Add swarmpit
This commit is contained in:
schmelczerandras
parent
0d93c7a5bf
commit
84639669d6
9 changed files with 163 additions and 116 deletions
7
infrastructure/add-swarmpit.sh
Normal file
7
infrastructure/add-swarmpit.sh
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
#!/bin/bash
|
||||
|
||||
DOMAIN=swarmpit.decla.red
|
||||
NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
|
||||
docker node update --label-add swarmpit.db-data=true $NODE_ID
|
||||
docker node update --label-add swarmpit.influx-data=true $NODE_ID
|
||||
docker stack deploy -c docker-compose.swarmpit.yml swarmpit
|
||||
93
infrastructure/docker-compose.swarmpit.yml
Normal file
93
infrastructure/docker-compose.swarmpit.yml
Normal file
|
|
@ -0,0 +1,93 @@
|
|||
version: "3.3"
|
||||
|
||||
# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml
|
||||
|
||||
services:
|
||||
app:
|
||||
image: swarmpit/swarmpit:latest
|
||||
environment:
|
||||
- SWARMPIT_DB=http://db:5984
|
||||
- SWARMPIT_INFLUXDB=http://influxdb:8086
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
ports:
|
||||
- "8080"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
reservations:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
|
||||
db:
|
||||
image: couchdb:2.3.0
|
||||
volumes:
|
||||
- db-data:/opt/couchdb/data
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.db-data == true
|
||||
|
||||
influxdb:
|
||||
image: influxdb:1.7
|
||||
volumes:
|
||||
- influx-data:/var/lib/influxdb
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.influx-data == true
|
||||
|
||||
agent:
|
||||
image: swarmpit/agent:latest
|
||||
environment:
|
||||
- DOCKER_API_VERSION=1.35
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
mode: global
|
||||
labels:
|
||||
swarmpit.agent: "true"
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.10"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 32M
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
db-data:
|
||||
driver: local
|
||||
influx-data:
|
||||
driver: local
|
||||
|
|
@ -5,8 +5,10 @@ services:
|
|||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-ingress
|
||||
depends_on:
|
||||
- certbot
|
||||
- frontend
|
||||
networks:
|
||||
- swarmpit_network
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
|
|
@ -29,34 +31,15 @@ services:
|
|||
- "443:443"
|
||||
command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
|
||||
volumes:
|
||||
- /root/data/certbot/conf:/etc/letsencrypt
|
||||
- /root/data/certbot/www:/var/www/certbot
|
||||
|
||||
certbot:
|
||||
init: true
|
||||
image: certbot/certbot
|
||||
deploy:
|
||||
replicas: 1
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
|
||||
volumes:
|
||||
- /root/data/certbot/conf:/etc/letsencrypt
|
||||
- /root/data/certbot/www:/var/www/certbot
|
||||
- /etc/letsencrypt:/etc/letsencrypt
|
||||
|
||||
frontend:
|
||||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-frontend
|
||||
ports:
|
||||
- "80"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
|
|
@ -74,3 +57,10 @@ services:
|
|||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
swarmpit_network:
|
||||
external: true
|
||||
|
|
|
|||
|
|
@ -1,66 +1,14 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Source https://medium.com/@pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
|
||||
sudo apt-get install certbot python3-certbot-dns-digitalocean -y
|
||||
|
||||
domains=(decla.red)
|
||||
rsa_key_size=4096
|
||||
data_path="./data/certbot"
|
||||
email="schmelczerandras@gmail.com" # Adding a valid address is strongly recommended
|
||||
certbot certonly \
|
||||
--dns-digitalocean \
|
||||
--dns-digitalocean-credentials ~/digitalocean.api.key \
|
||||
--dns-digitalocean-propagation-seconds 120 \
|
||||
-m "schmelczerandras@gmail.com" \
|
||||
-d "decla.red" -d "*.decla.red" \
|
||||
--agree-tos
|
||||
|
||||
if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
|
||||
echo "### Downloading recommended TLS parameters ..."
|
||||
mkdir -p "$data_path/conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
|
||||
echo
|
||||
fi
|
||||
|
||||
echo "### Creating dummy certificate for $domains ..."
|
||||
path="/etc/letsencrypt/live/$domains"
|
||||
mkdir -p "$data_path/conf/live/$domains"
|
||||
docker-compose run --rm --entrypoint "\
|
||||
openssl req -x509 -nodes -newkey rsa:1024 -days 1\
|
||||
-keyout '$path/privkey.pem' \
|
||||
-out '$path/fullchain.pem' \
|
||||
-subj '/CN=localhost'" certbot
|
||||
echo
|
||||
|
||||
|
||||
echo "### Starting nginx ..."
|
||||
docker-compose up --force-recreate -d ingress
|
||||
echo
|
||||
|
||||
echo "### Deleting dummy certificate for $domains ..."
|
||||
docker-compose run --rm --entrypoint "\
|
||||
rm -Rf /etc/letsencrypt/live/$domains && \
|
||||
rm -Rf /etc/letsencrypt/archive/$domains && \
|
||||
rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
|
||||
echo
|
||||
|
||||
|
||||
echo "### Requesting Let's Encrypt certificate for $domains ..."
|
||||
#Join $domains to -d args
|
||||
domain_args=""
|
||||
for domain in "${domains[@]}"; do
|
||||
domain_args="$domain_args -d $domain"
|
||||
done
|
||||
|
||||
|
||||
# Select appropriate email arg
|
||||
case "$email" in
|
||||
"") email_arg="--register-unsafely-without-email" ;;
|
||||
*) email_arg="--email $email" ;;
|
||||
esac
|
||||
|
||||
docker-compose run --rm --entrypoint "\
|
||||
certbot certonly --webroot -w /var/www/certbot \
|
||||
$staging_arg \
|
||||
$email_arg \
|
||||
$domain_args \
|
||||
--rsa-key-size $rsa_key_size \
|
||||
--agree-tos \
|
||||
--force-renewal" certbot
|
||||
echo
|
||||
|
||||
echo "### Reloading nginx ..."
|
||||
docker-compose exec ingress ingress -s reload
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem"
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
REMOTE_ADDRESS=$1
|
||||
echo Initializing new machine, $REMOTE_ADDRESS
|
||||
|
||||
cat init-remote.sh | ssh $REMOTE_ADDRESS
|
||||
Loading…
Add table
Add a link
Reference in a new issue