/config/guavo.conf

@@ -1,162 +0,0 @@
-
-    # server {
-    #     listen 80;
-    #     server_name *.develop.guavo.tech;
-    #     return 301 https://$host$request_uri;
-    # }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.guavo.tech:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name rabbitmq.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name grafana.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        proxy_set_header Host $http_host;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:3000/;
-        }
-
-        location /api/live/ws {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.guavo.tech:3000/api/live/ws;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header        X-Real-IP       $remote_addr;
-
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }
-
-    server {
-        listen      80;
-        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header        X-Real-IP       $remote_addr;
-
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }

nginx/nginx-dev/config/nginx.conf

@@ -8,6 +8,17 @@ http {
         '' close;
     }
 
-    include ./guavo.conf;
+    server {
-    include ./sprinthub.conf;
+        listen 80;
+        server_name *.develop.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.dev.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
+    include ./hosts.conf;
 }

nginx/nginx-dev/config/sprinthub.conf

@@ -1,143 +0,0 @@
-
-    server {
-        listen 80;
-        server_name *.develop.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.sprinthub.ru:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name rabbitmq.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name grafana.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        proxy_set_header Host $http_host;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:3000/;
-        }
-
-        location /api/live/ws {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.sprinthub.ru:3000/api/live/ws;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name ~^(?<domain>.*)\.develop\.sprinthub\.ru$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header        X-Real-IP       $remote_addr;
-
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }
-

nginx/nginx-dev/fullchain.pem

@@ -1,58 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE+zCCA+OgAwIBAgISA1gLQJEHOf44GcYLUSr2vDoDMA0GCSqGSIb3DQEBCwUA
-MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
-EwNSMTEwHhcNMjQwODE4MTcwNTE0WhcNMjQxMTE2MTcwNTEzWjAhMR8wHQYDVQQD
-DBYqLmRldmVsb3Auc3ByaW50aHViLnJ1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAu5dE0JYsLqqYrqulQkDeApuAPp5ckTFbg72UhSrfo2SbbP0S2//P
-75hvn4aUAsPPWsUk8PDYQn8tOd0/1TrLMmh8xhJxTUUcO3fgP0mbgiYsQep/z5LU
-BgzGC5R2zQhl4O+SdYlCC56zz1GHNK+IWhXgaLz0dnaKXEIpsVnu2r9THEFAoXRx
-j2J64WwdDSC63Qqs2juvMsU9zizYpOnQr6wxIYNIe+jnUJoGeg84gYz7RMzmEYQh
-9Ut36apABFt7vyo9YXKPA7X9GLGHiWBkisxhtXhyg27aHwYF8E9+C98qczbbBenG
-CqFcfAlYNaje8a1yOan/zFUWShOqDVS8gQIDAQABo4ICGTCCAhUwDgYDVR0PAQH/
-BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
-AjAAMB0GA1UdDgQWBBSYER0/itBzQ4e89Jz45eNBs2IHtDAfBgNVHSMEGDAWgBTF
-z0ak6vTDwHpslcQtsF6SLybjuTBXBggrBgEFBQcBAQRLMEkwIgYIKwYBBQUHMAGG
-Fmh0dHA6Ly9yMTEuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTEu
-aS5sZW5jci5vcmcvMCEGA1UdEQQaMBiCFiouZGV2ZWxvcC5zcHJpbnRodWIucnUw
-EwYDVR0gBAwwCjAIBgZngQwBAgEwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgAZ
-mBBxCfDWUi4wgNKeP2S7g24ozPkPUo7u385KPxa0ygAAAZFmqM41AAAEAwBHMEUC
-ICafD/B6cYgX6M7zYU0SaMx8mfJZiqvuGWGU15Xk+1ntAiEA86dLxeYXXRVDXU56
-4+fgStSswCsjvaHvzX2nND1f95EAdQB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIK
-n+ZnTFo6dAAAAZFmqM59AAAEAwBGMEQCIB/YExYTmuWxHl2kxLy+NO3txOaobvIZ
-pxkV69p4Yrg6AiB0PGckYcU3+eqiTyPKV21T/tXu2Sl6FTGn14991RqCxjANBgkq
-hkiG9w0BAQsFAAOCAQEAVdTUq5zdSfk7060jhQ5KeIzOjsX/A59psnT3YD+5SSJ+
-K4NFSG2MYGt32W+CcEglCF9PiPAq0++61TL9KTAlREwmReRRvhhwd6tHd/2hL9FN
-bIy34fXtd173FiFs2cmq70bChyNlnZHdgMEccfuqoamuwFnySqFFeUIPC36eD0XD
-+5FBgleiaEM2OL8ZelGj7wil4I8a5XT7U/Kzl3HXy94mHXHqf4d0tiJnAsrLhfvy
-Yl+5gXOMXvL5qZdQC0FR9mVQQF9oClRxsdDp681cJIM63b2KazEN1NhJP/rfn1ZO
-v9QdRNWZEIEp8dvYDoNNxwy5ibUcvdGOV1Mm0NVORQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
-WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
-DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
-AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
-6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
-SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
-Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
-hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
-/wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
-ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
-hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
-A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
-AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
-v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
-01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
-e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
-UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
-aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
-WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
-PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
-pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
-6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
-uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
------END CERTIFICATE-----

nginx/nginx-dev/prepare.py

@@ -0,0 +1,85 @@
+import os
+import sys
+from minio import Minio
+from urllib.request import urlopen
+from json import loads
+
+
+minio_client = Minio(
+    "minio.develop.sprinthub.ru:9000",
+    access_key="serviceminioadmin",
+    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
+    secure=False,
+)
+
+
+def get(url):
+    with urlopen(url) as response:
+        data = response.read().decode("utf-8")
+        return loads(data)
+
+
+try:
+    response = get(
+        "http://configurator/api/v1/fetch?project=certupdater&stage=development"
+    )
+    hosts = response["configs"]["hosts"]
+except Exception as e:
+    print(f"Error fetching config: {e}", file=sys.stderr)
+    sys.exit(1)
+
+config = ""
+for host, params in hosts.items():
+    config += """
+        server {{
+            listen      443 ssl http2;
+            listen      [::]:443 ssl http2;
+            server_name {host};
+
+            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
+            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
+
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Referrer-Policy "no-refferer-when-downgrade" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            location / {{
+                resolver 127.0.0.11;
+                proxy_pass http://{target_host}:{port}$request_uri;
+            }}
+        }}\n\n
+    """.format(
+        host=host, target_host=params["host"], port=params["port"]
+    )
+    try:
+        fullchain = minio_client.get_object(
+            "certupdater", f"certificates/{host}/fullchain.pem"
+        )
+        privkey = minio_client.get_object(
+            "certupdater", f"certificates/{host}/privkey.pem"
+        )
+        try:
+            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
+        except OSError as e:
+            print(f"Error creating directory: {e}", file=sys.stderr)
+            continue
+
+        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
+            fp.write(fullchain.data)
+        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
+            fp.write(privkey.data)
+    except Exception as e:
+        print(f"Error processing host {host}: {e}", file=sys.stderr)
+        continue
+
+try:
+    with open("/etc/nginx/hosts.conf", "w") as fp:
+        fp.write(config)
+except Exception as e:
+    print(f"Error writing config file: {e}", file=sys.stderr)
+    sys.exit(1)

nginx/nginx-dev/privkey.pem

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC7l0TQliwuqpiu
-q6VCQN4Cm4A+nlyRMVuDvZSFKt+jZJts/RLb/8/vmG+fhpQCw89axSTw8NhCfy05
-3T/VOssyaHzGEnFNRRw7d+A/SZuCJixB6n/PktQGDMYLlHbNCGXg75J1iUILnrPP
-UYc0r4haFeBovPR2dopcQimxWe7av1McQUChdHGPYnrhbB0NILrdCqzaO68yxT3O
-LNik6dCvrDEhg0h76OdQmgZ6DziBjPtEzOYRhCH1S3fpqkAEW3u/Kj1hco8Dtf0Y
-sYeJYGSKzGG1eHKDbtofBgXwT34L3ypzNtsF6cYKoVx8CVg1qN7xrXI5qf/MVRZK
-E6oNVLyBAgMBAAECggEBAKEV26TWX+hO3D+Z65ZCB6Lrjyu2ZzzSyogNQr07vMEd
-Qo5Ln2dFe3R+TNQLB4x8QtHqWrd/yeUIOnjm8cqT6ytFKGgaLCszPnQek3UlKyGO
-0BBmYwyHRARR8bq96WpVXM7USssda5Z42GUd2GG4nfjlskeegro7PsLMmerOlFpH
-2aYY/KTb6M45qSwZboFvg+s6bGFXjYafZ+Mktj+iJBLuNvxI0Hj6R5aX8XB3Ef68
-BiZA12z/jnzERm9zRiLmnGK0xdSRXVyNbeDcP4f8qlqk5N5ga0yxnJpEyTYzfGXy
-820TwpFh8G2AKdanbhAGKtI2vGPpO146dUaJdhYGxGUCgYEA66h58ttJKrAR0AP5
-+pU0yLo5myOBuRoBDn1k5+ppExqPi1bOQSebnkRRLpWuY1NfanFr3nbDjMi2FI8P
-VYTf5AECQQvvwXrbsRl0mFBlL4Q8r4yxTLTUBOvEQX63SyYvUwbsmYQSFuIOvr5L
-BV31UMR5CEuBGCCYUm6kZV6HeJsCgYEAy8ic9qwDxoYSdq5J9dbqtPjn5cIwpLhd
-o/0OJrkEptU8oIDyey/X5vlDV/FLfdsChjiMFjY661tOgXuTvDGTDzI51U6meKk7
-ogLpuURFVJIvWhPBilL+HvPY/oiZjmRyGgvlvpDPjAsWo155WqMrWPh4lfhXjY3z
-p5lofNB6axMCgYEAyjTT/ujeTTyq7BydYMCqfBoe19mNs/B2O6Ko9L6UzomZ5evk
-Ks/7nb/tENXqvtuJIeKUtlydyq1mXxmqBK1xF0kuT/YYEaKD4+B9xTwmtrD3CYLl
-l3YJ/vb2fWRnjpoDPXDRj6BdjTkHge/ym3ZVyqnrWIzBBpzhVsoNUdXc1EUCgYEA
-wniKQmTZnYSo7hVZg4A7r8SxGPP+k9NVmX+PF6kNJWDtYIZt4N1Bfqx1deFRl6N/
-fzNLjI7oH16dRrf1vmzY2HGn+0X5W8C0peF9xk2+k/yFr8KWujiFRmiStiUJ1XdJ
-5E1iTD/JsO2MBw/LY5G/dkJ4YTYD55SF53Vg32vcx30CgYEAog3coA0caJ8uAA5K
-UzcQ/vlX5twEt/DRBnrBbGtV/x4y36hRucahIDyTLEyCA9G0TFgQKMEUdUVkoLvQ
-cgtLLq340NYN+jFdpFDwAVSBi2Z3NVyh2rX5Q2saYzpOxVaaEe06dOC8Bl6le1EC
-cLTZ2YqFcCrRLrzy/hhKO7HImt4=
------END PRIVATE KEY-----

nginx/nginx-dev/refre.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+if ! python3 prepare.py; then
+    echo "Error running prepare.py" >&2
+    exit 1
+fi
+
+if ! nginx -s reload; then
+    echo "Error reloading nginx" >&2
+    exit 1
+fi

nginx/nginx-dev/run.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+/docker-entrypoint.sh nginx -g 'daemon off;'

nginx/nginx-prod/Dockerfile

@@ -1,10 +1,13 @@
 FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
-RUN apt-get install python3-certbot-nginx --yes
+RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN mkdir /etc/allinvest
+RUN pip3 install --break-system-packages minio
-COPY ./nginx-prod.conf /etc/nginx/nginx.conf
+COPY ./config /etc/nginx
-COPY ./privkey.pem /etc/nginx/privkey.pem
+COPY prepare.py prepare.py
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY run.sh run.sh
-COPY ./allinvest/privkey.pem /etc/allinvest/privkey.pem
+COPY refre.sh refre.sh
-COPY ./allinvest/fullchain.pem /etc/allinvest/fullchain.pem
+ENV PYTHONUNBUFFERED=1
+RUN chmod 777 run.sh
+RUN chmod 777 refre.sh
+ENTRYPOINT ["./run.sh"]

nginx/nginx-prod/allinvest/fullchain.pem

@@ -1,90 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE5TCCA82gAwIBAgISBLLA45sg/IhDBwA/vxe7YIKrMA0GCSqGSIb3DQEBCwUA
-MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
-EwJSMzAeFw0yNDAyMDMyMTI1NDdaFw0yNDA1MDMyMTI1NDZaMBcxFTATBgNVBAMT
-DHlvdXJnb2xzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANFC
-SqAyzSV1BHFSqKxH3GuLEVRgxUABAhveeLWOTJt3xrKTNhdgaP4fD8CZF5vmgFqx
-M/Zk4mizZ9FEQeKnrmlhAL643OaGRTVwN1FfBEfvr/fT3AQD0HQB55OSsUReSFUn
-yT9vR2cv+r/f6EU78Uw/svvTD7M0vY/uRfOc2qWv+I6dGsoS32iDQmsYlOK4HKWX
-mfBTuGSCJKcec1nviehXXrGFP4YJa3gs6RzWTtGXxGgI0lG9O366RszkKZKVJICh
-BH+YWV9KJ1hzgmRWlRJgs4t14MO2Dxw5Mu1G08WbaEQGvE7RgcBCNY8sV1K1Bx/P
-NUPRsSPT6rIsX3MhQ4sCAwEAAaOCAg4wggIKMA4GA1UdDwEB/wQEAwIFoDAdBgNV
-HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
-FgQUcY+9gyWVjqP8S2owFnPbtwbiZ1QwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA
-5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu
-by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w
-FwYDVR0RBBAwDoIMeW91cmdvbHMuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIB
-BAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUAO1N3dT4tuYBOizBbBv5AO2fYT8P0x70A
-DS1yb+H61BcAAAGNcRPt8gAABAMARjBEAiAMpD5lfh43xD1tAvsSa20OQ4LsQ8Kt
-YBvl5svUTuGrHAIgPveMh3yZ6z+QLW1k8Lv7z1kyXsxSvCUQrX16k7m1V8kAdwCi
-4r/WHt4vLweg1k5tN6fcZUOwxrUuotq3iviabfUX2AAAAY1xE+3xAAAEAwBIMEYC
-IQD+hmWzWe0y9M8xYKvuhySnHN6AWKQpvJgTqBsCFiiy5QIhANM0ce+SEC4BlY8m
-QAIGNXbAjlKU28q66EcTuSjji227MA0GCSqGSIb3DQEBCwUAA4IBAQAAfH8lbwUk
-JD6voPBGCTt7XSZPl9dq4LdmOLV3bsfjtqWOeGNCznBYKfRZO/UJ/srekCjapzKy
-DAmv0dl/tvBGfqhU/emOtKsq9AE0J7RqzF9SQPrVzq/VxWXGCCmtxUHEAlNk/lrg
-PqxpTUZdLpeBEbNvtloSaUEpe8mkFcFhw7TZVtdkpn+pHRlltqXry/8BekFPQR5Y
-qgI8akm2rXOV616MnF81DhIUVY4n6t4SVsDjSk69iDnKG97PJJK5yqsEfdZFiDRK
-PlhHTYwOsypaP/JMuanK8eGjnNR9pA40DEjAJO0kvE3IE7dHD3R1iGkXjr7wIkKw
-5NjP9yOv01mH
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
-WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
-R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
-sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
-NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
-Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
-/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
-AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
-Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
-FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
-AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
-Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
-gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
-PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
-ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
-CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
-lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
-avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
-yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
-yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
-hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
-HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
-MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
-nLRbwHOoq7hHwg==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
-MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
-DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
-ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
-wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
-LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
-4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
-bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
-sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
-Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
-FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
-SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
-PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
-TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
-SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
-c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
-+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
-ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
-b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
-U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
-MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
-5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
-9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
-WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
-he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
-Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
------END CERTIFICATE-----

nginx/nginx-prod/allinvest/privkey.pem

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDRQkqgMs0ldQRx
-UqisR9xrixFUYMVAAQIb3ni1jkybd8aykzYXYGj+Hw/AmReb5oBasTP2ZOJos2fR
-REHip65pYQC+uNzmhkU1cDdRXwRH76/309wEA9B0AeeTkrFEXkhVJ8k/b0dnL/q/
-3+hFO/FMP7L70w+zNL2P7kXznNqlr/iOnRrKEt9og0JrGJTiuByll5nwU7hkgiSn
-HnNZ74noV16xhT+GCWt4LOkc1k7Rl8RoCNJRvTt+ukbM5CmSlSSAoQR/mFlfSidY
-c4JkVpUSYLOLdeDDtg8cOTLtRtPFm2hEBrxO0YHAQjWPLFdStQcfzzVD0bEj0+qy
-LF9zIUOLAgMBAAECggEANWFhxAfxiRKWtYnOeVRDiDOLkii1aKRZM17HEBlitW4S
-g89FxyTS47BsxkbHXP+p0njNtpb5opfRbfKpk/YOaddS51QlFbE+ymj704gXgXpF
-O0USJPwMGuu5dU3AZp5eeUqS7dmnL01v+65UhATMgxTkxZSLtr1HdgXkVka3B/ir
-Q/iqR4ftt+qT0a9mzXQOxgdN7qnNwVNO1uJi87C6fQBRB6F724U5SJyOTMl9R6ZS
-+JZ9Oz5xxoGLA/Nftn078uMjf2ymWfOqicHYeXxfPYllXNuRsIf7NA00F0orwF15
-TWBZLB5GbkOIP7k7vzabZMCbGmf42XYtt1oFYIssIQKBgQD7aB8cUDVdE47VOX4p
-+Bf2ilMJA2d+KsCA3uYw5VQjjxBbfN+nChOx6e6eSmy2MMtH2ECG2IgW04FDbHtZ
-y2tbmRY3XIl+4dos+6ybbiYeYKRcHOQiXbjFK9ml1NpDcuLMHE3a6v0gFB8N0iB4
-J3u6h9+kHe3LGPzIVDGbITWi4wKBgQDVFQleHfRWM9/hebU8/tshY4sRJ9nA9haI
-F/NDMHhE+IyX9JHxGXtVE0ihOh0+0PLKLwtOepc4vqZaquKVnzZ82+sc+C4Iqg8K
-S+1NoRFOZG1AlM53UI51ZXLvXZp8gAdDBXzwBZpWZNdhJHJSnuwVI+UoDkrAQkmn
-/n4jzV01OQKBgQCH8pr4JYtlxIC1XryRl13l7JDQS+339MhaJ66UfD5OaDtxLYqH
-elSCHbzyDc7RinsyY4cpJAgbR84blprxSKXKR3MTBtA3M4xWTNXeyuaEAMCAKwNW
-bhXPUVIFcZ+BX6uysg+LtQyh/x93ysvSDY/Do1vVFHYVIHL5JUYZ3BBz/wKBgQDT
-oCYCnJtr9e9Xn6oZ30BBg/y9WCfTllVAaxEGXSBF19jCnntHyjgMga9zuSUMmzdX
-CKwhEG4aRHcxu2B4m3zhOwXiarZFkqiHYGtZ2ys2AVXkeyYnqBEklVI2W2+wUPNl
-ZBD2zYnAXjzu1OTaG857HIBebPtewTcoKwCajD8TOQKBgQDr07j3sx5nQsg4kHmR
-kBvHHjq7kQ1pEItrD/CfLsZ7Ntip4L82UzdZm/hhdM/12fB+wLu8HcZzvY5H1J+3
-IlkKYhAAe8lgzE7hYupVD9QtdFBuNsAnQfT+VV4JnZNDVZHXfnhz19KJ+iIvqton
-8WCEnmpiIKyt+Lq+Ol3n7PDMIw==
------END PRIVATE KEY-----

nginx/nginx-prod/config/nginx.conf

@@ -0,0 +1,24 @@
+events {}
+
+http {
+    client_max_body_size 50m;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
+    server {
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
+    include ./hosts.conf;
+}

nginx/nginx-prod/fullchain.pem

@@ -1,58 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIE7TCCA9WgAwIBAgISBDL/ZyXlpK88JpU+aNYTYbZcMA0GCSqGSIb3DQEBCwUA
-MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
-EwNSMTAwHhcNMjQwODE4MTczMDAxWhcNMjQxMTE2MTczMDAwWjAZMRcwFQYDVQQD
-DA4qLnNwcmludGh1Yi5ydTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AKwZZehw3dlvH5AvVfnaybqjB5K3YixMDkE3ygHvPL1d7c3QzmuIsPkpSQOt+fEY
-ERQEcXype1tmT6jmZs+WdP8ASXDW7V8pHrYBffZ5Hoxc6vydr/ArZJWblfm+bYaA
-68ZRj9sv1cGK0dk34v4QYa8EqQRezxFRT0lvfB2vyfZ/4xQ/ZPDzVjivUcWoWrC5
-+4WTg6e4ZtKQXiXBHS1z/FGhmTbudXXU9zi2Hyq+eEPwtU7hIZLtyAzc2TWJVHfw
-YJQMlSklpOMvKDSbgEW6LNsQcwYFJ/1MvX3C7TZX/uNuwssi5cMKmhecDf7g5pK4
-EqJnNFYZ9lZ0ofNFSj6qVu0CAwEAAaOCAhMwggIPMA4GA1UdDwEB/wQEAwIFoDAd
-BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
-HQ4EFgQU9g2CK2s4AK0F9lDh/iDOAgl9GJQwHwYDVR0jBBgwFoAUu7zDR6XkvKnG
-w6RyDBCNojXhyOgwVwYIKwYBBQUHAQEESzBJMCIGCCsGAQUFBzABhhZodHRwOi8v
-cjEwLm8ubGVuY3Iub3JnMCMGCCsGAQUFBzAChhdodHRwOi8vcjEwLmkubGVuY3Iu
-b3JnLzAZBgNVHREEEjAQgg4qLnNwcmludGh1Yi5ydTATBgNVHSAEDDAKMAgGBmeB
-DAECATCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AD8XS0/XIkdYlB1lHIS+DRLt
-kDd/H4Vq68G/KIXs+GRuAAABkWa/gHgAAAQDAEcwRQIhAOSEdIX9kjdYohZb942J
-dk5pUAYQl68bIBwIvHQF6Ru1AiAzNtoqdj11Uy4+lr0TbU8SE2tBgTGDxZRksCpC
-Kt83wQB3AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0AAABkWa/iHcA
-AAQDAEgwRgIhAPzli2g23TY0uFoU6LMrlqe3CPBWC8BWq/rnfOm/cOaJAiEAoefO
-g0i2LU8pUqkurW34EfXEQQUqSjy3ze8c9FKPUnYwDQYJKoZIhvcNAQELBQADggEB
-AMUvd2yvRsrp4iZk9rTd87Zjv0nWkAunwirx1jNhzRvP/vKGh1Zn1GPohr7TQQZ5
-EkJK+4w1+uq5ZrDrI3t+SKx15sv4iAJu7EAh6z0/oGkb27LlduXVSQ4hs5o/E4cL
-wdRONWKrKIchcM9vblicKOxFxCKUOXPMxH8YSDkkWK8KhCvE1sSzm0DzeRQVOwuK
-aWMJXoEF0pY6lOVGiGIxtozY3Q5IooBDX+bwDEq/SkwY38yig2NszpTwJKmVIV+E
-DjBoRHWoYYtEL1y2rh/OonQBGxSCUYSIrG3+BdqWwLL9LmgZk+A2X5Qa09aZQvnc
-hsfvAxxU+C7lArtjpA/pWYk=
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP
-MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
-Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa
-Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF
-bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL
-YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a
-/6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4
-FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR
-mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3
-DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG
-MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/
-AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5
-tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG
-Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD
-VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B
-AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo
-zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd
-u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9
-1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0
-GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh
-1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ
-QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N
-4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz
-rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei
-RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx
-KPpdzvvtTnOPlC7SQZSYmdunr3Bf9b77AiC/ZidstK36dRILKz7OA54=
------END CERTIFICATE-----

nginx/nginx-prod/nginx-prod.conf

@@ -1,217 +0,0 @@
-events {}
-
-http {
-    client_max_body_size 150m;
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        '' close;
-    }
-
-    server {
-        listen 80;
-        server_name gitlab.sprinthub.ru;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:1234/;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name gitlab.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:1234/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name rabbitmq.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name gitea.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:3000/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name ~^(?<domain>.*)\.sprinthub\.ru$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header        X-Real-IP       $remote_addr;
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }
-
-    server {
-        listen 80;
-        server_name yourgols.com;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name yourgols.com;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        ssl_certificate     /etc/allinvest/fullchain.pem;
-        ssl_certificate_key /etc/allinvest/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header        X-Real-IP       $remote_addr;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        location / {
-            proxy_pass http://yourgols-nginx:1238$request_uri;
-        }
-    }
-
-}

nginx/nginx-prod/prepare.py

@@ -0,0 +1,85 @@
+import os
+import sys
+from minio import Minio
+from urllib.request import urlopen
+from json import loads
+
+
+minio_client = Minio(
+    "minio.sprinthub.ru:9000",
+    access_key="serviceminioadmin",
+    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
+    secure=False,
+)
+
+
+def get(url):
+    with urlopen(url) as response:
+        data = response.read().decode("utf-8")
+        return loads(data)
+
+
+try:
+    response = get(
+        "http://configurator/api/v1/fetch?project=certupdater&stage=production"
+    )
+    hosts = response["configs"]["hosts"]
+except Exception as e:
+    print(f"Error fetching config: {e}", file=sys.stderr)
+    sys.exit(1)
+
+config = ""
+for host, params in hosts.items():
+    config += """
+        server {{
+            listen      443 ssl http2;
+            listen      [::]:443 ssl http2;
+            server_name {host};
+
+            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
+            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
+
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Referrer-Policy "no-refferer-when-downgrade" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            location / {{
+                resolver 127.0.0.11;
+                proxy_pass http://{target_host}:{port}$request_uri;
+            }}
+        }}\n\n
+    """.format(
+        host=host, target_host=params["host"], port=params["port"]
+    )
+    try:
+        fullchain = minio_client.get_object(
+            "certupdater", f"certificates/{host}/fullchain.pem"
+        )
+        privkey = minio_client.get_object(
+            "certupdater", f"certificates/{host}/privkey.pem"
+        )
+        try:
+            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
+        except OSError as e:
+            print(f"Error creating directory: {e}", file=sys.stderr)
+            continue
+
+        with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
+            fp.write(fullchain.data)
+        with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
+            fp.write(privkey.data)
+    except Exception as e:
+        print(f"Error processing host {host}: {e}", file=sys.stderr)
+        continue
+
+try:
+    with open("/etc/nginx/hosts.conf", "w") as fp:
+        fp.write(config)
+except Exception as e:
+    print(f"Error writing config file: {e}", file=sys.stderr)
+    sys.exit(1)

nginx/nginx-prod/privkey.pem

@@ -1,28 +0,0 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCsGWXocN3Zbx+Q
-L1X52sm6oweSt2IsTA5BN8oB7zy9Xe3N0M5riLD5KUkDrfnxGBEUBHF8qXtbZk+o
-5mbPlnT/AElw1u1fKR62AX32eR6MXOr8na/wK2SVm5X5vm2GgOvGUY/bL9XBitHZ
-N+L+EGGvBKkEXs8RUU9Jb3wdr8n2f+MUP2Tw81Y4r1HFqFqwufuFk4OnuGbSkF4l
-wR0tc/xRoZk27nV11Pc4th8qvnhD8LVO4SGS7cgM3Nk1iVR38GCUDJUpJaTjLyg0
-m4BFuizbEHMGBSf9TL19wu02V/7jbsLLIuXDCpoXnA3+4OaSuBKiZzRWGfZWdKHz
-RUo+qlbtAgMBAAECggEAUfpfMtPguZxXWqVRvQzdHwxdpSO5ngQ0nhhnH3jIZCQE
-DRAz48FfG7Dw2NHcx12BdRmQvaM14ZngxEHMI4I2BOosEZYvyC6cNHKNgAS96nqw
-bNjoX+0roqBUVnzBS1rJ9NQRRIWKuwDXaTNX61H+VhJQOIa4+DTVIdP7OWDtQX9t
-DyQM/vvGM0gHmUKvd15n8iU5obxMZm+2ntUYe38dSCKANuVgmT/+/mJHt7SWYXuD
-PAQX5IWVK2sMT+snPTW7ERXwOwHn4Sl57Juqz4lOGKYAsveFqi0F1UNyQ61ggjXU
-I17bSHONBxK1MPYKQyjiVGvMylpyTd0RWAUSUs3yQQKBgQDkKuKG+4ndxkxIpe/6
-ENkP2cvlhkO2BdQKfYsw20pxIZqOVwlatZ0OlFMkFJFWhIRP+aYi0+69THOpV1Dk
-E33+438fxBJLAZXUY5PJs47JBLq/bUCWgblshe3QAW3gZLbDb3+i0CI7YA7b6Vo4
-Rf0mkyjo10VmpjK9x7hvbtMfCQKBgQDBF6L+5jwlOHUV8FHRO2AlrRUMNHcEt3JN
-JDgoxPidHq1gYHsDC+tp2C+x1z5zSruOfIQPt0JnED+H+0l8gnPKMFbdrgJBExGq
-4z0FQIqysVE+8kPh6ikOMrec6RSHsW1e+y0v1Mn7zHb4a+6JfIukjsqPm07wSWFe
-9DXlGKANxQKBgQCok/rcalq5Tbqs7lU4+Fu3t15LjgDXKsU4nvtJNKxym7ZatnnF
-2GtbC0HGZZ/gQXaUtEoIb3dzy1mlY0rzyGcN/L2/FZnCa0BtNMlLfGvhn6nup2TS
-DrSWNvm29mddJGxYRzgRbh/sqJMx7d5nt2ZLquzN48d2CRNyXm6pfkNkKQKBgAur
-mw1e6vmw7NqzmK5VsVz1lhUTwrHFSKJC8yX7qa8NYJs3mZe4i7Ts/Qz5nmunc6iL
-/AtbHydNgxl75Zgh5k+tFkL1tmsqdOHoNBLyMK/WKbvtNo8b8PlLtW9FYxlEbwDT
-m4qNiNuwIuym0Vb78RC0FKgTUfUR6lGr3uoGz/2lAoGBANQrHCOr+2eOZawiWlQ3
-jPJQVRwzpPHPGnElcGJBMcA03UQCO/HXSJl/V5OGZjVH4zZ3iRInYvq4NR+KeQC8
-VXU4AWS9QIyx7UAGO8eDzENz6JG4Q1txkPsGIipvROdCCWFqaudyxRuWnKsXEwYn
-RGyseajshyNkpwLoMk2gx67+
------END PRIVATE KEY-----

nginx/nginx-prod/refre.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+nginx -s reload

nginx/nginx-prod/run.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+/docker-entrypoint.sh nginx -g 'daemon off;'

prepare/run-development.sh

@@ -0,0 +1,11 @@
+docker login -u mathwave -p $DOCKERHUB_PASSWORD
+mkdir /sprint-data/mongo || true
+mkdir /sprint-data/redis || true
+mkdir /sprint-data/rabbitmq || true
+mkdir /sprint-data/certs || true
+mkdir /sprint-data/gitea || true
+mkdir /sprint-data/clickhouse || true
+chmod 777 /sprint-data/redis
+chmod 777 /sprint-data/rabbitmq
+chmod 777 /sprint-data/gitea
+chmod 777 /sprint-data/clickhouse

prepare/run-production.sh

@@ -0,0 +1,29 @@
+docker login -u mathwave -p $DOCKERHUB_PASSWORD
+docker network create -d overlay --attachable swarmpit-nginx || true
+docker network create -d overlay --attachable common-infra-nginx || true
+docker network create -d overlay --attachable common-infra-nginx-development || true
+docker network create -d overlay --attachable queues || true
+docker network create -d overlay --attachable queues-development || true
+docker network create -d overlay --attachable configurator || true
+docker network create -d overlay --attachable monitoring || true
+docker network create -d overlay --attachable configurator-development || true
+docker network create -d overlay --attachable clickhouse || true
+docker network create -d overlay --attachable clickhouse-development || true
+mkdir /sprint-data/mongo || true
+mkdir /sprint-data/redis || true
+mkdir /sprint-data/rabbitmq || true
+mkdir /sprint-data/certs || true
+mkdir /sprint-data/gitea || true
+mkdir /sprint-data/clickhouse || true
+mkdir /sprint-data/grafana || true
+mkdir /sprint-data/authelia || true
+mkdir /sprint-data/authelia/config || true
+mkdir /sprint-data/authelia/data || true
+chmod 777 /sprint-data/authelia
+chmod 777 /sprint-data/authelia/config
+chmod 777 /sprint-data/authelia/data
+chmod 777 /sprint-data/redis
+chmod 777 /sprint-data/rabbitmq
+chmod 777 /sprint-data/gitea
+chmod 777 /sprint-data/clickhouse
+chmod 777 /sprint-data/grafana