self/infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: self:master
Branches Tags
self:master
self:prod
self:dev
self:gitea-migration
..
compare: self:gitea-migration
Branches Tags
self:prod
self:master
self:dev
self:gitea-migration

No commits in common. "master" and "gitea-migration" have entirely different histories.
master ... gitea-migr

35 changed files with 1042 additions and 658 deletions
Show Stats Expand all files Collapse all files

84
.deploy-infra/deploy-dev.yaml
View File

@ -5,46 +5,20 @@ services:
nginx:
image: mathwave/sprint-repo:sprint-infra-nginx-dev
networks:
- common-infra-nginx-development
- configurator
environment:
MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
- common-infra-nginx
ports:
- published: 80
target: 80
mode: host
- published: 443
target: 443
mode: host
- "80:80"
- "443:443"
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
update_config:
parallelism: 1
# order: stop-first
clickhouse:
image: clickhouse
networks:
- clickhouse-development
- common-infra-nginx-development
volumes:
- /sprint-data/clickhouse:/var/lib/clickhouse
environment:
CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_DEV
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
postgres:
image: postgres:14-alpine3.19
@ -59,15 +33,13 @@ services:
start_period: 20s
timeout: 10s
ports:
- published: 5432
target: 5432
mode: host
- "5432:5432"
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -80,15 +52,13 @@ services:
MONGO_INITDB_ROOT_USERNAME: mongo
MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_DEV
ports:
- published: 27017
target: 27017
mode: host
- "27017:27017"
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -98,12 +68,8 @@ services:
volumes:
- /sprint-data/rabbitmq:/var/lib/rabbitmq
ports:
- published: 5672
target: 5672
mode: host
- published: 15672
target: 15672
mode: host
- "5672:5672"
- "15672:15672"
environment:
RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
deploy:
@ -111,7 +77,7 @@ services:
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -121,16 +87,14 @@ services:
volumes:
- /sprint-data/redis:/data
ports:
- published: 6379
target: 6379
mode: host
- "6379:6379"
command: redis-server --requirepass $REDIS_PASSWORD_DEV
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -143,16 +107,12 @@ services:
MINIO_ROOT_USER: minioadmin
MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_DEV
ports:
- published: 9000
target: 9000
mode: host
- published: 9001
target: 9001
mode: host
- "9000:9000"
- "9001:9001"
deploy:
mode: replicated
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
restart_policy:
condition: any
update_config:
@ -172,7 +132,7 @@ services:
deploy:
mode: replicated
placement:
constraints: [node.labels.stage == development]
constraints: [node.role == manager]
restart_policy:
condition: any
update_config:
@ -184,9 +144,7 @@ volumes:
driver: local
networks:
common-infra-nginx-development:
external: true
configurator:
external: true
clickhouse-development:
net:
driver: overlay
common-infra-nginx:
external: true

169
.deploy-infra/deploy-prod.yaml Executable file → Normal file
View File

@ -6,125 +6,19 @@ services:
image: mathwave/sprint-repo:sprint-infra-nginx-prod
networks:
- common-infra-nginx
- configurator
environment:
MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
ports:
- published: 80
target: 80
mode: host
- published: 443
target: 443
mode: host
- "80:80"
- "443:443"
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
update_config:
parallelism: 1
# order: start-first
zitadel:
image: ghcr.io/zitadel/zitadel:latest
networks:
- common-infra-nginx
command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled'
environment:
ZITADEL_DATABASE_POSTGRES_HOST: pg.sprinthub.ru
ZITADEL_DATABASE_POSTGRES_PORT: 5432
ZITADEL_DATABASE_POSTGRES_DATABASE: zitadel
ZITADEL_DATABASE_POSTGRES_USER_USERNAME: postgres
ZITADEL_DATABASE_POSTGRES_USER_PASSWORD: $DB_PASSWORD_PROD
ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE: disable
ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME: postgres
ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD: $DB_PASSWORD_PROD
ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE: disable
ZITADEL_EXTERNALSECURE: "false"
ZITADEL_EXTERNALDOMAIN: zitadel.chocomarsh.com
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
update_config:
parallelism: 1
# authelia:
# image: mathwave/sprint-repo:authelia
# networks:
# - common-infra-nginx
# environment:
# AUTHELIA_JWT_SECRET: $AUTHTHELIA_JWT_SECRET
# AUTHELIA_SESSION_SECRET: $AUTHTHELIA_SESSION_SECRET
# AUTHELIA_STORAGE_ENCRYPTION_KEY: $AUTHELIA_STORAGE_ENCRYPTION_KEY
# AUTHELIA_STORAGE_POSTGRES_PORT: "5432"
# AUTHELIA_STORAGE_POSTGRES_DATABASE: "authelia"
# AUTHELIA_STORAGE_POSTGRES_USERNAME: "postgres"
# AUTHELIA_STORAGE_POSTGRES_PASSWORD: $DB_PASSWORD_PROD
# AUTHELIA_ACCESS_CONTROL_DEFAULT_POLICY: "one_factor"
# AUTHELIA_NOTIFIER_SMTP_ENABLED: "false"
# volumes:
# - /sprint-data/authelia/data:/var/lib/authelia
# deploy:
# mode: replicated
# replicas: 1
# restart_policy:
# condition: any
# placement:
# constraints: [node.labels.stage == production]
# update_config:
# parallelism: 1
grafana:
image: grafana/grafana
networks:
- common-infra-nginx
- clickhouse
volumes:
- /sprint-data/grafana:/var/lib/grafana
environment:
GF_SERVER_ROOT_URL: https://grafana.chocomarsh.com
GF_CORS_ENABLED: "false"
GF_AUTH_DISABLE_LOGIN_FORM: "false"
GF_CORS_ALLOW_ORIGINS: "*"
GF_SECURITY_CONTENT_SECURITY_POLICY: "false"
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
update_config:
parallelism: 1
clickhouse:
image: clickhouse
networks:
- clickhouse
volumes:
- /sprint-data/clickhouse:/var/lib/clickhouse
environment:
CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_PROD
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
update_config:
parallelism: 1
resources:
limits:
memory: 2048M
cpus: '2.0'
reservations:
memory: 1024M
cpus: '1.0'
order: start-first
postgres:
image: postgres:14-alpine3.19
@ -139,15 +33,13 @@ services:
start_period: 20s
timeout: 10s
ports:
- published: 5432
target: 5432
mode: host
- "5432:5432"
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -165,15 +57,32 @@ services:
MONGO_INITDB_ROOT_USERNAME: mongo
MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_PROD
ports:
- published: 27017
target: 27017
mode: host
- "27017:27017"
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
rabbitmq:
image: rabbitmq:3.10.7-management
volumes:
- /sprint-data/rabbitmq:/var/lib/rabbitmq
ports:
- "5672:5672"
- "15672:15672"
environment:
RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -183,16 +92,14 @@ services:
volumes:
- /sprint-data/redis:/data
ports:
- published: 6379
target: 6379
mode: host
- "6379:6379"
command: redis-server --requirepass $REDIS_PASSWORD_PROD
deploy:
mode: replicated
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
update_config:
parallelism: 1
order: start-first
@ -205,16 +112,12 @@ services:
MINIO_ROOT_USER: minioadmin
MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_PROD
ports:
- published: 9000
target: 9000
mode: host
- published: 9001
target: 9001
mode: host
- "9000:9000"
- "9001:9001"
deploy:
mode: replicated
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
restart_policy:
condition: any
update_config:
@ -241,7 +144,7 @@ services:
deploy:
mode: replicated
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
restart_policy:
condition: any
update_config:
@ -261,7 +164,7 @@ services:
deploy:
mode: replicated
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
restart_policy:
condition: any
update_config:
@ -279,7 +182,3 @@ networks:
driver: overlay
common-infra-nginx:
external: true
configurator:
external: true
clickhouse:
external: true

34
.deploy-nginx/deploy-dev.yaml
View File

@ -1,34 +0,0 @@
version: "3.6"
services:
nginx:
image: mathwave/sprint-repo:sprint-infra-nginx-dev
networks:
- common-infra-nginx-development
- configurator
environment:
MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
ports:
- published: 80
target: 80
mode: host
- published: 443
target: 443
mode: host
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == development]
update_config:
parallelism: 1
# order: stop-first
networks:
common-infra-nginx-development:
external: true
configurator:
external: true

34
.deploy-nginx/deploy-prod.yaml
View File

@ -1,34 +0,0 @@
version: "3.6"
services:
nginx:
image: mathwave/sprint-repo:sprint-infra-nginx-prod
networks:
- common-infra-nginx
- configurator
environment:
MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
ports:
- published: 80
target: 80
mode: host
- published: 443
target: 443
mode: host
deploy:
mode: replicated
replicas: 1
restart_policy:
condition: any
placement:
constraints: [node.labels.stage == production]
update_config:
parallelism: 1
# order: start-first
networks:
common-infra-nginx:
external: true
configurator:
external: true

39
.deploy-portainer/deploy-dev.yaml Normal file
View File

@ -0,0 +1,39 @@
version: '3.2'
services:
agent:
image: portainer/agent:2.11.1
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /var/lib/docker/volumes:/var/lib/docker/volumes
networks:
- agent_network
deploy:
mode: global
placement:
constraints: [node.platform.os == linux]
portainer:
image: portainer/portainer-ce:2.11.1
command: -H tcp://tasks.agent:9001 --tlsskipverify
ports:
- "9443:9443"
- "8888:9000"
- "8000:8000"
volumes:
- portainer_data:/data
networks:
- agent_network
deploy:
mode: replicated
replicas: 1
placement:
constraints: [node.role == manager]
networks:
agent_network:
driver: overlay
attachable: true
volumes:
portainer_data:

2
.deploy-portainer/deploy-prod.yaml
View File

@ -28,7 +28,7 @@ services:
mode: replicated
replicas: 1
placement:
constraints: [node.labels.stage == production]
constraints: [node.role == manager]
networks:
agent_network:

83
.deploy-swarmpit/deploy-dev.yaml Normal file
View File

@ -0,0 +1,83 @@
version: '3.3'
services:
app:
image: swarmpit/swarmpit:latest
environment:
- SWARMPIT_DB=http://db:5984
- SWARMPIT_INFLUXDB=http://influxdb:8086
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080"]
interval: 60s
timeout: 10s
retries: 3
networks:
- net
ports:
- "888:8080"
deploy:
resources:
limits:
memory: 1024M
reservations:
memory: 512M
placement:
constraints:
- node.role == manager
db:
image: treehouses/couchdb:2.3.1
volumes:
- db-data:/opt/couchdb/data
networks:
- net
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 128M
influxdb:
image: influxdb:1.7
volumes:
- influx-data:/var/lib/influxdb
networks:
- net
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 128M
agent:
image: swarmpit/agent:latest
environment:
- DOCKER_API_VERSION=1.35
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- net
deploy:
mode: global
labels:
swarmpit.agent: 'true'
resources:
limits:
memory: 64M
reservations:
memory: 32M
networks:
net:
driver: overlay
swarmpit-nginx:
external: true
volumes:
db-data:
driver: local
influx-data:
driver: local

16
.deploy-swarmpit/deploy-prod.yaml
View File

@ -24,10 +24,12 @@ services:
reservations:
memory: 512M
placement:
constraints: [node.labels.stage == production]
constraints:
- node.role == manager
db:
image: treehouses/couchdb:2.3.1
volumes:
- db-data:/opt/couchdb/data
networks:
- net
deploy:
@ -39,6 +41,8 @@ services:
influxdb:
image: influxdb:1.7
volumes:
- influx-data:/var/lib/influxdb
networks:
- net
deploy:
@ -69,3 +73,11 @@ services:
networks:
net:
driver: overlay
swarmpit-nginx:
external: true
volumes:
db-data:
driver: local
influx-data:
driver: local

29
.gitea/workflows/deploy-dev.yaml
View File

@ -9,7 +9,7 @@ on:
jobs:
build:
name: Build
runs-on: [ prod ]
runs-on: [ dev ]
steps:
- name: login
run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
@ -23,15 +23,15 @@ jobs:
run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
push:
name: Push
runs-on: [ prod ]
runs-on: [ dev ]
needs: build
steps:
- name: push nginx dev
run: docker push mathwave/sprint-repo:sprint-infra-nginx-dev
- name: push gitea runner
run: docker push mathwave/sprint-repo:gitea-runner
prepare:
name: prepare
deploy-dev:
name: Deploy dev
runs-on: [dev]
needs: push
steps:
@ -41,27 +41,16 @@ jobs:
uses: actions/checkout@v4
with:
ref: dev
- name: prepare
run: chmod 777 ./prepare/run-development.sh && ./prepare/run-development.sh
deploy-dev:
name: Deploy dev
runs-on: [prod]
needs: prepare
steps:
- name: login
run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
- name: checkout
uses: actions/checkout@v4
with:
ref: dev
- name: deploy swarmpit
run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-dev.yaml swarmpit
- name: deploy portainer
run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-dev.yaml portainer
- name: deploy infra
env:
MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
DB_PASSWORD_DEV: ${{ secrets.POSTGRES_PASSWORD_DEV }}
CLICKHOUSE_PASSWORD_DEV: ${{ secrets.CLICKHOUSE_PASSWORD_DEV }}
MINIO_PASSWORD_DEV: ${{ secrets.MINIO_PASSWORD_DEV }}
MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
REDIS_PASSWORD_DEV: ${{ secrets.REDIS_PASSWORD_DEV }}
RABBITMQ_PASSWORD_DEV: ${{ secrets.RABBITMQ_PASSWORD_DEV }}
REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra-development
run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra

28
.gitea/workflows/deploy-prod.yaml
View File

@ -9,44 +9,27 @@ on:
jobs:
build:
name: Build
runs-on: [ prod ]
runs-on: [ dev ]
steps:
- name: login
run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
- name: checkout
uses: actions/checkout@v4
with:
ref: prod
ref: dev
- name: build nginx prod
run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-prod nginx/nginx-prod
- name: build gitea runner
run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
- name: build authelia
run: docker build -t mathwave/sprint-repo:authelia authelia
push:
name: Push
runs-on: [ prod ]
runs-on: [ dev ]
needs: build
steps:
- name: push nginx prod
run: docker push mathwave/sprint-repo:sprint-infra-nginx-prod
- name: push gitea runner
run: docker push mathwave/sprint-repo:gitea-runner
- name: push authelia
run: docker push mathwave/sprint-repo:authelia
prepare:
name: prepare
runs-on: [prod]
needs: push
steps:
- name: login
run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
- name: checkout
uses: actions/checkout@v4
with:
ref: prod
- name: prepare
run: chmod 777 ./prepare/run-production.sh && ./prepare/run-production.sh
deploy-prod:
name: Deploy prod
runs-on: [prod]
@ -66,13 +49,8 @@ jobs:
env:
MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
DB_PASSWORD_PROD: ${{ secrets.POSTGRES_PASSWORD_PROD }}
CLICKHOUSE_PASSWORD_PROD: ${{ secrets.CLICKHOUSE_PASSWORD_PROD }}
MINIO_PASSWORD_PROD: ${{ secrets.MINIO_PASSWORD_PROD }}
MINIO_SECRET_KEY_PROD: ${{ secrets.MINIO_SECRET_KEY_PROD }}
REDIS_PASSWORD_PROD: ${{ secrets.REDIS_PASSWORD_PROD }}
RABBITMQ_PASSWORD_PROD: ${{ secrets.RABBITMQ_PASSWORD_PROD }}
REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
AUTHTHELIA_JWT_SECRET: ${{ secrets.AUTHTHELIA_JWT_SECRET }}
AUTHTHELIA_SESSION_SECRET: ${{ secrets.AUTHTHELIA_SESSION_SECRET }}
AUTHELIA_STORAGE_ENCRYPTION_KEY: ${{ secrets.AUTHELIA_STORAGE_ENCRYPTION_KEY }}
run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-prod.yaml infra

3
authelia/Dockerfile
View File

@ -1,3 +0,0 @@
FROM authelia/authelia
COPY configuration.yml /config/configuration.yml
COPY users.yml /config/users.yml

44
authelia/configuration.yml
View File

@ -1,44 +0,0 @@
theme: dark
jwt_secret: secret-jwt-will-be-overridden-by-env
server:
host: 0.0.0.0
port: 9091
log:
level: info
authentication_backend:
file:
path: /config/users.yml
access_control:
default_policy: one_factor
rules:
- domain: "*.chocomarsh.com"
policy: one_factor
session:
name: authelia_session
expiration: 1h
inactivity: 5m
remember_me_duration: 1w
cookies:
- domain: chocomarsh.com
authelia_url: https://auth.chocomarsh.com
default_redirection_url: https://login.chocomarsh.com
storage:
encryption_key: "a_very_long_secret_32_characters_minimum"
postgres:
host: pg.sprinthub.ru
port: 5432
database: authelia
schema: public
username: postgres
password: autheliapass # also override with env if preferred
notifier:
filesystem:
filename: /config/notification.txt

5
authelia/users.yml
View File

@ -1,5 +0,0 @@
users:
emmatveev:
password: "$argon2id$v=19$m=65536,t=1,p=4$CixMXaAilVof3yk1rtghwg$V/kcl1HNDWeybrV3SrVjjdI00D1lFtuvLldkwAklSOE"
displayname: "Egor Matveev"
email: emmtvv@gmail.com

14
gitlab-runner/Dockerfile Normal file
View File

@ -0,0 +1,14 @@
FROM gitlab/gitlab-runner
RUN apt-get update
RUN apt-get install --yes ca-certificates curl gnupg lsb-release
RUN mkdir -p /etc/apt/keyrings
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
RUN echo \
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
$(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
RUN apt-get update --yes
RUN apt-get install --yes docker-ce docker-ce-cli containerd.io docker-compose-plugin
RUN mkdir /etc/builds/
RUN chmod 777 /etc/builds

13
nginx/nginx-dev/Dockerfile
View File

@ -1,13 +1,4 @@
FROM nginx
RUN apt-get update
RUN apt-get install certbot --yes
RUN apt-get install python3-certbot-nginx python3-pip --yes
RUN pip3 install --break-system-packages minio
COPY ./config /etc/nginx
COPY prepare.py prepare.py
COPY run.sh run.sh
COPY refre.sh refre.sh
ENV PYTHONUNBUFFERED=1
RUN chmod 777 run.sh
RUN chmod 777 refre.sh
ENTRYPOINT ["./run.sh"]
COPY ./privkey.pem /etc/nginx/privkey.pem
COPY ./fullchain.pem /etc/nginx/fullchain.pem

162
nginx/nginx-dev/config/guavo.conf Normal file
View File

@ -0,0 +1,162 @@
# server {
# listen 80;
# server_name *.develop.guavo.tech;
# return 301 https://$host$request_uri;
# }
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name swarmpit.develop.guavo.tech;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.guavo.tech:888/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name portainer.develop.guavo.tech;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.guavo.tech:8888/;
}
location /api/websocket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass http://develop.guavo.tech:8888/api/websocket/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name rabbitmq.develop.guavo.tech;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.guavo.tech:15672/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name minio.develop.guavo.tech;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.guavo.tech:9001/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name grafana.develop.guavo.tech;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
proxy_set_header Host $http_host;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.guavo.tech:3000/;
}
location /api/live/ws {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass http://develop.guavo.tech:3000/api/live/ws;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
resolver 127.0.0.11 ipv6=off;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://$domain-nginx:1238$request_uri;
}
}
server {
listen 80;
server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
resolver 127.0.0.11 ipv6=off;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://$domain-nginx:1238$request_uri;
}
}

15
nginx/nginx-dev/config/nginx.conf
View File

@ -8,17 +8,6 @@ http {
'' close;
}
server {
listen 80;
server_name *.develop.sprinthub.ru;
return 301 https://$host$request_uri;
}
server {
listen 80;
server_name *.dev.chocomarsh.com;
return 301 https://$host$request_uri;
}
include ./hosts.conf;
include ./guavo.conf;
include ./sprinthub.conf;
}

143
nginx/nginx-dev/config/sprinthub.conf Normal file
View File

@ -0,0 +1,143 @@
server {
listen 80;
server_name *.develop.sprinthub.ru;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name swarmpit.develop.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.sprinthub.ru:888/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name portainer.develop.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.sprinthub.ru:8888/;
}
location /api/websocket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass http://develop.sprinthub.ru:8888/api/websocket/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name rabbitmq.develop.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.sprinthub.ru:15672/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name minio.develop.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.sprinthub.ru:9001/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name grafana.develop.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
proxy_set_header Host $http_host;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://develop.sprinthub.ru:3000/;
}
location /api/live/ws {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass http://develop.sprinthub.ru:3000/api/live/ws;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name ~^(?<domain>.*)\.develop\.sprinthub\.ru$;
resolver 127.0.0.11 ipv6=off;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://$domain-nginx:1238$request_uri;
}
}

58
nginx/nginx-dev/fullchain.pem Normal file
View File

@ -0,0 +1,58 @@
-----BEGIN CERTIFICATE-----
MIIE+zCCA+OgAwIBAgISA1gLQJEHOf44GcYLUSr2vDoDMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTEwHhcNMjQwODE4MTcwNTE0WhcNMjQxMTE2MTcwNTEzWjAhMR8wHQYDVQQD
DBYqLmRldmVsb3Auc3ByaW50aHViLnJ1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAu5dE0JYsLqqYrqulQkDeApuAPp5ckTFbg72UhSrfo2SbbP0S2//P
75hvn4aUAsPPWsUk8PDYQn8tOd0/1TrLMmh8xhJxTUUcO3fgP0mbgiYsQep/z5LU
BgzGC5R2zQhl4O+SdYlCC56zz1GHNK+IWhXgaLz0dnaKXEIpsVnu2r9THEFAoXRx
j2J64WwdDSC63Qqs2juvMsU9zizYpOnQr6wxIYNIe+jnUJoGeg84gYz7RMzmEYQh
9Ut36apABFt7vyo9YXKPA7X9GLGHiWBkisxhtXhyg27aHwYF8E9+C98qczbbBenG
CqFcfAlYNaje8a1yOan/zFUWShOqDVS8gQIDAQABo4ICGTCCAhUwDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
AjAAMB0GA1UdDgQWBBSYER0/itBzQ4e89Jz45eNBs2IHtDAfBgNVHSMEGDAWgBTF
z0ak6vTDwHpslcQtsF6SLybjuTBXBggrBgEFBQcBAQRLMEkwIgYIKwYBBQUHMAGG
Fmh0dHA6Ly9yMTEuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTEu
aS5sZW5jci5vcmcvMCEGA1UdEQQaMBiCFiouZGV2ZWxvcC5zcHJpbnRodWIucnUw
EwYDVR0gBAwwCjAIBgZngQwBAgEwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgAZ
mBBxCfDWUi4wgNKeP2S7g24ozPkPUo7u385KPxa0ygAAAZFmqM41AAAEAwBHMEUC
ICafD/B6cYgX6M7zYU0SaMx8mfJZiqvuGWGU15Xk+1ntAiEA86dLxeYXXRVDXU56
4+fgStSswCsjvaHvzX2nND1f95EAdQB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIK
n+ZnTFo6dAAAAZFmqM59AAAEAwBGMEQCIB/YExYTmuWxHl2kxLy+NO3txOaobvIZ
pxkV69p4Yrg6AiB0PGckYcU3+eqiTyPKV21T/tXu2Sl6FTGn14991RqCxjANBgkq
hkiG9w0BAQsFAAOCAQEAVdTUq5zdSfk7060jhQ5KeIzOjsX/A59psnT3YD+5SSJ+
K4NFSG2MYGt32W+CcEglCF9PiPAq0++61TL9KTAlREwmReRRvhhwd6tHd/2hL9FN
bIy34fXtd173FiFs2cmq70bChyNlnZHdgMEccfuqoamuwFnySqFFeUIPC36eD0XD
+5FBgleiaEM2OL8ZelGj7wil4I8a5XT7U/Kzl3HXy94mHXHqf4d0tiJnAsrLhfvy
Yl+5gXOMXvL5qZdQC0FR9mVQQF9oClRxsdDp681cJIM63b2KazEN1NhJP/rfn1ZO
v9QdRNWZEIEp8dvYDoNNxwy5ibUcvdGOV1Mm0NVORQ==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
/wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
-----END CERTIFICATE-----

85
nginx/nginx-dev/prepare.py
View File

@ -1,85 +0,0 @@
import os
import sys
from minio import Minio
from urllib.request import urlopen
from json import loads
minio_client = Minio(
"minio.develop.sprinthub.ru:9000",
access_key="serviceminioadmin",
secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
secure=False,
)
def get(url):
with urlopen(url) as response:
data = response.read().decode("utf-8")
return loads(data)
try:
response = get(
"http://configurator/api/v1/fetch?project=certupdater&stage=development"
)
hosts = response["configs"]["hosts"]
except Exception as e:
print(f"Error fetching config: {e}", file=sys.stderr)
sys.exit(1)
config = ""
for host, params in hosts.items():
config += """
server {{
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {host};
ssl_certificate /etc/nginx/{host}/fullchain.pem;
ssl_certificate_key /etc/nginx/{host}/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
location / {{
resolver 127.0.0.11;
proxy_pass http://{target_host}:{port}$request_uri;
}}
}}\n\n
""".format(
host=host, target_host=params["host"], port=params["port"]
)
try:
fullchain = minio_client.get_object(
"certupdater", f"certificates/{host}/fullchain.pem"
)
privkey = minio_client.get_object(
"certupdater", f"certificates/{host}/privkey.pem"
)
try:
os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
except OSError as e:
print(f"Error creating directory: {e}", file=sys.stderr)
continue
with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
fp.write(fullchain.data)
with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
fp.write(privkey.data)
except Exception as e:
print(f"Error processing host {host}: {e}", file=sys.stderr)
continue
try:
with open("/etc/nginx/hosts.conf", "w") as fp:
fp.write(config)
except Exception as e:
print(f"Error writing config file: {e}", file=sys.stderr)
sys.exit(1)

28
nginx/nginx-dev/privkey.pem Normal file
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC7l0TQliwuqpiu
q6VCQN4Cm4A+nlyRMVuDvZSFKt+jZJts/RLb/8/vmG+fhpQCw89axSTw8NhCfy05
3T/VOssyaHzGEnFNRRw7d+A/SZuCJixB6n/PktQGDMYLlHbNCGXg75J1iUILnrPP
UYc0r4haFeBovPR2dopcQimxWe7av1McQUChdHGPYnrhbB0NILrdCqzaO68yxT3O
LNik6dCvrDEhg0h76OdQmgZ6DziBjPtEzOYRhCH1S3fpqkAEW3u/Kj1hco8Dtf0Y
sYeJYGSKzGG1eHKDbtofBgXwT34L3ypzNtsF6cYKoVx8CVg1qN7xrXI5qf/MVRZK
E6oNVLyBAgMBAAECggEBAKEV26TWX+hO3D+Z65ZCB6Lrjyu2ZzzSyogNQr07vMEd
Qo5Ln2dFe3R+TNQLB4x8QtHqWrd/yeUIOnjm8cqT6ytFKGgaLCszPnQek3UlKyGO
0BBmYwyHRARR8bq96WpVXM7USssda5Z42GUd2GG4nfjlskeegro7PsLMmerOlFpH
2aYY/KTb6M45qSwZboFvg+s6bGFXjYafZ+Mktj+iJBLuNvxI0Hj6R5aX8XB3Ef68
BiZA12z/jnzERm9zRiLmnGK0xdSRXVyNbeDcP4f8qlqk5N5ga0yxnJpEyTYzfGXy
820TwpFh8G2AKdanbhAGKtI2vGPpO146dUaJdhYGxGUCgYEA66h58ttJKrAR0AP5
+pU0yLo5myOBuRoBDn1k5+ppExqPi1bOQSebnkRRLpWuY1NfanFr3nbDjMi2FI8P
VYTf5AECQQvvwXrbsRl0mFBlL4Q8r4yxTLTUBOvEQX63SyYvUwbsmYQSFuIOvr5L
BV31UMR5CEuBGCCYUm6kZV6HeJsCgYEAy8ic9qwDxoYSdq5J9dbqtPjn5cIwpLhd
o/0OJrkEptU8oIDyey/X5vlDV/FLfdsChjiMFjY661tOgXuTvDGTDzI51U6meKk7
ogLpuURFVJIvWhPBilL+HvPY/oiZjmRyGgvlvpDPjAsWo155WqMrWPh4lfhXjY3z
p5lofNB6axMCgYEAyjTT/ujeTTyq7BydYMCqfBoe19mNs/B2O6Ko9L6UzomZ5evk
Ks/7nb/tENXqvtuJIeKUtlydyq1mXxmqBK1xF0kuT/YYEaKD4+B9xTwmtrD3CYLl
l3YJ/vb2fWRnjpoDPXDRj6BdjTkHge/ym3ZVyqnrWIzBBpzhVsoNUdXc1EUCgYEA
wniKQmTZnYSo7hVZg4A7r8SxGPP+k9NVmX+PF6kNJWDtYIZt4N1Bfqx1deFRl6N/
fzNLjI7oH16dRrf1vmzY2HGn+0X5W8C0peF9xk2+k/yFr8KWujiFRmiStiUJ1XdJ
5E1iTD/JsO2MBw/LY5G/dkJ4YTYD55SF53Vg32vcx30CgYEAog3coA0caJ8uAA5K
UzcQ/vlX5twEt/DRBnrBbGtV/x4y36hRucahIDyTLEyCA9G0TFgQKMEUdUVkoLvQ
cgtLLq340NYN+jFdpFDwAVSBi2Z3NVyh2rX5Q2saYzpOxVaaEe06dOC8Bl6le1EC
cLTZ2YqFcCrRLrzy/hhKO7HImt4=
-----END PRIVATE KEY-----

11
nginx/nginx-dev/refre.sh
View File

@ -1,11 +0,0 @@
#!/bin/bash
if ! python3 prepare.py; then
echo "Error running prepare.py" >&2
exit 1
fi
if ! nginx -s reload; then
echo "Error reloading nginx" >&2
exit 1
fi

4
nginx/nginx-dev/run.sh
View File

@ -1,4 +0,0 @@
#!/bin/bash
python3 prepare.py
/docker-entrypoint.sh nginx -g 'daemon off;'

17
nginx/nginx-prod/Dockerfile
View File

@ -1,13 +1,10 @@
FROM nginx
RUN apt-get update
RUN apt-get install certbot --yes
RUN apt-get install python3-certbot-nginx python3-pip --yes
RUN pip3 install --break-system-packages minio
COPY ./config /etc/nginx
COPY prepare.py prepare.py
COPY run.sh run.sh
COPY refre.sh refre.sh
ENV PYTHONUNBUFFERED=1
RUN chmod 777 run.sh
RUN chmod 777 refre.sh
ENTRYPOINT ["./run.sh"]
RUN apt-get install python3-certbot-nginx --yes
RUN mkdir /etc/allinvest
COPY ./nginx-prod.conf /etc/nginx/nginx.conf
COPY ./privkey.pem /etc/nginx/privkey.pem
COPY ./fullchain.pem /etc/nginx/fullchain.pem
COPY ./allinvest/privkey.pem /etc/allinvest/privkey.pem
COPY ./allinvest/fullchain.pem /etc/allinvest/fullchain.pem

90
nginx/nginx-prod/allinvest/fullchain.pem Normal file
View File

@ -0,0 +1,90 @@
-----BEGIN CERTIFICATE-----
MIIE5TCCA82gAwIBAgISBLLA45sg/IhDBwA/vxe7YIKrMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yNDAyMDMyMTI1NDdaFw0yNDA1MDMyMTI1NDZaMBcxFTATBgNVBAMT
DHlvdXJnb2xzLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANFC
SqAyzSV1BHFSqKxH3GuLEVRgxUABAhveeLWOTJt3xrKTNhdgaP4fD8CZF5vmgFqx
M/Zk4mizZ9FEQeKnrmlhAL643OaGRTVwN1FfBEfvr/fT3AQD0HQB55OSsUReSFUn
yT9vR2cv+r/f6EU78Uw/svvTD7M0vY/uRfOc2qWv+I6dGsoS32iDQmsYlOK4HKWX
mfBTuGSCJKcec1nviehXXrGFP4YJa3gs6RzWTtGXxGgI0lG9O366RszkKZKVJICh
BH+YWV9KJ1hzgmRWlRJgs4t14MO2Dxw5Mu1G08WbaEQGvE7RgcBCNY8sV1K1Bx/P
NUPRsSPT6rIsX3MhQ4sCAwEAAaOCAg4wggIKMA4GA1UdDwEB/wQEAwIFoDAdBgNV
HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4E
FgQUcY+9gyWVjqP8S2owFnPbtwbiZ1QwHwYDVR0jBBgwFoAUFC6zF7dYVsuuUAlA
5h+vnYsUwsYwVQYIKwYBBQUHAQEESTBHMCEGCCsGAQUFBzABhhVodHRwOi8vcjMu
by5sZW5jci5vcmcwIgYIKwYBBQUHMAKGFmh0dHA6Ly9yMy5pLmxlbmNyLm9yZy8w
FwYDVR0RBBAwDoIMeW91cmdvbHMuY29tMBMGA1UdIAQMMAowCAYGZ4EMAQIBMIIB
BAYKKwYBBAHWeQIEAgSB9QSB8gDwAHUAO1N3dT4tuYBOizBbBv5AO2fYT8P0x70A
DS1yb+H61BcAAAGNcRPt8gAABAMARjBEAiAMpD5lfh43xD1tAvsSa20OQ4LsQ8Kt
YBvl5svUTuGrHAIgPveMh3yZ6z+QLW1k8Lv7z1kyXsxSvCUQrX16k7m1V8kAdwCi
4r/WHt4vLweg1k5tN6fcZUOwxrUuotq3iviabfUX2AAAAY1xE+3xAAAEAwBIMEYC
IQD+hmWzWe0y9M8xYKvuhySnHN6AWKQpvJgTqBsCFiiy5QIhANM0ce+SEC4BlY8m
QAIGNXbAjlKU28q66EcTuSjji227MA0GCSqGSIb3DQEBCwUAA4IBAQAAfH8lbwUk
JD6voPBGCTt7XSZPl9dq4LdmOLV3bsfjtqWOeGNCznBYKfRZO/UJ/srekCjapzKy
DAmv0dl/tvBGfqhU/emOtKsq9AE0J7RqzF9SQPrVzq/VxWXGCCmtxUHEAlNk/lrg
PqxpTUZdLpeBEbNvtloSaUEpe8mkFcFhw7TZVtdkpn+pHRlltqXry/8BekFPQR5Y
qgI8akm2rXOV616MnF81DhIUVY4n6t4SVsDjSk69iDnKG97PJJK5yqsEfdZFiDRK
PlhHTYwOsypaP/JMuanK8eGjnNR9pA40DEjAJO0kvE3IE7dHD3R1iGkXjr7wIkKw
5NjP9yOv01mH
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw
WhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP
R5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx
sxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm
NHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg
Z3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG
/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC
AYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB
Af8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA
FHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw
AoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw
Oi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB
gt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W
PTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl
ikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz
CkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm
lJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4
avAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2
yJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O
yK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids
hCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+
HlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv
MldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX
nLRbwHOoq7hHwg==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/
MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT
DkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB
AQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC
ov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL
wYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D
LtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK
4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5
bHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y
sR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ
Xmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4
FQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc
SLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql
PRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND
TwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw
SwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1
c3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx
+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB
ATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu
b3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E
U1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu
MA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC
5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW
9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG
WCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O
he8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

28
nginx/nginx-prod/allinvest/privkey.pem Executable file
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDRQkqgMs0ldQRx
UqisR9xrixFUYMVAAQIb3ni1jkybd8aykzYXYGj+Hw/AmReb5oBasTP2ZOJos2fR
REHip65pYQC+uNzmhkU1cDdRXwRH76/309wEA9B0AeeTkrFEXkhVJ8k/b0dnL/q/
3+hFO/FMP7L70w+zNL2P7kXznNqlr/iOnRrKEt9og0JrGJTiuByll5nwU7hkgiSn
HnNZ74noV16xhT+GCWt4LOkc1k7Rl8RoCNJRvTt+ukbM5CmSlSSAoQR/mFlfSidY
c4JkVpUSYLOLdeDDtg8cOTLtRtPFm2hEBrxO0YHAQjWPLFdStQcfzzVD0bEj0+qy
LF9zIUOLAgMBAAECggEANWFhxAfxiRKWtYnOeVRDiDOLkii1aKRZM17HEBlitW4S
g89FxyTS47BsxkbHXP+p0njNtpb5opfRbfKpk/YOaddS51QlFbE+ymj704gXgXpF
O0USJPwMGuu5dU3AZp5eeUqS7dmnL01v+65UhATMgxTkxZSLtr1HdgXkVka3B/ir
Q/iqR4ftt+qT0a9mzXQOxgdN7qnNwVNO1uJi87C6fQBRB6F724U5SJyOTMl9R6ZS
+JZ9Oz5xxoGLA/Nftn078uMjf2ymWfOqicHYeXxfPYllXNuRsIf7NA00F0orwF15
TWBZLB5GbkOIP7k7vzabZMCbGmf42XYtt1oFYIssIQKBgQD7aB8cUDVdE47VOX4p
+Bf2ilMJA2d+KsCA3uYw5VQjjxBbfN+nChOx6e6eSmy2MMtH2ECG2IgW04FDbHtZ
y2tbmRY3XIl+4dos+6ybbiYeYKRcHOQiXbjFK9ml1NpDcuLMHE3a6v0gFB8N0iB4
J3u6h9+kHe3LGPzIVDGbITWi4wKBgQDVFQleHfRWM9/hebU8/tshY4sRJ9nA9haI
F/NDMHhE+IyX9JHxGXtVE0ihOh0+0PLKLwtOepc4vqZaquKVnzZ82+sc+C4Iqg8K
S+1NoRFOZG1AlM53UI51ZXLvXZp8gAdDBXzwBZpWZNdhJHJSnuwVI+UoDkrAQkmn
/n4jzV01OQKBgQCH8pr4JYtlxIC1XryRl13l7JDQS+339MhaJ66UfD5OaDtxLYqH
elSCHbzyDc7RinsyY4cpJAgbR84blprxSKXKR3MTBtA3M4xWTNXeyuaEAMCAKwNW
bhXPUVIFcZ+BX6uysg+LtQyh/x93ysvSDY/Do1vVFHYVIHL5JUYZ3BBz/wKBgQDT
oCYCnJtr9e9Xn6oZ30BBg/y9WCfTllVAaxEGXSBF19jCnntHyjgMga9zuSUMmzdX
CKwhEG4aRHcxu2B4m3zhOwXiarZFkqiHYGtZ2ys2AVXkeyYnqBEklVI2W2+wUPNl
ZBD2zYnAXjzu1OTaG857HIBebPtewTcoKwCajD8TOQKBgQDr07j3sx5nQsg4kHmR
kBvHHjq7kQ1pEItrD/CfLsZ7Ntip4L82UzdZm/hhdM/12fB+wLu8HcZzvY5H1J+3
IlkKYhAAe8lgzE7hYupVD9QtdFBuNsAnQfT+VV4JnZNDVZHXfnhz19KJ+iIvqton
8WCEnmpiIKyt+Lq+Ol3n7PDMIw==
-----END PRIVATE KEY-----

24
nginx/nginx-prod/config/nginx.conf
View File

@ -1,24 +0,0 @@
events {}
http {
client_max_body_size 50m;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name *.sprinthub.ru;
return 301 https://$host$request_uri;
}
server {
listen 80;
server_name *.chocomarsh.com;
return 301 https://$host$request_uri;
}
include ./hosts.conf;
}

58
nginx/nginx-prod/fullchain.pem Normal file
View File

@ -0,0 +1,58 @@
-----BEGIN CERTIFICATE-----
MIIE7TCCA9WgAwIBAgISBDL/ZyXlpK88JpU+aNYTYbZcMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTAwHhcNMjQwODE4MTczMDAxWhcNMjQxMTE2MTczMDAwWjAZMRcwFQYDVQQD
DA4qLnNwcmludGh1Yi5ydTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AKwZZehw3dlvH5AvVfnaybqjB5K3YixMDkE3ygHvPL1d7c3QzmuIsPkpSQOt+fEY
ERQEcXype1tmT6jmZs+WdP8ASXDW7V8pHrYBffZ5Hoxc6vydr/ArZJWblfm+bYaA
68ZRj9sv1cGK0dk34v4QYa8EqQRezxFRT0lvfB2vyfZ/4xQ/ZPDzVjivUcWoWrC5
+4WTg6e4ZtKQXiXBHS1z/FGhmTbudXXU9zi2Hyq+eEPwtU7hIZLtyAzc2TWJVHfw
YJQMlSklpOMvKDSbgEW6LNsQcwYFJ/1MvX3C7TZX/uNuwssi5cMKmhecDf7g5pK4
EqJnNFYZ9lZ0ofNFSj6qVu0CAwEAAaOCAhMwggIPMA4GA1UdDwEB/wQEAwIFoDAd
BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
HQ4EFgQU9g2CK2s4AK0F9lDh/iDOAgl9GJQwHwYDVR0jBBgwFoAUu7zDR6XkvKnG
w6RyDBCNojXhyOgwVwYIKwYBBQUHAQEESzBJMCIGCCsGAQUFBzABhhZodHRwOi8v
cjEwLm8ubGVuY3Iub3JnMCMGCCsGAQUFBzAChhdodHRwOi8vcjEwLmkubGVuY3Iu
b3JnLzAZBgNVHREEEjAQgg4qLnNwcmludGh1Yi5ydTATBgNVHSAEDDAKMAgGBmeB
DAECATCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AD8XS0/XIkdYlB1lHIS+DRLt
kDd/H4Vq68G/KIXs+GRuAAABkWa/gHgAAAQDAEcwRQIhAOSEdIX9kjdYohZb942J
dk5pUAYQl68bIBwIvHQF6Ru1AiAzNtoqdj11Uy4+lr0TbU8SE2tBgTGDxZRksCpC
Kt83wQB3AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0AAABkWa/iHcA
AAQDAEgwRgIhAPzli2g23TY0uFoU6LMrlqe3CPBWC8BWq/rnfOm/cOaJAiEAoefO
g0i2LU8pUqkurW34EfXEQQUqSjy3ze8c9FKPUnYwDQYJKoZIhvcNAQELBQADggEB
AMUvd2yvRsrp4iZk9rTd87Zjv0nWkAunwirx1jNhzRvP/vKGh1Zn1GPohr7TQQZ5
EkJK+4w1+uq5ZrDrI3t+SKx15sv4iAJu7EAh6z0/oGkb27LlduXVSQ4hs5o/E4cL
wdRONWKrKIchcM9vblicKOxFxCKUOXPMxH8YSDkkWK8KhCvE1sSzm0DzeRQVOwuK
aWMJXoEF0pY6lOVGiGIxtozY3Q5IooBDX+bwDEq/SkwY38yig2NszpTwJKmVIV+E
DjBoRHWoYYtEL1y2rh/OonQBGxSCUYSIrG3+BdqWwLL9LmgZk+A2X5Qa09aZQvnc
hsfvAxxU+C7lArtjpA/pWYk=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP
MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa
Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF
bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL
YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a
/6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4
FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR
mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3
DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG
MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/
AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5
tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG
Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD
VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B
AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo
zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd
u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9
1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0
GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh
1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ
QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N
4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz
rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei
RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx
KPpdzvvtTnOPlC7SQZSYmdunr3Bf9b77AiC/ZidstK36dRILKz7OA54=
-----END CERTIFICATE-----

217
nginx/nginx-prod/nginx-prod.conf Normal file
View File

@ -0,0 +1,217 @@
events {}
http {
client_max_body_size 150m;
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name gitlab.sprinthub.ru;
location / {
proxy_pass http://dev.sprinthub.ru:1234/;
}
}
server {
listen 80;
server_name *.sprinthub.ru;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name gitlab.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:1234/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name swarmpit.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:888/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name portainer.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:8888/;
}
location /api/websocket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name rabbitmq.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:15672/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name swarmpit.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:15672/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name minio.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:9001/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name gitea.sprinthub.ru;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
location / {
proxy_pass http://dev.sprinthub.ru:3000/;
}
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name ~^(?<domain>.*)\.sprinthub\.ru$;
resolver 127.0.0.11 ipv6=off;
ssl_certificate /etc/nginx/fullchain.pem;
ssl_certificate_key /etc/nginx/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_set_header X-Real-IP $remote_addr;
location / {
proxy_pass http://$domain-nginx:1238$request_uri;
}
}
server {
listen 80;
server_name yourgols.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name yourgols.com;
resolver 127.0.0.11 ipv6=off;
ssl_certificate /etc/allinvest/fullchain.pem;
ssl_certificate_key /etc/allinvest/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
location / {
proxy_pass http://yourgols-nginx:1238$request_uri;
}
}
}

85
nginx/nginx-prod/prepare.py
View File

@ -1,85 +0,0 @@
import os
import sys
from minio import Minio
from urllib.request import urlopen
from json import loads
minio_client = Minio(
"minio.sprinthub.ru:9000",
access_key="serviceminioadmin",
secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
secure=False,
)
def get(url):
with urlopen(url) as response:
data = response.read().decode("utf-8")
return loads(data)
try:
response = get(
"http://configurator/api/v1/fetch?project=certupdater&stage=production"
)
hosts = response["configs"]["hosts"]
except Exception as e:
print(f"Error fetching config: {e}", file=sys.stderr)
sys.exit(1)
config = ""
for host, params in hosts.items():
config += """
server {{
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name {host};
ssl_certificate /etc/nginx/{host}/fullchain.pem;
ssl_certificate_key /etc/nginx/{host}/privkey.pem;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-refferer-when-downgrade" always;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
location / {{
resolver 127.0.0.11;
proxy_pass http://{target_host}:{port}$request_uri;
}}
}}\n\n
""".format(
host=host, target_host=params["host"], port=params["port"]
)
try:
fullchain = minio_client.get_object(
"certupdater", f"certificates/{host}/fullchain.pem"
)
privkey = minio_client.get_object(
"certupdater", f"certificates/{host}/privkey.pem"
)
try:
os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
except OSError as e:
print(f"Error creating directory: {e}", file=sys.stderr)
continue
with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
fp.write(fullchain.data)
with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
fp.write(privkey.data)
except Exception as e:
print(f"Error processing host {host}: {e}", file=sys.stderr)
continue
try:
with open("/etc/nginx/hosts.conf", "w") as fp:
fp.write(config)
except Exception as e:
print(f"Error writing config file: {e}", file=sys.stderr)
sys.exit(1)

28
nginx/nginx-prod/privkey.pem Normal file
View File

@ -0,0 +1,28 @@
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCsGWXocN3Zbx+Q
L1X52sm6oweSt2IsTA5BN8oB7zy9Xe3N0M5riLD5KUkDrfnxGBEUBHF8qXtbZk+o
5mbPlnT/AElw1u1fKR62AX32eR6MXOr8na/wK2SVm5X5vm2GgOvGUY/bL9XBitHZ
N+L+EGGvBKkEXs8RUU9Jb3wdr8n2f+MUP2Tw81Y4r1HFqFqwufuFk4OnuGbSkF4l
wR0tc/xRoZk27nV11Pc4th8qvnhD8LVO4SGS7cgM3Nk1iVR38GCUDJUpJaTjLyg0
m4BFuizbEHMGBSf9TL19wu02V/7jbsLLIuXDCpoXnA3+4OaSuBKiZzRWGfZWdKHz
RUo+qlbtAgMBAAECggEAUfpfMtPguZxXWqVRvQzdHwxdpSO5ngQ0nhhnH3jIZCQE
DRAz48FfG7Dw2NHcx12BdRmQvaM14ZngxEHMI4I2BOosEZYvyC6cNHKNgAS96nqw
bNjoX+0roqBUVnzBS1rJ9NQRRIWKuwDXaTNX61H+VhJQOIa4+DTVIdP7OWDtQX9t
DyQM/vvGM0gHmUKvd15n8iU5obxMZm+2ntUYe38dSCKANuVgmT/+/mJHt7SWYXuD
PAQX5IWVK2sMT+snPTW7ERXwOwHn4Sl57Juqz4lOGKYAsveFqi0F1UNyQ61ggjXU
I17bSHONBxK1MPYKQyjiVGvMylpyTd0RWAUSUs3yQQKBgQDkKuKG+4ndxkxIpe/6
ENkP2cvlhkO2BdQKfYsw20pxIZqOVwlatZ0OlFMkFJFWhIRP+aYi0+69THOpV1Dk
E33+438fxBJLAZXUY5PJs47JBLq/bUCWgblshe3QAW3gZLbDb3+i0CI7YA7b6Vo4
Rf0mkyjo10VmpjK9x7hvbtMfCQKBgQDBF6L+5jwlOHUV8FHRO2AlrRUMNHcEt3JN
JDgoxPidHq1gYHsDC+tp2C+x1z5zSruOfIQPt0JnED+H+0l8gnPKMFbdrgJBExGq
4z0FQIqysVE+8kPh6ikOMrec6RSHsW1e+y0v1Mn7zHb4a+6JfIukjsqPm07wSWFe
9DXlGKANxQKBgQCok/rcalq5Tbqs7lU4+Fu3t15LjgDXKsU4nvtJNKxym7ZatnnF
2GtbC0HGZZ/gQXaUtEoIb3dzy1mlY0rzyGcN/L2/FZnCa0BtNMlLfGvhn6nup2TS
DrSWNvm29mddJGxYRzgRbh/sqJMx7d5nt2ZLquzN48d2CRNyXm6pfkNkKQKBgAur
mw1e6vmw7NqzmK5VsVz1lhUTwrHFSKJC8yX7qa8NYJs3mZe4i7Ts/Qz5nmunc6iL
/AtbHydNgxl75Zgh5k+tFkL1tmsqdOHoNBLyMK/WKbvtNo8b8PlLtW9FYxlEbwDT
m4qNiNuwIuym0Vb78RC0FKgTUfUR6lGr3uoGz/2lAoGBANQrHCOr+2eOZawiWlQ3
jPJQVRwzpPHPGnElcGJBMcA03UQCO/HXSJl/V5OGZjVH4zZ3iRInYvq4NR+KeQC8
VXU4AWS9QIyx7UAGO8eDzENz6JG4Q1txkPsGIipvROdCCWFqaudyxRuWnKsXEwYn
RGyseajshyNkpwLoMk2gx67+
-----END PRIVATE KEY-----

4
nginx/nginx-prod/refre.sh
View File

@ -1,4 +0,0 @@
#!/bin/bash
python3 prepare.py
nginx -s reload

4
nginx/nginx-prod/run.sh
View File

@ -1,4 +0,0 @@
#!/bin/bash
python3 prepare.py
/docker-entrypoint.sh nginx -g 'daemon off;'

11
prepare/run-development.sh
View File

@ -1,11 +0,0 @@
docker login -u mathwave -p $DOCKERHUB_PASSWORD
mkdir /sprint-data/mongo || true
mkdir /sprint-data/redis || true
mkdir /sprint-data/rabbitmq || true
mkdir /sprint-data/certs || true
mkdir /sprint-data/gitea || true
mkdir /sprint-data/clickhouse || true
chmod 777 /sprint-data/redis
chmod 777 /sprint-data/rabbitmq
chmod 777 /sprint-data/gitea
chmod 777 /sprint-data/clickhouse

29
prepare/run-production.sh
View File

@ -1,29 +0,0 @@
docker login -u mathwave -p $DOCKERHUB_PASSWORD
docker network create -d overlay --attachable swarmpit-nginx || true
docker network create -d overlay --attachable common-infra-nginx || true
docker network create -d overlay --attachable common-infra-nginx-development || true
docker network create -d overlay --attachable queues || true
docker network create -d overlay --attachable queues-development || true
docker network create -d overlay --attachable configurator || true
docker network create -d overlay --attachable monitoring || true
docker network create -d overlay --attachable configurator-development || true
docker network create -d overlay --attachable clickhouse || true
docker network create -d overlay --attachable clickhouse-development || true
mkdir /sprint-data/mongo || true
mkdir /sprint-data/redis || true
mkdir /sprint-data/rabbitmq || true
mkdir /sprint-data/certs || true
mkdir /sprint-data/gitea || true
mkdir /sprint-data/clickhouse || true
mkdir /sprint-data/grafana || true
mkdir /sprint-data/authelia || true
mkdir /sprint-data/authelia/config || true
mkdir /sprint-data/authelia/data || true
chmod 777 /sprint-data/authelia
chmod 777 /sprint-data/authelia/config
chmod 777 /sprint-data/authelia/data
chmod 777 /sprint-data/redis
chmod 777 /sprint-data/rabbitmq
chmod 777 /sprint-data/gitea
chmod 777 /sprint-data/clickhouse
chmod 777 /sprint-data/grafana