Add swarmpit
This commit is contained in:
schmelczerandras
parent
0d93c7a5bf
commit
84639669d6
9 changed files with 163 additions and 116 deletions
11
README.md
11
README.md
|
|
@ -13,13 +13,16 @@ A good-looking 2D adventure.
|
|||
|
||||
## Todo
|
||||
|
||||
- host script
|
||||
- https://github.com/ottomatica/slim
|
||||
- rancher os
|
||||
- Frontend nginx disable logging
|
||||
- procedural piano
|
||||
- obfuscate function names
|
||||
- lightweight object storage
|
||||
- docker engine dashboard?
|
||||
- dockerswarm.rocks
|
||||
- local dev env
|
||||
- prettier script
|
||||
- monitoring
|
||||
- traefik
|
||||
- CI pipeline:
|
||||
- prettier script
|
||||
- tests?
|
||||
- monitoring: https://dockerswarm.rocks/swarmpit/
|
||||
|
|
|
|||
7
infrastructure/add-swarmpit.sh
Normal file
7
infrastructure/add-swarmpit.sh
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/bash
|
||||
|
||||
DOMAIN=swarmpit.decla.red
|
||||
NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
|
||||
docker node update --label-add swarmpit.db-data=true $NODE_ID
|
||||
docker node update --label-add swarmpit.influx-data=true $NODE_ID
|
||||
docker stack deploy -c docker-compose.swarmpit.yml swarmpit
|
||||
93
infrastructure/docker-compose.swarmpit.yml
Normal file
93
infrastructure/docker-compose.swarmpit.yml
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
version: "3.3"
|
||||
|
||||
# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml
|
||||
|
||||
services:
|
||||
app:
|
||||
image: swarmpit/swarmpit:latest
|
||||
environment:
|
||||
- SWARMPIT_DB=http://db:5984
|
||||
- SWARMPIT_INFLUXDB=http://influxdb:8086
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
ports:
|
||||
- "8080"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
reservations:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
|
||||
db:
|
||||
image: couchdb:2.3.0
|
||||
volumes:
|
||||
- db-data:/opt/couchdb/data
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.db-data == true
|
||||
|
||||
influxdb:
|
||||
image: influxdb:1.7
|
||||
volumes:
|
||||
- influx-data:/var/lib/influxdb
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.influx-data == true
|
||||
|
||||
agent:
|
||||
image: swarmpit/agent:latest
|
||||
environment:
|
||||
- DOCKER_API_VERSION=1.35
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
mode: global
|
||||
labels:
|
||||
swarmpit.agent: "true"
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.10"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 32M
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
db-data:
|
||||
driver: local
|
||||
influx-data:
|
||||
driver: local
|
||||
|
|
@ -5,8 +5,10 @@ services:
|
|||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-ingress
|
||||
depends_on:
|
||||
- certbot
|
||||
- frontend
|
||||
networks:
|
||||
- swarmpit_network
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
|
|
@ -29,34 +31,15 @@ services:
|
|||
- "443:443"
|
||||
command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
|
||||
volumes:
|
||||
- /root/data/certbot/conf:/etc/letsencrypt
|
||||
- /root/data/certbot/www:/var/www/certbot
|
||||
|
||||
certbot:
|
||||
init: true
|
||||
image: certbot/certbot
|
||||
deploy:
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
|
||||
volumes:
|
||||
- /root/data/certbot/conf:/etc/letsencrypt
|
||||
- /root/data/certbot/www:/var/www/certbot
|
||||
- /etc/letsencrypt:/etc/letsencrypt
|
||||
|
||||
frontend:
|
||||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-frontend
|
||||
ports:
|
||||
- "80"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
|
|
@ -74,3 +57,10 @@ services:
|
|||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
swarmpit_network:
|
||||
external: true
|
||||
|
|
|
|||
|
|
@ -1,66 +1,14 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Source https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
|
||||
sudo apt-get install certbot python3-certbot-dns-digitalocean -y
|
||||
|
||||
domains=(decla.red)
|
||||
rsa_key_size=4096
|
||||
data_path="./data/certbot"
|
||||
email="schmelczerandras@gmail.com" # Adding a valid address is strongly recommended
|
||||
certbot certonly \
|
||||
--dns-digitalocean \
|
||||
--dns-digitalocean-credentials ~/digitalocean.api.key \
|
||||
--dns-digitalocean-propagation-seconds 120 \
|
||||
-m "schmelczerandras@gmail.com" \
|
||||
-d "decla.red" -d "*.decla.red" \
|
||||
--agree-tos
|
||||
|
||||
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
|
||||
echo "### Downloading recommended TLS parameters ..."
|
||||
mkdir -p "$data_path/conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
|
||||
echo
|
||||
fi
|
||||
|
||||
echo "### Creating dummy certificate for $domains ..."
|
||||
path="/etc/letsencrypt/live/$domains"
|
||||
mkdir -p "$data_path/conf/live/$domains"
|
||||
docker-compose run --rm --entrypoint "\
|
||||
openssl req -x509 -nodes -newkey rsa:1024 -days 1\
|
||||
-keyout '$path/privkey.pem' \
|
||||
-out '$path/fullchain.pem' \
|
||||
-subj '/CN=localhost'" certbot
|
||||
echo
|
||||
|
||||
|
||||
echo "### Starting nginx ..."
|
||||
docker-compose up --force-recreate -d ingress
|
||||
echo
|
||||
|
||||
echo "### Deleting dummy certificate for $domains ..."
|
||||
docker-compose run --rm --entrypoint "\
|
||||
rm -Rf /etc/letsencrypt/live/$domains && \
|
||||
rm -Rf /etc/letsencrypt/archive/$domains && \
|
||||
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
|
||||
echo
|
||||
|
||||
|
||||
echo "### Requesting Let's Encrypt certificate for $domains ..."
|
||||
#Join $domains to -d args
|
||||
domain_args=""
|
||||
for domain in "${domains[@]}"; do
|
||||
domain_args="$domain_args -d $domain"
|
||||
done
|
||||
|
||||
|
||||
# Select appropriate email arg
|
||||
case "$email" in
|
||||
"") email_arg="--register-unsafely-without-email" ;;
|
||||
*) email_arg="--email $email" ;;
|
||||
esac
|
||||
|
||||
docker-compose run --rm --entrypoint "\
|
||||
certbot certonly --webroot -w /var/www/certbot \
|
||||
$staging_arg \
|
||||
$email_arg \
|
||||
$domain_args \
|
||||
--rsa-key-size $rsa_key_size \
|
||||
--agree-tos \
|
||||
--force-renewal" certbot
|
||||
echo
|
||||
|
||||
echo "### Reloading nginx ..."
|
||||
docker-compose exec ingress ingress -s reload
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem"
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
REMOTE_ADDRESS=$1
|
||||
echo Initializing new machine, $REMOTE_ADDRESS
|
||||
|
||||
cat init-remote.sh | ssh $REMOTE_ADDRESS
|
||||
|
|
@ -22,34 +22,18 @@ http {
|
|||
|
||||
server {
|
||||
listen 80;
|
||||
server_name decla.red;
|
||||
server_name *.decla.red decla.red;
|
||||
server_tokens off;
|
||||
|
||||
location /.well-known/acme-challenge/ {
|
||||
root /var/www/certbot;
|
||||
}
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name decla.red;
|
||||
server_tokens off;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location ~ ^/(502).html$ {
|
||||
root /usr/share/nginx/html/errors;
|
||||
internal;
|
||||
}
|
||||
server_name decla.red default_server;
|
||||
|
||||
include /etc/nginx/ssl-server.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://frontend;
|
||||
|
|
@ -57,7 +41,18 @@ http {
|
|||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
|
||||
error_page 502 /502.html;
|
||||
server {
|
||||
server_name swarmpit.decla.red;
|
||||
|
||||
include /etc/nginx/ssl-server.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://app:8080;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
17
ingress/nginx-config/ssl-server.conf
Normal file
17
ingress/nginx-config/ssl-server.conf
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
listen 443 ssl;
|
||||
|
||||
server_tokens off;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location ~* ^/(502).html$ {
|
||||
root /usr/share/nginx/html/errors;
|
||||
internal;
|
||||
}
|
||||
|
||||
error_page 502 /502.html;
|
||||
Loading…
Add table
Add a link
Reference in a new issue