From 84639669d6eb445d9e8ae6511bd5000a431ded42 Mon Sep 17 00:00:00 2001 From: schmelczerandras Date: Wed, 29 Jul 2020 12:43:34 +0200 Subject: [PATCH] Add swarmpit --- README.md | 11 ++- infrastructure/add-swarmpit.sh | 7 ++ infrastructure/docker-compose.swarmpit.yml | 93 +++++++++++++++++++ infrastructure/docker-compose.yml | 36 +++---- infrastructure/init-letsencrypt.sh | 72 ++------------ .../{init.sh => init-remote-shared.sh} | 0 infrastructure/init-remote.sh | 6 -- ingress/nginx-config/nginx.conf | 37 ++++---- ingress/nginx-config/ssl-server.conf | 17 ++++ 9 files changed, 163 insertions(+), 116 deletions(-) create mode 100644 infrastructure/add-swarmpit.sh create mode 100644 infrastructure/docker-compose.swarmpit.yml rename infrastructure/{init.sh => init-remote-shared.sh} (100%) delete mode 100644 infrastructure/init-remote.sh create mode 100644 ingress/nginx-config/ssl-server.conf diff --git a/README.md b/README.md index 7eebbbb..40be57c 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,16 @@ A good-looking 2D adventure. ## Todo +- host script + - https://github.com/ottomatica/slim + - rancher os - Frontend nginx disable logging - procedural piano - obfuscate function names - lightweight object storage -- docker engine dashboard? - dockerswarm.rocks - local dev env -- prettier script -- monitoring -- traefik +- CI pipeline: + - prettier script + - tests? +- monitoring: https://dockerswarm.rocks/swarmpit/ diff --git a/infrastructure/add-swarmpit.sh b/infrastructure/add-swarmpit.sh new file mode 100644 index 0000000..d4fef74 --- /dev/null +++ b/infrastructure/add-swarmpit.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +DOMAIN=swarmpit.decla.red +NODE_ID=$(docker info -f '{{.Swarm.NodeID}}') +docker node update --label-add swarmpit.db-data=true $NODE_ID +docker node update --label-add swarmpit.influx-data=true $NODE_ID +docker stack deploy -c docker-compose.swarmpit.yml swarmpit diff --git a/infrastructure/docker-compose.swarmpit.yml b/infrastructure/docker-compose.swarmpit.yml new file mode 100644 index 0000000..ee12784 --- /dev/null +++ b/infrastructure/docker-compose.swarmpit.yml @@ -0,0 +1,93 @@ +version: "3.3" + +# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml + +services: + app: + image: swarmpit/swarmpit:latest + environment: + - SWARMPIT_DB=http://db:5984 + - SWARMPIT_INFLUXDB=http://influxdb:8086 + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + ports: + - "8080" + networks: + - network + deploy: + resources: + limits: + cpus: "0.15" + memory: 256M + reservations: + cpus: "0.15" + memory: 256M + placement: + constraints: + - node.role == manager + + db: + image: couchdb:2.3.0 + volumes: + - db-data:/opt/couchdb/data + networks: + - network + deploy: + resources: + limits: + cpus: "0.05" + memory: 64M + reservations: + cpus: "0.05" + memory: 64M + placement: + constraints: + - node.labels.swarmpit.db-data == true + + influxdb: + image: influxdb:1.7 + volumes: + - influx-data:/var/lib/influxdb + networks: + - network + deploy: + resources: + limits: + cpus: "0.05" + memory: 64M + reservations: + cpus: "0.05" + memory: 64M + placement: + constraints: + - node.labels.swarmpit.influx-data == true + + agent: + image: swarmpit/agent:latest + environment: + - DOCKER_API_VERSION=1.35 + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + networks: + - network + deploy: + mode: global + labels: + swarmpit.agent: "true" + resources: + limits: + cpus: "0.10" + memory: 64M + reservations: + cpus: "0.05" + memory: 32M + +networks: + network: + driver: overlay + +volumes: + db-data: + driver: local + influx-data: + driver: local diff --git a/infrastructure/docker-compose.yml b/infrastructure/docker-compose.yml index 6caba4f..40f9473 100644 --- a/infrastructure/docker-compose.yml +++ b/infrastructure/docker-compose.yml @@ -5,8 +5,10 @@ services: init: true image: ${CONTAINER_REGISTRY}/declared-ingress depends_on: - - certbot - frontend + networks: + - swarmpit_network + - network deploy: replicas: 2 resources: @@ -29,34 +31,15 @@ services: - "443:443" command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"''' volumes: - - /root/data/certbot/conf:/etc/letsencrypt - - /root/data/certbot/www:/var/www/certbot - - certbot: - init: true - image: certbot/certbot - deploy: - replicas: 1 - resources: - limits: - cpus: "0.05" - memory: 64M - reservations: - cpus: "0.05" - memory: 64M - restart_policy: - condition: on-failure - window: 30s - entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'" - volumes: - - /root/data/certbot/conf:/etc/letsencrypt - - /root/data/certbot/www:/var/www/certbot + - /etc/letsencrypt:/etc/letsencrypt frontend: init: true image: ${CONTAINER_REGISTRY}/declared-frontend ports: - "80" + networks: + - network deploy: replicas: 2 resources: @@ -74,3 +57,10 @@ services: restart_policy: condition: on-failure window: 30s + +networks: + network: + driver: overlay + + swarmpit_network: + external: true diff --git a/infrastructure/init-letsencrypt.sh b/infrastructure/init-letsencrypt.sh index 5cc9d50..e81379c 100644 --- a/infrastructure/init-letsencrypt.sh +++ b/infrastructure/init-letsencrypt.sh @@ -1,66 +1,14 @@ #!/bin/bash -# Source https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71 +sudo apt-get install certbot python3-certbot-dns-digitalocean -y -domains=(decla.red) -rsa_key_size=4096 -data_path="./data/certbot" -email="schmelczerandras@gmail.com" # Adding a valid address is strongly recommended +certbot certonly \ + --dns-digitalocean \ + --dns-digitalocean-credentials ~/digitalocean.api.key \ + --dns-digitalocean-propagation-seconds 120 \ + -m "schmelczerandras@gmail.com" \ + -d "decla.red" -d "*.decla.red" \ + --agree-tos -if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then - echo "### Downloading recommended TLS parameters ..." - mkdir -p "$data_path/conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf" - curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem" - echo -fi - -echo "### Creating dummy certificate for $domains ..." -path="/etc/letsencrypt/live/$domains" -mkdir -p "$data_path/conf/live/$domains" -docker-compose run --rm --entrypoint "\ - openssl req -x509 -nodes -newkey rsa:1024 -days 1\ - -keyout '$path/privkey.pem' \ - -out '$path/fullchain.pem' \ - -subj '/CN=localhost'" certbot -echo - - -echo "### Starting nginx ..." -docker-compose up --force-recreate -d ingress -echo - -echo "### Deleting dummy certificate for $domains ..." -docker-compose run --rm --entrypoint "\ - rm -Rf /etc/letsencrypt/live/$domains && \ - rm -Rf /etc/letsencrypt/archive/$domains && \ - rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot -echo - - -echo "### Requesting Let's Encrypt certificate for $domains ..." -#Join $domains to -d args -domain_args="" -for domain in "${domains[@]}"; do - domain_args="$domain_args -d $domain" -done - - -# Select appropriate email arg -case "$email" in - "") email_arg="--register-unsafely-without-email" ;; - *) email_arg="--email $email" ;; -esac - -docker-compose run --rm --entrypoint "\ - certbot certonly --webroot -w /var/www/certbot \ - $staging_arg \ - $email_arg \ - $domain_args \ - --rsa-key-size $rsa_key_size \ - --agree-tos \ - --force-renewal" certbot -echo - -echo "### Reloading nginx ..." -docker-compose exec ingress ingress -s reload +curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf" +curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem" \ No newline at end of file diff --git a/infrastructure/init.sh b/infrastructure/init-remote-shared.sh similarity index 100% rename from infrastructure/init.sh rename to infrastructure/init-remote-shared.sh diff --git a/infrastructure/init-remote.sh b/infrastructure/init-remote.sh deleted file mode 100644 index 361e1e2..0000000 --- a/infrastructure/init-remote.sh +++ /dev/null @@ -1,6 +0,0 @@ -#!/bin/bash - -REMOTE_ADDRESS=$1 -echo Initializing new machine, $REMOTE_ADDRESS - -cat init-remote.sh | ssh $REMOTE_ADDRESS diff --git a/ingress/nginx-config/nginx.conf b/ingress/nginx-config/nginx.conf index 843a5d1..f9e9492 100644 --- a/ingress/nginx-config/nginx.conf +++ b/ingress/nginx-config/nginx.conf @@ -22,34 +22,18 @@ http { server { listen 80; - server_name decla.red; + server_name *.decla.red decla.red; server_tokens off; - location /.well-known/acme-challenge/ { - root /var/www/certbot; - } - location / { return 301 https://$host$request_uri; } } server { - listen 443 ssl; - server_name decla.red; - server_tokens off; - - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - - ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem; - include /etc/letsencrypt/options-ssl-nginx.conf; - ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; - - location ~ ^/(502).html$ { - root /usr/share/nginx/html/errors; - internal; - } + server_name decla.red default_server; + + include /etc/nginx/ssl-server.conf; location / { proxy_pass http://frontend; @@ -57,7 +41,18 @@ http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } + } - error_page 502 /502.html; + server { + server_name swarmpit.decla.red; + + include /etc/nginx/ssl-server.conf; + + location / { + proxy_pass http://app:8080; + proxy_set_header Host $http_host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + } } } diff --git a/ingress/nginx-config/ssl-server.conf b/ingress/nginx-config/ssl-server.conf new file mode 100644 index 0000000..ae2593e --- /dev/null +++ b/ingress/nginx-config/ssl-server.conf @@ -0,0 +1,17 @@ +listen 443 ssl; + +server_tokens off; + +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + +ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem; +include /etc/letsencrypt/options-ssl-nginx.conf; +ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; + +location ~* ^/(502).html$ { + root /usr/share/nginx/html/errors; + internal; +} + +error_page 502 /502.html;