Change deployment
This commit is contained in:
schmelczerandras
parent
6d6284f717
commit
dc63b0186e
11 changed files with 34 additions and 324 deletions
26
.github/workflows/main.yaml
vendored
26
.github/workflows/main.yaml
vendored
|
|
@ -8,24 +8,6 @@ env:
|
|||
DOMAIN: decla.red
|
||||
|
||||
jobs:
|
||||
build-ingress:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout current branch with lfs
|
||||
uses: actions/checkout@main
|
||||
with:
|
||||
lfs: true
|
||||
|
||||
- name: Setup auth tokens
|
||||
run: |
|
||||
docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }}
|
||||
|
||||
- name: Build and push ingress
|
||||
run: |
|
||||
docker build . -t $CONTAINER_REGISTRY/declared-ingress
|
||||
docker push $CONTAINER_REGISTRY/declared-ingress
|
||||
working-directory: ingress
|
||||
|
||||
build-frontend:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
|
|
@ -48,7 +30,6 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
needs:
|
||||
- build-frontend
|
||||
- build-ingress
|
||||
steps:
|
||||
- name: Checkout current branch with lfs
|
||||
uses: actions/checkout@main
|
||||
|
|
@ -63,8 +44,7 @@ jobs:
|
|||
chmod 400 ~/.ssh/id_ed25519
|
||||
ssh -o StrictHostKeyChecking=no root@$DOMAIN uptime
|
||||
|
||||
- name: Stack up
|
||||
- name: Stack deploy
|
||||
run: |
|
||||
DOCKER_HOST=ssh://root@$DOMAIN docker login -u ${{ secrets.DOCKER_TOKEN }} -p ${{ secrets.DOCKER_TOKEN }} $CONTAINER_REGISTRY
|
||||
DOCKER_HOST=ssh://root@$DOMAIN docker stack up declared -c docker-compose.yml --with-registry-auth
|
||||
working-directory: infrastructure
|
||||
DOCKER_HOST=ssh://root@$DOMAIN docker login -u ${{ secrets.DOCKER_TOKEN }} -p ${{ secrets.DOCKER_TOKEN }}
|
||||
DOCKER_HOST=ssh://root@$DOMAIN docker stack deploy declared -c docker-compose.yml --with-registry-auth
|
||||
|
|
|
|||
31
docker-compose.yml
Normal file
31
docker-compose.yml
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
version: "3.8"
|
||||
|
||||
services:
|
||||
declared-frontend:
|
||||
init: true
|
||||
image: schmelczera/declared-frontend
|
||||
ports:
|
||||
- "80"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.1"
|
||||
memory: 16M
|
||||
reservations:
|
||||
cpus: "0.1"
|
||||
memory: 16M
|
||||
update_config:
|
||||
parallelism: 1
|
||||
failure_action: rollback
|
||||
delay: 10s
|
||||
monitor: 10s
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
|
@ -1 +0,0 @@
|
|||
CONTAINER_REGISTRY=registry.digitalocean.com/declared
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
DOMAIN=swarmpit.decla.red
|
||||
NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
|
||||
docker node update --label-add swarmpit.db-data=true $NODE_ID
|
||||
docker node update --label-add swarmpit.influx-data=true $NODE_ID
|
||||
docker stack deploy -c docker-compose.swarmpit.yml swarmpit
|
||||
|
|
@ -1,93 +0,0 @@
|
|||
version: "3.3"
|
||||
|
||||
# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml
|
||||
|
||||
services:
|
||||
app:
|
||||
image: swarmpit/swarmpit:latest
|
||||
environment:
|
||||
- SWARMPIT_DB=http://db:5984
|
||||
- SWARMPIT_INFLUXDB=http://influxdb:8086
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
ports:
|
||||
- "8080"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
reservations:
|
||||
cpus: "0.15"
|
||||
memory: 256M
|
||||
placement:
|
||||
constraints:
|
||||
- node.role == manager
|
||||
|
||||
db:
|
||||
image: couchdb:2.3.0
|
||||
volumes:
|
||||
- db-data:/opt/couchdb/data
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.db-data == true
|
||||
|
||||
influxdb:
|
||||
image: influxdb:1.7
|
||||
volumes:
|
||||
- influx-data:/var/lib/influxdb
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 64M
|
||||
placement:
|
||||
constraints:
|
||||
- node.labels.swarmpit.influx-data == true
|
||||
|
||||
agent:
|
||||
image: swarmpit/agent:latest
|
||||
environment:
|
||||
- DOCKER_API_VERSION=1.35
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
mode: global
|
||||
labels:
|
||||
swarmpit.agent: "true"
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.10"
|
||||
memory: 64M
|
||||
reservations:
|
||||
cpus: "0.05"
|
||||
memory: 32M
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
volumes:
|
||||
db-data:
|
||||
driver: local
|
||||
influx-data:
|
||||
driver: local
|
||||
|
|
@ -1,66 +0,0 @@
|
|||
version: "3.8"
|
||||
|
||||
services:
|
||||
ingress:
|
||||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-ingress
|
||||
depends_on:
|
||||
- frontend
|
||||
networks:
|
||||
- swarmpit_network
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.6"
|
||||
memory: 32M
|
||||
reservations:
|
||||
cpus: "0.2"
|
||||
memory: 32M
|
||||
update_config:
|
||||
parallelism: 1
|
||||
failure_action: rollback
|
||||
delay: 10s
|
||||
monitor: 10s
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
|
||||
volumes:
|
||||
- /etc/letsencrypt:/etc/letsencrypt
|
||||
|
||||
frontend:
|
||||
init: true
|
||||
image: ${CONTAINER_REGISTRY}/declared-frontend
|
||||
ports:
|
||||
- "80"
|
||||
networks:
|
||||
- network
|
||||
deploy:
|
||||
replicas: 2
|
||||
resources:
|
||||
limits:
|
||||
cpus: "0.1"
|
||||
memory: 32M
|
||||
reservations:
|
||||
cpus: "0.1"
|
||||
memory: 32M
|
||||
update_config:
|
||||
parallelism: 1
|
||||
failure_action: rollback
|
||||
delay: 10s
|
||||
monitor: 10s
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
window: 30s
|
||||
|
||||
networks:
|
||||
network:
|
||||
driver: overlay
|
||||
|
||||
swarmpit_network:
|
||||
external: true
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
sudo apt-get install certbot python3-certbot-dns-digitalocean -y
|
||||
|
||||
certbot certonly \
|
||||
--dns-digitalocean \
|
||||
--dns-digitalocean-credentials ~/digitalocean.api.key \
|
||||
--dns-digitalocean-propagation-seconds 120 \
|
||||
-m "schmelczerandras@gmail.com" \
|
||||
-d "decla.red" -d "*.decla.red" \
|
||||
--agree-tos --non-interactive
|
||||
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf"
|
||||
curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem"
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
echo Configuring iptables
|
||||
echo Start state
|
||||
iptables -L ufw-user-input
|
||||
|
||||
iptables -D ufw-user-input 4
|
||||
iptables -D ufw-user-input 4
|
||||
iptables -I ufw-user-input -p tcp --dport 22 -j ACCEPT
|
||||
iptables -I ufw-user-input -p tcp --dport 80 -j ACCEPT
|
||||
iptables -I ufw-user-input -p tcp --dport 443 -j ACCEPT
|
||||
|
||||
echo End state
|
||||
iptables -L ufw-user-input
|
||||
|
||||
echo Updating system
|
||||
apt update &&\
|
||||
apt upgrade -y &&\
|
||||
apt install zsh &&\
|
||||
sh -c "$(CHSH=yes curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
|
||||
|
||||
docker login -u $DOCKER_TOKEN -p $DOCKER_TOKEN registry.digitalocean.com/declared
|
||||
|
||||
echo Removing banner
|
||||
rm -rf /etc/update-motd.d/99-one-click
|
||||
|
||||
docker swarm init --advertise-addr eth0
|
||||
|
||||
./init-letsencrypt.sh
|
||||
curl https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bash
|
||||
docker-compose down
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
FROM schmelczera/error-pages as build-error-pages
|
||||
RUN python build.py 502
|
||||
|
||||
FROM nginx:alpine
|
||||
|
||||
WORKDIR /usr/share/nginx/html
|
||||
|
||||
RUN rm -rf *
|
||||
|
||||
COPY --from=build-error-pages /home/python/built errors
|
||||
RUN find . -type f | xargs gzip -k9 &&\
|
||||
chmod -R 555 .
|
||||
|
||||
COPY nginx-config /etc/nginx/
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
user nginx;
|
||||
worker_processes auto;
|
||||
|
||||
error_log /var/log/nginx/error.log warn;
|
||||
pid /var/run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /var/log/nginx/access.log main;
|
||||
|
||||
keepalive_timeout 65;
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name *.decla.red decla.red;
|
||||
server_tokens off;
|
||||
|
||||
location / {
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
server_name decla.red default_server;
|
||||
|
||||
include /etc/nginx/ssl-server.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://frontend;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
server_name swarmpit.decla.red;
|
||||
|
||||
include /etc/nginx/ssl-server.conf;
|
||||
|
||||
location / {
|
||||
proxy_pass http://app:8080;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
listen 443 ssl;
|
||||
|
||||
server_tokens off;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
|
||||
include /etc/letsencrypt/options-ssl-nginx.conf;
|
||||
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
|
||||
|
||||
location ~* ^/(502).html$ {
|
||||
root /usr/share/nginx/html/errors;
|
||||
internal;
|
||||
}
|
||||
|
||||
error_page 502 /502.html;
|
||||
Loading…
Add table
Add a link
Reference in a new issue