Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 forust
|
5b3ef39102
|
No files matched your search
@@ -1,191 +0,0 @@
|
|||||||
# Инструкция: Анализ хранилища Kubernetes и настройка NFS
|
|
||||||
|
|
||||||
## Цель
|
|
||||||
Проанализировать текущую конфигурацию хранилища Kubernetes и подготовить план внедрения NFS StorageClass для сохранения данных при удалении namespace.
|
|
||||||
|
|
||||||
## 1. Собрать информацию о кластере
|
|
||||||
|
|
||||||
### 1.1. Версия Kubernetes и тип дистрибутива
|
|
||||||
```bash
|
|
||||||
kubectl version --short
|
|
||||||
# или
|
|
||||||
kubectl version
|
|
||||||
```
|
|
||||||
|
|
||||||
Определить, используется ли k3s, k8s, microk8s и т.д.:
|
|
||||||
```bash
|
|
||||||
# Проверить наличие k3s
|
|
||||||
which k3s
|
|
||||||
# Проверить процесс
|
|
||||||
ps aux | grep -E 'kube|k3s'
|
|
||||||
```
|
|
||||||
|
|
||||||
### 1.2. StorageClass
|
|
||||||
```bash
|
|
||||||
kubectl get storageclass -o wide
|
|
||||||
```
|
|
||||||
|
|
||||||
Запомнить:
|
|
||||||
- `PROVISIONER` — какой драйвер используется
|
|
||||||
- `RECLAIMPOLICY` — Delete или Retain
|
|
||||||
- Какой StorageClass помечен как `(default)`
|
|
||||||
|
|
||||||
### 1.3. Существующие PV и PVC
|
|
||||||
```bash
|
|
||||||
kubectl get pv -o wide
|
|
||||||
kubectl get pvc --all-namespaces
|
|
||||||
```
|
|
||||||
|
|
||||||
Посмотреть, какие PVC привязаны к каким PV, и какой reclaimPolicy у PV.
|
|
||||||
|
|
||||||
### 1.4. Нода и диски
|
|
||||||
```bash
|
|
||||||
# Список нод
|
|
||||||
kubectl get nodes -o wide
|
|
||||||
|
|
||||||
# На каждой ноде (через ssh или локально):
|
|
||||||
lsblk
|
|
||||||
df -h
|
|
||||||
cat /etc/fstab
|
|
||||||
```
|
|
||||||
|
|
||||||
Определить:
|
|
||||||
- Есть ли отдельный раздел/диск для данных
|
|
||||||
- Куда смонтированы разделы
|
|
||||||
- Сколько свободного места
|
|
||||||
- Есть ли монтирование NTFS-разделов (как `/media/forust/Programs`)
|
|
||||||
|
|
||||||
### 1.5. Где local-path хранит данные (для k3s)
|
|
||||||
```bash
|
|
||||||
ls -la /var/lib/rancher/k3s/storage/ 2>/dev/null
|
|
||||||
# или для microk8s
|
|
||||||
ls -la /var/snap/microk8s/common/ 2>/dev/null
|
|
||||||
```
|
|
||||||
|
|
||||||
## 2. Анализ: сохраняются ли данные при удалении namespace?
|
|
||||||
|
|
||||||
| Сценарий | Результат |
|
|
||||||
|---|---|
|
|
||||||
| `kubectl delete ns <ns>` | Все PVC в namespace удаляются |
|
|
||||||
| PVC → PV c `reclaimPolicy: Delete` | PV и данные удалены |
|
|
||||||
| PVC → PV c `reclaimPolicy: Retain` | PV остаётся (статус Released), данные целы |
|
|
||||||
|
|
||||||
**Вывод:** Если reclaimPolicy в StorageClass = `Delete`, то данные **пропадут**. Если `Retain` — сохранятся.
|
|
||||||
|
|
||||||
## 3. План внедрения NFS
|
|
||||||
|
|
||||||
### 3.1. Проверить, установлен ли NFS
|
|
||||||
```bash
|
|
||||||
which nfsstat exportfs mount.nfs
|
|
||||||
systemctl status nfs-server 2>/dev/null || systemctl status nfs-kernel-server 2>/dev/null
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3.2. Выбрать директорию для NFS-экспорта
|
|
||||||
|
|
||||||
Варианты (выбрать подходящий):
|
|
||||||
- `/var/lib/k8s-nfs/` — на корневом разделе
|
|
||||||
- `<путь к отдельному разделу>/k8s-nfs/` — если есть отдельный диск/раздел
|
|
||||||
- Не рекомендуется использовать NTFS-раздел (проблемы с правами и производительностью)
|
|
||||||
|
|
||||||
Требования:
|
|
||||||
- Файловая система: ext4 или xfs (не ntfs!)
|
|
||||||
- Достаточно свободного места
|
|
||||||
- Права: `755`, владелец root
|
|
||||||
|
|
||||||
### 3.3. Установить NFS-сервер
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Debian/Ubuntu
|
|
||||||
apt update && apt install -y nfs-kernel-server
|
|
||||||
|
|
||||||
# RHEL/Fedora
|
|
||||||
dnf install -y nfs-utils
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3.4. Настроить экспорт
|
|
||||||
|
|
||||||
Создать директорию:
|
|
||||||
```bash
|
|
||||||
mkdir -p /var/lib/k8s-nfs
|
|
||||||
chmod 755 /var/lib/k8s-nfs
|
|
||||||
```
|
|
||||||
|
|
||||||
Добавить в `/etc/exports`:
|
|
||||||
```
|
|
||||||
/var/lib/k8s-nfs *(rw,sync,no_subtree_check,no_root_squash)
|
|
||||||
```
|
|
||||||
|
|
||||||
Применить:
|
|
||||||
```bash
|
|
||||||
exportfs -rav
|
|
||||||
```
|
|
||||||
|
|
||||||
Проверить:
|
|
||||||
```bash
|
|
||||||
showmount -e localhost
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3.5. Выбрать способ интеграции с Kubernetes
|
|
||||||
|
|
||||||
#### Вариант A: nfs-subdir-external-provisioner (проще)
|
|
||||||
```bash
|
|
||||||
helm repo add nfs-subdir-external-provisioner https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
|
|
||||||
helm install nfs-provisioner nfs-subdir-external-provisioner/nfs-subdir-external-provisioner \
|
|
||||||
--namespace kube-system \
|
|
||||||
--set nfs.server=127.0.0.1 \
|
|
||||||
--set nfs.path=/var/lib/k8s-nfs \
|
|
||||||
--set storageClass.name=nfs \
|
|
||||||
--set storageClass.defaultClass=false \
|
|
||||||
--set storageClass.reclaimPolicy=Retain
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Вариант B: NFS CSI Driver
|
|
||||||
```bash
|
|
||||||
helm repo add csi-driver-nfs https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
|
|
||||||
helm install csi-driver-nfs csi-driver-nfs/csi-driver-nfs --namespace kube-system
|
|
||||||
```
|
|
||||||
|
|
||||||
После установки CSI драйвера создать StorageClass:
|
|
||||||
```yaml
|
|
||||||
apiVersion: storage.k8s.io/v1
|
|
||||||
kind: StorageClass
|
|
||||||
metadata:
|
|
||||||
name: nfs
|
|
||||||
provisioner: nfs.csi.k8s.io
|
|
||||||
parameters:
|
|
||||||
server: 127.0.0.1
|
|
||||||
share: /var/lib/k8s-nfs
|
|
||||||
reclaimPolicy: Retain
|
|
||||||
volumeBindingMode: Immediate
|
|
||||||
```
|
|
||||||
|
|
||||||
### 3.6. Проверить результат
|
|
||||||
```bash
|
|
||||||
kubectl get storageclass
|
|
||||||
kubectl get pods -n kube-system | grep -E 'nfs|provisioner'
|
|
||||||
```
|
|
||||||
|
|
||||||
## 4. Итоговая конфигурация
|
|
||||||
|
|
||||||
После внедрения в кластере будет два StorageClass:
|
|
||||||
|
|
||||||
| Имя | Provisioner | ReclaimPolicy | Назначение |
|
|
||||||
|---|---|---|---|
|
|
||||||
| `local-path` (default) | rancher.io/local-path | Delete | Временные данные, stateless |
|
|
||||||
| `nfs` | nfs-subdir-external-provisioner или nfs.csi.k8s.io | Retain | Данные, которые нужно сохранять |
|
|
||||||
|
|
||||||
**Главное преимущество:** PVC c `storageClassName: nfs` при удалении namespace сохраняют данные на диске, так как NFS-провизор использует `reclaimPolicy: Retain` или файлы физически остаются в NFS-экспорте.
|
|
||||||
|
|
||||||
## 5. Ответы на частые вопросы
|
|
||||||
|
|
||||||
**В:** Не упадёт ли local-path при установке NFS?
|
|
||||||
**О:** Нет, они независимы. local-path продолжает работать как обычно.
|
|
||||||
|
|
||||||
**В:** Данные NFS и local-path будут на одном диске?
|
|
||||||
**О:** Да, можно настроить оба на одном разделе, в разных каталогах.
|
|
||||||
|
|
||||||
**В:** Что если у меня несколько нод?
|
|
||||||
**О:** NFS сервер нужно поднять на одной ноде, а с других нод должна быть доступна шари. Для multi-node лучше использовать отдельный сервер или distributed storage (Longhorn, Rook/Ceph).
|
|
||||||
|
|
||||||
**В:** Можно ли использовать существующий NTFS-раздел для NFS?
|
|
||||||
**О:** Не рекомендуется — NTFS не поддерживает права Linux (no_root_squash не сработает корректно), возможны проблемы с блокировками и производительностью.
|
|
||||||
@@ -1,24 +0,0 @@
|
|||||||
root = true
|
|
||||||
|
|
||||||
[*]
|
|
||||||
indent_style = space
|
|
||||||
indent_size = 2
|
|
||||||
end_of_line = lf
|
|
||||||
charset = utf-8
|
|
||||||
trim_trailing_whitespace = true
|
|
||||||
insert_final_newline = true
|
|
||||||
|
|
||||||
[*.{yml,yaml}]
|
|
||||||
indent_size = 2
|
|
||||||
|
|
||||||
[*.{json,jsonc}]
|
|
||||||
indent_size = 2
|
|
||||||
|
|
||||||
[*.md]
|
|
||||||
trim_trailing_whitespace = false
|
|
||||||
|
|
||||||
[*.py]
|
|
||||||
indent_size = 4
|
|
||||||
|
|
||||||
[{Makefile,makefile}]
|
|
||||||
indent_style = tab
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
# actionlint configuration. Passed explicitly from the ci workflow:
|
|
||||||
# actionlint -config-file .gitea/actionlint.yaml .gitea/workflows/*.yaml
|
|
||||||
#
|
|
||||||
# The self-hosted act_runner registers custom labels that actionlint cannot know
|
|
||||||
# about, so declare them here instead of silencing the whole runner-label check.
|
|
||||||
self-hosted-runner:
|
|
||||||
labels:
|
|
||||||
- arch
|
|
||||||
- homelab
|
|
||||||
- prod
|
|
||||||
@@ -1,80 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Local regressions only: kubectl is mocked and Docker is used for config parsing.
|
|
||||||
set -euo pipefail
|
|
||||||
repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
||||||
scratch="$(mktemp -d)"
|
|
||||||
trap 'rm -rf "$scratch"' EXIT
|
|
||||||
|
|
||||||
mkdir -p "$scratch/repo/app" "$scratch/repo/postgres" "$scratch/repo/netbird" "$scratch/repo/renovate"
|
|
||||||
git -C "$scratch/repo" init -q
|
|
||||||
for file in app/compose.yaml postgres/shared-compose.yaml netbird/client.compose.yaml renovate/renovate-compose.yaml; do
|
|
||||||
touch "$scratch/repo/$file"
|
|
||||||
done
|
|
||||||
git -C "$scratch/repo" add .
|
|
||||||
# shellcheck source=../workflows/compose-lint.sh
|
|
||||||
source "$repo/.gitea/workflows/compose-lint.sh"
|
|
||||||
actual="$(cd "$scratch/repo" && compose_files)"
|
|
||||||
expected=$'app/compose.yaml\nnetbird/client.compose.yaml\npostgres/shared-compose.yaml\nrenovate/renovate-compose.yaml'
|
|
||||||
[ "$actual" = "$expected" ] || { echo 'Compose discovery missed a file' >&2; exit 1; }
|
|
||||||
|
|
||||||
cat >"$scratch/compose.yaml" <<'YAML'
|
|
||||||
services:
|
|
||||||
example:
|
|
||||||
image: busybox:1.37.0
|
|
||||||
environment:
|
|
||||||
REQUIRED: ${HOMELAB_TEST_REQUIRED:?required for this regression}
|
|
||||||
YAML
|
|
||||||
unset HOMELAB_TEST_REQUIRED
|
|
||||||
if validate_compose_file "$scratch/compose.yaml" >"$scratch/config.log" 2>&1; then
|
|
||||||
echo 'Full Compose validation accepted a missing variable' >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
grep -q 'required for this regression' "$scratch/config.log"
|
|
||||||
HOMELAB_TEST_REQUIRED=present validate_compose_file "$scratch/compose.yaml"
|
|
||||||
|
|
||||||
cat >"$scratch/resources.json" <<'JSON'
|
|
||||||
{"kind":"List","items":[
|
|
||||||
{"kind":"Deployment","metadata":{"namespace":"app"},"spec":{"template":{"spec":{
|
|
||||||
"containers":[{"envFrom":[{"secretRef":{"name":"credentials"}},{"secretRef":{"name":"optional","optional":true}}],"env":[{"valueFrom":{"secretKeyRef":{"name":"credentials","key":"password"}}}]}],
|
|
||||||
"initContainers":[{"envFrom":[{"secretRef":{"name":"init"}}]}],
|
|
||||||
"imagePullSecrets":[{"name":"registry"}],
|
|
||||||
"volumes":[{"secret":{"secretName":"mounted"}},{"projected":{"sources":[{"secret":{"name":"projected"}},{"secret":{"name":"optional-projected","optional":true}}]}}]
|
|
||||||
}}}},
|
|
||||||
{"kind":"CronJob","metadata":{},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"envFrom":[{"secretRef":{"name":"cron"}}]}]}}}}}},
|
|
||||||
{"kind":"IngressRoute","metadata":{"namespace":"app"},"spec":{"tls":{"secretName":"controller-issued-tls"}}}
|
|
||||||
]}
|
|
||||||
JSON
|
|
||||||
actual="$(jq -r -f "$repo/.gitea/workflows/secret-references.jq" "$scratch/resources.json" | sort)"
|
|
||||||
expected=$'app credentials\napp init\napp mounted\napp projected\napp registry\ndefault cron'
|
|
||||||
[ "$actual" = "$expected" ] || { echo "Unexpected Secret references: $actual" >&2; exit 1; }
|
|
||||||
|
|
||||||
REPO="$repo"
|
|
||||||
# shellcheck source=../workflows/deploy-lib.sh
|
|
||||||
source "$repo/.gitea/workflows/deploy-lib.sh"
|
|
||||||
K8S_MANIFESTS=("$scratch/resources.json")
|
|
||||||
KUSTOMIZE_APPS=()
|
|
||||||
# No live cluster access. Reject credentials in app even if they exist elsewhere.
|
|
||||||
kubectl() {
|
|
||||||
case "$1" in
|
|
||||||
create) cat "$scratch/resources.json" ;;
|
|
||||||
get)
|
|
||||||
if [ "$3" = credentials ] && [ "$5" = app ]; then
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
return 0
|
|
||||||
;;
|
|
||||||
*) echo "Unexpected kubectl invocation: $*" >&2; return 1 ;;
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
if check_referenced_secrets >"$scratch/secrets.log"; then
|
|
||||||
echo 'Namespace-scoped Secret check accepted a missing Secret' >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
|
|
||||||
# API/rendering errors must not produce an empty reference list and pass.
|
|
||||||
kubectl() { return 1; }
|
|
||||||
if check_referenced_secrets >"$scratch/secrets.log"; then
|
|
||||||
echo 'Secret check accepted a failed manifest render' >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
printf '%s\n' 'Deploy validation regressions passed.'
|
|
||||||
@@ -1,550 +0,0 @@
|
|||||||
name: ci
|
|
||||||
|
|
||||||
on:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- "**"
|
|
||||||
pull_request:
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
# Every job here is checkout plus local tools. The token needs to read the tree
|
|
||||||
# and nothing else, and saying so keeps a future step that reaches for the API
|
|
||||||
# from quietly holding a token that can write to the repository.
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
concurrency:
|
|
||||||
group: ci-${{ github.ref }}
|
|
||||||
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
|
|
||||||
|
|
||||||
env:
|
|
||||||
REGISTRY: gcr.forust.xyz
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
lint-compose:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
# Structure check for every committed Compose file, active or not.
|
|
||||||
# Interpolation, env-file and bind-mount resolution are all switched off,
|
|
||||||
# because inactive stacks have no .env here and would only fail on their
|
|
||||||
# ${VAR:?} guards. Active stacks get the full check with interpolation in
|
|
||||||
# the deploy workflow, where the real .env files live.
|
|
||||||
- name: Validate Compose files
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
source .gitea/workflows/compose-lint.sh
|
|
||||||
|
|
||||||
mapfile -t safe_flags < <(compose_safe_flags)
|
|
||||||
echo "docker compose config ${safe_flags[*]-}"
|
|
||||||
|
|
||||||
mapfile -t files < <(compose_files)
|
|
||||||
if [ "${#files[@]}" -eq 0 ]; then
|
|
||||||
echo "No Compose files found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
failed=0
|
|
||||||
for f in "${files[@]}"; do
|
|
||||||
if ! out="$(validate_compose_file "$f" ${safe_flags[@]+"${safe_flags[@]}"} 2>&1)"; then
|
|
||||||
failed=1
|
|
||||||
echo "::error file=${f}::$(printf '%s' "$out" | head -1)"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "$failed" -ne 0 ]; then
|
|
||||||
echo "Compose validation failed."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "checked ${#files[@]} Compose file(s)"
|
|
||||||
|
|
||||||
lint-actionlint:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Lint Gitea Actions workflows with actionlint
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh actionlint)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
actionlint -config-file .gitea/actionlint.yaml -color .gitea/workflows/*.yaml
|
|
||||||
|
|
||||||
lint-shellcheck:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Lint shell scripts with ShellCheck
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck jq)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
mapfile -t scripts < <(
|
|
||||||
git ls-files '*.sh' ':(glob)**/*.bash'
|
|
||||||
)
|
|
||||||
if [ "${#scripts[@]}" -eq 0 ]; then
|
|
||||||
echo "No shell scripts found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
|
|
||||||
bash .gitea/tests/deploy-validation.sh
|
|
||||||
|
|
||||||
lint-prettier:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Check formatting with Prettier
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh prettier)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
|
|
||||||
mapfile -t prettier_files < <(
|
|
||||||
git ls-files \
|
|
||||||
| grep -E '\.(md|json|ya?ml|html|css)$' \
|
|
||||||
| grep -Ev '^(\.docs/|\.zed/|errorpages/html/|homepages/(forust_files|xdfnx_files)/)'
|
|
||||||
)
|
|
||||||
|
|
||||||
if [ "${#prettier_files[@]}" -eq 0 ]; then
|
|
||||||
echo "No Prettier-managed files found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
prettier --check --ignore-unknown "${prettier_files[@]}"
|
|
||||||
|
|
||||||
lint-ruff:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Lint and format-check Python with Ruff
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh ruff)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
ruff check .
|
|
||||||
ruff format --check .
|
|
||||||
|
|
||||||
lint-yaml:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Lint YAML syntax
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh yamllint)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
|
|
||||||
mapfile -t yaml_files < <(
|
|
||||||
git ls-files '*.yaml' '*.yml' \
|
|
||||||
':!node_modules/**' \
|
|
||||||
':!**/.venv/**'
|
|
||||||
)
|
|
||||||
|
|
||||||
if [ "${#yaml_files[@]}" -eq 0 ]; then
|
|
||||||
echo "No YAML files found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
yamllint -c .yamllint "${yaml_files[@]}"
|
|
||||||
|
|
||||||
lint-dockerfiles:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Lint Dockerfiles
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh hadolint)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
|
|
||||||
mapfile -t dockerfiles < <(
|
|
||||||
git ls-files ':(glob)**/Dockerfile' ':(glob)**/Dockerfile.*'
|
|
||||||
)
|
|
||||||
|
|
||||||
if [ "${#dockerfiles[@]}" -eq 0 ]; then
|
|
||||||
echo "No Dockerfiles found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
hadolint -c .hadolint.yaml "${dockerfiles[@]}"
|
|
||||||
|
|
||||||
validate:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 20
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Validate Kubernetes manifests against JSON schemas
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh kubeconform)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
|
|
||||||
mapfile -t manifests < <(
|
|
||||||
git ls-files ':(glob)**/k8s/**/*.yaml' ':(glob)**/k8s/**/*.yml' \
|
|
||||||
| grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
|
|
||||||
)
|
|
||||||
|
|
||||||
if [ "${#manifests[@]}" -eq 0 ]; then
|
|
||||||
echo "No Kubernetes manifests found."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
kubeconform \
|
|
||||||
-strict \
|
|
||||||
-ignore-missing-schemas \
|
|
||||||
-summary \
|
|
||||||
"${manifests[@]}"
|
|
||||||
|
|
||||||
# kubeconform has no schemas for CRDs, so every IngressRoute, Certificate,
|
|
||||||
# PrometheusRule, Middleware, ServersTransport and ServiceMonitor is silently
|
|
||||||
# skipped above. The live API server knows the real CRD schemas (and runs the
|
|
||||||
# cert-manager / Traefik admission webhooks), so validate there too.
|
|
||||||
#
|
|
||||||
# Only services marked with a k8s/active marker are checked: server-side
|
|
||||||
# dry-run needs the target namespace to exist, and inactive services are not
|
|
||||||
# deployed. Services being enabled for the first time are still covered by
|
|
||||||
# the JSON-schema pass above.
|
|
||||||
#
|
|
||||||
# Main pushes only. `--dry-run=server` persists nothing, but it does execute
|
|
||||||
# the admission webhooks of the production API server, so anyone able to open
|
|
||||||
# a pull request would be able to run arbitrary manifest content through
|
|
||||||
# cert-manager and Traefik. A pull request has nothing to gain from it either:
|
|
||||||
# only main is ever deployed, and this job runs to completion before the
|
|
||||||
# deploy workflow is allowed to start, so a bad CRD is still caught before
|
|
||||||
# anything reaches the cluster -- just on the push rather than on the PR.
|
|
||||||
- name: Note the server-side check is not running here
|
|
||||||
if: github.event_name == 'pull_request' || github.ref != 'refs/heads/main'
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
echo "::notice::Skipping the server-side dry-run. It executes the cert-manager and" \
|
|
||||||
"Traefik admission webhooks against the production API server, so it is limited" \
|
|
||||||
"to pushes to main. CRDs are still schema-checked by kubeconform above, and the" \
|
|
||||||
"server-side pass still runs on main before the deploy."
|
|
||||||
|
|
||||||
- name: Validate active manifests against the live API server
|
|
||||||
if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
if ! kubectl get --raw='/readyz' --request-timeout=10s >/dev/null 2>&1; then
|
|
||||||
echo "::warning::Cluster unreachable — skipped server-side validation of CRDs (IngressRoute, Certificate, PrometheusRule). Review manifest changes manually."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
mapfile -t k8s_dirs < <(
|
|
||||||
git ls-files '*.yaml' '*.yml' \
|
|
||||||
| grep -E '(^|/)k8s/' \
|
|
||||||
| sed -E 's#((^|.*/)k8s)/.*#\1#' \
|
|
||||||
| sort -u
|
|
||||||
)
|
|
||||||
|
|
||||||
manifests=()
|
|
||||||
kustomize_apps=()
|
|
||||||
for dir in "${k8s_dirs[@]}"; do
|
|
||||||
if [ ! -f "${dir}/active" ]; then
|
|
||||||
echo "skip (no k8s/active): ${dir}"
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
if [ -f "${dir}/overlays/prod/kustomization.yaml" ]; then
|
|
||||||
kustomize_apps+=("${dir}/overlays/prod")
|
|
||||||
elif [ -f "${dir}/base/kustomization.yaml" ]; then
|
|
||||||
kustomize_apps+=("${dir}/base")
|
|
||||||
else
|
|
||||||
while IFS= read -r f; do
|
|
||||||
[ -n "$f" ] && manifests+=("$f")
|
|
||||||
done < <(
|
|
||||||
git ls-files "${dir}/*.yaml" "${dir}/*.yml" \
|
|
||||||
| grep -Ev '(^|/)(kustomization\.ya?ml|.*\.example\.ya?ml|.*values\.ya?ml|patch-.*\.ya?ml)$'
|
|
||||||
)
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "server-side dry-run: ${#manifests[@]} manifests, ${#kustomize_apps[@]} kustomize apps"
|
|
||||||
failed=0
|
|
||||||
for m in ${manifests[@]+"${manifests[@]}"}; do
|
|
||||||
if ! out="$(kubectl apply --dry-run=server -f "$m" 2>&1)"; then
|
|
||||||
failed=1
|
|
||||||
echo "::error file=${m}::$(printf '%s' "$out" | head -1)"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
for k in ${kustomize_apps[@]+"${kustomize_apps[@]}"}; do
|
|
||||||
if ! out="$(kubectl apply -k "$k" --dry-run=server 2>&1)"; then
|
|
||||||
failed=1
|
|
||||||
echo "::error file=${k}::$(printf '%s' "$out" | head -1)"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "$failed" -ne 0 ]; then
|
|
||||||
echo "Server-side validation failed. The API server (or an admission webhook) rejected these manifests."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "server-side dry-run: all active manifests accepted by the API server"
|
|
||||||
|
|
||||||
build:
|
|
||||||
needs:
|
|
||||||
# The panel's scan-deps/test-backend/test-frontend jobs gated here until
|
|
||||||
# userbot moved to its own repo; upstream's code is upstream's gate now.
|
|
||||||
# The rule is unchanged: publishing and passing the checks are the same
|
|
||||||
# gate, so a commit that fails any of these still cannot move :prod.
|
|
||||||
[lint-actionlint, lint-shellcheck, lint-compose, lint-prettier, lint-ruff, lint-yaml, lint-dockerfiles, validate]
|
|
||||||
if: github.event_name != 'pull_request' && (github.ref_name == 'main' || github.ref_name == 'dev') && !startsWith(github.ref_name, 'renovate/')
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 60
|
|
||||||
outputs:
|
|
||||||
services: ${{ steps.services.outputs.services }}
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
with:
|
|
||||||
fetch-depth: 0
|
|
||||||
|
|
||||||
- name: Detect changed docker-built services
|
|
||||||
id: services
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
base="${{ github.event.before }}"
|
|
||||||
if [ -z "$base" ] || [ "$base" = "0000000000000000000000000000000000000000" ]; then
|
|
||||||
base="$(git rev-list --max-parents=0 HEAD)"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# A failed diff used to leave changed_files empty, which reads exactly
|
|
||||||
# like "nothing to build": the job went green having built nothing and
|
|
||||||
# the tag never moved. The status is checked, not assumed.
|
|
||||||
if ! changed="$(git diff --name-only "$base" "${GITHUB_SHA}")"; then
|
|
||||||
echo "::error::cannot diff ${base}..${GITHUB_SHA}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
mapfile -t changed_files <<<"$changed"
|
|
||||||
|
|
||||||
services=()
|
|
||||||
|
|
||||||
add_service() {
|
|
||||||
local name="$1"
|
|
||||||
local seen=0
|
|
||||||
for existing in "${services[@]}"; do
|
|
||||||
if [ "$existing" = "$name" ]; then
|
|
||||||
seen=1
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
if [ "$seen" -eq 0 ]; then
|
|
||||||
services+=("$name")
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
for file in "${changed_files[@]}"; do
|
|
||||||
case "$file" in
|
|
||||||
errorpages/*)
|
|
||||||
add_service errorpages
|
|
||||||
;;
|
|
||||||
homepages/*)
|
|
||||||
add_service homepages
|
|
||||||
;;
|
|
||||||
edu_master/phpsessid-bot/*|edu_master/webinar-checker/*|edu_master/compose.yaml)
|
|
||||||
add_service edu_master
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "${#services[@]}" -eq 0 ]; then
|
|
||||||
echo "No docker-built services changed."
|
|
||||||
echo "services=" >> "$GITHUB_OUTPUT"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
printf '%s\n' "${services[@]}" | tee /tmp/services.txt
|
|
||||||
echo "services=$(paste -sd, /tmp/services.txt)" >> "$GITHUB_OUTPUT"
|
|
||||||
|
|
||||||
- name: Log in to registry
|
|
||||||
# The pin step below also writes (manifest PUTs), and it runs on every
|
|
||||||
# main push — including manifest-only ones where services is empty. A
|
|
||||||
# stale persistent login on the old runner used to mask this; a clean
|
|
||||||
# runner pushes anonymously and gets 401.
|
|
||||||
if: steps.services.outputs.services != '' || github.ref_name == 'main'
|
|
||||||
shell: bash
|
|
||||||
# Through env, not by substitution into the script. A secret written
|
|
||||||
# into a run: block is pasted into the shell source before bash parses
|
|
||||||
# it, so a password containing a quote, a backtick or $(...) becomes
|
|
||||||
# code that runs. Masking the value in the log does not prevent that.
|
|
||||||
env:
|
|
||||||
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
||||||
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
printf '%s' "$REGISTRY_PASSWORD" | docker login "${REGISTRY}" \
|
|
||||||
-u "$REGISTRY_USERNAME" \
|
|
||||||
--password-stdin
|
|
||||||
|
|
||||||
- name: Build and push changed images
|
|
||||||
if: steps.services.outputs.services != ''
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
# This step was the one run: block in the workflow without it, and it
|
|
||||||
# is the one that cannot afford it: a docker push that failed partway
|
|
||||||
# through the loop used to be followed by more pushes, the loop's exit
|
|
||||||
# status came from the last one, and the job went green with half the
|
|
||||||
# images missing from the registry.
|
|
||||||
set -euo pipefail
|
|
||||||
IFS=, read -r -a services <<< "${{ steps.services.outputs.services }}"
|
|
||||||
|
|
||||||
# Tags for this push. The commit-pinned name is the point of this
|
|
||||||
# step: the deploy resolves it in preference to :prod, so a deploy
|
|
||||||
# that sat in the queue behind a later push still gets the build of
|
|
||||||
# the commit CI validated, instead of whatever :prod points at by the
|
|
||||||
# time it runs. See render_pinned in deploy-lib.sh.
|
|
||||||
commit_tag=""
|
|
||||||
if [ "${GITHUB_REF_NAME}" = "main" ]; then
|
|
||||||
commit_tag="sha-${GITHUB_SHA:0:12}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
set_tags() {
|
|
||||||
tags=()
|
|
||||||
case "${GITHUB_REF_NAME}" in
|
|
||||||
main) tags+=("main" "prod") ;;
|
|
||||||
dev) tags+=("dev") ;;
|
|
||||||
esac
|
|
||||||
if [ -n "$commit_tag" ]; then
|
|
||||||
tags+=("$commit_tag")
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
for service in "${services[@]}"; do
|
|
||||||
case "$service" in
|
|
||||||
errorpages)
|
|
||||||
image="${REGISTRY}/forust/error-pages"
|
|
||||||
set_tags
|
|
||||||
build_args=()
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
build_args+=(-t "${image}:${tag}")
|
|
||||||
done
|
|
||||||
docker build \
|
|
||||||
--cache-from "type=registry,ref=${image}:buildcache" \
|
|
||||||
--cache-to "type=registry,ref=${image}:buildcache,mode=max" \
|
|
||||||
"${build_args[@]}" errorpages
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
docker push "${image}:${tag}"
|
|
||||||
done
|
|
||||||
;;
|
|
||||||
homepages)
|
|
||||||
for variant in forust xdfnx; do
|
|
||||||
case "$variant" in
|
|
||||||
forust)
|
|
||||||
image="${REGISTRY}/forust/forust-homepage"
|
|
||||||
;;
|
|
||||||
xdfnx)
|
|
||||||
image="${REGISTRY}/forust/xdfnx-homepage"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
set_tags
|
|
||||||
build_args=()
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
build_args+=(-t "${image}:${tag}")
|
|
||||||
done
|
|
||||||
docker build \
|
|
||||||
--cache-from "type=registry,ref=${image}:buildcache" \
|
|
||||||
--cache-to "type=registry,ref=${image}:buildcache,mode=max" \
|
|
||||||
"${build_args[@]}" -f "homepages/Dockerfile.${variant}" homepages
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
docker push "${image}:${tag}"
|
|
||||||
done
|
|
||||||
done
|
|
||||||
;;
|
|
||||||
edu_master)
|
|
||||||
for variant in session-keeper webinar-checker; do
|
|
||||||
case "$variant" in
|
|
||||||
session-keeper)
|
|
||||||
context="edu_master/phpsessid-bot"
|
|
||||||
image="${REGISTRY}/forust/session-keeper"
|
|
||||||
;;
|
|
||||||
webinar-checker)
|
|
||||||
context="edu_master/webinar-checker"
|
|
||||||
image="${REGISTRY}/forust/webinar-checker"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
set_tags
|
|
||||||
build_args=()
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
build_args+=(-t "${image}:${tag}")
|
|
||||||
done
|
|
||||||
docker build \
|
|
||||||
--cache-from "type=registry,ref=${image}:buildcache" \
|
|
||||||
--cache-to "type=registry,ref=${image}:buildcache,mode=max" \
|
|
||||||
"${build_args[@]}" "$context"
|
|
||||||
for tag in "${tags[@]}"; do
|
|
||||||
docker push "${image}:${tag}"
|
|
||||||
done
|
|
||||||
done
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
# Every image the tree names has to carry the commit-pinned name, not only
|
|
||||||
# the ones this push rebuilt. A push that touches nothing but manifests
|
|
||||||
# builds nothing, and its deploy would then find no commit-pinned tag to
|
|
||||||
# resolve and quietly fall back to the moving :prod - which is the whole
|
|
||||||
# failure the commit-pinned name exists to remove.
|
|
||||||
#
|
|
||||||
# Re-tagging copies the manifest list and transfers no layers, so pinning
|
|
||||||
# six images that already exist costs six registry writes.
|
|
||||||
#
|
|
||||||
# The list is derived from the tree rather than written out here, so an
|
|
||||||
# image added to a manifest is covered without a second place to update.
|
|
||||||
- name: Pin the commit name on the images this push did not rebuild
|
|
||||||
if: github.ref_name == 'main'
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
commit_tag="sha-${GITHUB_SHA:0:12}"
|
|
||||||
mapfile -t repos < <(
|
|
||||||
git grep -hoE 'gcr\.forust\.xyz/forust/[A-Za-z0-9._-]+' -- '*.yaml' '*.yml' \
|
|
||||||
| sort -u
|
|
||||||
)
|
|
||||||
if [ "${#repos[@]}" -eq 0 ]; then
|
|
||||||
echo "No own images referenced by the tree."
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
echo "pinning ${#repos[@]} image(s) to $commit_tag"
|
|
||||||
for repo in "${repos[@]}"; do
|
|
||||||
if docker buildx imagetools inspect "$repo:$commit_tag" >/dev/null 2>&1; then
|
|
||||||
echo " already built by this push: ${repo##*/}"
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
if ! docker buildx imagetools inspect "$repo:prod" >/dev/null 2>&1; then
|
|
||||||
echo " WARNING: ${repo##*/} has no :prod to pin and no build produced it"
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
docker buildx imagetools create --tag "$repo:$commit_tag" "$repo:prod"
|
|
||||||
echo " pinned ${repo##*/}"
|
|
||||||
done
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Shared helpers for validating Compose files. Sourced both by steps in
|
|
||||||
# .gitea/workflows/ci.yaml and by deploy-lib.sh on the workstation.
|
|
||||||
#
|
|
||||||
# Two levels of checking, matching how the repo is structured:
|
|
||||||
#
|
|
||||||
# general every committed Compose file, active or not. Pure structure check:
|
|
||||||
# no ${VAR} interpolation, no .env lookup, no bind-mount path
|
|
||||||
# resolution. Disabled stacks deliberately have no .env in the repo
|
|
||||||
# and no values on the CI runner, so a full `config` run would fail on
|
|
||||||
# their `${VAR:?}` guards for reasons that have nothing to do with the
|
|
||||||
# change under review.
|
|
||||||
#
|
|
||||||
# full active stacks only, with interpolation and env-file resolution, so
|
|
||||||
# required variables and referenced files are actually resolved. Needs
|
|
||||||
# the gitignored .env files, so this only runs in the deploy workflow
|
|
||||||
# on the workstation.
|
|
||||||
#
|
|
||||||
# This file is meant to be sourced, not executed.
|
|
||||||
|
|
||||||
# All committed Compose files, including the ones deploy never starts.
|
|
||||||
compose_files() {
|
|
||||||
git ls-files \
|
|
||||||
'*compose.yaml' '*compose.yml'
|
|
||||||
}
|
|
||||||
|
|
||||||
# Prints the flags that turn `docker compose config` into the general check.
|
|
||||||
# Probed rather than hardcoded so an older Compose without --no-env-resolution
|
|
||||||
# still gets the flags it does support.
|
|
||||||
compose_safe_flags() {
|
|
||||||
local help flag
|
|
||||||
help="$(docker compose config --help 2>/dev/null || true)"
|
|
||||||
for flag in --no-interpolate --no-env-resolution --no-path-resolution; do
|
|
||||||
if printf '%s' "$help" | grep -q -- "$flag"; then
|
|
||||||
printf '%s\n' "$flag"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
# validate_compose_file <file> [extra docker compose config flags...]
|
|
||||||
validate_compose_file() {
|
|
||||||
local file="$1"
|
|
||||||
shift
|
|
||||||
docker compose -f "$file" config --quiet "$@"
|
|
||||||
}
|
|
||||||
File diff suppressed because it is too large.
Load diff
@@ -1,197 +0,0 @@
|
|||||||
name: deploy
|
|
||||||
|
|
||||||
on:
|
|
||||||
# Deploy only what CI already validated. workflow_run is used instead of
|
|
||||||
# workflow_dispatch so a red lint/validate run can never reach the cluster.
|
|
||||||
workflow_run:
|
|
||||||
workflows: [ci]
|
|
||||||
types: [completed]
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
# The deploy jobs read the tree, then reach the cluster over SSH with the
|
|
||||||
# deploy key. The Actions token itself is not part of that path, so it gets
|
|
||||||
# read-only contents and no more.
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
concurrency:
|
|
||||||
group: deploy-main
|
|
||||||
# Queue instead of cancelling. Cancelling a run kills the apply job mid-loop and
|
|
||||||
# takes the verify job down with it, so a superseded deploy would leave the
|
|
||||||
# cluster half-applied and unchecked — the exact failure the verify job exists
|
|
||||||
# to catch. kubectl apply and docker compose up are both idempotent, so letting
|
|
||||||
# the older run finish and then deploying the newer commit costs little.
|
|
||||||
cancel-in-progress: false
|
|
||||||
|
|
||||||
env:
|
|
||||||
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
||||||
DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
|
|
||||||
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
|
|
||||||
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
|
|
||||||
DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
||||||
APPLY_PRUNE: ${{ vars.APPLY_PRUNE }}
|
|
||||||
# workflow_run's own GITHUB_SHA points at the branch head, not at the commit the
|
|
||||||
# finished ci run checked. Pin the exact validated commit instead, so a push
|
|
||||||
# landing mid-deploy cannot make the workstation deploy something else. Also
|
|
||||||
# what the verify job checks the snapshot against. Empty for workflow_dispatch,
|
|
||||||
# which falls back to the current origin/main.
|
|
||||||
DEPLOY_SHA: ${{ github.event.workflow_run.head_sha }}
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
preflight:
|
|
||||||
# Autodeploy defaults to OFF: pushes deploy only when the AUTODEPLOY repo
|
|
||||||
# variable is set to 'true' (Settings -> Actions -> Variables). A manual
|
|
||||||
# Run workflow always bypasses the switch: dispatching it is the explicit
|
|
||||||
# intent to deploy.
|
|
||||||
if: >-
|
|
||||||
(vars.AUTODEPLOY == 'true' || github.event_name == 'workflow_dispatch') &&
|
|
||||||
(github.event_name != 'workflow_run' ||
|
|
||||||
(github.event.workflow_run.conclusion == 'success' &&
|
|
||||||
github.event.workflow_run.head_branch == 'main'))
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Fetch and reset workstation
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh preflight
|
|
||||||
|
|
||||||
validate:
|
|
||||||
needs: [preflight]
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
timeout-minutes: 20
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Dry-run manifests and check Secrets
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh validate
|
|
||||||
|
|
||||||
apply-k8s:
|
|
||||||
needs: [validate]
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
# Apply only, no verification, so this is just the work itself: snapshot,
|
|
||||||
# then sequential `helm upgrade --install --wait --rollback-on-failure --timeout 10m`, then the apply loop.
|
|
||||||
# Verification has its own job and its own budget.
|
|
||||||
#
|
|
||||||
# 45 is roughly four times the measured cost of the stage, which is
|
|
||||||
# deliberately not raised on a theory:
|
|
||||||
#
|
|
||||||
# helm, healthy 3 no-op upgrades ~3-5 min
|
|
||||||
# helm, one release bad rollback-on-failure spends its 10m, ~10-15 min
|
|
||||||
# then rolls that one back
|
|
||||||
# apply loop ~40 manifests, 4 of which ~1 min
|
|
||||||
# resolve an image digest
|
|
||||||
# restart_stale_images 7.6s to find 8 workloads, ~0.5 min
|
|
||||||
# 9.8s to resolve their digests
|
|
||||||
#
|
|
||||||
# The helm figure is one release, not three: `set -e` aborts
|
|
||||||
# upgrade_helm_releases on the first failure, so a broken release costs
|
|
||||||
# 10m and the other two are never attempted. Multiplying 10m by three
|
|
||||||
# overstates the worst case by 20 minutes.
|
|
||||||
#
|
|
||||||
# The 45 minutes this was last raised to 45 were still not enough, and the
|
|
||||||
# job logs for those runs no longer exist, so what actually consumed the
|
|
||||||
# budget is not known - the two measurable candidates above account for
|
|
||||||
# ~15 of it. The unbounded `docker manifest inspect` against the registry's
|
|
||||||
# known hang mode is now bounded inside registry_digest (25s timeout, 3
|
|
||||||
# attempts): a dead registry fails each owned image after ~85s instead of
|
|
||||||
# hanging the stage, and a blinking one is retried instead of failing the
|
|
||||||
# whole apply file. Still open: make the stage announce which manifest it
|
|
||||||
# is working on, so a killed run leaves a diagnosable last line.
|
|
||||||
timeout-minutes: 45
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Apply Kubernetes manifests
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh apply-k8s
|
|
||||||
|
|
||||||
apply-compose:
|
|
||||||
needs: [validate]
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
timeout-minutes: 30
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Redeploy docker compose stacks
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh apply-compose
|
|
||||||
|
|
||||||
# Watches the workloads this deploy changed and rolls back the ones that never
|
|
||||||
# became healthy. Runs even when the apply jobs failed, timed out or were
|
|
||||||
# cancelled — that is the whole point of splitting it out. `always()` is what
|
|
||||||
# lets it start after a failed dependency; the needs on apply-compose are a
|
|
||||||
# barrier, so verification begins only once both applies are done.
|
|
||||||
verify-k8s:
|
|
||||||
needs: [apply-k8s, apply-compose]
|
|
||||||
if: >-
|
|
||||||
always() &&
|
|
||||||
needs.apply-k8s.result != 'skipped' &&
|
|
||||||
needs.apply-compose.result != 'skipped'
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
# Not raised, because the arithmetic does not close.
|
|
||||||
#
|
|
||||||
# 32 workloads are under management and the wave width is 8, so the verify
|
|
||||||
# itself is 4 waves of ROLLOUT_TIMEOUT (300s) = 20 minutes worst case, when
|
|
||||||
# every rollout times out rather than converging. That is already 20 of 30.
|
|
||||||
#
|
|
||||||
# The other 10 would have to absorb rollback, and rollback_workloads is a
|
|
||||||
# serial `while read` loop at 300s per failed workload. 10 minutes buys two.
|
|
||||||
# Any larger number is buying a bigger multiple of an unbounded term rather
|
|
||||||
# than covering a known cost: 60 minutes buys eight, and 60 minutes is
|
|
||||||
# therefore not a bound, it is a guess with two digits.
|
|
||||||
#
|
|
||||||
# The number becomes derivable the moment rollback uses the same wave width
|
|
||||||
# as the verify: 32 failures then cost 4 waves = 20 minutes instead of 160,
|
|
||||||
# and 45 covers verify plus rollback at full width. That change is to the
|
|
||||||
# recovery path and is not folded into a timeout edit.
|
|
||||||
timeout-minutes: 30
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Verify workloads and roll back on failure
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh verify-k8s
|
|
||||||
|
|
||||||
# Asks the public route of every active service whether it is actually
|
|
||||||
# serving, which the rollout check above structurally cannot: a pod can
|
|
||||||
# converge and still be crash-looping, or be listening on a port no Service
|
|
||||||
# points at, or answer 500.
|
|
||||||
#
|
|
||||||
# `always()` for the same reason verify-k8s has it, and it runs after that job
|
|
||||||
# specifically because a rollback is when a route most needs re-checking. The
|
|
||||||
# needs is a barrier, not a filter: whether verify-k8s passed, failed or was
|
|
||||||
# cancelled, the probes are what say whether the cluster is serving, and
|
|
||||||
# suppressing them on a rollback would hide the one run where the answer
|
|
||||||
# matters most.
|
|
||||||
smoke:
|
|
||||||
needs: [verify-k8s]
|
|
||||||
if: always() && needs.verify-k8s.result != 'skipped'
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab, prod]
|
|
||||||
timeout-minutes: 10
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
- name: Probe the public route of every active service
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/ssh-run.sh smoke
|
|
||||||
@@ -1,264 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Installs the pinned CI tools into "$TOOLS_DIR/bin" and echoes that directory
|
|
||||||
# on stdout, so callers can do:
|
|
||||||
#
|
|
||||||
# export PATH="$(bash .gitea/workflows/install-ci-tools.sh kubeconform shellcheck):$PATH"
|
|
||||||
#
|
|
||||||
# Versions come from tool-versions.env next to this script and are kept fresh by
|
|
||||||
# Renovate. Re-running is cheap: an already-installed tool at the pinned version
|
|
||||||
# is left alone.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
# shellcheck source=tool-versions.env
|
|
||||||
. "$here/tool-versions.env"
|
|
||||||
|
|
||||||
TOOLS_DIR="${TOOLS_DIR:-${RUNNER_TEMP:-/tmp}/homelab-tools}"
|
|
||||||
BIN_DIR="$TOOLS_DIR/bin"
|
|
||||||
mkdir -p "$BIN_DIR"
|
|
||||||
# The just-installed tools must resolve inside this script too: callers only
|
|
||||||
# prepend BIN_DIR to PATH after the script exits, so a bare `uv` below would
|
|
||||||
# miss the binary install_uv just placed (exit 127 on a clean runner).
|
|
||||||
export PATH="$BIN_DIR:$PATH"
|
|
||||||
|
|
||||||
arch="$(uname -m)"
|
|
||||||
# Upstream projects disagree on arch spelling: kubeconform and actionlint use
|
|
||||||
# Go names (amd64/arm64), shellcheck uses uname names (x86_64/aarch64), node
|
|
||||||
# uses neither (x64/arm64), and hadolint mixes the two in a single release
|
|
||||||
# (x86_64 but arm64).
|
|
||||||
case "$arch" in
|
|
||||||
x86_64 | amd64)
|
|
||||||
goarch=amd64
|
|
||||||
sharch=x86_64
|
|
||||||
nodearch=x64
|
|
||||||
hadolintarch=x86_64
|
|
||||||
;;
|
|
||||||
aarch64 | arm64)
|
|
||||||
goarch=arm64
|
|
||||||
sharch=aarch64
|
|
||||||
nodearch=arm64
|
|
||||||
hadolintarch=arm64
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo "install-ci-tools: unsupported architecture: $arch" >&2
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
fetch() {
|
|
||||||
# fetch <url> <dest>
|
|
||||||
if command -v curl >/dev/null 2>&1; then
|
|
||||||
curl -sSLf --retry 3 -o "$2" "$1"
|
|
||||||
elif command -v wget >/dev/null 2>&1; then
|
|
||||||
wget -q -O "$2" "$1"
|
|
||||||
else
|
|
||||||
echo "install-ci-tools: neither curl nor wget is available" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
# resolve <command>
|
|
||||||
# Absolute path to use for invoking a tool: the copy in BIN_DIR when present,
|
|
||||||
# otherwise the name for PATH lookup. Every version check and every in-script
|
|
||||||
# invocation goes through this, so a tool missing from both places reads as
|
|
||||||
# "not installed" instead of dying with 127 under `set -e`.
|
|
||||||
resolve() {
|
|
||||||
if [ -x "$BIN_DIR/$1" ]; then
|
|
||||||
printf '%s' "$BIN_DIR/$1"
|
|
||||||
else
|
|
||||||
printf '%s' "$1"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
# installed_version <command>
|
|
||||||
# Prints the version of an already-installed tool, or nothing. Each tool spells
|
|
||||||
# its version flag differently, hence the case.
|
|
||||||
installed_version() {
|
|
||||||
local bin out
|
|
||||||
bin="$(resolve "$1")"
|
|
||||||
if ! command -v "$bin" >/dev/null 2>&1; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
case "$1" in
|
|
||||||
kubeconform) out="$("$bin" -v 2>/dev/null | head -1 || true)" ;;
|
|
||||||
*) out="$("$bin" --version 2>/dev/null | head -1 || true)" ;;
|
|
||||||
esac
|
|
||||||
printf '%s' "$out"
|
|
||||||
}
|
|
||||||
|
|
||||||
# at_version <command> <expected>
|
|
||||||
at_version() {
|
|
||||||
case "$(installed_version "$1")" in
|
|
||||||
*"$2"*) return 0 ;;
|
|
||||||
*) return 1 ;;
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
install_kubeconform() {
|
|
||||||
if at_version kubeconform "v${KUBECONFORM_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
local tmp
|
|
||||||
tmp="$(mktemp -d)"
|
|
||||||
fetch "https://github.com/yannh/kubeconform/releases/download/v${KUBECONFORM_VERSION}/kubeconform-linux-${goarch}.tar.gz" \
|
|
||||||
"$tmp/kubeconform.tar.gz"
|
|
||||||
tar -xzf "$tmp/kubeconform.tar.gz" -C "$tmp" kubeconform
|
|
||||||
install -m 0755 "$tmp/kubeconform" "$BIN_DIR/kubeconform"
|
|
||||||
rm -rf "$tmp"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_shellcheck() {
|
|
||||||
if at_version shellcheck "${SHELLCHECK_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
local tmp
|
|
||||||
tmp="$(mktemp -d)"
|
|
||||||
fetch "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.${sharch}.tar.xz" \
|
|
||||||
"$tmp/shellcheck.tar.xz"
|
|
||||||
tar -xJf "$tmp/shellcheck.tar.xz" -C "$tmp" --strip-components=1 "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
|
|
||||||
install -m 0755 "$tmp/shellcheck" "$BIN_DIR/shellcheck"
|
|
||||||
rm -rf "$tmp"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_jq() {
|
|
||||||
if at_version jq "${JQ_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
fetch "https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-${goarch}" \
|
|
||||||
"$BIN_DIR/jq"
|
|
||||||
chmod 0755 "$BIN_DIR/jq"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_uv() {
|
|
||||||
if at_version uv "${UV_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
local tmp
|
|
||||||
tmp="$(mktemp -d)"
|
|
||||||
# uv release tags carry no leading v, unlike every other tool installed here.
|
|
||||||
fetch "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${sharch}-unknown-linux-gnu.tar.gz" \
|
|
||||||
"$tmp/uv.tar.gz"
|
|
||||||
tar -xzf "$tmp/uv.tar.gz" -C "$tmp" --strip-components=1 "uv-${sharch}-unknown-linux-gnu/uv"
|
|
||||||
install -m 0755 "$tmp/uv" "$BIN_DIR/uv"
|
|
||||||
rm -rf "$tmp"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_hadolint() {
|
|
||||||
if at_version hadolint "${HADOLINT_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
# A bare binary, no archive: hadolint ships one file per platform.
|
|
||||||
fetch "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-${hadolintarch}" \
|
|
||||||
"$BIN_DIR/hadolint"
|
|
||||||
chmod 0755 "$BIN_DIR/hadolint"
|
|
||||||
}
|
|
||||||
|
|
||||||
# ruff and yamllint both come from PyPI as wheels, which uv unpacks for us.
|
|
||||||
install_uv_tool() {
|
|
||||||
# <package> <pinned version>
|
|
||||||
if at_version "$1" "$2"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
install_uv
|
|
||||||
UV_TOOL_BIN_DIR="$BIN_DIR" "$BIN_DIR/uv" tool install --force "$1==$2" >/dev/null
|
|
||||||
}
|
|
||||||
|
|
||||||
install_ruff() {
|
|
||||||
install_uv_tool ruff "${RUFF_VERSION}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_yamllint() {
|
|
||||||
install_uv_tool yamllint "${YAMLLINT_VERSION}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_pip_audit() {
|
|
||||||
install_uv_tool pip-audit "${PIP_AUDIT_VERSION}"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_prettier() {
|
|
||||||
if at_version prettier "${PRETTIER_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
# Not a standalone binary: prettier's entry point requires ../package.json
|
|
||||||
# relative to its own real path, so the package directory has to survive
|
|
||||||
# next to it. Hence a versioned directory plus a relative symlink, rather
|
|
||||||
# than copying the one file out as the other installers do.
|
|
||||||
local dir="$BIN_DIR/prettier-${PRETTIER_VERSION}"
|
|
||||||
if [ ! -f "$dir/package/package.json" ]; then
|
|
||||||
rm -rf "$dir"
|
|
||||||
mkdir -p "$dir"
|
|
||||||
fetch "https://registry.npmjs.org/prettier/-/prettier-${PRETTIER_VERSION}.tgz" "$dir/prettier.tgz"
|
|
||||||
tar -xzf "$dir/prettier.tgz" -C "$dir"
|
|
||||||
rm -f "$dir/prettier.tgz"
|
|
||||||
# npm strips the exec bit from bin/ on the way into the tarball.
|
|
||||||
chmod 0755 "$dir/package/bin/prettier.cjs"
|
|
||||||
fi
|
|
||||||
# Relative, so the whole tree stays valid if TOOLS_DIR is relocated.
|
|
||||||
ln -sfn "prettier-${PRETTIER_VERSION}/package/bin/prettier.cjs" "$BIN_DIR/prettier"
|
|
||||||
}
|
|
||||||
|
|
||||||
install_node() {
|
|
||||||
# npm gets checked by running it, not by looking it up: what matters is that
|
|
||||||
# it answers, so a stub, a half-removed Arch package or a name that resolves
|
|
||||||
# to something broken all have to read as "not installed". The runner's npm
|
|
||||||
# is a symlink into /usr/lib/node_modules/npm, which is exactly the kind of
|
|
||||||
# thing that disappears between runs.
|
|
||||||
if at_version node "v${NODE_VERSION}" && [ -n "$(installed_version npm)" ]; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
# Same shape as prettier above: the tarball's bin/npm and bin/npx are links
|
|
||||||
# into lib/node_modules, so the whole tree has to survive next to them.
|
|
||||||
local dir="$BIN_DIR/node-${NODE_VERSION}"
|
|
||||||
if [ ! -x "$dir/bin/node" ]; then
|
|
||||||
rm -rf "$dir"
|
|
||||||
mkdir -p "$dir"
|
|
||||||
fetch "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${nodearch}.tar.xz" \
|
|
||||||
"$dir/node.tar.xz"
|
|
||||||
tar -xJf "$dir/node.tar.xz" -C "$dir" --strip-components=1 "node-v${NODE_VERSION}-linux-${nodearch}"
|
|
||||||
rm -f "$dir/node.tar.xz"
|
|
||||||
fi
|
|
||||||
# Relative, so the whole tree stays valid if TOOLS_DIR is relocated.
|
|
||||||
for bin in node npm npx; do
|
|
||||||
ln -sfn "node-${NODE_VERSION}/bin/${bin}" "$BIN_DIR/${bin}"
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
install_actionlint() {
|
|
||||||
if at_version actionlint "${ACTIONLINT_VERSION}"; then
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
local tmp
|
|
||||||
tmp="$(mktemp -d)"
|
|
||||||
fetch "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_${goarch}.tar.gz" \
|
|
||||||
"$tmp/actionlint.tar.gz"
|
|
||||||
tar -xzf "$tmp/actionlint.tar.gz" -C "$tmp" actionlint
|
|
||||||
install -m 0755 "$tmp/actionlint" "$BIN_DIR/actionlint"
|
|
||||||
rm -rf "$tmp"
|
|
||||||
}
|
|
||||||
|
|
||||||
wanted=("$@")
|
|
||||||
if [ "${#wanted[@]}" -eq 0 ]; then
|
|
||||||
wanted=(kubeconform shellcheck actionlint prettier ruff yamllint hadolint)
|
|
||||||
fi
|
|
||||||
|
|
||||||
for tool in "${wanted[@]}"; do
|
|
||||||
case "$tool" in
|
|
||||||
kubeconform) install_kubeconform ;;
|
|
||||||
shellcheck) install_shellcheck ;;
|
|
||||||
jq) install_jq ;;
|
|
||||||
actionlint) install_actionlint ;;
|
|
||||||
prettier) install_prettier ;;
|
|
||||||
ruff) install_ruff ;;
|
|
||||||
yamllint) install_yamllint ;;
|
|
||||||
pip-audit) install_pip_audit ;;
|
|
||||||
hadolint) install_hadolint ;;
|
|
||||||
node) install_node ;;
|
|
||||||
uv) install_uv ;;
|
|
||||||
*)
|
|
||||||
echo "install-ci-tools: unknown tool: $tool" >&2
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
printf '%s\n' "$BIN_DIR"
|
|
||||||
@@ -1,76 +0,0 @@
|
|||||||
name: renovate-ci
|
|
||||||
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
push:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
workflow_dispatch:
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
validate-renovate:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 20
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
# renovate/k8s/cronjob.yaml is the single source of truth for the image tag,
|
|
||||||
# so the same version that runs in the cluster is the one validated here.
|
|
||||||
- name: Resolve the deployed Renovate image
|
|
||||||
id: image
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
image="$(sed -n 's|.*image:[[:space:]]*\(renovate/renovate:[^[:space:]]*\).*|\1|p' \
|
|
||||||
renovate/k8s/cronjob.yaml | head -1)"
|
|
||||||
if [ -z "$image" ]; then
|
|
||||||
echo "::error::no renovate/renovate image found in renovate/k8s/cronjob.yaml"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "using $image"
|
|
||||||
echo "image=$image" >> "$GITHUB_OUTPUT"
|
|
||||||
|
|
||||||
- name: Validate Renovate repository config
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
docker run --rm \
|
|
||||||
-v "$PWD/renovate:/opt/renovate:ro" \
|
|
||||||
-e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
|
|
||||||
"${{ steps.image.outputs.image }}" \
|
|
||||||
renovate-config-validator /opt/renovate/renovate.json
|
|
||||||
|
|
||||||
# The CronJob cannot read the repository, so renovate/k8s/configmap.yaml
|
|
||||||
# carries an inlined copy of the config. Fail if it no longer matches.
|
|
||||||
- name: Check the generated Renovate ConfigMap
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
./.gitea/workflows/sync-renovate-configmap.sh --check
|
|
||||||
|
|
||||||
- name: Validate Renovate Kubernetes manifests
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
tools_dir="$(bash .gitea/workflows/install-ci-tools.sh kubeconform)"
|
|
||||||
export PATH="$tools_dir:$PATH"
|
|
||||||
kubeconform \
|
|
||||||
-strict \
|
|
||||||
-ignore-missing-schemas \
|
|
||||||
-summary \
|
|
||||||
renovate/k8s/namespace.yaml \
|
|
||||||
renovate/k8s/configmap.yaml \
|
|
||||||
renovate/k8s/cronjob.yaml
|
|
||||||
|
|
||||||
- name: Validate Renovate Compose file
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
source .gitea/workflows/compose-lint.sh
|
|
||||||
mapfile -t safe_flags < <(compose_safe_flags)
|
|
||||||
validate_compose_file renovate/renovate-compose.yaml \
|
|
||||||
${safe_flags[@]+"${safe_flags[@]}"}
|
|
||||||
@@ -1,92 +0,0 @@
|
|||||||
name: renovate-run
|
|
||||||
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
inputs:
|
|
||||||
repositories:
|
|
||||||
description: "Repositories to scan (comma-separated)"
|
|
||||||
required: false
|
|
||||||
default: "forust/homelab"
|
|
||||||
log_level:
|
|
||||||
description: "Renovate log level"
|
|
||||||
required: false
|
|
||||||
default: "info"
|
|
||||||
type: choice
|
|
||||||
options:
|
|
||||||
- info
|
|
||||||
- debug
|
|
||||||
dry_run:
|
|
||||||
description: "Plan only, do not open or update PRs"
|
|
||||||
required: false
|
|
||||||
default: false
|
|
||||||
type: boolean
|
|
||||||
|
|
||||||
# Renovate writes through its own bot PAT, passed in as RENOVATE_TOKEN, so the
|
|
||||||
# Actions token is only ever used to read the checkout.
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
concurrency:
|
|
||||||
group: renovate-run
|
|
||||||
cancel-in-progress: false
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
run-renovate:
|
|
||||||
runs-on: [self-hosted, linux, arch, homelab]
|
|
||||||
timeout-minutes: 60
|
|
||||||
steps:
|
|
||||||
- name: Checkout repository
|
|
||||||
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
||||||
|
|
||||||
# renovate/k8s/cronjob.yaml is the single source of truth for the image tag.
|
|
||||||
# Reading it here means this workflow validates and runs the exact version
|
|
||||||
# that is deployed, instead of a copy that silently goes stale.
|
|
||||||
- name: Resolve the deployed Renovate image
|
|
||||||
id: image
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
image="$(sed -n 's|.*image:[[:space:]]*\(renovate/renovate:[^[:space:]]*\).*|\1|p' \
|
|
||||||
renovate/k8s/cronjob.yaml | head -1)"
|
|
||||||
if [ -z "$image" ]; then
|
|
||||||
echo "::error::no renovate/renovate image found in renovate/k8s/cronjob.yaml"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "using $image"
|
|
||||||
echo "image=$image" >> "$GITHUB_OUTPUT"
|
|
||||||
|
|
||||||
- name: Validate Renovate config
|
|
||||||
shell: bash
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
docker run --rm \
|
|
||||||
-v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
|
|
||||||
-e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
|
|
||||||
"${{ steps.image.outputs.image }}" \
|
|
||||||
renovate-config-validator
|
|
||||||
|
|
||||||
- name: Run Renovate
|
|
||||||
shell: bash
|
|
||||||
env:
|
|
||||||
RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
|
|
||||||
RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
|
|
||||||
RENOVATE_REPOSITORIES: ${{ inputs.repositories }}
|
|
||||||
RENOVATE_DRY_RUN: ${{ inputs.dry_run && 'full' || '' }}
|
|
||||||
LOG_LEVEL: ${{ inputs.log_level }}
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
: "${RENOVATE_TOKEN:?missing RENOVATE_TOKEN secret — add a renovate-bot PAT in repo/org Actions secrets}"
|
|
||||||
|
|
||||||
docker run --rm \
|
|
||||||
-v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
|
|
||||||
-e RENOVATE_PLATFORM=gitea \
|
|
||||||
-e RENOVATE_ENDPOINT=https://git.forust.xyz/api/v1 \
|
|
||||||
-e RENOVATE_TOKEN="$RENOVATE_TOKEN" \
|
|
||||||
-e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \
|
|
||||||
-e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \
|
|
||||||
-e RENOVATE_DRY_RUN="${RENOVATE_DRY_RUN:-}" \
|
|
||||||
-e RENOVATE_CONFIG_FILE=/opt/renovate/renovate.json \
|
|
||||||
-e RENOVATE_BASE_DIR=/tmp/renovate \
|
|
||||||
-e LOG_LEVEL="${LOG_LEVEL:-info}" \
|
|
||||||
"${{ steps.image.outputs.image }}"
|
|
||||||
@@ -1,13 +0,0 @@
|
|||||||
# kubectl emits a List for files containing multiple resources.
|
|
||||||
(if .kind == "List" then .items[] else . end)
|
|
||||||
| (.metadata.namespace // "default") as $ns
|
|
||||||
| [
|
|
||||||
(.. | objects
|
|
||||||
| (.secretRef? // empty), (.secretKeyRef? // empty), (.secret? // empty)
|
|
||||||
| select(.optional != true)
|
|
||||||
| .name // .secretName // empty),
|
|
||||||
(.. | objects | .imagePullSecrets[]?.name)
|
|
||||||
]
|
|
||||||
| unique[]
|
|
||||||
| select(. != null and . != "")
|
|
||||||
| "\($ns) \(.)"
|
|
||||||
@@ -1,71 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# usage: ssh-run.sh <stage>
|
|
||||||
# Runs one deploy-lib.sh stage on the workstation over SSH.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
: "${DEPLOY_HOST:?missing DEPLOY_HOST}"
|
|
||||||
: "${DEPLOY_USER:?missing DEPLOY_USER}"
|
|
||||||
: "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
|
|
||||||
|
|
||||||
deploy_port="${DEPLOY_PORT:-22}"
|
|
||||||
deploy_path="${DEPLOY_PATH:-/srv/homelab}"
|
|
||||||
deploy_path="$(printf '%s' "$deploy_path" | tr -d '\"' | tr -d '\r' | xargs)"
|
|
||||||
|
|
||||||
# The private key is written to a per-run directory that is removed on exit, so a
|
|
||||||
# failed or cancelled job cannot leave deploy credentials in the runner's temp
|
|
||||||
# directory. Do not use a fixed path: apply-k8s and apply-compose run in parallel.
|
|
||||||
key_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/homelab-deploy-key.XXXXXXXX")"
|
|
||||||
trap 'rm -rf "$key_dir"' EXIT INT TERM
|
|
||||||
|
|
||||||
ssh_key="$key_dir/deploy_key"
|
|
||||||
printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
|
|
||||||
chmod 600 "$ssh_key"
|
|
||||||
|
|
||||||
# A connection that died silently used to hang until the job timeout, and the
|
|
||||||
# stage was never re-run: one flaky TCP session cost a whole 45-minute apply.
|
|
||||||
# ServerAlive* bounds how long a dead peer goes unnoticed, ConnectTimeout bounds
|
|
||||||
# setup. Only exit 255 - ssh's own transport failures - is retried. A stage that
|
|
||||||
# fails on its own merits exits with the remote's status, so a real failure
|
|
||||||
# still surfaces its own log instead of burning three attempts. The stages are
|
|
||||||
# declarative applies, so re-running one that had already committed is harmless.
|
|
||||||
ssh_opts=(
|
|
||||||
-i "$ssh_key" -p "$deploy_port"
|
|
||||||
-o BatchMode=yes -o StrictHostKeyChecking=accept-new
|
|
||||||
-o ConnectTimeout=15
|
|
||||||
-o ServerAliveInterval=15 -o ServerAliveCountMax=4
|
|
||||||
)
|
|
||||||
|
|
||||||
rc=0
|
|
||||||
# apply-k8s and apply-compose are separate workflow jobs so the graph stays
|
|
||||||
# intact for the verify job, but on a single node they must not run at once:
|
|
||||||
# host docker churn on top of cluster churn is what melts the node (load 40+,
|
|
||||||
# netbird/ssh die, helm is left pending-*). Serialize them on the workstation
|
|
||||||
# with a shared lock; whoever arrives second waits.
|
|
||||||
remote_cmd=(bash -se)
|
|
||||||
case "$1" in
|
|
||||||
apply-k8s | apply-compose)
|
|
||||||
remote_cmd=(flock -w 5400 /tmp/homelab-apply.lock bash -se)
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
for attempt in 1 2 3; do
|
|
||||||
if [ "$attempt" -gt 1 ]; then
|
|
||||||
echo ":: warning::ssh transport failed, retrying (${attempt}/3)"
|
|
||||||
sleep $((attempt * 5))
|
|
||||||
fi
|
|
||||||
rc=0
|
|
||||||
# shellcheck disable=SC2029 # remote_cmd/ssh_opts expand on the client on purpose: they select the local ssh invocation, only the heredoc runs remotely.
|
|
||||||
ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" \
|
|
||||||
env "REPO=$deploy_path" "APPLY_PRUNE=${APPLY_PRUNE:-false}" \
|
|
||||||
"DEPLOY_SHA=${DEPLOY_SHA:-}" "DEPLOY_SNAPSHOT_DIR=${DEPLOY_SNAPSHOT_DIR:-}" \
|
|
||||||
"STAGE=$1" "${remote_cmd[@]}" <<'EOF' || rc=$?
|
|
||||||
source "$REPO/.gitea/workflows/deploy-lib.sh"
|
|
||||||
run_stage "$STAGE"
|
|
||||||
EOF
|
|
||||||
[ "$rc" -eq 0 ] && break
|
|
||||||
[ "$rc" -ne 255 ] && break
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "$rc" -ne 0 ]; then
|
|
||||||
echo ":: error::stage $1 failed over ssh (exit $rc)"
|
|
||||||
fi
|
|
||||||
exit "$rc"
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Regenerates renovate/k8s/configmap.yaml from renovate/renovate.json.
|
|
||||||
#
|
|
||||||
# renovate/renovate.json is the single source of truth: the CronJob, the Compose
|
|
||||||
# file and the renovate-run workflow all mount that exact file. A ConfigMap cannot
|
|
||||||
# read a file from the repository, so the same bytes are inlined here as a literal
|
|
||||||
# block. This script keeps the copy honest:
|
|
||||||
#
|
|
||||||
# .gitea/workflows/sync-renovate-configmap.sh # rewrite in place
|
|
||||||
# .gitea/workflows/sync-renovate-configmap.sh --check # fail if out of date
|
|
||||||
#
|
|
||||||
# renovate-ci runs the --check form on every PR and push, so a config change that
|
|
||||||
# forgets to regenerate the ConfigMap cannot be merged.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
||||||
repo="$(git -C "$here" rev-parse --show-toplevel)"
|
|
||||||
|
|
||||||
src="$repo/renovate/renovate.json"
|
|
||||||
dst="$repo/renovate/k8s/configmap.yaml"
|
|
||||||
[ -f "$src" ] || {
|
|
||||||
echo "missing $src" >&2
|
|
||||||
exit 1
|
|
||||||
}
|
|
||||||
|
|
||||||
render() {
|
|
||||||
cat <<'HEADER'
|
|
||||||
# GENERATED FILE - do not edit by hand.
|
|
||||||
# Source: renovate/renovate.json
|
|
||||||
# Regenerate: .gitea/workflows/sync-renovate-configmap.sh
|
|
||||||
# Verify: .gitea/workflows/sync-renovate-configmap.sh --check
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: renovate-config
|
|
||||||
namespace: renovate
|
|
||||||
data:
|
|
||||||
renovate.json: |
|
|
||||||
HEADER
|
|
||||||
sed 's/^/ /' "$src"
|
|
||||||
}
|
|
||||||
|
|
||||||
if [ "${1:-}" = "--check" ]; then
|
|
||||||
if ! diff -u "$dst" <(render) >/dev/null 2>&1; then
|
|
||||||
echo "ERROR: $dst is out of sync with renovate/renovate.json"
|
|
||||||
echo "Run: .gitea/workflows/sync-renovate-configmap.sh"
|
|
||||||
diff -u "$dst" <(render) || true
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "renovate/k8s/configmap.yaml is in sync with renovate/renovate.json"
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
render >"$dst"
|
|
||||||
echo "wrote $dst"
|
|
||||||
@@ -1,36 +0,0 @@
|
|||||||
# Pinned versions of the CI tools installed by install-ci-tools.sh.
|
|
||||||
# Renovate keeps these up to date (see customManagers in renovate/renovate.json).
|
|
||||||
#
|
|
||||||
# Every version here except NODE_VERSION matches what was already installed on
|
|
||||||
# the runner, so pinning them changes what CI does not at all. It changes what
|
|
||||||
# CI does when the runner is rebuilt with something else: today
|
|
||||||
# install-ci-tools.sh finds the pinned version already on PATH and installs
|
|
||||||
# nothing, and a runner that drifts gets the pinned one installed over it.
|
|
||||||
#
|
|
||||||
# The renovate image version is NOT pinned here: renovate/k8s/cronjob.yaml is the
|
|
||||||
# single source of truth and the workflows read the tag from it, so there is
|
|
||||||
# nothing to drift.
|
|
||||||
ACTIONLINT_VERSION="1.7.7"
|
|
||||||
SHELLCHECK_VERSION="0.11.0"
|
|
||||||
KUBECONFORM_VERSION="0.8.0"
|
|
||||||
PRETTIER_VERSION="3.8.1"
|
|
||||||
RUFF_VERSION="0.16.8"
|
|
||||||
YAMLLINT_VERSION="1.38.0"
|
|
||||||
HADOLINT_VERSION="2.14.0"
|
|
||||||
# pip-audit reads the advisory database over the network, so a floating version
|
|
||||||
# would make the same commit report different things on different days. Pin it
|
|
||||||
# like the rest: the advisories themselves are the moving part, not the tool.
|
|
||||||
PIP_AUDIT_VERSION="2.10.1"
|
|
||||||
# uv builds the throwaway venv the pytest job runs in, and unpacks the PyPI
|
|
||||||
# wheels for ruff, yamllint and pip-audit.
|
|
||||||
UV_VERSION="0.12.17"
|
|
||||||
# node runs `npm ci` for the frontend tests and the npm audit, and it is the one
|
|
||||||
# pin here that does NOT come from the runner: the runner's system node is a
|
|
||||||
# rolling Arch package (it was node 26 with no npm at all when this was pinned),
|
|
||||||
# and the panel image is node:22-alpine. Pinned to the image's major on purpose,
|
|
||||||
# so the tree that gets tested is the tree that gets built. Renovate keeps this
|
|
||||||
# in step with the Dockerfile's node: tag via the "node runtime" group.
|
|
||||||
NODE_VERSION="22.23.3"
|
|
||||||
|
|
||||||
# Secret-reference regression tests parse rendered Kubernetes objects.
|
|
||||||
JQ_VERSION="1.8.1"
|
|
||||||
+7
-31
@@ -5,12 +5,12 @@ sync.ffs_lock
|
|||||||
# Copyparty
|
# Copyparty
|
||||||
*.hist/
|
*.hist/
|
||||||
|
|
||||||
# Volumes, configs and data directories
|
# Volumes and data directories
|
||||||
gitea/gitea-db/
|
gitea/gitea-db/
|
||||||
gitea/gitea-data/*
|
gitea/gitea-data/*
|
||||||
n8n/n8n-data/*
|
n8n/n8n-data/*
|
||||||
n8n/n8n-node-data/*
|
n8n/n8n-node-data/*
|
||||||
adguardhome/conf/*
|
adguardhome/data/*
|
||||||
dockmon/data/*
|
dockmon/data/*
|
||||||
portainer/portainer_data/*
|
portainer/portainer_data/*
|
||||||
metube/MeTube_downloads
|
metube/MeTube_downloads
|
||||||
@@ -21,10 +21,6 @@ checkmk/checkmk/*
|
|||||||
downtify/Downtify_downloads
|
downtify/Downtify_downloads
|
||||||
headscale/config/*
|
headscale/config/*
|
||||||
headscale/data/*
|
headscale/data/*
|
||||||
# NetBird local hostnames and generated secrets
|
|
||||||
netbird/.env
|
|
||||||
netbird/secrets/
|
|
||||||
searxng/core-config/*
|
|
||||||
|
|
||||||
# Steaming services files
|
# Steaming services files
|
||||||
streaming/jellyfin/*
|
streaming/jellyfin/*
|
||||||
@@ -35,28 +31,23 @@ streaming/data/*
|
|||||||
streaming/qbittorrent/*
|
streaming/qbittorrent/*
|
||||||
streaming/prowlarr/*
|
streaming/prowlarr/*
|
||||||
|
|
||||||
# Homepage
|
# Homepage
|
||||||
|
homepages/forust_files/assets/images/team/*
|
||||||
homepages/forust_files/.well-known/*
|
homepages/forust_files/.well-known/*
|
||||||
|
|
||||||
# Traefik files
|
# Traefik files
|
||||||
traefik/letsencrypt/acme.json
|
traefik/letsencrypt/acme.json
|
||||||
traefik/dynamic/fileservers.yml
|
traefik/dynamic/fileservers.yml
|
||||||
traefik/dynamic/*.local.y*ml.*
|
|
||||||
traefik/dynamic/*.external.y*ml
|
|
||||||
traefik/k8s/fileservers.y*ml
|
|
||||||
traefik/k8s/aliasHeadersStrategy.md
|
|
||||||
|
|
||||||
traefik/logs/*
|
traefik/logs/*
|
||||||
|
|
||||||
# SSL Certificates
|
# SSL Certificates
|
||||||
adguardhome/certs/*
|
adguardhome/certs/*
|
||||||
traefik/certs/*
|
traefik/certs/*
|
||||||
certs/
|
|
||||||
|
|
||||||
# Monitoring
|
# Monitoring
|
||||||
monitoring/prometheus.yml
|
monitoring/prometheus.yml
|
||||||
|
|
||||||
# Python
|
# Python
|
||||||
.python-version
|
.python-version
|
||||||
venv/
|
venv/
|
||||||
pyc
|
pyc
|
||||||
@@ -86,8 +77,6 @@ replacements.txt
|
|||||||
|
|
||||||
# Git
|
# Git
|
||||||
.gitattributes
|
.gitattributes
|
||||||
# Gitea/github Runners
|
|
||||||
.runner
|
|
||||||
|
|
||||||
# Misc
|
# Misc
|
||||||
.DS_Store
|
.DS_Store
|
||||||
@@ -96,23 +85,10 @@ replacements.txt
|
|||||||
# Temp files
|
# Temp files
|
||||||
edu_master/temp/
|
edu_master/temp/
|
||||||
temp/*
|
temp/*
|
||||||
# Local-only tooling scratch space (pinned CI tools, verification scripts)
|
|
||||||
tmp/
|
|
||||||
|
|
||||||
# Environment
|
# Environment
|
||||||
.env
|
.env
|
||||||
.env.anna
|
.env.anna
|
||||||
.env.forust
|
.env.forust
|
||||||
.env.*
|
.env.*
|
||||||
!*example
|
!*example
|
||||||
|
|
||||||
# kubernetes
|
|
||||||
*/k8s/*secret*
|
|
||||||
!*/k8s/*secret*.example
|
|
||||||
**/k8s/*secret*
|
|
||||||
!**/k8s/*secret*.example
|
|
||||||
# Local-only tweaks, not for upstream
|
|
||||||
prometheus-stack/k8s/grafana-values.yaml
|
|
||||||
traefik/k8s/local-tls.yaml
|
|
||||||
converters/k8s/config.yaml
|
|
||||||
convertx/k8s/config.yaml
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
ignored:
|
|
||||||
- DL3008
|
|
||||||
- DL3042
|
|
||||||
- DL3018
|
|
||||||
- DL3059
|
|
||||||
trustedRegistries:
|
|
||||||
- docker.io
|
|
||||||
- ghcr.io
|
|
||||||
- quay.io
|
|
||||||
- gcr.forust.xyz
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
{
|
|
||||||
"default": true,
|
|
||||||
"MD013": false,
|
|
||||||
"MD024": false,
|
|
||||||
"MD033": false,
|
|
||||||
"MD041": false,
|
|
||||||
"MD046": false
|
|
||||||
}
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
bracketSameLine: true
|
|
||||||
htmlWhitespaceSensitivity: css
|
|
||||||
printWidth: 120
|
|
||||||
tabWidth: 2
|
|
||||||
trailingComma: all
|
|
||||||
proseWrap: preserve
|
|
||||||
endOfLine: lf
|
|
||||||
@@ -1,22 +0,0 @@
|
|||||||
extends: default
|
|
||||||
|
|
||||||
rules:
|
|
||||||
comments:
|
|
||||||
min-spaces-from-content: 1
|
|
||||||
comments-indentation: false
|
|
||||||
document-start: disable
|
|
||||||
line-length: disable
|
|
||||||
braces:
|
|
||||||
min-spaces-inside: 0
|
|
||||||
max-spaces-inside: 1
|
|
||||||
brackets:
|
|
||||||
min-spaces-inside: 0
|
|
||||||
max-spaces-inside: 1
|
|
||||||
indentation:
|
|
||||||
spaces: 2
|
|
||||||
indent-sequences: consistent
|
|
||||||
truthy:
|
|
||||||
allowed-values:
|
|
||||||
- "true"
|
|
||||||
- "false"
|
|
||||||
- "on"
|
|
||||||
@@ -1,40 +0,0 @@
|
|||||||
{
|
|
||||||
"tab_size": 2,
|
|
||||||
"soft_wrap": "prefer_line",
|
|
||||||
"preferred_line_length": 120,
|
|
||||||
"format_on_save": "on",
|
|
||||||
"languages": {
|
|
||||||
"YAML": {
|
|
||||||
"tab_size": 2,
|
|
||||||
"hard_tabs": false,
|
|
||||||
"format_on_save": "on",
|
|
||||||
"formatter": {
|
|
||||||
"language_server": { "name": "yaml-language-server" },
|
|
||||||
},
|
|
||||||
},
|
|
||||||
"Python": {
|
|
||||||
"tab_size": 4,
|
|
||||||
"format_on_save": "on",
|
|
||||||
"language_servers": ["pyright", "ruff"],
|
|
||||||
"formatter": {
|
|
||||||
"language_server": { "name": "ruff" },
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
"lsp": {
|
|
||||||
"yaml-language-server": {
|
|
||||||
"settings": {
|
|
||||||
"yaml": {
|
|
||||||
"schemas": {
|
|
||||||
"kubernetes": ["**/k8s/*.yaml", "**/k8s/*.yml"],
|
|
||||||
},
|
|
||||||
"validate": true,
|
|
||||||
"completion": true,
|
|
||||||
"format": {
|
|
||||||
"enable": true,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
+14
-12
@@ -1,6 +1,6 @@
|
|||||||
services:
|
services:
|
||||||
adguard:
|
adguard:
|
||||||
image: adguard/adguardhome:v0.107.79
|
image: adguard/adguardhome:latest
|
||||||
container_name: adguardhome
|
container_name: adguardhome
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
ports:
|
ports:
|
||||||
@@ -11,38 +11,40 @@ services:
|
|||||||
# - "68:68/tcp" # DHCP
|
# - "68:68/tcp" # DHCP
|
||||||
# - "3000:3000/tcp"
|
# - "3000:3000/tcp"
|
||||||
volumes:
|
volumes:
|
||||||
- data:/opt/adguardhome/work
|
- ./data/work:/opt/adguardhome/work
|
||||||
- ./conf:/opt/adguardhome/conf
|
- ./data/conf:/opt/adguardhome/conf
|
||||||
- ./certs:/certs:ro
|
- ./certs:/certs:ro
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
|
- "traefik.docker.network=proxy"
|
||||||
- "traefik.http.services.adguard.loadbalancer.server.port=3000"
|
- "traefik.http.services.adguard.loadbalancer.server.port=3000"
|
||||||
|
|
||||||
# Prod Router
|
# Prod Router
|
||||||
- "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
|
- "traefik.http.routers.adguard.rule=Host(`dns.forust.xyz`) || Host(`adguard.forust.xyz`)"
|
||||||
- "traefik.http.routers.adguard.entrypoints=websecure"
|
- "traefik.http.routers.adguard.entrypoints=websecure"
|
||||||
- "traefik.http.routers.adguard.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.adguard.middlewares=security-headers@file"
|
||||||
|
- "traefik.http.routers.adguard.tls=true"
|
||||||
# Local Router
|
# Local Router
|
||||||
- "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
|
- "traefik.http.routers.adguard-local.rule=Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`)"
|
||||||
- "traefik.http.routers.adguard-local.entrypoints=websecure"
|
- "traefik.http.routers.adguard-local.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.adguard-local.middlewares=security-headers@file"
|
||||||
- "traefik.http.routers.adguard-local.tls=true"
|
- "traefik.http.routers.adguard-local.tls=true"
|
||||||
# Dev Router
|
# Dev Router
|
||||||
- "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)"
|
- "traefik.http.routers.adguard-dev.rule=Host(`adguard.gigaforust.internal`) Host(`dns.gigaforust.internal`)"
|
||||||
- "traefik.http.routers.adguard-dev.entrypoints=websecure"
|
- "traefik.http.routers.adguard-dev.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.adguard-dev.middlewares=security-headers@file"
|
||||||
- "traefik.http.routers.adguard-dev.tls=true"
|
- "traefik.http.routers.adguard-dev.tls=true"
|
||||||
# DoH Router
|
# DoH Router
|
||||||
- "traefik.http.routers.dns-over-https.rule=(Host(`dns.forust.xyz` || Host(`adguard.forust.xyz`)) && PathPrefix(`/dns-query`))"
|
- "traefik.http.routers.dns.rule=(Host(`dns.forust.xyz`) && PathPrefix(`/dns-query`))"
|
||||||
- "traefik.http.routers.dns-over-https.entrypoints=websecure"
|
- "traefik.http.routers.dns.entrypoints=websecure"
|
||||||
- "traefik.http.routers.dns-over-https.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.dns.tls.certresolver=letsencrypt"
|
||||||
|
|
||||||
# Glance Metadata
|
# Glance Metadata
|
||||||
- glance.name=adguard
|
- glance.name=adguard
|
||||||
- glance.url=https://adguard.forust.xyz/
|
- glance.url=https://adguard.forust.xyz/
|
||||||
- glance.description=AdGuard Home is a network-wide software for blocking ads.
|
- glance.description=AdGuard Home is a network-wide software for blocking ads.
|
||||||
networks:
|
networks:
|
||||||
- proxy
|
- proxy
|
||||||
volumes:
|
|
||||||
data:
|
|
||||||
networks:
|
networks:
|
||||||
proxy:
|
proxy:
|
||||||
external: true
|
external: true
|
||||||
@@ -1,127 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: adguard-lb-service
|
|
||||||
namespace: adguard
|
|
||||||
annotations:
|
|
||||||
metallb.io/loadBalancerIPs: "192.168.80.3"
|
|
||||||
spec:
|
|
||||||
type: LoadBalancer
|
|
||||||
externalTrafficPolicy: Local
|
|
||||||
selector:
|
|
||||||
app: adguard
|
|
||||||
ports:
|
|
||||||
- name: dns-udp
|
|
||||||
port: 53
|
|
||||||
targetPort: 53
|
|
||||||
protocol: UDP
|
|
||||||
- name: dns-tcp
|
|
||||||
port: 53
|
|
||||||
targetPort: 53
|
|
||||||
protocol: TCP
|
|
||||||
- name: dot
|
|
||||||
port: 853
|
|
||||||
targetPort: 853
|
|
||||||
protocol: TCP
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: adguard-service
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: adguard
|
|
||||||
ports:
|
|
||||||
- port: 3000
|
|
||||||
name: webui
|
|
||||||
targetPort: 3000
|
|
||||||
- port: 53
|
|
||||||
name: dns
|
|
||||||
targetPort: 53
|
|
||||||
protocol: UDP
|
|
||||||
- port: 53
|
|
||||||
name: dns-tcp
|
|
||||||
targetPort: 53
|
|
||||||
protocol: TCP
|
|
||||||
- port: 853
|
|
||||||
name: dot
|
|
||||||
targetPort: 853
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: adguard-deployment
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: adguard
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: adguard
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: adguard
|
|
||||||
image: adguard/adguardhome:v0.107.79
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: "1.5Gi"
|
|
||||||
cpu: "300m"
|
|
||||||
requests:
|
|
||||||
memory: "512Mi"
|
|
||||||
cpu: "50m"
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
name: webui
|
|
||||||
- containerPort: 53
|
|
||||||
name: dns
|
|
||||||
- containerPort: 853
|
|
||||||
name: dot
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: dns
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 3
|
|
||||||
volumeMounts:
|
|
||||||
- name: adguard-data
|
|
||||||
mountPath: /opt/adguardhome/work
|
|
||||||
subPath: work
|
|
||||||
- name: adguard-data
|
|
||||||
mountPath: /opt/adguardhome/conf
|
|
||||||
subPath: conf
|
|
||||||
- name: adguard-certs
|
|
||||||
mountPath: /certs
|
|
||||||
readOnly: true
|
|
||||||
volumes:
|
|
||||||
- name: adguard-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: adguard-pvc
|
|
||||||
- name: adguard-certs
|
|
||||||
secret:
|
|
||||||
secretName: adguard-certs
|
|
||||||
items:
|
|
||||||
- key: tls.crt
|
|
||||||
path: fullchain.pem
|
|
||||||
- key: tls.key
|
|
||||||
path: privkey.pem
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: adguard-pvc
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 2Gi
|
|
||||||
@@ -1,12 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: adguard-certs
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
secretName: adguard-certs
|
|
||||||
dnsNames:
|
|
||||||
- dns.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,43 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: adguard-prod
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`dns.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: adguard-service
|
|
||||||
port: 3000
|
|
||||||
- match: (Host(`dns.forust.xyz`)) && PathPrefix(`/dns-query`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: adguard-service
|
|
||||||
port: 3000
|
|
||||||
tls:
|
|
||||||
secretName: adguard-certs
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: adguard-local
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: adguard-service
|
|
||||||
port: 3000
|
|
||||||
- match: (Host(`adguard.workstation.internal`) || Host(`dns.workstation.internal`) || Host(`adguard.gigaforust.internal`) || Host(`dns.gigaforust.internal`)) && PathPrefix(`/dns-query`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: adguard-service
|
|
||||||
port: 3000
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-wildcard-tls
|
|
||||||
namespace: adguard
|
|
||||||
spec:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
dnsNames:
|
|
||||||
- "*.workstation.internal"
|
|
||||||
- "*.gigaforust.internal"
|
|
||||||
- workstation.internal
|
|
||||||
- gigaforust.internal
|
|
||||||
issuerRef:
|
|
||||||
name: internal-ca
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: adguard
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
kubectl apply -f k8s/namespace.yaml && \
|
|
||||||
kubectl create secret tls adguard-certs -n adguard \
|
|
||||||
--cert=certs/fullchain.pem \
|
|
||||||
--key=certs/privkey.pem --dry-run=client -o yaml > \
|
|
||||||
k8s/secrets.yaml
|
|
||||||
|
|
||||||
# OR WITH NO FILE CREATION:
|
|
||||||
kubectl create secret tls adguard-certs -n adguard \
|
|
||||||
--cert=certs/fullchain.pem --key=certs/privkey.pem \
|
|
||||||
--save-config
|
|
||||||
@@ -1,6 +1,6 @@
|
|||||||
services:
|
services:
|
||||||
postgresql:
|
postgresql:
|
||||||
image: docker.io/library/postgres:15.19-alpine
|
image: docker.io/library/postgres:15-alpine
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
env_file:
|
env_file:
|
||||||
- .env
|
- .env
|
||||||
@@ -42,20 +42,26 @@ services:
|
|||||||
- ./custom-templates:/templates
|
- ./custom-templates:/templates
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
|
- "traefik.docker.network=proxy"
|
||||||
- "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
|
- "traefik.http.services.authentik-server.loadbalancer.server.port=9000"
|
||||||
|
|
||||||
# Prod Router
|
# Prod Router
|
||||||
- "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
|
- "traefik.http.routers.authentik-server.rule=Host(`auth.forust.xyz`)"
|
||||||
- "traefik.http.routers.authentik-server.entrypoints=websecure"
|
- "traefik.http.routers.authentik-server.entrypoints=websecure"
|
||||||
- "traefik.http.routers.authentik-server.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.authentik-server.middlewares=security-headers@file"
|
||||||
|
- "traefik.http.routers.authentik-server.service=authentik-server"
|
||||||
|
- "traefik.http.routers.authentik-server.tls=true"
|
||||||
# Local Router
|
# Local Router
|
||||||
- "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`)"
|
- "traefik.http.routers.authentik-server-local.rule=Host(`auth.workstation.internal`) || Host(`auth-dashboard.internal`)"
|
||||||
- "traefik.http.routers.authentik-server-local.entrypoints=websecure"
|
- "traefik.http.routers.authentik-server-local.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.authentik-server-local.middlewares=security-headers@file"
|
||||||
|
- "traefik.http.routers.authentik-server-local.service=authentik-server"
|
||||||
- "traefik.http.routers.authentik-server-local.tls=true"
|
- "traefik.http.routers.authentik-server-local.tls=true"
|
||||||
# Dev Router
|
# Dev Router
|
||||||
- "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
|
- "traefik.http.routers.authentik-server-dev.rule=Host(`auth.gigaforust.internal`)"
|
||||||
- "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
|
- "traefik.http.routers.authentik-server-dev.entrypoints=websecure"
|
||||||
- "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
|
- "traefik.http.routers.authentik-server-dev.middlewares=security-headers@file"
|
||||||
|
- "traefik.http.routers.authentik-server-dev.service=authentik-server"
|
||||||
- "traefik.http.routers.authentik-server-dev.tls=true"
|
- "traefik.http.routers.authentik-server-dev.tls=true"
|
||||||
networks:
|
networks:
|
||||||
- proxy
|
- proxy
|
||||||
|
|||||||
@@ -1,101 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: authentik-server-service
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: authentik-server
|
|
||||||
ports:
|
|
||||||
- port: 9000
|
|
||||||
targetPort: 9000
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: authentik-worker-service
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
selector:
|
|
||||||
app: authentik-worker
|
|
||||||
ports:
|
|
||||||
- port: 9000
|
|
||||||
targetPort: 9000
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: authentik-server-deployment
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: authentik-server
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: authentik-server
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: authentik-server
|
|
||||||
image: ghcr.io/goauthentik/server:2026.8.3
|
|
||||||
args: ["server"]
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: authentik-config
|
|
||||||
- secretRef:
|
|
||||||
name: authentik-secrets
|
|
||||||
ports:
|
|
||||||
- containerPort: 9000
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "768Mi"
|
|
||||||
cpu: "100m"
|
|
||||||
limits:
|
|
||||||
memory: "1.5Gi"
|
|
||||||
cpu: "1000m"
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: authentik-worker-deployment
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: authentik-worker
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: authentik-worker
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: authentik-worker
|
|
||||||
image: ghcr.io/goauthentik/server:2026.8.3
|
|
||||||
args: ["worker"]
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 0
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: authentik-config
|
|
||||||
- secretRef:
|
|
||||||
name: authentik-secrets
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "320Mi"
|
|
||||||
cpu: "100m"
|
|
||||||
limits:
|
|
||||||
memory: "768Mi"
|
|
||||||
cpu: "700m"
|
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: authentik-prod-tls
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
secretName: authentik-prod-tls
|
|
||||||
dnsNames:
|
|
||||||
- auth.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-wildcard-tls
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
dnsNames:
|
|
||||||
- "*.workstation.internal"
|
|
||||||
- "*.gigaforust.internal"
|
|
||||||
- workstation.internal
|
|
||||||
- gigaforust.internal
|
|
||||||
issuerRef:
|
|
||||||
name: internal-ca
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: authentik-config
|
|
||||||
namespace: authentik
|
|
||||||
data:
|
|
||||||
AUTHENTIK_IMAGE: ghcr.io/goauthentik/server
|
|
||||||
AUTHENTIK_TAG: "2025.10.2"
|
|
||||||
AUTHENTIK_POSTGRESQL__HOST: postgres.database.svc.cluster.local
|
|
||||||
AUTHENTIK_POSTGRESQL__NAME: authentik
|
|
||||||
AUTHENTIK_ERROR_REPORTING__ENABLED: "true"
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: authentik-prod
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`auth.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: authentik-server-service
|
|
||||||
port: 9000
|
|
||||||
tls:
|
|
||||||
secretName: authentik-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: authentik-local
|
|
||||||
namespace: authentik
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`auth.workstation.internal`) || Host(`auth.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: authentik-server-service
|
|
||||||
port: 9000
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: authentik
|
|
||||||
@@ -1,11 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: authentik-secrets
|
|
||||||
namespace: authentik
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
AUTHENTIK_SECRET_KEY: ""
|
|
||||||
AUTHENTIK_POSTGRESQL__PASSWORD: ""
|
|
||||||
AUTHENTIK_POSTGRESQL__USER: authentik
|
|
||||||
AUTHENTIK_BOOTSTRAP_PASSWORD: authentik
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
crds:
|
|
||||||
enabled: true
|
|
||||||
prometheus:
|
|
||||||
servicemonitor:
|
|
||||||
enabled: true
|
|
||||||
interval: 60s
|
|
||||||
scrapeTimeout: 30s
|
|
||||||
labels:
|
|
||||||
release: prometheus-stack
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-staging
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
email: bobrovod@national.shitposting.agency
|
|
||||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-staging-account-key
|
|
||||||
solvers:
|
|
||||||
- http01:
|
|
||||||
ingress:
|
|
||||||
class: traefik
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
email: bobrovod@national.shitposting.agency
|
|
||||||
server: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-prod-account-key
|
|
||||||
solvers:
|
|
||||||
- http01:
|
|
||||||
ingress:
|
|
||||||
class: traefik
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIFFjCCAv6gAwIBAgIUetKpTfEDOn2985FFMu6G26itT+wwDQYJKoZIhvcNAQEN
|
|
||||||
BQAwIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRlcm5hbCByb290IENBMB4XDTI2MDky
|
|
||||||
MzEyNDA0N1oXDTM2MDkyMDEyNDA0N1owIzEhMB8GA1UEAxMYaG9tZWxhYiBpbnRl
|
|
||||||
cm5hbCByb290IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvmNP
|
|
||||||
ZCOoD8NtNuYJKVXBlTPjX7D7sJCSK5neH7ZbYV5+lmUlEErY8Mik7j37V5k5NfpF
|
|
||||||
Ig85pOjP7RckTPz5V6ek3yaN40s4AL053sN5ZPauDVYjalaEHTgj5sEMqlLACQWI
|
|
||||||
yZmJOZspZykae8dIpQnqCoFpRT4FurJ78v4a0ylnFVLMQn/lyCHedwTjkEdtYWYr
|
|
||||||
ccJy8vQwqkzs/rWvEH1lDqZhennLOrmcCjfonG7D/pruMn4z+6E28p4+ejkRrI6x
|
|
||||||
luak3KnpT1XMeHtgU21hiRGaMDBchHMFgAhnY1qosymKenXvfTZItwgjZbwa1hJI
|
|
||||||
GAiDm+jQDKMjzRZ3rH6Xfc0auUcykNz73PpNu1NGm78nndXwCXcXn1LFKNQJ+r1U
|
|
||||||
sJiyAmUZmXVn4aM4OMf2F38k7wTYIKg7nRGaUkNeKDlNkjA4HvgWw+jwO1KmdHQ/
|
|
||||||
mOem1rosDWHRK01wg+Gga9mQCnhNhxglg3t/UeSic6uOaRsvaz4qkzHq8MbCujVz
|
|
||||||
DpKQjqdikYOAXZOs4KlBLWrS7NaK4NzfSD02pBUErh54ruJfY/bWz9KyXzBD/lQZ
|
|
||||||
VUTKyvUVB0bkVHEdf1jJmX3H4IZRQSF5JPqOBotW6bJI5fEGNBvj9Zxy4nm2WWGz
|
|
||||||
yyP3uWsQz8U/Wdx9nXZLHInTZBsvgLYtKUAWA30CAwEAAaNCMEAwDgYDVR0PAQH/
|
|
||||||
BAQDAgKkMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEkKm2rxPaK6+O9WD80z
|
|
||||||
BLC6F9QsMA0GCSqGSIb3DQEBDQUAA4ICAQAnFyHz97Umf5VIu+dKTJid7C73VugJ
|
|
||||||
TIar/xJBs/4CxP+znBxhJjXygRoyIfzoVGWcB2ZSL//vL78Qlts79K/Imc9a4RFF
|
|
||||||
wMvCxsRXAEQ4TpeWi3ophPNcs4rhsP+gQKQFtnyKP9519bqpfxp0bTqwOV2o18fn
|
|
||||||
za7rlQViiEnNV58j7CVoM9+mJvVVfBEX1Km+GyJL9GadzbIQ7FxClVJZefCbft93
|
|
||||||
zHVk9gDOw8ys1XGSR2OUCyCLinXO6mqS16CmBb2MAKXq/YyH7E0N8iotAPGtfA8V
|
|
||||||
M/0ddy947rY0xCrtECfWwvGQpJS7NRv/Z9b2jCfXrI5LXmL2nfQRg0y9GE4Vjwr+
|
|
||||||
WxtGU5jOeFt0jQ+xRzcgG0Op+qK3x55l5LSo2hOcOVYbiHxcHEJFgwNi1ADeBFwb
|
|
||||||
q/HdysfURSOghqjIpMMAUabBp+DBUg2EUF7pIaUqbdqExFYcr9EYisEMiNsmKmN+
|
|
||||||
8ZbcOeerFKDQj+t/R0bFXa7UBn2UWsjI8zlR74aa2kLDXwtyz/XlO/FlYm66eBFo
|
|
||||||
2/eYUSeU+S4ej+wUAs/dvjF7f190/DUQGuwOTlLTahqWDztmhCk7qzbECu56CwKT
|
|
||||||
E5Ect2P72UleYwdblkVOVd352AmiwEzdOaziIRrPh8uenEknH6JBYPO3mjk7cCg+
|
|
||||||
GPGcNIBctjdXhg==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
@@ -1,33 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: selfsigned
|
|
||||||
spec:
|
|
||||||
selfSigned: {}
|
|
||||||
---
|
|
||||||
# Homelab internal root CA (10y). Install the .crt on clients (see below).
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-ca-root
|
|
||||||
namespace: cert-manager
|
|
||||||
spec:
|
|
||||||
isCA: true
|
|
||||||
commonName: homelab internal root CA
|
|
||||||
duration: 87600h
|
|
||||||
renewBefore: 7200h
|
|
||||||
secretName: internal-ca-root
|
|
||||||
privateKey:
|
|
||||||
algorithm: RSA
|
|
||||||
size: 4096
|
|
||||||
issuerRef:
|
|
||||||
name: selfsigned
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: ClusterIssuer
|
|
||||||
metadata:
|
|
||||||
name: internal-ca
|
|
||||||
spec:
|
|
||||||
ca:
|
|
||||||
secretName: internal-ca-root
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: cert-manager
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
CLOUDFLARE_API_TOKEN=YOUR_CLOUDFLARE_API_TOKEN
|
|
||||||
DOMAINS=example.com,dns.example.com,mc.example.com,auth.example.com,ssh.example.com
|
|
||||||
IP4_DOMAINS=
|
|
||||||
IP6_DOMAINS=
|
|
||||||
IP4_PROVIDER=cloudflare.trace
|
|
||||||
IP6_PROVIDER=none # change if you want to update AAAA
|
|
||||||
UPDATE_CRON=@every 5m
|
|
||||||
UPDATE_ON_START=true
|
|
||||||
DELETE_ON_STOP=false
|
|
||||||
DELETE_ON_FAILURE=true
|
|
||||||
TTL=1
|
|
||||||
PROXIED=!is(dns.example.com) && !is(mc.example.com) && !is(ssh.example.com)
|
|
||||||
EMOJI=true
|
|
||||||
UPTIMEKUMA=https://uptime-kuma.example.com/api/push/AsaSDFGFkfklaFALSKffkfFKfkfkfkFK?status=up&msg=OK&ping=
|
|
||||||
REJECT_CLOUDFLARE_IPS=true
|
|
||||||
+6
-23
@@ -1,30 +1,13 @@
|
|||||||
services:
|
services:
|
||||||
cloudflare-ddns:
|
cloudflare-ddns:
|
||||||
image: timothyjmiller/cloudflare-ddns:2.2.0
|
image: timothyjmiller/cloudflare-ddns:latest
|
||||||
container_name: cloudflare-ddns
|
container_name: cloudflare-ddns
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
security_opt:
|
security_opt:
|
||||||
- no-new-privileges:true
|
- no-new-privileges:true
|
||||||
network_mode: "host"
|
network_mode: 'host'
|
||||||
# https://github.com/timothymiller/cloudflare-ddns#-quick-start
|
|
||||||
environment:
|
environment:
|
||||||
- CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN:?Cloudflare API token is required}
|
- PUID=1000
|
||||||
- DOMAINS=${DOMAINS:-}
|
- PGID=1000
|
||||||
- IP4_DOMAINS=${IP4_DOMAINS:-}
|
volumes:
|
||||||
- IP6_DOMAINS=${IP6_DOMAINS:-}
|
- ./config.json:/config.json
|
||||||
- IP4_PROVIDER=${IP4_PROVIDER:-cloudflare.trace}
|
|
||||||
- IP6_PROVIDER=${IP6_PROVIDER:-none}
|
|
||||||
- UPDATE_CRON=${UPDATE_CRON:-@every 5m}
|
|
||||||
- UPDATE_ON_START=${UPDATE_ON_START:-true}
|
|
||||||
- DELETE_ON_STOP=${DELETE_ON_STOP:-false}
|
|
||||||
- DELETE_ON_FAILURE=${DELETE_ON_FAILURE:-true}
|
|
||||||
- TTL=${TTL:-1} # 1=auto
|
|
||||||
# to proxy only "dns.example.com" and "wfs.example.com" use "!is(dns.domain.com) && !is (wfs.domain.com)"
|
|
||||||
- PROXIED=${PROXIED:-true}
|
|
||||||
- EMOJI=${EMOJI:-true}
|
|
||||||
- UPTIMEKUMA=${UPTIMEKUMA:-}
|
|
||||||
- HEALTHCHECKS=${HEALTHCHECKS:-}
|
|
||||||
- REJECT_CLOUDFLARE_IPS=${REJECT_CLOUDFLARE_IPS:-true}
|
|
||||||
# volumes:
|
|
||||||
# Prefer using environment variables for configuration, config.json legacy support
|
|
||||||
# - ./config.json:/config.json
|
|
||||||
@@ -7,7 +7,7 @@
|
|||||||
"api_key": {
|
"api_key": {
|
||||||
"api_key": "api_key_here",
|
"api_key": "api_key_here",
|
||||||
"account_email": "your_email_here"
|
"account_email": "your_email_here"
|
||||||
},
|
}
|
||||||
"zone_id": "your_zone-id",
|
"zone_id": "your_zone-id",
|
||||||
"subdomains": [
|
"subdomains": [
|
||||||
{ "name": "", "proxied": true },
|
{ "name": "", "proxied": true },
|
||||||
|
|||||||
@@ -1 +0,0 @@
|
|||||||
secret.yaml
|
|
||||||
Whitespace-only changes.
@@ -1,36 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: cfddns
|
|
||||||
labels:
|
|
||||||
app: cfddns
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: cfddns
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: cfddns
|
|
||||||
spec:
|
|
||||||
hostNetwork: true
|
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
|
||||||
containers:
|
|
||||||
- name: cloudflare-ddns
|
|
||||||
image: timothyjmiller/cloudflare-ddns:2.2.0
|
|
||||||
imagePullPolicy: Always
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "32Mi"
|
|
||||||
cpu: "30m"
|
|
||||||
limits:
|
|
||||||
memory: "128Mi"
|
|
||||||
cpu: "50m"
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: cfddns-secrets
|
|
||||||
@@ -1,18 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: cfddns-secrets
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
CLOUDFLARE_API_TOKEN: your_token
|
|
||||||
DOMAINS: "example.com,www.example.com"
|
|
||||||
IP4_PROVIDER: cloudflare.trace
|
|
||||||
IP6_PROVIDER: none
|
|
||||||
UPDATE_CRON: "@every 5m"
|
|
||||||
UPDATE_ON_START: "true"
|
|
||||||
DELETE_ON_STOP: "false"
|
|
||||||
DELETE_ON_FAILURE: "true"
|
|
||||||
TTL: "1"
|
|
||||||
PROXIED: "true"
|
|
||||||
EMOJI: "true"
|
|
||||||
REJECT_CLOUDFLARE_IPS: "true"
|
|
||||||
@@ -1,6 +1,6 @@
|
|||||||
services:
|
services:
|
||||||
checkmk:
|
checkmk:
|
||||||
image: "checkmk/check-mk-raw:2.4.0-2026.09.14"
|
image: "checkmk/check-mk-raw:2.4.0-latest"
|
||||||
container_name: "checkmk"
|
container_name: "checkmk"
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
# ports:
|
# ports:
|
||||||
@@ -13,21 +13,24 @@ services:
|
|||||||
environment:
|
environment:
|
||||||
- CMK_PASSWORD=${CMK_PASSWORD:-password}
|
- CMK_PASSWORD=${CMK_PASSWORD:-password}
|
||||||
- CMK_SITE_ID=cmk
|
- CMK_SITE_ID=cmk
|
||||||
- TZ=${TZ:-Etc/UTC}
|
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
|
- "traefik.docker.network=proxy"
|
||||||
- "traefik.http.services.checkmk.loadbalancer.server.port=5000"
|
- "traefik.http.services.checkmk.loadbalancer.server.port=5000"
|
||||||
|
|
||||||
# Prod Router
|
# Prod Router
|
||||||
- "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
|
- "traefik.http.routers.checkmk.rule=Host(`cmk.forust.xyz`)"
|
||||||
- "traefik.http.routers.checkmk.entrypoints=websecure"
|
- "traefik.http.routers.checkmk.entrypoints=websecure"
|
||||||
- "traefik.http.routers.checkmk.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.checkmk.middlewares=security-headers@file"
|
||||||
|
- "traefik.http.routers.checkmk.tls=true"
|
||||||
# Local Router
|
# Local Router
|
||||||
- "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
|
- "traefik.http.routers.checkmk-local.rule=Host(`cmk.workstation.internal`)"
|
||||||
- "traefik.http.routers.checkmk-local.entrypoints=websecure"
|
- "traefik.http.routers.checkmk-local.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.checkmk-local.middlewares=security-headers@file"
|
||||||
- "traefik.http.routers.checkmk-local.tls=true"
|
- "traefik.http.routers.checkmk-local.tls=true"
|
||||||
# Dev Router
|
# Dev Router
|
||||||
- "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
|
- "traefik.http.routers.checkmk-dev.rule=Host(`cmk.gigaforust.internal`)"
|
||||||
|
- "traefik.http.routers.checkmk-dev.middlewares=security-headers@file"
|
||||||
- "traefik.http.routers.checkmk-dev.entrypoints=websecure"
|
- "traefik.http.routers.checkmk-dev.entrypoints=websecure"
|
||||||
- "traefik.http.routers.checkmk-dev.tls=true"
|
- "traefik.http.routers.checkmk-dev.tls=true"
|
||||||
networks:
|
networks:
|
||||||
|
|||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: checkmk-prod-tls
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
secretName: checkmk-prod-tls
|
|
||||||
dnsNames:
|
|
||||||
- cmk.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-wildcard-tls
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
dnsNames:
|
|
||||||
- "*.workstation.internal"
|
|
||||||
- "*.gigaforust.internal"
|
|
||||||
- workstation.internal
|
|
||||||
- gigaforust.internal
|
|
||||||
issuerRef:
|
|
||||||
name: internal-ca
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,79 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: checkmk-service
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: checkmk
|
|
||||||
ports:
|
|
||||||
- name: web
|
|
||||||
port: 5000
|
|
||||||
targetPort: 5000
|
|
||||||
- name: agent-receiver
|
|
||||||
port: 8000
|
|
||||||
targetPort: 8000
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: checkmk-deployment
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: checkmk
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: checkmk
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: checkmk
|
|
||||||
image: checkmk/check-mk-raw:2.4.0-2026.09.14
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: checkmk-secrets
|
|
||||||
- configMapRef:
|
|
||||||
name: checkmk-config
|
|
||||||
ports:
|
|
||||||
- name: web
|
|
||||||
containerPort: 5000
|
|
||||||
- name: agent-receiver
|
|
||||||
containerPort: 8000
|
|
||||||
volumeMounts:
|
|
||||||
- name: sites
|
|
||||||
mountPath: /omd/sites
|
|
||||||
- name: tmp
|
|
||||||
mountPath: /opt/omd/sites/cmk/tmp
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "2Gi"
|
|
||||||
cpu: "600m"
|
|
||||||
limits:
|
|
||||||
memory: "5Gi"
|
|
||||||
cpu: "4"
|
|
||||||
volumes:
|
|
||||||
- name: sites
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: checkmk-sites-pvc
|
|
||||||
- name: tmp
|
|
||||||
emptyDir:
|
|
||||||
medium: Memory
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: checkmk-sites-pvc
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 5Gi
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: checkmk-config
|
|
||||||
namespace: checkmk
|
|
||||||
data:
|
|
||||||
TZ: Europe/Bratislava
|
|
||||||
CMK_SITE_ID: cmk
|
|
||||||
@@ -1,49 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: checkmk-prod
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`cmk.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: checkmk-service
|
|
||||||
port: 5000
|
|
||||||
tls:
|
|
||||||
secretName: checkmk-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRouteTCP
|
|
||||||
metadata:
|
|
||||||
name: checkmk-agent-receiver
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- checkmk-agent
|
|
||||||
routes:
|
|
||||||
- match: HostSNI(`*`)
|
|
||||||
services:
|
|
||||||
- name: checkmk-service
|
|
||||||
port: 8000
|
|
||||||
tls:
|
|
||||||
passthrough: true
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: checkmk-local
|
|
||||||
namespace: checkmk
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`cmk.workstation.internal`) || Host(`cmk.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: checkmk-service
|
|
||||||
port: 5000
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: checkmk
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: checkmk-secrets
|
|
||||||
namespace: checkmk
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
CMK_PASSWORD: "password"
|
|
||||||
@@ -1 +0,0 @@
|
|||||||
secret.yaml
|
|
||||||
@@ -1,41 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: cloudflared
|
|
||||||
labels:
|
|
||||||
app: cloudflared
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: cloudflared
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: cloudflared
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: cloudflared
|
|
||||||
image: cloudflare/cloudflared:2026.9.3
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
args:
|
|
||||||
- tunnel
|
|
||||||
- --no-autoupdate
|
|
||||||
- run
|
|
||||||
env:
|
|
||||||
- name: TUNNEL_TOKEN
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: cloudflared-secrets
|
|
||||||
key: TUNNEL_TOKEN
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "128Mi"
|
|
||||||
cpu: "30m"
|
|
||||||
limits:
|
|
||||||
memory: "256Mi"
|
|
||||||
cpu: "200m"
|
|
||||||
@@ -1,7 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: cloudflared-secrets
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
TUNNEL_TOKEN: your_tunnel_token_here
|
|
||||||
@@ -1,9 +0,0 @@
|
|||||||
ACCOUNT_REGISTRATION=false
|
|
||||||
HTTP_ALLOWED=false
|
|
||||||
ALLOW_UNAUTHENTICAED=false
|
|
||||||
AUTO_DELETE_EVERY_N_HOURS=24
|
|
||||||
WEBROOT=/convert
|
|
||||||
HIDE_HISTORY=false
|
|
||||||
LANGUAGE=en
|
|
||||||
UNAUTHED_USER_SHARING=false
|
|
||||||
MAX_CONVERT_PROCESS=0
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
services:
|
|
||||||
convertx:
|
|
||||||
container_name: convertx
|
|
||||||
image: ghcr.io/c4illin/convertx:v0.19.0
|
|
||||||
restart: unless-stopped
|
|
||||||
ports:
|
|
||||||
- "9992:3000"
|
|
||||||
# https://github.com/C4illin/ConvertX#environment-variables
|
|
||||||
environment:
|
|
||||||
- JWT_SECRET=$(JWT_SECRET)
|
|
||||||
- ACCOUNT_REGISTRATION=$(ACCOUNT_REGISTRATION:-false)
|
|
||||||
- HTTP_ALLOWED=$(HTTP_ALLOWED:-false)
|
|
||||||
- ALLOW_UNAUTHENTICATED=$(ALLOW_UNAUTHENTICATED:-false)
|
|
||||||
- AUTO_DELETE_EVERY_N_HOURS=$(AUTO_DELETE_EVERY_N_HOURS:-24)
|
|
||||||
- WEBROOT=$(WEBROOT)
|
|
||||||
- HIDE_HISTORY=$(HIDE_HISTORY:-false)
|
|
||||||
- LANGUAGE=$(LANGUAGE:-en)
|
|
||||||
- UNAUTHENTICATED_USER_SHARING=$(UNAUTHENTICATED_USER_SHARING:-false)
|
|
||||||
- MAX_CONVERT_PROCESS=$(MAX_CONVERT_PROCESS:-0)
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.http.services.convertx.loadbalancer.server.port=3000"
|
|
||||||
# Prod Router
|
|
||||||
- "traefik.http.routers.convertx.rule=(Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)"
|
|
||||||
- "traefik.http.routers.convertx.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.convertx.priority=50"
|
|
||||||
- "traefik.http.routers.convertx.tls.certresolver=letsencrypt"
|
|
||||||
# Local Router
|
|
||||||
- "traefik.http.routers.convertx-local.rule=Host(`workstation.internal`) && PathPrefix(`/convert`)"
|
|
||||||
- "traefik.http.routers.convertx-local.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.convertx-local.priority=50"
|
|
||||||
- "traefik.http.routers.convertx-local.tls=true"
|
|
||||||
# Dev Router
|
|
||||||
- "traefik.http.routers.convertx-dev.rule=Host(`gigaforust.internal`) && PathPrefix(`/convert`)"
|
|
||||||
- "traefik.http.routers.convertx-dev.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.convertx-dev.priority=50"
|
|
||||||
- "traefik.http.routers.convertx-dev.tls=true"
|
|
||||||
networks:
|
|
||||||
- proxy
|
|
||||||
volumes:
|
|
||||||
- data:/app/data
|
|
||||||
|
|
||||||
bentopdf:
|
|
||||||
container_name: bentopdf
|
|
||||||
image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
|
|
||||||
restart: unless-stopped
|
|
||||||
labels:
|
|
||||||
- "traefik.enable=true"
|
|
||||||
- "traefik.http.services.bentopdf.loadbalancer.server.port=8080"
|
|
||||||
|
|
||||||
# Prod router
|
|
||||||
- "traefik.http.routers.bentopdf.rule=Host(`pdf.forust.xyz`)"
|
|
||||||
- "traefik.http.routers.bentopdf.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.bentopdf.tls.certresolver=letsencrypt"
|
|
||||||
- "traefik.http.routers.bentopdf.tls=true"
|
|
||||||
# Local router
|
|
||||||
- "traefik.http.routers.bentopdf-local.rule=Host(`pdf.workstation.internal`)"
|
|
||||||
- "traefik.http.routers.bentopdf-local.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.bentopdf-local.tls=true"
|
|
||||||
# Dev router
|
|
||||||
- "traefik.http.routers.bentopdf-dev.rule=Host(`pdf.gigaforust.internal`)"
|
|
||||||
- "traefik.http.routers.bentopdf-dev.entrypoints=websecure"
|
|
||||||
- "traefik.http.routers.bentopdf-dev.tls=true"
|
|
||||||
networks:
|
|
||||||
- proxy
|
|
||||||
networks:
|
|
||||||
proxy:
|
|
||||||
external: true
|
|
||||||
volumes:
|
|
||||||
data:
|
|
||||||
Whitespace-only changes.
@@ -1,43 +0,0 @@
|
|||||||
kind: Service
|
|
||||||
apiVersion: v1
|
|
||||||
metadata:
|
|
||||||
name: bentopdf-service
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: bentopdf
|
|
||||||
ports:
|
|
||||||
- port: 8080
|
|
||||||
targetPort: 8080
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: bentopdf-deployment
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
replicas: 2
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: bentopdf
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: bentopdf
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- image: bentopdf/bentopdf@sha256:4eb4ec8f5030faf87c29a73d3d5a2781f28a597cf440c3ab111eb96aee550871
|
|
||||||
imagePullPolicy: Always
|
|
||||||
name: bentopdf
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
# p95 4M, max 11M over 7 days. Was 50Mi/700Mi.
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "32Mi"
|
|
||||||
cpu: "50m"
|
|
||||||
ephemeral-storage: "100Mi"
|
|
||||||
limits:
|
|
||||||
memory: "128Mi"
|
|
||||||
cpu: "700m"
|
|
||||||
ephemeral-storage: "5Gi"
|
|
||||||
@@ -1,42 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: convertx-prod-tls
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
secretName: convertx-prod-tls
|
|
||||||
dnsNames:
|
|
||||||
- forust.xyz
|
|
||||||
- www.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: bentopdf-prod-tls
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
secretName: bentopdf-prod-tls
|
|
||||||
dnsNames:
|
|
||||||
- pdf.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-wildcard-tls
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
dnsNames:
|
|
||||||
- "*.workstation.internal"
|
|
||||||
- "*.gigaforust.internal"
|
|
||||||
- workstation.internal
|
|
||||||
- gigaforust.internal
|
|
||||||
issuerRef:
|
|
||||||
name: internal-ca
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
# test manifest with docker and k8s config keys mismatch
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: convertx-config
|
|
||||||
namespace: converters
|
|
||||||
data:
|
|
||||||
ACCOUNT_REGISTRATION: "false"
|
|
||||||
HTTP_ALLOWED: "false"
|
|
||||||
ALLOW_UNAUTHENTICAED: "false"
|
|
||||||
AUTO_DELETE_EVERY_N_HOURS: "24"
|
|
||||||
WEBROOT: "/convert"
|
|
||||||
HIDE_HISTORY: "false"
|
|
||||||
LANGUAGE: "en"
|
|
||||||
UNAUTHED_USER_SHARING: "false"
|
|
||||||
MAX_CONVERT_PROCESS: "0"
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: convertx-service
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: convertx
|
|
||||||
ports:
|
|
||||||
- port: 3000
|
|
||||||
targetPort: 3000
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: convertx-deployment
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: convertx
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: convertx
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- image: ghcr.io/c4illin/convertx:v0.19.0
|
|
||||||
name: convertx
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: convertx-config
|
|
||||||
- secretRef:
|
|
||||||
name: convertx-secrets
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /data
|
|
||||||
name: data
|
|
||||||
# p95 85M, max 136M over 7 days, spikes while converting. Was 250Mi/1.5Gi.
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "128Mi"
|
|
||||||
cpu: "100m"
|
|
||||||
limits:
|
|
||||||
cpu: "1500m"
|
|
||||||
memory: "512Mi"
|
|
||||||
volumes:
|
|
||||||
- name: data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: convertx-pvc
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: convertx-pvc
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 2Gi
|
|
||||||
@@ -1,70 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: convertx-prod
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: (Host(`forust.xyz`) || Host(`www.forust.xyz`)) && PathPrefix(`/convert`)
|
|
||||||
kind: Rule
|
|
||||||
priority: 50
|
|
||||||
services:
|
|
||||||
- name: convertx-service
|
|
||||||
port: 3000
|
|
||||||
tls:
|
|
||||||
secretName: convertx-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: convertx-local
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: (Host(`workstation.internal`) || Host(`gigaforust.internal`)) && PathPrefix(`/convert`)
|
|
||||||
kind: Rule
|
|
||||||
priority: 50
|
|
||||||
services:
|
|
||||||
- name: convertx-service
|
|
||||||
port: 3000
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: bentopdf-prod
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`pdf.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: bentopdf-service
|
|
||||||
port: 8080
|
|
||||||
tls:
|
|
||||||
secretName: bentopdf-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: bentopdf-local
|
|
||||||
namespace: converters
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`pdf.workstation.internal`) || Host(`pdf.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: bentopdf-service
|
|
||||||
port: 8080
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: converters
|
|
||||||
@@ -1,8 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: convertx-secrets
|
|
||||||
namespace: converters
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
jwt-secret: ""
|
|
||||||
@@ -1,203 +0,0 @@
|
|||||||
container_runtime: containerd
|
|
||||||
|
|
||||||
agent:
|
|
||||||
acquisition: []
|
|
||||||
additionalAcquisition:
|
|
||||||
- labels:
|
|
||||||
type: traefik
|
|
||||||
limit: 1000
|
|
||||||
query: |
|
|
||||||
{namespace="traefik"}
|
|
||||||
source: loki
|
|
||||||
url: http://loki.prometheus.svc.cluster.local:3100/
|
|
||||||
wait_for_ready: 30s
|
|
||||||
env:
|
|
||||||
- name: COLLECTIONS
|
|
||||||
value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
|
|
||||||
- name: DISABLE_COLLECTIONS
|
|
||||||
value: crowdsecurity/sshd
|
|
||||||
# Bans on 401/403 bursts hurt more than they protect: with L3 enforcement
|
|
||||||
# a false positive cuts the IP off everything (SSH included), and past
|
|
||||||
# incidents show legit automation (deploy runner, mesh peers, registry
|
|
||||||
# pulls) tripping this probe. Probing/XSS/SQLi/CVE scenarios stay.
|
|
||||||
- name: DISABLE_SCENARIOS
|
|
||||||
value: crowdsecurity/http-generic-bf
|
|
||||||
metrics:
|
|
||||||
enabled: true
|
|
||||||
serviceMonitor:
|
|
||||||
additionalLabels:
|
|
||||||
release: prometheus-stack
|
|
||||||
enabled: true
|
|
||||||
# Static machine identity: agent pods mount pre-created LAPI credentials
|
|
||||||
# (Secret crowdsec-agent-credentials, key local_api_credentials.yaml)
|
|
||||||
# at the exact path the agent entrypoint expects. Together with the
|
|
||||||
# patched register-init (enforced by janitor-cronjob.yaml) the agent
|
|
||||||
# never calls `cscli lapi register` in steady state, so pod names,
|
|
||||||
# restarts and reboots can no longer break it.
|
|
||||||
extraVolumes:
|
|
||||||
- name: static-creds
|
|
||||||
secret:
|
|
||||||
secretName: crowdsec-agent-credentials
|
|
||||||
items:
|
|
||||||
- key: local_api_credentials.yaml
|
|
||||||
path: local_api_credentials.yaml
|
|
||||||
extraVolumeMounts:
|
|
||||||
- name: static-creds
|
|
||||||
mountPath: /tmp_config/local_api_credentials.yaml
|
|
||||||
subPath: local_api_credentials.yaml
|
|
||||||
readOnly: true
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 200m
|
|
||||||
memory: 500Mi
|
|
||||||
requests:
|
|
||||||
cpu: 50m
|
|
||||||
memory: 100Mi
|
|
||||||
|
|
||||||
config:
|
|
||||||
parsers:
|
|
||||||
s02-enrich:
|
|
||||||
mobile-whitelist.yaml: |
|
|
||||||
name: forust/mobile-whitelist
|
|
||||||
description: "Whitelist SWAN/4ka mobile network"
|
|
||||||
whitelist:
|
|
||||||
reason: "Mobile IP whitelist"
|
|
||||||
cidr:
|
|
||||||
- "84.245.64.0/18"
|
|
||||||
# CrowdSec's own guidance: CIDR allowlisting belongs at the parser stage.
|
|
||||||
# A parser whitelist discards the event before it reaches a bucket, so
|
|
||||||
# these addresses never produce an overflow and never become a decision.
|
|
||||||
# A postoverflow whitelist is checked only *after* the ban exists, and
|
|
||||||
# the bouncer answers 403 for as long as it does - which is a window we
|
|
||||||
# do not want the deploy sitting in.
|
|
||||||
local-network.yaml: |
|
|
||||||
name: forust/local-network
|
|
||||||
description: "Whitelist loopback, private and VPN networks"
|
|
||||||
whitelist:
|
|
||||||
reason: "Local network"
|
|
||||||
cidr:
|
|
||||||
- "127.0.0.0/8"
|
|
||||||
- "10.0.0.0/8"
|
|
||||||
- "172.16.0.0/12"
|
|
||||||
- "192.168.0.0/16"
|
|
||||||
# CGNAT range (RFC 6598). The workstation and the k0s node live
|
|
||||||
# here on WireGuard, and 100.64.0.0/10 is not covered by the
|
|
||||||
# RFC 1918 blocks above.
|
|
||||||
- "100.64.0.0/10"
|
|
||||||
- "169.254.0.0/16"
|
|
||||||
- "fc00::/7"
|
|
||||||
- "fe80::/10"
|
|
||||||
vps-whitelist.yaml: |
|
|
||||||
name: forust/vps-whitelist
|
|
||||||
description: "Whitelist static VPS"
|
|
||||||
whitelist:
|
|
||||||
reason: "VPS"
|
|
||||||
ip:
|
|
||||||
- "193.181.211.79"
|
|
||||||
|
|
||||||
postoverflows:
|
|
||||||
s01-whitelist:
|
|
||||||
# The one whitelist that has to stay here: resolving a hostname is a
|
|
||||||
# network call, and the docs put expensive lookups in postoverflows on
|
|
||||||
# purpose - it runs only when a bucket actually overflows.
|
|
||||||
# ddns.forust.xyz is the public home address, not a private one, so
|
|
||||||
# forust/local-network does not cover it.
|
|
||||||
home-dynamic-ip.yaml: |
|
|
||||||
name: forust/home-dynamic-ip
|
|
||||||
description: "Whitelist home dynamic IP"
|
|
||||||
whitelist:
|
|
||||||
reason: "Home dynamic IP"
|
|
||||||
expression:
|
|
||||||
- evt.Overflow.Alert.Source.IP in LookupHost("ddns.forust.xyz")
|
|
||||||
|
|
||||||
# LAPI-only main config override, merged over config.yaml. NOTE: the
|
|
||||||
# chart's own default for this key is REPLACED, not merged, so its
|
|
||||||
# auto_registration block is repeated verbatim below - drop it and the
|
|
||||||
# agent can no longer register itself.
|
|
||||||
config.yaml.local: |
|
|
||||||
api:
|
|
||||||
server:
|
|
||||||
auto_registration: # Activate if not using TLS for authentication
|
|
||||||
enabled: true
|
|
||||||
token: "${REGISTRATION_TOKEN}" # /!\ Do not modify this variable (auto-generated and handled by the chart)
|
|
||||||
allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
|
|
||||||
- "127.0.0.1/32"
|
|
||||||
- "192.168.0.0/16"
|
|
||||||
- "10.0.0.0/8"
|
|
||||||
- "172.16.0.0/12"
|
|
||||||
# This homelab has no egress to console.crowdsec.cloud: DNS does
|
|
||||||
# not resolve. The LAPI kept trying anyway ("Signal push: N
|
|
||||||
# signals to push", "capi metrics: sending" every 10s) and each
|
|
||||||
# attempt sat on a resolver timeout WHILE HOLDING A WRITE
|
|
||||||
# TRANSACTION, which is what kept stalling per-request decision
|
|
||||||
# lookups even with WAL enabled. Nothing to share and nothing to
|
|
||||||
# pull - turn the Central API off instead of letting it block the
|
|
||||||
# only database writer we have.
|
|
||||||
online_client:
|
|
||||||
sharing: false
|
|
||||||
pull:
|
|
||||||
community: false
|
|
||||||
blocklists: false
|
|
||||||
disable_usage_metrics_export: true
|
|
||||||
db_config:
|
|
||||||
# SQLite without WAL serialises every reader behind the writer's
|
|
||||||
# rollback journal, and the LAPI writes constantly: the agent pushes
|
|
||||||
# Traefik alerts read from Loki, the metrics collector counts
|
|
||||||
# decisions, the bouncer touches "last pull" on every request.
|
|
||||||
# Symptom: decision lookups taking 10-30s (and a second connection
|
|
||||||
# that could not even open the database) while the LAPI sat at 28m
|
|
||||||
# CPU - the process was blocked in fsync, not computing. Every
|
|
||||||
# bouncer-protected request then blew through the plugin timeout and
|
|
||||||
# fail-closed with 403, on every site at once.
|
|
||||||
# The PVC is local-path-retain (hostPath), not a network share, so
|
|
||||||
# WAL is safe here; the crowdsec docs recommend it for exactly this
|
|
||||||
# ("allowing more concurrency in SQLite that will improve
|
|
||||||
# performances in most scenarios").
|
|
||||||
use_wal: true
|
|
||||||
# Keeps the alert table bounded. At the 5000/7d default the file
|
|
||||||
# reached 54MB in 15 days off the Traefik access log alone, and the
|
|
||||||
# metrics collector counts decisions on a timer; a smaller working
|
|
||||||
# set means fewer full scans. Crowdsec only prunes - SQLite never
|
|
||||||
# shrinks the file, so the size stays until a manual VACUUM.
|
|
||||||
flush:
|
|
||||||
max_items: 1000
|
|
||||||
max_age: 24h
|
|
||||||
|
|
||||||
lapi:
|
|
||||||
env:
|
|
||||||
- name: COLLECTIONS
|
|
||||||
value: crowdsecurity/traefik crowdsecurity/base-http-scenarios
|
|
||||||
- name: DISABLE_COLLECTIONS
|
|
||||||
value: crowdsecurity/linux crowdsecurity/sshd
|
|
||||||
metrics:
|
|
||||||
enabled: true
|
|
||||||
serviceMonitor:
|
|
||||||
additionalLabels:
|
|
||||||
release: prometheus-stack
|
|
||||||
enabled: true
|
|
||||||
persistentVolume:
|
|
||||||
config:
|
|
||||||
enabled: true
|
|
||||||
size: 100Mi
|
|
||||||
storageClassName: local-path-retain
|
|
||||||
data:
|
|
||||||
enabled: true
|
|
||||||
size: 1Gi
|
|
||||||
storageClassName: local-path-retain
|
|
||||||
# LAPI answers a blocking /v1/decisions lookup for EVERY bouncer-protected
|
|
||||||
# request (whole Traefik front door), so it is the hot path of the proxy.
|
|
||||||
# At 400m/500Mi it went CPU-throttled and idle lookups measured 1.3-7.4s,
|
|
||||||
# which pushed requests into the bouncer's fail-closed 403.
|
|
||||||
# Single replica on purpose: LAPI is stateful (BoltDB on the `data` PVC,
|
|
||||||
# credentials on the `config` PVC) - two replicas sharing those RWO
|
|
||||||
# volumes would corrupt the decision store. Scale up CPU, not replicas.
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 1500m
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 250m
|
|
||||||
memory: 500Mi
|
|
||||||
service:
|
|
||||||
type: ClusterIP
|
|
||||||
storeLAPICscliCredentialsInSecret: true
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
crowdsec-overview.json: "{\n \"__inputs\": [\n {\n \"name\": \"DS_PROMETHEUS\",\n \"label\": \"Prometheus\",\n \"description\": \"\",\n \"type\": \"datasource\",\n \"pluginId\": \"prometheus\",\n \"pluginName\": \"Prometheus\"\n }\n ],\n \"__requires\": [\n {\n \"type\": \"grafana\",\n \"id\": \"grafana\",\n \"name\": \"Grafana\",\n \"version\": \"8.1.2\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"graph\",\n \"name\": \"Graph (old)\",\n \"version\": \"\"\n },\n {\n \"type\": \"datasource\",\n \"id\": \"prometheus\",\n \"name\": \"Prometheus\",\n \"version\": \"1.0.0\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"stat\",\n \"name\": \"Stat\",\n \"version\": \"\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"timeseries\",\n \"name\": \"Time series\",\n \"version\": \"\"\n }\n ],\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": \"-- Grafana --\",\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n },\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"gnetId\": null,\n \"graphTooltip\": 0,\n \"id\": null,\n \"links\": [],\n \"panels\": [\n {\n \"collapsed\": false,\n \"datasource\": null,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 24,\n \"panels\": [],\n \"title\": \"Summary\",\n \"type\": \"row\"\n },\n {\n \"cacheTimeout\": null,\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"text\": \"N/A\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"#E02F44\",\n \"value\": null\n },\n {\n \"color\": \"#E02F44\",\n \"value\": 10\n },\n {\n \"color\": \"#299c46\",\n \"value\": 10\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 6,\n \"x\": 0,\n \"y\": 1\n },\n \"id\": 2,\n \"interval\": null,\n \"links\": [],\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"background\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"text\": {},\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"8.1.2\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"count(cs_info)\",\n \"interval\": \"\",\n \"legendFormat\": \"\",\n \"refId\": \"A\"\n }\n ],\n \"timeFrom\": null,\n \"timeShift\": null,\n \"title\": \"Running Crowdsec\",\n \"transparent\": true,\n \"type\": \"stat\"\n },\n {\n \"aliasColors\": {},\n \"bars\": false,\n \"dashLength\": 10,\n \"dashes\": false,\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"decimals\": 1,\n \"fieldConfig\": {\n \"defaults\": {\n \"links\": []\n },\n \"overrides\": []\n },\n \"fill\": 1,\n \"fillGradient\": 0,\n \"gridPos\": {\n \"h\": 8,\n \"w\": 18,\n \"x\": 6,\n \"y\": 1\n },\n \"hiddenSeries\": false,\n \"id\": 8,\n \"legend\": {\n \"alignAsTable\": true,\n \"avg\": false,\n \"current\": false,\n \"max\": false,\n \"min\": false,\n \"rightSide\": true,\n \"show\": true,\n \"sort\": \"total\",\n \"sortDesc\": true,\n \"total\": true,\n \"values\": true\n },\n \"lines\": true,\n \"linewidth\": 1,\n \"nullPointMode\": \"null\",\n \"options\": {\n \"alertThreshold\": true\n },\n \"percentage\": false,\n \"pluginVersion\": \"8.1.2\",\n \"pointradius\": 2,\n \"points\": false,\n \"renLine truncated
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/managed-by: manual
|
|
||||||
grafana_dashboard: "1"
|
|
||||||
name: crowdsec-crowdsec-overview
|
|
||||||
namespace: prometheus
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
crowdsec-lapi-metrics.json: "{\n \"__inputs\": [\n {\n \"name\": \"DS_PROMETHEUS\",\n \"label\": \"Prometheus\",\n \"description\": \"\",\n \"type\": \"datasource\",\n \"pluginId\": \"prometheus\",\n \"pluginName\": \"Prometheus\"\n }\n ],\n \"__requires\": [\n {\n \"type\": \"panel\",\n \"id\": \"bargauge\",\n \"name\": \"Bar gauge\",\n \"version\": \"\"\n },\n {\n \"type\": \"grafana\",\n \"id\": \"grafana\",\n \"name\": \"Grafana\",\n \"version\": \"8.1.2\"\n },\n {\n \"type\": \"datasource\",\n \"id\": \"prometheus\",\n \"name\": \"Prometheus\",\n \"version\": \"1.0.0\"\n }\n ],\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": \"-- Grafana --\",\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n },\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"gnetId\": null,\n \"graphTooltip\": 0,\n \"id\": null,\n \"iteration\": 1655915193937,\n \"links\": [],\n \"panels\": [\n {\n \"collapsed\": false,\n \"datasource\": null,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 10,\n \"panels\": [],\n \"title\": \"Agents\",\n \"type\": \"row\"\n },\n {\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n }\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 0,\n \"y\": 1\n },\n \"id\": 2,\n \"options\": {\n \"displayMode\": \"gradient\",\n \"orientation\": \"vertical\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showUnfilled\": false,\n \"text\": {}\n },\n \"pluginVersion\": \"8.1.2\",\n \"repeat\": \"query0\",\n \"repeatDirection\": \"h\",\n \"targets\": [\n {\n \"exemplar\": false,\n \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\", instance=\\\"$lapi\\\"}[$__rate_interval])) by (le)\",\n \"format\": \"heatmap\",\n \"interval\": \"\",\n \"legendFormat\": \"{{le}}\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Agents Login\",\n \"type\": \"heatmap\"\n },\n {\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"none\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 8,\n \"w\": 12,\n \"x\": 12,\n \"y\": 1\n },\n \"id\": 6,\n \"options\": {\n \"displayMode\": \"gradient\",\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"showUnfilled\": false,\n \"text\": {}\n },\n \"pluginVersion\": \"8.1.2\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"sum(rate(cs_lapi_request_duration_seconds_bucket{endpoint=\\\"/v1/watchers/login\\\"}[$__rate_interval])) by (le)\",\n \"format\": \"heatmap\",\n \"interval\": \"\",\n \"legendFormat\": \"{{le}}\",\n \"refId\": \"A\"\n }\n ],\n \"title\": \"Heartbeat\",\n \"type\": \"heatmap\"\n },\n {\n \"collapsed\": false,\n \"datasource\": null,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 9\n },\n \"id\": 12,\n \"panels\": [],\n \"title\": \"Decisions\",\n \"type\": \"row\"\n },\n {\n \"datasource\": \"${DS_PROMETHEUS}\",\n Line truncated
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/managed-by: manual
|
|
||||||
grafana_dashboard: "1"
|
|
||||||
name: crowdsec-crowdsec-lapi-metrics
|
|
||||||
namespace: prometheus
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
crowdsec-insight.json: "{\n \"__inputs\": [\n {\n \"name\": \"DS_PROMETHEUS\",\n \"label\": \"Prometheus\",\n \"description\": \"\",\n \"type\": \"datasource\",\n \"pluginId\": \"prometheus\",\n \"pluginName\": \"Prometheus\"\n }\n ],\n \"__requires\": [\n {\n \"type\": \"panel\",\n \"id\": \"bargauge\",\n \"name\": \"Bar gauge\",\n \"version\": \"\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"gauge\",\n \"name\": \"Gauge\",\n \"version\": \"\"\n },\n {\n \"type\": \"grafana\",\n \"id\": \"grafana\",\n \"name\": \"Grafana\",\n \"version\": \"8.1.2\"\n },\n {\n \"type\": \"datasource\",\n \"id\": \"prometheus\",\n \"name\": \"Prometheus\",\n \"version\": \"1.0.0\"\n },\n {\n \"type\": \"panel\",\n \"id\": \"stat\",\n \"name\": \"Stat\",\n \"version\": \"\"\n }\n ],\n \"annotations\": {\n \"list\": [\n {\n \"builtIn\": 1,\n \"datasource\": \"-- Grafana --\",\n \"enable\": true,\n \"hide\": true,\n \"iconColor\": \"rgba(0, 211, 255, 1)\",\n \"name\": \"Annotations & Alerts\",\n \"target\": {\n \"limit\": 100,\n \"matchAny\": false,\n \"tags\": [],\n \"type\": \"dashboard\"\n },\n \"type\": \"dashboard\"\n }\n ]\n },\n \"editable\": true,\n \"gnetId\": null,\n \"graphTooltip\": 0,\n \"id\": null,\n \"iteration\": 1655915159751,\n \"links\": [],\n \"panels\": [\n {\n \"collapsed\": true,\n \"datasource\": null,\n \"gridPos\": {\n \"h\": 1,\n \"w\": 24,\n \"x\": 0,\n \"y\": 0\n },\n \"id\": 22,\n \"panels\": [\n {\n \"cacheTimeout\": null,\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"fieldConfig\": {\n \"defaults\": {\n \"color\": {\n \"mode\": \"thresholds\"\n },\n \"mappings\": [\n {\n \"options\": {\n \"match\": \"null\",\n \"result\": {\n \"text\": \"N/A\"\n }\n },\n \"type\": \"special\"\n }\n ],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n },\n {\n \"color\": \"red\",\n \"value\": 80\n }\n ]\n },\n \"unit\": \"dateTimeAsIso\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 5,\n \"x\": 2,\n \"y\": 1\n },\n \"id\": 2,\n \"interval\": null,\n \"links\": [],\n \"maxDataPoints\": 100,\n \"options\": {\n \"colorMode\": \"none\",\n \"graphMode\": \"none\",\n \"justifyMode\": \"auto\",\n \"orientation\": \"horizontal\",\n \"reduceOptions\": {\n \"calcs\": [\n \"lastNotNull\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\n \"text\": {},\n \"textMode\": \"auto\"\n },\n \"pluginVersion\": \"8.1.2\",\n \"targets\": [\n {\n \"exemplar\": true,\n \"expr\": \"(process_start_time_seconds{instance=\\\"$instance\\\"})*1000\",\n \"interval\": \"\",\n \"legendFormat\": \"{{instance}}\",\n \"refId\": \"A\"\n }\n ],\n \"timeFrom\": null,\n \"timeShift\": null,\n \"title\": \"Up since\",\n \"type\": \"stat\"\n },\n {\n \"datasource\": \"${DS_PROMETHEUS}\",\n \"fieldConfig\": {\n \"defaults\": {\n \"displayName\": \"\",\n \"mappings\": [],\n \"thresholds\": {\n \"mode\": \"absolute\",\n \"steps\": [\n {\n \"color\": \"green\",\n \"value\": null\n }\n ]\n },\n \"unit\": \"decbytes\"\n },\n \"overrides\": []\n },\n \"gridPos\": {\n \"h\": 9,\n \"w\": 5,\n \"x\": 7,\n \"y\": 1\n },\n \"id\": 4,\n \"options\": {\n \"orientation\": \"auto\",\n \"reduceOptions\": {\n \"calcs\": [\n \"mean\"\n ],\n \"fields\": \"\",\n \"values\": false\n },\Line truncated
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/managed-by: manual
|
|
||||||
grafana_dashboard: "1"
|
|
||||||
name: crowdsec-crowdsec-insight
|
|
||||||
namespace: prometheus
|
|
||||||
@@ -1,202 +0,0 @@
|
|||||||
# CrowdSec self-healing: static machine identity + enforcement loops.
|
|
||||||
#
|
|
||||||
# Problem it fixes: the chart's agent init container runs
|
|
||||||
# `cscli lapi register --machine "$POD_NAME" ...`
|
|
||||||
# unconditionally. Credentials live in an emptyDir, the machine row lives
|
|
||||||
# in LAPI's persistent DB. Any init re-run for an already-known pod name
|
|
||||||
# (kubelet restart, node reboot) dies with
|
|
||||||
# 403 Forbidden: user '<pod>' already exist
|
|
||||||
# and the DaemonSet pod sticks in Init forever. Every DS restart also
|
|
||||||
# leaves an orphan machine row that is never cleaned.
|
|
||||||
#
|
|
||||||
# Design (name-independent):
|
|
||||||
# * Agent identity is a STATIC machine `crowdsec-agent-workstation`
|
|
||||||
# whose password lives in Secret `crowdsec-agent-credentials`
|
|
||||||
# (created once, manually - like all other secrets in this repo).
|
|
||||||
# The secret is mounted into agent pods at
|
|
||||||
# /tmp_config/local_api_credentials.yaml (see extraVolumeMounts in
|
|
||||||
# crowdsec-values.yaml), which is exactly the path the agent's main
|
|
||||||
# container copies into place at startup.
|
|
||||||
# * The DS init command is patched (strategic merge, by container name)
|
|
||||||
# to SKIP registration when that file exists, keeping the legacy
|
|
||||||
# register path only as fallback. Detection marker in the patched
|
|
||||||
# command: `[ -s /tmp_config`.
|
|
||||||
# * This CronJob enforces the desired state hourly, so recovery is
|
|
||||||
# automatic even after `helm upgrade` reverts the DS patch or the
|
|
||||||
# LAPI database is wiped:
|
|
||||||
# 1. patch DS init if it still has the unconditional register
|
|
||||||
# (no-op otherwise - no restart churn);
|
|
||||||
# 2. prune machines with no heartbeat for 2h (orphan hygiene);
|
|
||||||
# 3. ensure the static machine exists, recreating it with the
|
|
||||||
# Secret password if missing (agent retry loops reconnect
|
|
||||||
# on their own - same name + same password);
|
|
||||||
# 4. prune bouncer entries idle for 30d.
|
|
||||||
#
|
|
||||||
# It used to also delete LePresidente/http-generic-403-bf decisions hourly.
|
|
||||||
# That was a workaround for the bouncer failing closed on a slow LAPI and
|
|
||||||
# 403-ing the deploy runner into a 4h ban. The bouncer now polls decisions
|
|
||||||
# into a cache and never blocks on an unreachable LAPI, so it cannot
|
|
||||||
# manufacture those 403s any more, and the scenario only fires against real
|
|
||||||
# scanners - deleting their decisions hourly was undoing a working ban.
|
|
||||||
#
|
|
||||||
# Manual apply (crowdsec/k8s is NOT managed by deploy.yaml):
|
|
||||||
# kubectl apply -f crowdsec/k8s/janitor-cronjob.yaml
|
|
||||||
# Force a run:
|
|
||||||
# kubectl create job -n crowdsec --from=cronjob/crowdsec-janitor janitor-now
|
|
||||||
#
|
|
||||||
# Helm upgrades: the janitor's strategic patch puts the DS field under
|
|
||||||
# the `kubectl-patch` field manager, so a plain `helm upgrade` FAILS
|
|
||||||
# with an SSA conflict on initContainers[].command. Procedure:
|
|
||||||
# 1. revert init to chart state (kills the conflict):
|
|
||||||
# helm template crowdsec crowdsec/crowdsec --version <ver> \
|
|
||||||
# -n crowdsec -f crowdsec/k8s/crowdsec-values.yaml > /tmp/r.yaml
|
|
||||||
# python3 -c "import yaml,json; ..." # build revert patch from
|
|
||||||
# the rendered DaemonSet init command, then
|
|
||||||
# kubectl patch ds crowdsec-agent -n crowdsec \
|
|
||||||
# --type strategic -p "\$(cat /tmp/revert_patch.json)"
|
|
||||||
# 2. helm upgrade --install crowdsec ... (no --force needed)
|
|
||||||
# 3. janitor-now right away (upgrade reverts init; new pods would
|
|
||||||
# sit in Init until the next hourly run otherwise).
|
|
||||||
#
|
|
||||||
# One-time bootstrap (order matters):
|
|
||||||
# 1. Create Secret + static machine (see commands in chat).
|
|
||||||
# 2. Apply this file, trigger janitor-now, wait for agent 1/1.
|
|
||||||
# 3. One-time orphan cleanup:
|
|
||||||
# kubectl exec -n crowdsec deploy/crowdsec-lapi -- \
|
|
||||||
# cscli machines prune --duration 1h --force
|
|
||||||
# 4. Only then `helm upgrade` crowdsec with the extraVolumes values.
|
|
||||||
# Upgrade reverts the DS patch; trigger janitor-now right after it
|
|
||||||
# (otherwise new pods sit in Init until the next hourly run, then
|
|
||||||
# self-heal anyway).
|
|
||||||
#
|
|
||||||
# Password rotation: update the Secret, delete the machine
|
|
||||||
# (`cscli machines delete crowdsec-agent-workstation`), trigger
|
|
||||||
# janitor-now (recreates it), then `kubectl rollout restart
|
|
||||||
# ds/crowdsec-agent -n crowdsec` (agent reads the file at startup only).
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: crowdsec-janitor
|
|
||||||
namespace: crowdsec
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: crowdsec-janitor
|
|
||||||
namespace: crowdsec
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["pods"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["pods/exec"]
|
|
||||||
verbs: ["create"]
|
|
||||||
- apiGroups: ["apps"]
|
|
||||||
resources: ["daemonsets"]
|
|
||||||
verbs: ["get", "patch"]
|
|
||||||
# `kubectl exec deploy/<name>` resolves deploy -> replicaset -> pod,
|
|
||||||
# which needs read access to these (exec itself is pods/exec above).
|
|
||||||
- apiGroups: ["apps"]
|
|
||||||
resources: ["deployments", "replicasets"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: crowdsec-janitor
|
|
||||||
namespace: crowdsec
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: crowdsec-janitor
|
|
||||||
namespace: crowdsec
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: crowdsec-janitor
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: CronJob
|
|
||||||
metadata:
|
|
||||||
name: crowdsec-janitor
|
|
||||||
namespace: crowdsec
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
spec:
|
|
||||||
schedule: "17 * * * *"
|
|
||||||
concurrencyPolicy: Forbid
|
|
||||||
successfulJobsHistoryLimit: 3
|
|
||||||
failedJobsHistoryLimit: 3
|
|
||||||
jobTemplate:
|
|
||||||
spec:
|
|
||||||
activeDeadlineSeconds: 300
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
spec:
|
|
||||||
serviceAccountName: crowdsec-janitor
|
|
||||||
restartPolicy: OnFailure
|
|
||||||
containers:
|
|
||||||
- name: janitor
|
|
||||||
# Same image the chart itself uses for registration jobs;
|
|
||||||
# IfNotPresent so it works while the node is offline
|
|
||||||
# (layer cached from the chart install).
|
|
||||||
image: alpine/kubectl:latest
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
- name: AGENT_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: crowdsec-agent-credentials
|
|
||||||
key: password
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
set -eu
|
|
||||||
LAPI_EXEC="kubectl exec -n crowdsec deploy/crowdsec-lapi --"
|
|
||||||
echo "== 1. enforce patched agent init =="
|
|
||||||
CUR=$(kubectl get ds crowdsec-agent -n crowdsec \
|
|
||||||
-o jsonpath='{.spec.template.spec.initContainers[0].command[2]}')
|
|
||||||
case "$CUR" in
|
|
||||||
*'-s /tmp_config'*)
|
|
||||||
echo "init already patched"
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo "patching init"
|
|
||||||
WAIT='until nc "$LAPI_HOST" "$LAPI_PORT" -z'
|
|
||||||
WAIT="$WAIT; do echo waiting for lapi to start; sleep 5; done"
|
|
||||||
LINK='ln -s /staging/etc/crowdsec /etc/crowdsec'
|
|
||||||
REG='cscli lapi register --machine "$USERNAME"'
|
|
||||||
REG="$REG -u \"\$LAPI_URL\" --token \"\$REGISTRATION_TOKEN\""
|
|
||||||
CREDS=/tmp_config/local_api_credentials.yaml
|
|
||||||
CMD="$WAIT; $LINK; [ -s $CREDS ] || {"
|
|
||||||
CMD="$CMD $REG && cp"
|
|
||||||
CMD="$CMD /etc/crowdsec/local_api_credentials.yaml $CREDS; }"
|
|
||||||
ESC=$(printf '%s' "$CMD" | sed 's/"/\\"/g')
|
|
||||||
PATCH='{"spec":{"template":{"spec":{"initContainers":'
|
|
||||||
PATCH=$PATCH'[{"name":"wait-for-lapi-and-register",'
|
|
||||||
PATCH=$PATCH'"command":["sh","-c","'$ESC'"]}]}}}}'
|
|
||||||
kubectl patch ds crowdsec-agent -n crowdsec \
|
|
||||||
--type strategic -p "$PATCH"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
echo "== 2. prune orphan machines (no heartbeat for 2h) =="
|
|
||||||
$LAPI_EXEC cscli machines prune --duration 2h --force
|
|
||||||
echo "== 3. ensure static machine exists =="
|
|
||||||
if $LAPI_EXEC cscli machines inspect \
|
|
||||||
crowdsec-agent-workstation >/dev/null 2>&1; then
|
|
||||||
echo "static machine present"
|
|
||||||
else
|
|
||||||
echo "recreating static machine"
|
|
||||||
$LAPI_EXEC cscli machines add crowdsec-agent-workstation \
|
|
||||||
--password "$AGENT_PASSWORD" --force
|
|
||||||
fi
|
|
||||||
echo "== 4. prune stale bouncers (no pull for 30d) =="
|
|
||||||
$LAPI_EXEC cscli bouncers prune -d 720h --force
|
|
||||||
@@ -1,6 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: crowdsec
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: crowdsec
|
|
||||||
@@ -1,34 +0,0 @@
|
|||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: crowdsec-lapi
|
|
||||||
namespace: crowdsec
|
|
||||||
spec:
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: crowdsec
|
|
||||||
type: lapi
|
|
||||||
policyTypes:
|
|
||||||
- Ingress
|
|
||||||
ingress:
|
|
||||||
- from:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: traefik
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: traefik
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: crowdsec
|
|
||||||
type: agent
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 8080
|
|
||||||
- from:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: prometheus
|
|
||||||
ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 6060
|
|
||||||
+45
-41
@@ -1,46 +1,50 @@
|
|||||||
services:
|
services:
|
||||||
dockmon:
|
dockmon:
|
||||||
image: darthnorse/dockmon:2.5.0
|
image: darthnorse/dockmon:latest
|
||||||
container_name: dockmon
|
container_name: dockmon
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
# ports:
|
# ports:
|
||||||
# - 8000:443
|
# - 8000:443
|
||||||
volumes:
|
volumes:
|
||||||
- data:/app/data
|
- data:/app/data
|
||||||
- /var/run/docker.sock:/var/run/docker.sock
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "curl", "-k", "-f", "https://localhost:443/health"]
|
test: [ "CMD", "curl", "-k", "-f", "https://localhost:443/health" ]
|
||||||
interval: 30s
|
interval: 30s
|
||||||
timeout: 10s
|
timeout: 10s
|
||||||
retries: 3
|
retries: 3
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- "traefik.enable=true"
|
||||||
- "traefik.http.services.dockmon.loadbalancer.server.port=443"
|
- "traefik.docker.network=proxy"
|
||||||
- "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
|
- "traefik.http.services.dockmon.loadbalancer.server.port=443"
|
||||||
- "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
|
- "traefik.http.services.dockmon.loadbalancer.server.scheme=https"
|
||||||
|
- "traefik.http.services.dockmon.loadbalancer.serverstransport=insecureTransport@file"
|
||||||
|
|
||||||
# Prod Router
|
# Prod Router
|
||||||
- "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
|
- "traefik.http.routers.dockmon.rule=Host(`dockmon.forust.xyz`)"
|
||||||
- "traefik.http.routers.dockmon.entrypoints=websecure"
|
- "traefik.http.routers.dockmon.entrypoints=websecure"
|
||||||
- "traefik.http.routers.dockmon.middlewares=security-headers@file"
|
- "traefik.http.routers.dockmon.middlewares=security-chain@file"
|
||||||
- "traefik.http.routers.dockmon.tls.certresolver=letsencrypt"
|
- "traefik.http.routers.dockmon.service=dockmon"
|
||||||
# Local Router
|
- "traefik.http.routers.dockmon.tls=true"
|
||||||
- "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
|
# Local Router
|
||||||
- "traefik.http.routers.dockmon-local.entrypoints=websecure"
|
- "traefik.http.routers.dockmon-local.rule=Host(`dockmon.workstation.internal`)"
|
||||||
- "traefik.http.routers.dockmon-local.tls=true"
|
- "traefik.http.routers.dockmon-local.entrypoints=websecure"
|
||||||
# Dev Router
|
- "traefik.http.routers.dockmon-local.middlewares=security-headers@file"
|
||||||
- "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
|
- "traefik.http.routers.dockmon-local.tls=true"
|
||||||
- "traefik.http.routers.dockmon-dev.entrypoints=websecure"
|
# Dev Router
|
||||||
- "traefik.http.routers.dockmon-dev.tls=true"
|
- "traefik.http.routers.dockmon-dev.rule=Host(`dockmon.gigaforust.internal`)"
|
||||||
|
- "traefik.http.routers.dockmon-dev.entrypoints=websecure"
|
||||||
|
- "traefik.http.routers.dockmon-dev.middlewares=security-chain@file"
|
||||||
|
- "traefik.http.routers.dockmon-dev.tls=true"
|
||||||
|
|
||||||
# Glance Metadata
|
# Glance Metadata
|
||||||
- glance.name=dockmon
|
- glance.name=dockmon
|
||||||
- glance.url=https://dockmon.forust.xyz/
|
- glance.url=https://dockmon.forust.xyz/
|
||||||
- glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
|
- glance.description=Dockmon is a lightweight Docker container monitoring and management tool with a user-friendly web interface.
|
||||||
networks:
|
networks:
|
||||||
- proxy
|
- proxy
|
||||||
volumes:
|
volumes:
|
||||||
data:
|
data:
|
||||||
networks:
|
networks:
|
||||||
proxy:
|
proxy:
|
||||||
external: true
|
external: true
|
||||||
@@ -1,28 +0,0 @@
|
|||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: dockmon-prod-tls
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
secretName: dockmon-prod-tls
|
|
||||||
dnsNames:
|
|
||||||
- dockmon.forust.xyz
|
|
||||||
issuerRef:
|
|
||||||
name: letsencrypt-prod
|
|
||||||
kind: ClusterIssuer
|
|
||||||
---
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
name: internal-wildcard-tls
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
dnsNames:
|
|
||||||
- "*.workstation.internal"
|
|
||||||
- "*.gigaforust.internal"
|
|
||||||
- workstation.internal
|
|
||||||
- gigaforust.internal
|
|
||||||
issuerRef:
|
|
||||||
name: internal-ca
|
|
||||||
kind: ClusterIssuer
|
|
||||||
@@ -1,68 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: dockmon-service
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
clusterIP: None
|
|
||||||
selector:
|
|
||||||
app: dockmon
|
|
||||||
ports:
|
|
||||||
- port: 443
|
|
||||||
targetPort: 443
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: dockmon-statefulset
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
serviceName: dockmon-service
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: dockmon
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: dockmon
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: dockmon
|
|
||||||
image: darthnorse/dockmon:2.5.0
|
|
||||||
ports:
|
|
||||||
- containerPort: 443
|
|
||||||
volumeMounts:
|
|
||||||
- name: data
|
|
||||||
mountPath: /app/data
|
|
||||||
- name: docker-sock
|
|
||||||
mountPath: /var/run/docker.sock
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /health
|
|
||||||
port: 443
|
|
||||||
scheme: HTTPS
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 10
|
|
||||||
failureThreshold: 3
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "512Mi"
|
|
||||||
cpu: "200m"
|
|
||||||
limits:
|
|
||||||
memory: "1.5Gi"
|
|
||||||
cpu: "700m "
|
|
||||||
volumes:
|
|
||||||
- name: docker-sock
|
|
||||||
hostPath:
|
|
||||||
path: /var/run/docker.sock
|
|
||||||
type: Socket
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes: ["ReadWriteOnce"]
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 1Gi
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: ServersTransport
|
|
||||||
metadata:
|
|
||||||
name: dockmon-transport
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
insecureSkipVerify: true
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: dockmon-prod
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`dockmon.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
middlewares:
|
|
||||||
- name: security-headers@file
|
|
||||||
services:
|
|
||||||
- name: dockmon-service
|
|
||||||
port: 443
|
|
||||||
serversTransport: dockmon-transport
|
|
||||||
tls:
|
|
||||||
secretName: dockmon-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: dockmon-local
|
|
||||||
namespace: dockmon
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`dockmon.workstation.internal`) || Host(`dockmon.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: dockmon-service
|
|
||||||
port: 443
|
|
||||||
serversTransport: dockmon-transport
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: dockmon
|
|
||||||
+17
-15
@@ -1,29 +1,31 @@
|
|||||||
services:
|
services:
|
||||||
downtify:
|
downtify:
|
||||||
container_name: downtify
|
container_name: downtify
|
||||||
image: ghcr.io/henriquesebastiao/downtify:3.4.0
|
image: ghcr.io/henriquesebastiao/downtify:latest
|
||||||
restart: unless-stopped
|
|
||||||
# ports:
|
# ports:
|
||||||
# - '7077:8000'
|
# - '7077:8000'
|
||||||
volumes:
|
volumes:
|
||||||
- ./Downtify_downloads:/downloads
|
- ./Downtify_downloads:/downloads
|
||||||
labels:
|
labels:
|
||||||
- "traefik.enable=true"
|
- traefik.enable=true
|
||||||
- "traefik.http.services.downtify.loadbalancer.server.port=8000"
|
- traefik.docker.network=proxy
|
||||||
|
- traefik.http.services.downtify.loadbalancer.server.port=8000
|
||||||
|
|
||||||
# Prod Router
|
# Prod Router
|
||||||
- "traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)"
|
- traefik.http.routers.downtify.rule=Host(`downtify.forust.xyz`)
|
||||||
- "traefik.http.routers.downtify.entrypoints=websecure"
|
- traefik.http.routers.downtify.entrypoints=websecure
|
||||||
- "traefik.http.routers.downtify.middlewares=security-chain@file"
|
- traefik.http.routers.downtify.middlewares=security-chain@file
|
||||||
- "traefik.http.routers.downtify.tls.certresolver=letsencrypt"
|
- traefik.http.routers.downtify.tls=true
|
||||||
# Local Router
|
# Local Router
|
||||||
- "traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`)"
|
- traefik.http.routers.downtify-local.rule=Host(`downtify.workstation.internal`) || Host(`downtify.internal`)
|
||||||
- "traefik.http.routers.downtify-local.entrypoints=websecure"
|
- traefik.http.routers.downtify-local.entrypoints=websecure
|
||||||
- "traefik.http.routers.downtify-local.tls=true"
|
- traefik.http.routers.downtify-local.middlewares=security-headers@file
|
||||||
|
- traefik.http.routers.downtify-local.tls=true
|
||||||
# Dev Router
|
# Dev Router
|
||||||
- "traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)"
|
- traefik.http.routers.downtify-dev.rule=Host(`downtify.gigaforust.internal`)
|
||||||
- "traefik.http.routers.downtify-dev.entrypoints=websecure"
|
- traefik.http.routers.downtify-dev.entrypoints=websecure
|
||||||
- "traefik.http.routers.downtify-dev.tls=true"
|
- traefik.http.routers.downtify-dev.middlewares=security-chain@file
|
||||||
|
- traefik.http.routers.downtify-dev.tls=true
|
||||||
networks:
|
networks:
|
||||||
- proxy
|
- proxy
|
||||||
networks:
|
networks:
|
||||||
|
|||||||
@@ -1,60 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: downtify-service
|
|
||||||
namespace: downtify
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: downtify
|
|
||||||
ports:
|
|
||||||
- port: 8000
|
|
||||||
targetPort: 8000
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: downtify-deployment
|
|
||||||
namespace: downtify
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: downtify
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: downtify
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: downtify
|
|
||||||
image: ghcr.io/henriquesebastiao/downtify:3.4.0
|
|
||||||
ports:
|
|
||||||
- containerPort: 8000
|
|
||||||
volumeMounts:
|
|
||||||
- name: downloads
|
|
||||||
mountPath: /downloads
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
memory: "128Mi"
|
|
||||||
cpu: "200m"
|
|
||||||
limits:
|
|
||||||
memory: "1Gi"
|
|
||||||
cpu: "1"
|
|
||||||
volumes:
|
|
||||||
- name: downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: downtify-downloads-pvc
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: downtify-downloads-pvc
|
|
||||||
namespace: downtify
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
@@ -1,35 +0,0 @@
|
|||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: downtify-prod
|
|
||||||
namespace: downtify
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`downtify.forust.xyz`)
|
|
||||||
kind: Rule
|
|
||||||
middlewares:
|
|
||||||
- name: security-chain@file
|
|
||||||
services:
|
|
||||||
- name: downtify-service
|
|
||||||
port: 8000
|
|
||||||
tls:
|
|
||||||
secretName: downtify-prod-tls
|
|
||||||
---
|
|
||||||
apiVersion: traefik.io/v1alpha1
|
|
||||||
kind: IngressRoute
|
|
||||||
metadata:
|
|
||||||
name: downtify-local
|
|
||||||
namespace: downtify
|
|
||||||
spec:
|
|
||||||
entryPoints:
|
|
||||||
- websecure
|
|
||||||
routes:
|
|
||||||
- match: Host(`downtify.workstation.internal`) || Host(`downtify.gigaforust.internal`)
|
|
||||||
kind: Rule
|
|
||||||
services:
|
|
||||||
- name: downtify-service
|
|
||||||
port: 8000
|
|
||||||
tls:
|
|
||||||
secretName: internal-wildcard-tls
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: downtify
|
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
FROM python:3.9-alpine
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
# Установка зависимостей
|
||||||
|
COPY requirements.txt .
|
||||||
|
RUN pip install --no-cache-dir -r requirements.txt
|
||||||
|
|
||||||
|
# Копирование кода
|
||||||
|
COPY main.py .
|
||||||
|
COPY .env .
|
||||||
|
# Запуск бота
|
||||||
|
CMD ["python", "-u", "main.py"]
|
||||||
@@ -0,0 +1,373 @@
|
|||||||
|
Mozilla Public License Version 2.0
|
||||||
|
==================================
|
||||||
|
|
||||||
|
1. Definitions
|
||||||
|
--------------
|
||||||
|
|
||||||
|
1.1. "Contributor"
|
||||||
|
means each individual or legal entity that creates, contributes to
|
||||||
|
the creation of, or owns Covered Software.
|
||||||
|
|
||||||
|
1.2. "Contributor Version"
|
||||||
|
means the combination of the Contributions of others (if any) used
|
||||||
|
by a Contributor and that particular Contributor's Contribution.
|
||||||
|
|
||||||
|
1.3. "Contribution"
|
||||||
|
means Covered Software of a particular Contributor.
|
||||||
|
|
||||||
|
1.4. "Covered Software"
|
||||||
|
means Source Code Form to which the initial Contributor has attached
|
||||||
|
the notice in Exhibit A, the Executable Form of such Source Code
|
||||||
|
Form, and Modifications of such Source Code Form, in each case
|
||||||
|
including portions thereof.
|
||||||
|
|
||||||
|
1.5. "Incompatible With Secondary Licenses"
|
||||||
|
means
|
||||||
|
|
||||||
|
(a) that the initial Contributor has attached the notice described
|
||||||
|
in Exhibit B to the Covered Software; or
|
||||||
|
|
||||||
|
(b) that the Covered Software was made available under the terms of
|
||||||
|
version 1.1 or earlier of the License, but not also under the
|
||||||
|
terms of a Secondary License.
|
||||||
|
|
||||||
|
1.6. "Executable Form"
|
||||||
|
means any form of the work other than Source Code Form.
|
||||||
|
|
||||||
|
1.7. "Larger Work"
|
||||||
|
means a work that combines Covered Software with other material, in
|
||||||
|
a separate file or files, that is not Covered Software.
|
||||||
|
|
||||||
|
1.8. "License"
|
||||||
|
means this document.
|
||||||
|
|
||||||
|
1.9. "Licensable"
|
||||||
|
means having the right to grant, to the maximum extent possible,
|
||||||
|
whether at the time of the initial grant or subsequently, any and
|
||||||
|
all of the rights conveyed by this License.
|
||||||
|
|
||||||
|
1.10. "Modifications"
|
||||||
|
means any of the following:
|
||||||
|
|
||||||
|
(a) any file in Source Code Form that results from an addition to,
|
||||||
|
deletion from, or modification of the contents of Covered
|
||||||
|
Software; or
|
||||||
|
|
||||||
|
(b) any new file in Source Code Form that contains any Covered
|
||||||
|
Software.
|
||||||
|
|
||||||
|
1.11. "Patent Claims" of a Contributor
|
||||||
|
means any patent claim(s), including without limitation, method,
|
||||||
|
process, and apparatus claims, in any patent Licensable by such
|
||||||
|
Contributor that would be infringed, but for the grant of the
|
||||||
|
License, by the making, using, selling, offering for sale, having
|
||||||
|
made, import, or transfer of either its Contributions or its
|
||||||
|
Contributor Version.
|
||||||
|
|
||||||
|
1.12. "Secondary License"
|
||||||
|
means either the GNU General Public License, Version 2.0, the GNU
|
||||||
|
Lesser General Public License, Version 2.1, the GNU Affero General
|
||||||
|
Public License, Version 3.0, or any later versions of those
|
||||||
|
licenses.
|
||||||
|
|
||||||
|
1.13. "Source Code Form"
|
||||||
|
means the form of the work preferred for making modifications.
|
||||||
|
|
||||||
|
1.14. "You" (or "Your")
|
||||||
|
means an individual or a legal entity exercising rights under this
|
||||||
|
License. For legal entities, "You" includes any entity that
|
||||||
|
controls, is controlled by, or is under common control with You. For
|
||||||
|
purposes of this definition, "control" means (a) the power, direct
|
||||||
|
or indirect, to cause the direction or management of such entity,
|
||||||
|
whether by contract or otherwise, or (b) ownership of more than
|
||||||
|
fifty percent (50%) of the outstanding shares or beneficial
|
||||||
|
ownership of such entity.
|
||||||
|
|
||||||
|
2. License Grants and Conditions
|
||||||
|
--------------------------------
|
||||||
|
|
||||||
|
2.1. Grants
|
||||||
|
|
||||||
|
Each Contributor hereby grants You a world-wide, royalty-free,
|
||||||
|
non-exclusive license:
|
||||||
|
|
||||||
|
(a) under intellectual property rights (other than patent or trademark)
|
||||||
|
Licensable by such Contributor to use, reproduce, make available,
|
||||||
|
modify, display, perform, distribute, and otherwise exploit its
|
||||||
|
Contributions, either on an unmodified basis, with Modifications, or
|
||||||
|
as part of a Larger Work; and
|
||||||
|
|
||||||
|
(b) under Patent Claims of such Contributor to make, use, sell, offer
|
||||||
|
for sale, have made, import, and otherwise transfer either its
|
||||||
|
Contributions or its Contributor Version.
|
||||||
|
|
||||||
|
2.2. Effective Date
|
||||||
|
|
||||||
|
The licenses granted in Section 2.1 with respect to any Contribution
|
||||||
|
become effective for each Contribution on the date the Contributor first
|
||||||
|
distributes such Contribution.
|
||||||
|
|
||||||
|
2.3. Limitations on Grant Scope
|
||||||
|
|
||||||
|
The licenses granted in this Section 2 are the only rights granted under
|
||||||
|
this License. No additional rights or licenses will be implied from the
|
||||||
|
distribution or licensing of Covered Software under this License.
|
||||||
|
Notwithstanding Section 2.1(b) above, no patent license is granted by a
|
||||||
|
Contributor:
|
||||||
|
|
||||||
|
(a) for any code that a Contributor has removed from Covered Software;
|
||||||
|
or
|
||||||
|
|
||||||
|
(b) for infringements caused by: (i) Your and any other third party's
|
||||||
|
modifications of Covered Software, or (ii) the combination of its
|
||||||
|
Contributions with other software (except as part of its Contributor
|
||||||
|
Version); or
|
||||||
|
|
||||||
|
(c) under Patent Claims infringed by Covered Software in the absence of
|
||||||
|
its Contributions.
|
||||||
|
|
||||||
|
This License does not grant any rights in the trademarks, service marks,
|
||||||
|
or logos of any Contributor (except as may be necessary to comply with
|
||||||
|
the notice requirements in Section 3.4).
|
||||||
|
|
||||||
|
2.4. Subsequent Licenses
|
||||||
|
|
||||||
|
No Contributor makes additional grants as a result of Your choice to
|
||||||
|
distribute the Covered Software under a subsequent version of this
|
||||||
|
License (see Section 10.2) or under the terms of a Secondary License (if
|
||||||
|
permitted under the terms of Section 3.3).
|
||||||
|
|
||||||
|
2.5. Representation
|
||||||
|
|
||||||
|
Each Contributor represents that the Contributor believes its
|
||||||
|
Contributions are its original creation(s) or it has sufficient rights
|
||||||
|
to grant the rights to its Contributions conveyed by this License.
|
||||||
|
|
||||||
|
2.6. Fair Use
|
||||||
|
|
||||||
|
This License is not intended to limit any rights You have under
|
||||||
|
applicable copyright doctrines of fair use, fair dealing, or other
|
||||||
|
equivalents.
|
||||||
|
|
||||||
|
2.7. Conditions
|
||||||
|
|
||||||
|
Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
|
||||||
|
in Section 2.1.
|
||||||
|
|
||||||
|
3. Responsibilities
|
||||||
|
-------------------
|
||||||
|
|
||||||
|
3.1. Distribution of Source Form
|
||||||
|
|
||||||
|
All distribution of Covered Software in Source Code Form, including any
|
||||||
|
Modifications that You create or to which You contribute, must be under
|
||||||
|
the terms of this License. You must inform recipients that the Source
|
||||||
|
Code Form of the Covered Software is governed by the terms of this
|
||||||
|
License, and how they can obtain a copy of this License. You may not
|
||||||
|
attempt to alter or restrict the recipients' rights in the Source Code
|
||||||
|
Form.
|
||||||
|
|
||||||
|
3.2. Distribution of Executable Form
|
||||||
|
|
||||||
|
If You distribute Covered Software in Executable Form then:
|
||||||
|
|
||||||
|
(a) such Covered Software must also be made available in Source Code
|
||||||
|
Form, as described in Section 3.1, and You must inform recipients of
|
||||||
|
the Executable Form how they can obtain a copy of such Source Code
|
||||||
|
Form by reasonable means in a timely manner, at a charge no more
|
||||||
|
than the cost of distribution to the recipient; and
|
||||||
|
|
||||||
|
(b) You may distribute such Executable Form under the terms of this
|
||||||
|
License, or sublicense it under different terms, provided that the
|
||||||
|
license for the Executable Form does not attempt to limit or alter
|
||||||
|
the recipients' rights in the Source Code Form under this License.
|
||||||
|
|
||||||
|
3.3. Distribution of a Larger Work
|
||||||
|
|
||||||
|
You may create and distribute a Larger Work under terms of Your choice,
|
||||||
|
provided that You also comply with the requirements of this License for
|
||||||
|
the Covered Software. If the Larger Work is a combination of Covered
|
||||||
|
Software with a work governed by one or more Secondary Licenses, and the
|
||||||
|
Covered Software is not Incompatible With Secondary Licenses, this
|
||||||
|
License permits You to additionally distribute such Covered Software
|
||||||
|
under the terms of such Secondary License(s), so that the recipient of
|
||||||
|
the Larger Work may, at their option, further distribute the Covered
|
||||||
|
Software under the terms of either this License or such Secondary
|
||||||
|
License(s).
|
||||||
|
|
||||||
|
3.4. Notices
|
||||||
|
|
||||||
|
You may not remove or alter the substance of any license notices
|
||||||
|
(including copyright notices, patent notices, disclaimers of warranty,
|
||||||
|
or limitations of liability) contained within the Source Code Form of
|
||||||
|
the Covered Software, except that You may alter any license notices to
|
||||||
|
the extent required to remedy known factual inaccuracies.
|
||||||
|
|
||||||
|
3.5. Application of Additional Terms
|
||||||
|
|
||||||
|
You may choose to offer, and to charge a fee for, warranty, support,
|
||||||
|
indemnity or liability obligations to one or more recipients of Covered
|
||||||
|
Software. However, You may do so only on Your own behalf, and not on
|
||||||
|
behalf of any Contributor. You must make it absolutely clear that any
|
||||||
|
such warranty, support, indemnity, or liability obligation is offered by
|
||||||
|
You alone, and You hereby agree to indemnify every Contributor for any
|
||||||
|
liability incurred by such Contributor as a result of warranty, support,
|
||||||
|
indemnity or liability terms You offer. You may include additional
|
||||||
|
disclaimers of warranty and limitations of liability specific to any
|
||||||
|
jurisdiction.
|
||||||
|
|
||||||
|
4. Inability to Comply Due to Statute or Regulation
|
||||||
|
---------------------------------------------------
|
||||||
|
|
||||||
|
If it is impossible for You to comply with any of the terms of this
|
||||||
|
License with respect to some or all of the Covered Software due to
|
||||||
|
statute, judicial order, or regulation then You must: (a) comply with
|
||||||
|
the terms of this License to the maximum extent possible; and (b)
|
||||||
|
describe the limitations and the code they affect. Such description must
|
||||||
|
be placed in a text file included with all distributions of the Covered
|
||||||
|
Software under this License. Except to the extent prohibited by statute
|
||||||
|
or regulation, such description must be sufficiently detailed for a
|
||||||
|
recipient of ordinary skill to be able to understand it.
|
||||||
|
|
||||||
|
5. Termination
|
||||||
|
--------------
|
||||||
|
|
||||||
|
5.1. The rights granted under this License will terminate automatically
|
||||||
|
if You fail to comply with any of its terms. However, if You become
|
||||||
|
compliant, then the rights granted under this License from a particular
|
||||||
|
Contributor are reinstated (a) provisionally, unless and until such
|
||||||
|
Contributor explicitly and finally terminates Your grants, and (b) on an
|
||||||
|
ongoing basis, if such Contributor fails to notify You of the
|
||||||
|
non-compliance by some reasonable means prior to 60 days after You have
|
||||||
|
come back into compliance. Moreover, Your grants from a particular
|
||||||
|
Contributor are reinstated on an ongoing basis if such Contributor
|
||||||
|
notifies You of the non-compliance by some reasonable means, this is the
|
||||||
|
first time You have received notice of non-compliance with this License
|
||||||
|
from such Contributor, and You become compliant prior to 30 days after
|
||||||
|
Your receipt of the notice.
|
||||||
|
|
||||||
|
5.2. If You initiate litigation against any entity by asserting a patent
|
||||||
|
infringement claim (excluding declaratory judgment actions,
|
||||||
|
counter-claims, and cross-claims) alleging that a Contributor Version
|
||||||
|
directly or indirectly infringes any patent, then the rights granted to
|
||||||
|
You by any and all Contributors for the Covered Software under Section
|
||||||
|
2.1 of this License shall terminate.
|
||||||
|
|
||||||
|
5.3. In the event of termination under Sections 5.1 or 5.2 above, all
|
||||||
|
end user license agreements (excluding distributors and resellers) which
|
||||||
|
have been validly granted by You or Your distributors under this License
|
||||||
|
prior to termination shall survive termination.
|
||||||
|
|
||||||
|
************************************************************************
|
||||||
|
* *
|
||||||
|
* 6. Disclaimer of Warranty *
|
||||||
|
* ------------------------- *
|
||||||
|
* *
|
||||||
|
* Covered Software is provided under this License on an "as is" *
|
||||||
|
* basis, without warranty of any kind, either expressed, implied, or *
|
||||||
|
* statutory, including, without limitation, warranties that the *
|
||||||
|
* Covered Software is free of defects, merchantable, fit for a *
|
||||||
|
* particular purpose or non-infringing. The entire risk as to the *
|
||||||
|
* quality and performance of the Covered Software is with You. *
|
||||||
|
* Should any Covered Software prove defective in any respect, You *
|
||||||
|
* (not any Contributor) assume the cost of any necessary servicing, *
|
||||||
|
* repair, or correction. This disclaimer of warranty constitutes an *
|
||||||
|
* essential part of this License. No use of any Covered Software is *
|
||||||
|
* authorized under this License except under this disclaimer. *
|
||||||
|
* *
|
||||||
|
************************************************************************
|
||||||
|
|
||||||
|
************************************************************************
|
||||||
|
* *
|
||||||
|
* 7. Limitation of Liability *
|
||||||
|
* -------------------------- *
|
||||||
|
* *
|
||||||
|
* Under no circumstances and under no legal theory, whether tort *
|
||||||
|
* (including negligence), contract, or otherwise, shall any *
|
||||||
|
* Contributor, or anyone who distributes Covered Software as *
|
||||||
|
* permitted above, be liable to You for any direct, indirect, *
|
||||||
|
* special, incidental, or consequential damages of any character *
|
||||||
|
* including, without limitation, damages for lost profits, loss of *
|
||||||
|
* goodwill, work stoppage, computer failure or malfunction, or any *
|
||||||
|
* and all other commercial damages or losses, even if such party *
|
||||||
|
* shall have been informed of the possibility of such damages. This *
|
||||||
|
* limitation of liability shall not apply to liability for death or *
|
||||||
|
* personal injury resulting from such party's negligence to the *
|
||||||
|
* extent applicable law prohibits such limitation. Some *
|
||||||
|
* jurisdictions do not allow the exclusion or limitation of *
|
||||||
|
* incidental or consequential damages, so this exclusion and *
|
||||||
|
* limitation may not apply to You. *
|
||||||
|
* *
|
||||||
|
************************************************************************
|
||||||
|
|
||||||
|
8. Litigation
|
||||||
|
-------------
|
||||||
|
|
||||||
|
Any litigation relating to this License may be brought only in the
|
||||||
|
courts of a jurisdiction where the defendant maintains its principal
|
||||||
|
place of business and such litigation shall be governed by laws of that
|
||||||
|
jurisdiction, without reference to its conflict-of-law provisions.
|
||||||
|
Nothing in this Section shall prevent a party's ability to bring
|
||||||
|
cross-claims or counter-claims.
|
||||||
|
|
||||||
|
9. Miscellaneous
|
||||||
|
----------------
|
||||||
|
|
||||||
|
This License represents the complete agreement concerning the subject
|
||||||
|
matter hereof. If any provision of this License is held to be
|
||||||
|
unenforceable, such provision shall be reformed only to the extent
|
||||||
|
necessary to make it enforceable. Any law or regulation which provides
|
||||||
|
that the language of a contract shall be construed against the drafter
|
||||||
|
shall not be used to construe this License against a Contributor.
|
||||||
|
|
||||||
|
10. Versions of the License
|
||||||
|
---------------------------
|
||||||
|
|
||||||
|
10.1. New Versions
|
||||||
|
|
||||||
|
Mozilla Foundation is the license steward. Except as provided in Section
|
||||||
|
10.3, no one other than the license steward has the right to modify or
|
||||||
|
publish new versions of this License. Each version will be given a
|
||||||
|
distinguishing version number.
|
||||||
|
|
||||||
|
10.2. Effect of New Versions
|
||||||
|
|
||||||
|
You may distribute the Covered Software under the terms of the version
|
||||||
|
of the License under which You originally received the Covered Software,
|
||||||
|
or under the terms of any subsequent version published by the license
|
||||||
|
steward.
|
||||||
|
|
||||||
|
10.3. Modified Versions
|
||||||
|
|
||||||
|
If you create software not governed by this License, and you want to
|
||||||
|
create a new license for such software, you may create and use a
|
||||||
|
modified version of this License if you rename the license and remove
|
||||||
|
any references to the name of the license steward (except to note that
|
||||||
|
such modified license differs from this License).
|
||||||
|
|
||||||
|
10.4. Distributing Source Code Form that is Incompatible With Secondary
|
||||||
|
Licenses
|
||||||
|
|
||||||
|
If You choose to distribute Source Code Form that is Incompatible With
|
||||||
|
Secondary Licenses under the terms of this version of the License, the
|
||||||
|
notice described in Exhibit B of this License must be attached.
|
||||||
|
|
||||||
|
Exhibit A - Source Code Form License Notice
|
||||||
|
-------------------------------------------
|
||||||
|
|
||||||
|
This Source Code Form is subject to the terms of the Mozilla Public
|
||||||
|
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||||
|
file, You can obtain one at https://mozilla.org/MPL/2.0/.
|
||||||
|
|
||||||
|
If it is not possible or desirable to put the notice in a particular
|
||||||
|
file, then You may include the notice in a location (such as a LICENSE
|
||||||
|
file in a relevant directory) where a recipient would be likely to look
|
||||||
|
for such a notice.
|
||||||
|
|
||||||
|
You may add additional accurate notices of copyright ownership.
|
||||||
|
|
||||||
|
Exhibit B - "Incompatible With Secondary Licenses" Notice
|
||||||
|
---------------------------------------------------------
|
||||||
|
|
||||||
|
This Source Code Form is "Incompatible With Secondary Licenses", as
|
||||||
|
defined by the Mozilla Public License, v. 2.0.
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
services:
|
||||||
|
dtek_notif:
|
||||||
|
build:
|
||||||
|
context: .
|
||||||
|
dockerfile: Dockerfile
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
- TZ=Europe/Kyiv
|
||||||
|
|
||||||
|
dns:
|
||||||
|
- 1.1.1.1
|
||||||
|
- 8.8.8.8
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
@@ -0,0 +1,778 @@
|
|||||||
|
import requests
|
||||||
|
import json
|
||||||
|
import asyncio
|
||||||
|
from bs4 import BeautifulSoup
|
||||||
|
from datetime import datetime, timedelta
|
||||||
|
from aiogram import Bot, Dispatcher, types
|
||||||
|
from aiogram.filters import Command
|
||||||
|
from aiogram.types import Message, KeyboardButton
|
||||||
|
from aiogram.utils.keyboard import ReplyKeyboardBuilder
|
||||||
|
import logging
|
||||||
|
import os
|
||||||
|
from dotenv import load_dotenv
|
||||||
|
from typing import Optional, List, Dict
|
||||||
|
|
||||||
|
# Загрузка переменных окружения
|
||||||
|
load_dotenv()
|
||||||
|
|
||||||
|
# Настройки
|
||||||
|
TELEGRAM_TOKEN = os.getenv("TELEGRAM_TOKEN", "YOUR_TOKEN_HERE")
|
||||||
|
ALLOWED_CHAT_IDS = list(map(int, os.getenv("ALLOWED_CHAT_IDS", "").split(","))) if os.getenv("ALLOWED_CHAT_IDS") else []
|
||||||
|
CHECK_INTERVAL = int(os.getenv("CHECK_INTERVAL", "120"))
|
||||||
|
|
||||||
|
# Параметры для запроса
|
||||||
|
VOE_CITY_ID = int(os.getenv("VOE_CITY_ID", "VOE_CITY_ID"))
|
||||||
|
VOE_STREET_ID = int(os.getenv("VOE_STREET_ID", "VOE_STREET_ID"))
|
||||||
|
VOE_HOUSE_ID = int(os.getenv("VOE_HOUSE_ID", "VOE_HOUSE_ID"))
|
||||||
|
|
||||||
|
# Настройка логирования
|
||||||
|
logging.basicConfig(
|
||||||
|
level=logging.INFO,
|
||||||
|
format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
|
||||||
|
)
|
||||||
|
logger = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
# Глобальные переменные
|
||||||
|
bot = Bot(token=TELEGRAM_TOKEN)
|
||||||
|
dp = Dispatcher()
|
||||||
|
last_schedule: Optional[List[Dict]] = None
|
||||||
|
last_notification_time: Dict[str, datetime] = {}
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# УТИЛИТЫ
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
def format_time_duration(minutes: int) -> str:
|
||||||
|
"""Форматирует время из минут в часы и минуты"""
|
||||||
|
hours = minutes // 60
|
||||||
|
mins = minutes % 60
|
||||||
|
|
||||||
|
if hours == 0:
|
||||||
|
return f"{mins}м"
|
||||||
|
elif mins == 0:
|
||||||
|
return f"{hours}ч"
|
||||||
|
return f"{hours}ч {mins}м"
|
||||||
|
|
||||||
|
|
||||||
|
def get_day_statistics(day_blocks: List[Dict]) -> Dict[str, int]:
|
||||||
|
"""Получает статистику по дню"""
|
||||||
|
total_minutes = 0
|
||||||
|
confirmed_minutes = 0
|
||||||
|
possible_minutes = 0
|
||||||
|
|
||||||
|
for block in day_blocks:
|
||||||
|
for half in [block["first_half"], block["second_half"]]:
|
||||||
|
if half["status"] == "off":
|
||||||
|
total_minutes += 30
|
||||||
|
if half["confirmed"]:
|
||||||
|
confirmed_minutes += 30
|
||||||
|
else:
|
||||||
|
possible_minutes += 30
|
||||||
|
|
||||||
|
return {
|
||||||
|
"total": total_minutes,
|
||||||
|
"confirmed": confirmed_minutes,
|
||||||
|
"possible": possible_minutes
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# ПАРСИНГ ДАННЫХ
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
def parse_html(html: str) -> List[Dict]:
|
||||||
|
"""Парсит HTML с графиком отключений (логика от 15.11.2024)"""
|
||||||
|
soup = BeautifulSoup(html, "html.parser")
|
||||||
|
cells = soup.select(".disconnection-detailed-table-cell.cell")
|
||||||
|
|
||||||
|
schedule = []
|
||||||
|
current_hour = 0
|
||||||
|
current_day = 0
|
||||||
|
|
||||||
|
for cell in cells:
|
||||||
|
if 'legend' in cell.get('class', []) or 'head' in cell.get('class', []):
|
||||||
|
continue
|
||||||
|
|
||||||
|
cell_classes = cell.get('class', [])
|
||||||
|
|
||||||
|
# ПРоверка статуса отключения на весь час
|
||||||
|
full_hour_off = 'has_disconnection' in cell_classes and 'full_hour' in cell_classes
|
||||||
|
no_disconnection_cell = 'no_disconnection' in cell_classes
|
||||||
|
|
||||||
|
hour_block = cell.select_one(".hour_block")
|
||||||
|
if not hour_block:
|
||||||
|
continue
|
||||||
|
|
||||||
|
# Проверка подтверждённости отключения для всего часа
|
||||||
|
cell_confirmed = None
|
||||||
|
if 'confirm_1' in cell_classes:
|
||||||
|
cell_confirmed = True
|
||||||
|
elif 'confirm_0' in cell_classes:
|
||||||
|
cell_confirmed = False
|
||||||
|
|
||||||
|
# Проверка половин часа
|
||||||
|
left = hour_block.select_one(".half.left")
|
||||||
|
right = hour_block.select_one(".half.right")
|
||||||
|
|
||||||
|
def parse_half(half, is_full_hour_off: bool) -> Dict:
|
||||||
|
"""Парсит половину часа"""
|
||||||
|
if not half:
|
||||||
|
return {"status": "on", "queue": None, "confirmed": None}
|
||||||
|
|
||||||
|
half_classes = half.get('class', [])
|
||||||
|
|
||||||
|
# Если вся ячейка full_hour - используем статус ячейки
|
||||||
|
if is_full_hour_off:
|
||||||
|
return {"status": "off", "queue": None, "confirmed": cell_confirmed}
|
||||||
|
|
||||||
|
# Определяем статус половины
|
||||||
|
if 'has_disconnection' in half_classes:
|
||||||
|
status = "off"
|
||||||
|
elif 'no_disconnection' in half_classes:
|
||||||
|
status = "on"
|
||||||
|
else:
|
||||||
|
status = "on" # По умолчанию считаем включенным
|
||||||
|
|
||||||
|
# Если выключено - ищем подробности
|
||||||
|
queue = None
|
||||||
|
confirmed = None
|
||||||
|
|
||||||
|
if status == "off":
|
||||||
|
disconnection_div = half.select_one(".disconnection")
|
||||||
|
if disconnection_div:
|
||||||
|
# Ищем номер черги в title
|
||||||
|
if disconnection_div.has_attr("title"):
|
||||||
|
title = disconnection_div["title"]
|
||||||
|
if "Номер черги" in title or "Номер черги:" in title:
|
||||||
|
try:
|
||||||
|
queue = title.split(":")[-1].strip()
|
||||||
|
except:
|
||||||
|
pass
|
||||||
|
|
||||||
|
# Определяем подтверждение
|
||||||
|
disc_classes = disconnection_div.get('class', [])
|
||||||
|
if 'disconnection_confirm_1' in disc_classes:
|
||||||
|
confirmed = True
|
||||||
|
elif 'disconnection_confirm_0' in disc_classes:
|
||||||
|
confirmed = False
|
||||||
|
|
||||||
|
return {"status": status, "queue": queue, "confirmed": confirmed}
|
||||||
|
|
||||||
|
first_half_data = parse_half(left, full_hour_off)
|
||||||
|
second_half_data = parse_half(right, full_hour_off)
|
||||||
|
|
||||||
|
schedule.append({
|
||||||
|
"hour": current_hour,
|
||||||
|
"day": current_day,
|
||||||
|
"first_half": first_half_data,
|
||||||
|
"second_half": second_half_data,
|
||||||
|
})
|
||||||
|
|
||||||
|
current_hour += 1
|
||||||
|
if current_hour >= 24:
|
||||||
|
current_hour = 0
|
||||||
|
current_day += 1
|
||||||
|
|
||||||
|
return schedule
|
||||||
|
|
||||||
|
|
||||||
|
def get_voe_html(city_id: int, street_id: int, house_id: int) -> str:
|
||||||
|
"""Получает HTML с сайта VOE"""
|
||||||
|
url = "https://www.voe.com.ua/disconnection/detailed?ajax_form=1&_wrapper_format=drupal_ajax"
|
||||||
|
headers = {
|
||||||
|
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
|
||||||
|
"X-Requested-With": "XMLHttpRequest",
|
||||||
|
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
|
||||||
|
}
|
||||||
|
data = {
|
||||||
|
"search_type": 0,
|
||||||
|
"city_id": city_id,
|
||||||
|
"street_id": street_id,
|
||||||
|
"house_id": house_id,
|
||||||
|
"form_build_id": "form-Irv5aHw1R2FT_Ik2apyHOZ47hTH5xPNH_LQnBrmpSTc",
|
||||||
|
"form_id": "disconnection_detailed_search_form",
|
||||||
|
"_triggering_element_name": "search",
|
||||||
|
"_triggering_element_value": "Показати",
|
||||||
|
"_drupal_ajax": 1,
|
||||||
|
}
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.post(url, headers=headers, data=data, timeout=10)
|
||||||
|
response.raise_for_status()
|
||||||
|
resp_json = response.json()
|
||||||
|
|
||||||
|
insert_html = next(
|
||||||
|
(item["data"] for item in resp_json if item.get("command") == "insert"),
|
||||||
|
None
|
||||||
|
)
|
||||||
|
|
||||||
|
if not insert_html:
|
||||||
|
raise ValueError("HTML не найден в ответе")
|
||||||
|
|
||||||
|
return insert_html
|
||||||
|
except requests.exceptions.RequestException as e:
|
||||||
|
logger.error(f"Ошибка запроса VOE: {e}")
|
||||||
|
raise
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# ФОРМАТИРОВАНИЕ СООБЩЕНИЙ
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
def get_main_keyboard():
|
||||||
|
"""Создает главную клавиатуру"""
|
||||||
|
builder = ReplyKeyboardBuilder()
|
||||||
|
builder.row(
|
||||||
|
KeyboardButton(text="📊 Графік"),
|
||||||
|
KeyboardButton(text="🔄 Оновити")
|
||||||
|
)
|
||||||
|
builder.row(
|
||||||
|
KeyboardButton(text="📅 Сьогодні"),
|
||||||
|
KeyboardButton(text="📅 Завтра")
|
||||||
|
)
|
||||||
|
builder.row(KeyboardButton(text="ℹ️ Про бота"))
|
||||||
|
return builder.as_markup(resize_keyboard=True)
|
||||||
|
|
||||||
|
|
||||||
|
def format_schedule_message(schedule: List[Dict], days_to_show: int = 2) -> str:
|
||||||
|
"""Форматирует полный график на несколько дней"""
|
||||||
|
lines = [
|
||||||
|
"⚡️ <b>Графік відключень світла</b>",
|
||||||
|
f"🕐 Оновлено: {datetime.now().strftime('%d.%m.%Y %H:%M:%S')}",
|
||||||
|
"─" * 30,
|
||||||
|
""
|
||||||
|
]
|
||||||
|
|
||||||
|
start_date = datetime.now()
|
||||||
|
|
||||||
|
for day in range(min(days_to_show, 2)):
|
||||||
|
day_blocks = [b for b in schedule if b["day"] == day]
|
||||||
|
if not day_blocks:
|
||||||
|
continue
|
||||||
|
|
||||||
|
date_str = (start_date + timedelta(days=day)).strftime('%d.%m.%Y')
|
||||||
|
day_name = "🌅 <b>Сьогодні</b>" if day == 0 else "🌄 <b>Завтра</b>"
|
||||||
|
|
||||||
|
lines.append(f"{day_name} ({date_str})")
|
||||||
|
|
||||||
|
# Статистика
|
||||||
|
stats = get_day_statistics(day_blocks)
|
||||||
|
if stats["total"] > 0:
|
||||||
|
lines.append(f"⏱ Всього: <code>{format_time_duration(stats['total'])}</code>")
|
||||||
|
if stats["confirmed"] > 0:
|
||||||
|
lines.append(f"🔴 Підтверджено: <code>{format_time_duration(stats['confirmed'])}</code>")
|
||||||
|
if stats["possible"] > 0:
|
||||||
|
lines.append(f"🟠 Можливо: <code>{format_time_duration(stats['possible'])}</code>")
|
||||||
|
else:
|
||||||
|
lines.append("🟢 <b>Відключень немає!</b>")
|
||||||
|
|
||||||
|
lines.append("")
|
||||||
|
|
||||||
|
# Детальный список отключений
|
||||||
|
disconnections = []
|
||||||
|
current_status = None
|
||||||
|
start_time = None
|
||||||
|
current_confirmed = None
|
||||||
|
current_queue = None
|
||||||
|
|
||||||
|
for block in day_blocks:
|
||||||
|
hour = block["hour"]
|
||||||
|
|
||||||
|
for half_idx, half in enumerate([block["first_half"], block["second_half"]]):
|
||||||
|
time_str = f"{hour:02d}:00" if half_idx == 0 else f"{hour:02d}:30"
|
||||||
|
|
||||||
|
if half["status"] == "off":
|
||||||
|
if current_status != "off":
|
||||||
|
start_time = time_str
|
||||||
|
current_confirmed = half["confirmed"]
|
||||||
|
current_queue = half["queue"]
|
||||||
|
current_status = "off"
|
||||||
|
else:
|
||||||
|
if current_status == "off":
|
||||||
|
icon = "🔴" if current_confirmed else "🟠"
|
||||||
|
queue_text = f" (Ч{current_queue})" if current_queue else ""
|
||||||
|
disconnections.append(f"{icon} <code>{start_time} - {time_str}</code>{queue_text}")
|
||||||
|
current_status = half["status"]
|
||||||
|
|
||||||
|
# Если день закончился на отключении
|
||||||
|
if current_status == "off":
|
||||||
|
icon = "🔴" if current_confirmed else "🟠"
|
||||||
|
queue_text = f" (Ч{current_queue})" if current_queue else ""
|
||||||
|
next_hour = (day_blocks[-1]["hour"] + 1) % 24
|
||||||
|
end_time = f"{next_hour:02d}:00"
|
||||||
|
disconnections.append(f"{icon} <code>{start_time} - {end_time}</code>{queue_text}")
|
||||||
|
|
||||||
|
if disconnections:
|
||||||
|
for idx, disc in enumerate(disconnections, 1):
|
||||||
|
lines.append(f"{idx}. {disc}")
|
||||||
|
|
||||||
|
lines.append("")
|
||||||
|
|
||||||
|
lines.append("<i>🔴 = підтверджено • 🟠 = можливо • 🟢 = світло</i>")
|
||||||
|
|
||||||
|
return "\n".join(lines)
|
||||||
|
|
||||||
|
|
||||||
|
def format_single_day_schedule(schedule: List[Dict], day: int) -> str:
|
||||||
|
"""Форматирует график на один день"""
|
||||||
|
day_blocks = [b for b in schedule if b["day"] == day]
|
||||||
|
if not day_blocks:
|
||||||
|
return "❌ Немає даних для цього дня"
|
||||||
|
|
||||||
|
start_date = datetime.now()
|
||||||
|
date_str = (start_date + timedelta(days=day)).strftime('%d.%m.%Y')
|
||||||
|
day_name = "🟠 <b>Сьогодні</b>" if day == 0 else "🔶 <b>Завтра</b>"
|
||||||
|
|
||||||
|
lines = [
|
||||||
|
f"{day_name} • {date_str}",
|
||||||
|
""
|
||||||
|
]
|
||||||
|
|
||||||
|
# Статистика
|
||||||
|
lines.append("<b>📊 Статистика</b>")
|
||||||
|
stats = get_day_statistics(day_blocks)
|
||||||
|
|
||||||
|
if stats["total"] == 0:
|
||||||
|
lines.append("└ 🟢 <b>Відключень немає!</b>")
|
||||||
|
else:
|
||||||
|
total_time = format_time_duration(stats["total"])
|
||||||
|
lines.append(f"├ ⏱ Всього: <code>{total_time}</code>")
|
||||||
|
|
||||||
|
if stats["confirmed"] > 0:
|
||||||
|
confirmed_time = format_time_duration(stats["confirmed"])
|
||||||
|
lines.append(f"├ 🔴 Підтверджено: <code>{confirmed_time}</code>")
|
||||||
|
|
||||||
|
if stats["possible"] > 0:
|
||||||
|
possible_time = format_time_duration(stats["possible"])
|
||||||
|
lines.append(f"└ 🟠 Можливо: <code>{possible_time}</code>")
|
||||||
|
else:
|
||||||
|
lines.append(f"└ 🟢 Решта часу світло")
|
||||||
|
|
||||||
|
lines.append("")
|
||||||
|
|
||||||
|
# Детальный список отключений
|
||||||
|
disconnections = []
|
||||||
|
current_status = None
|
||||||
|
start_time = None
|
||||||
|
current_confirmed = None
|
||||||
|
current_queue = None
|
||||||
|
|
||||||
|
for block in day_blocks:
|
||||||
|
hour = block["hour"]
|
||||||
|
|
||||||
|
for half_idx, half in enumerate([block["first_half"], block["second_half"]]):
|
||||||
|
time_str = f"{hour:02d}:00" if half_idx == 0 else f"{hour:02d}:30"
|
||||||
|
|
||||||
|
if half["status"] == "off":
|
||||||
|
if current_status != "off":
|
||||||
|
start_time = time_str
|
||||||
|
current_confirmed = half["confirmed"]
|
||||||
|
current_queue = half["queue"]
|
||||||
|
current_status = "off"
|
||||||
|
else:
|
||||||
|
if current_status == "off":
|
||||||
|
icon = "🔴" if current_confirmed else "🟠"
|
||||||
|
queue_text = f" (Ч.{current_queue})" if current_queue else ""
|
||||||
|
disconnections.append(f"{icon} <code>{start_time} - {time_str}</code>{queue_text}")
|
||||||
|
current_status = half["status"]
|
||||||
|
|
||||||
|
# Если день закончился на отключении
|
||||||
|
if current_status == "off":
|
||||||
|
icon = "🔴" if current_confirmed else "🟠"
|
||||||
|
queue_text = f" (Ч.{current_queue})" if current_queue else ""
|
||||||
|
next_hour = (day_blocks[-1]["hour"] + 1) % 24
|
||||||
|
end_time = f"{next_hour:02d}:00"
|
||||||
|
disconnections.append(f"{icon} <code>{start_time} - {end_time}</code>{queue_text}")
|
||||||
|
|
||||||
|
if disconnections:
|
||||||
|
lines.append("<b>⚡️ Розклад відключень</b>")
|
||||||
|
for idx, disc in enumerate(disconnections, 1):
|
||||||
|
lines.append(f"{idx}. {disc}")
|
||||||
|
|
||||||
|
lines.append("")
|
||||||
|
lines.append("<i>🔴 підтверджено • 🟠 можливо • 🟢 світло</i>")
|
||||||
|
|
||||||
|
return "\n".join(lines)
|
||||||
|
|
||||||
|
|
||||||
|
def schedules_differ(old_schedule: Optional[List[Dict]], new_schedule: Optional[List[Dict]]) -> bool:
|
||||||
|
"""Проверяет отличия между графиками"""
|
||||||
|
if old_schedule is None or new_schedule is None:
|
||||||
|
return True
|
||||||
|
|
||||||
|
if len(old_schedule) != len(new_schedule):
|
||||||
|
return True
|
||||||
|
|
||||||
|
for old, new in zip(old_schedule, new_schedule):
|
||||||
|
if old["day"] >= 2:
|
||||||
|
break
|
||||||
|
|
||||||
|
if (old["first_half"] != new["first_half"] or
|
||||||
|
old["second_half"] != new["second_half"]):
|
||||||
|
return True
|
||||||
|
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# УВЕДОМЛЕНИЯ
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
async def send_to_all_users(message_text: str, parse_mode: str = "HTML"):
|
||||||
|
"""Отправляет сообщение всем пользователям"""
|
||||||
|
if not ALLOWED_CHAT_IDS:
|
||||||
|
logger.warning("Нет допущенных ID чатов для отправки уведомлений")
|
||||||
|
return
|
||||||
|
|
||||||
|
for chat_id in ALLOWED_CHAT_IDS:
|
||||||
|
try:
|
||||||
|
await bot.send_message(chat_id, message_text, parse_mode=parse_mode)
|
||||||
|
logger.info(f"✅ Сообщение отправлено пользователю {chat_id}")
|
||||||
|
except Exception as e:
|
||||||
|
logger.error(f"❌ Ошибка отправки пользователю {chat_id}: {e}")
|
||||||
|
await asyncio.sleep(0.5)
|
||||||
|
|
||||||
|
|
||||||
|
async def check_schedule():
|
||||||
|
"""Проверяет график и отправляет уведомления"""
|
||||||
|
global last_schedule
|
||||||
|
|
||||||
|
try:
|
||||||
|
logger.info("🔍 Проверка графика...")
|
||||||
|
html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
|
||||||
|
new_schedule = parse_html(html)
|
||||||
|
|
||||||
|
if schedules_differ(last_schedule, new_schedule):
|
||||||
|
logger.info("✨ Обнаружены изменения!")
|
||||||
|
message = format_schedule_message(new_schedule, days_to_show=2)
|
||||||
|
|
||||||
|
if last_schedule is not None:
|
||||||
|
await send_to_all_users(f"🔄 <b>Графік оновлено!</b>\n\n{message}")
|
||||||
|
|
||||||
|
last_schedule = new_schedule
|
||||||
|
else:
|
||||||
|
logger.info("✓ Графік без змін")
|
||||||
|
|
||||||
|
except Exception as e:
|
||||||
|
logger.error(f"❌ Ошибка при проверке графика: {e}")
|
||||||
|
|
||||||
|
|
||||||
|
async def check_upcoming_disconnections():
|
||||||
|
"""Проверяет предстоящие события и отправляет предупреждения за 5 минут"""
|
||||||
|
global last_notification_time
|
||||||
|
|
||||||
|
if last_schedule is None:
|
||||||
|
return
|
||||||
|
|
||||||
|
now = datetime.now()
|
||||||
|
today_blocks = [b for b in last_schedule if b["day"] == 0]
|
||||||
|
|
||||||
|
# Создаем список всех переходов (off -> on или on -> off)
|
||||||
|
transitions = []
|
||||||
|
prev_status = None
|
||||||
|
|
||||||
|
for block in today_blocks:
|
||||||
|
hour = block["hour"]
|
||||||
|
|
||||||
|
for half_idx, half in enumerate([block["first_half"], block["second_half"]]):
|
||||||
|
minute = 0 if half_idx == 0 else 30
|
||||||
|
time_str = f"{hour:02d}:{minute:02d}"
|
||||||
|
|
||||||
|
current_status = half["status"]
|
||||||
|
|
||||||
|
# Если статус изменился - это переход
|
||||||
|
if prev_status is not None and prev_status != current_status:
|
||||||
|
transitions.append({
|
||||||
|
"hour": hour,
|
||||||
|
"minute": minute,
|
||||||
|
"time_str": time_str,
|
||||||
|
"from_status": prev_status,
|
||||||
|
"to_status": current_status,
|
||||||
|
"confirmed": half.get("confirmed"),
|
||||||
|
"queue": half.get("queue")
|
||||||
|
})
|
||||||
|
|
||||||
|
prev_status = current_status
|
||||||
|
|
||||||
|
# Проверяем переходы
|
||||||
|
for transition in transitions:
|
||||||
|
event_time = now.replace(
|
||||||
|
hour=transition["hour"],
|
||||||
|
minute=transition["minute"],
|
||||||
|
second=0,
|
||||||
|
microsecond=0
|
||||||
|
)
|
||||||
|
|
||||||
|
time_until = (event_time - now).total_seconds() / 60
|
||||||
|
notification_key = f"{transition['hour']}:{transition['minute']}_{transition['to_status']}"
|
||||||
|
|
||||||
|
# Если за 5 минут до события (±1 минута) и еще не отправляли
|
||||||
|
if 4 <= time_until <= 6:
|
||||||
|
# Проверяем, не отправляли ли уже уведомление сегодня
|
||||||
|
if notification_key in last_notification_time:
|
||||||
|
last_notif_time = last_notification_time[notification_key]
|
||||||
|
if last_notif_time.date() == now.date():
|
||||||
|
continue # Уже отправляли сегодня
|
||||||
|
|
||||||
|
# Переход на ОТКЛЮЧЕНИЕ (on -> off)
|
||||||
|
if transition["from_status"] == "on" and transition["to_status"] == "off":
|
||||||
|
icon = "🔴" if transition["confirmed"] else "🟠"
|
||||||
|
status = "підтверджено" if transition["confirmed"] else "можливе"
|
||||||
|
queue_info = f" (Черга {transition['queue']})" if transition['queue'] else ""
|
||||||
|
|
||||||
|
warning = (
|
||||||
|
f"⚠️ <b>УВАГА! ВІДКЛЮЧЕННЯ</b>\n\n"
|
||||||
|
f"Через ~5 хвилин\n"
|
||||||
|
f"Час: <code>{transition['time_str']}</code>\n"
|
||||||
|
f"Статус: {icon} {status}{queue_info}"
|
||||||
|
)
|
||||||
|
|
||||||
|
await send_to_all_users(warning)
|
||||||
|
last_notification_time[notification_key] = now
|
||||||
|
logger.info(f"📢 Відправлено попередження про ВІДКЛЮЧЕННЯ в {transition['time_str']}")
|
||||||
|
|
||||||
|
# Переход на ВКЛЮЧЕНИЕ (off -> on)
|
||||||
|
elif transition["from_status"] == "off" and transition["to_status"] == "on":
|
||||||
|
warning = (
|
||||||
|
f"✅ <b>УВАГА! ВКЛЮЧЕННЯ</b>\n\n"
|
||||||
|
f"Через ~5 хвилин буде світло\n"
|
||||||
|
f"Час: <code>{transition['time_str']}</code>"
|
||||||
|
)
|
||||||
|
|
||||||
|
await send_to_all_users(warning)
|
||||||
|
last_notification_time[notification_key] = now
|
||||||
|
logger.info(f"📢 Відправлено попередження про ВКЛЮЧЕННЯ в {transition['time_str']}")
|
||||||
|
|
||||||
|
|
||||||
|
async def monitoring_loop():
|
||||||
|
"""Основной цикл мониторинга"""
|
||||||
|
await check_schedule()
|
||||||
|
|
||||||
|
while True:
|
||||||
|
try:
|
||||||
|
await asyncio.sleep(CHECK_INTERVAL)
|
||||||
|
await check_schedule()
|
||||||
|
await check_upcoming_disconnections()
|
||||||
|
except Exception as e:
|
||||||
|
logger.error(f"Ошибка в цикле мониторинга: {e}")
|
||||||
|
await asyncio.sleep(5)
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# ОБРАБОТЧИКИ КОМАНД
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
@dp.message(Command("start"))
|
||||||
|
async def cmd_start(message: Message):
|
||||||
|
"""Обработчик /start"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
await message.answer("❌ У вас немає доступу до цього бота.")
|
||||||
|
return
|
||||||
|
|
||||||
|
await message.answer(
|
||||||
|
"👋 <b>Ласкаво просимо!</b>\n\n"
|
||||||
|
"🤖 <b>Бот для моніторингу графіку відключень світла</b>\n\n"
|
||||||
|
"✨ <b>Можливості:</b>\n"
|
||||||
|
"• 📊 Перегляд графіку на сьогодні і завтра\n"
|
||||||
|
"• 🔔 Автоматичні сповіщення за 5 хвилин до подій\n"
|
||||||
|
"• 🔄 Моніторинг змін графіку\n\n"
|
||||||
|
"Використовуйте кнопки нижче 👇",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message(lambda msg: msg.text == "ℹ️ Про бота")
|
||||||
|
async def cmd_info(message: Message):
|
||||||
|
"""Показывает информацию о боте"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
return
|
||||||
|
|
||||||
|
await message.answer(
|
||||||
|
"<b>ℹ️ Про бота</b>\n\n"
|
||||||
|
"🚀 <b>Версія:</b> 2.2 (Стабільна)\n\n"
|
||||||
|
"📝 <b>Реліз-ноути:</b>\n"
|
||||||
|
"├ 15.11.2024: Адаптація під оновлену логіку сайту VOE\n"
|
||||||
|
"├ Виправлено парсинг half.left та half.right\n"
|
||||||
|
"├ Покращено визначення підтвердження відключень\n"
|
||||||
|
"└ Оптимізовано обробку статусу для всієї години\n\n"
|
||||||
|
"⚡ <b>Функціональність:</b>\n"
|
||||||
|
"├ Моніторинг графіку 24/7\n"
|
||||||
|
"├ Сповіщення за 5 хвилин\n"
|
||||||
|
"├ Детальна статистика дня\n"
|
||||||
|
"└ Красива візуалізація\n\n"
|
||||||
|
"🔐 <b>Безпека:</b> Використовуються .env файли\n"
|
||||||
|
"💾 <b>Джерело:</b> voe.com.ua",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message(Command("schedule"))
|
||||||
|
async def cmd_schedule(message: Message):
|
||||||
|
"""Показывает полный график"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
await message.answer("❌ У вас немає доступу.")
|
||||||
|
return
|
||||||
|
|
||||||
|
try:
|
||||||
|
await message.answer("⏳ Завантаження графіку...")
|
||||||
|
html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
|
||||||
|
schedule = parse_html(html)
|
||||||
|
text = format_schedule_message(schedule, days_to_show=2)
|
||||||
|
await message.answer(text, parse_mode="HTML", reply_markup=get_main_keyboard())
|
||||||
|
except Exception as e:
|
||||||
|
await message.answer(
|
||||||
|
f"❌ <b>Помилка:</b> {str(e)}",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message(Command("today"))
|
||||||
|
async def cmd_today(message: Message):
|
||||||
|
"""Показывает график на сегодня"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
await message.answer("❌ У вас немає доступу.")
|
||||||
|
return
|
||||||
|
|
||||||
|
try:
|
||||||
|
await message.answer("⏳ Завантаження графіку сьогодні...")
|
||||||
|
html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
|
||||||
|
schedule = parse_html(html)
|
||||||
|
text = format_single_day_schedule(schedule, 0)
|
||||||
|
await message.answer(text, parse_mode="HTML", reply_markup=get_main_keyboard())
|
||||||
|
except Exception as e:
|
||||||
|
await message.answer(
|
||||||
|
f"❌ <b>Помилка:</b> {str(e)}",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message(Command("tomorrow"))
|
||||||
|
async def cmd_tomorrow(message: Message):
|
||||||
|
"""Показывает график на завтра"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
await message.answer("❌ У вас немає доступу.")
|
||||||
|
return
|
||||||
|
|
||||||
|
try:
|
||||||
|
await message.answer("⏳ Завантаження графіку завтра...")
|
||||||
|
html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
|
||||||
|
schedule = parse_html(html)
|
||||||
|
text = format_single_day_schedule(schedule, 1)
|
||||||
|
await message.answer(text, parse_mode="HTML", reply_markup=get_main_keyboard())
|
||||||
|
# await message.answer("❌ Функція тимчасово недоступна. Чекаємо на оновлення сайту", parse_mode="HTML", reply_markup=get_main_keyboard())
|
||||||
|
except Exception as e:
|
||||||
|
await message.answer(
|
||||||
|
f"❌ <b>Помилка:</b> {str(e)}",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message(Command("check"))
|
||||||
|
async def cmd_check(message: Message):
|
||||||
|
"""Принудительная проверка графика"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
await message.answer("❌ У вас немає доступу.")
|
||||||
|
return
|
||||||
|
|
||||||
|
try:
|
||||||
|
await message.answer("🔄 <b>Перевіряю графік...</b>", parse_mode="HTML")
|
||||||
|
html = get_voe_html(VOE_CITY_ID, VOE_STREET_ID, VOE_HOUSE_ID)
|
||||||
|
new_schedule = parse_html(html)
|
||||||
|
|
||||||
|
prefix = "✅ <b>Знайдено зміни!</b>\n\n" if schedules_differ(last_schedule, new_schedule) else "✓ <b>Графік без змін</b>\n\n"
|
||||||
|
result = prefix + format_schedule_message(new_schedule, days_to_show=2)
|
||||||
|
|
||||||
|
await message.answer(result, parse_mode="HTML", reply_markup=get_main_keyboard())
|
||||||
|
except Exception as e:
|
||||||
|
await message.answer(
|
||||||
|
f"❌ <b>Помилка:</b> {str(e)}",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
@dp.message()
|
||||||
|
async def handle_text(message: Message):
|
||||||
|
"""Обработчик текстовых сообщений и кнопок"""
|
||||||
|
if message.chat.id not in ALLOWED_CHAT_IDS:
|
||||||
|
return
|
||||||
|
|
||||||
|
text = message.text
|
||||||
|
|
||||||
|
# Кнопка "Графік"
|
||||||
|
if text == "📊 Графік":
|
||||||
|
await cmd_schedule(message)
|
||||||
|
|
||||||
|
# Кнопка "Сьогодні"
|
||||||
|
elif text == "📅 Сьогодні":
|
||||||
|
await cmd_today(message)
|
||||||
|
|
||||||
|
# Кнопка "Завтра"
|
||||||
|
elif text == "📅 Завтра":
|
||||||
|
await cmd_tomorrow(message)
|
||||||
|
|
||||||
|
# Кнопка "Оновити"
|
||||||
|
elif text == "🔄 Оновити":
|
||||||
|
await cmd_check(message)
|
||||||
|
|
||||||
|
# Кнопка "Про бота"
|
||||||
|
elif text == "ℹ️ Про бота":
|
||||||
|
await cmd_info(message)
|
||||||
|
|
||||||
|
# Неизвестная команда
|
||||||
|
else:
|
||||||
|
await message.answer(
|
||||||
|
"❓ <b>Команда не розпізнана</b>\n\n"
|
||||||
|
"Використовуйте кнопки на клавіатурі або команди:\n"
|
||||||
|
"/start • /today • /tomorrow • /schedule • /check",
|
||||||
|
parse_mode="HTML",
|
||||||
|
reply_markup=get_main_keyboard()
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
# ============================================================================
|
||||||
|
# ГЛАВНАЯ ФУНКЦИЯ
|
||||||
|
# ============================================================================
|
||||||
|
|
||||||
|
async def main():
|
||||||
|
"""Главная функция"""
|
||||||
|
logger.info("=" * 50)
|
||||||
|
logger.info("ЗАПУСК БОТА V2.2 (stable 2.2, 15.11.2025)")
|
||||||
|
logger.info("=" * 50)
|
||||||
|
|
||||||
|
if not TELEGRAM_TOKEN or TELEGRAM_TOKEN = os.getenv("TELEGRAM_TOKEN", "YOUR_TOKEN_HERE")
|
||||||
|
logger.error("❌ TELEGRAM_TOKEN не конфігурований! Напишіть токен в .env файл")
|
||||||
|
return
|
||||||
|
|
||||||
|
if not ALLOWED_CHAT_IDS:
|
||||||
|
logger.error("❌ ALLOWED_CHAT_IDS не конфігуровані! Напишіть ID в .env файл")
|
||||||
|
return
|
||||||
|
|
||||||
|
logger.info(f"📌 Allowed chat ids: {ALLOWED_CHAT_IDS}")
|
||||||
|
logger.info(f"⏱ Інтервал перевірки: {CHECK_INTERVAL} сек")
|
||||||
|
logger.info("=" * 50)
|
||||||
|
|
||||||
|
# Запускаем мониторинг
|
||||||
|
monitoring_task = asyncio.create_task(monitoring_loop())
|
||||||
|
|
||||||
|
try:
|
||||||
|
await dp.start_polling(bot)
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
logger.info("⏹ Бот зупинений користувачем")
|
||||||
|
finally:
|
||||||
|
monitoring_task.cancel()
|
||||||
|
await bot.session.close()
|
||||||
|
logger.info("✓ Підключення закрито")
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
try:
|
||||||
|
asyncio.run(main())
|
||||||
|
except KeyboardInterrupt:
|
||||||
|
logger.info("⏹ Завершено")
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
[project]
|
||||||
|
name = "dtek-notif"
|
||||||
|
version = "0.1.0"
|
||||||
|
description = "Add your description here"
|
||||||
|
readme = "README.md"
|
||||||
|
requires-python = ">=3.13"
|
||||||
|
dependencies = []
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
requests>=2.31.0
|
||||||
|
beautifulsoup4>=4.12.0
|
||||||
|
aiogram>=3.3.0
|
||||||
|
python-dotenv>=1.0.0
|
||||||
|
aiohttp>=3.9.0
|
||||||
@@ -9,6 +9,5 @@ WEBINAR_CHECK_INTERVAL=60
|
|||||||
REDIS_HOST=redis
|
REDIS_HOST=redis
|
||||||
REDIS_PORT=6379
|
REDIS_PORT=6379
|
||||||
PLAYWRIGHT_WS=ws://playwright-service:3000/ws
|
PLAYWRIGHT_WS=ws://playwright-service:3000/ws
|
||||||
TZ=Europe/Kyiv
|
|
||||||
WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
|
WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
|
||||||
WEBINAR_ADMIN_ID=123456789
|
WEBINAR_ADMIN_ID=123456789
|
||||||
@@ -1 +0,0 @@
|
|||||||
1.56.0
|
|
||||||
@@ -1,11 +1,11 @@
|
|||||||
services:
|
services:
|
||||||
redis:
|
redis:
|
||||||
image: redis:8.10.2-alpine
|
image: redis:alpine
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
volumes:
|
volumes:
|
||||||
- redis-data:/data
|
- redis-data:/data
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD", "redis-cli", "ping"]
|
test: [ "CMD", "redis-cli", "ping" ]
|
||||||
interval: 5s
|
interval: 5s
|
||||||
timeout: 3s
|
timeout: 3s
|
||||||
retries: 5
|
retries: 5
|
||||||
@@ -17,15 +17,13 @@ services:
|
|||||||
|
|
||||||
session-keeper:
|
session-keeper:
|
||||||
build: ./phpsessid-bot
|
build: ./phpsessid-bot
|
||||||
image: gcr.forust.xyz/forust/session-keeper:prod
|
|
||||||
pull_policy: build
|
|
||||||
env_file: .env
|
env_file: .env
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
redis:
|
redis:
|
||||||
condition: service_healthy
|
condition: service_healthy
|
||||||
healthcheck:
|
healthcheck:
|
||||||
test: ["CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
|
test: [ "CMD-SHELL", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1" ]
|
||||||
interval: 30s
|
interval: 30s
|
||||||
timeout: 5s
|
timeout: 5s
|
||||||
retries: 10
|
retries: 10
|
||||||
@@ -33,8 +31,6 @@ services:
|
|||||||
|
|
||||||
webinar-checker:
|
webinar-checker:
|
||||||
build: ./webinar-checker
|
build: ./webinar-checker
|
||||||
image: gcr.forust.xyz/forust/webinar-checker:prod
|
|
||||||
pull_policy: build
|
|
||||||
env_file: .env
|
env_file: .env
|
||||||
restart: unless-stopped
|
restart: unless-stopped
|
||||||
depends_on:
|
depends_on:
|
||||||
|
|||||||
Whitespace-only changes.
@@ -1,96 +0,0 @@
|
|||||||
apiVersion: monitoring.coreos.com/v1
|
|
||||||
kind: PrometheusRule
|
|
||||||
metadata:
|
|
||||||
name: edu-master-webinar
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
release: prometheus-stack
|
|
||||||
spec:
|
|
||||||
groups:
|
|
||||||
- name: edu_master.webinar
|
|
||||||
rules:
|
|
||||||
# No successful webinar check for 5m (~2-3 missed 2-min checks).
|
|
||||||
# Catches: playwright hangs/timeouts, version skew, site changes, hung job.
|
|
||||||
# The last_success > 0 guard is mandatory: checker.py initialises
|
|
||||||
# last_success to 0, so without it `time() - 0` equals the current epoch
|
|
||||||
# and humanizeDuration renders ~20722d on every pod restart. Keep the
|
|
||||||
# duration expression on the left so $value stays the real gap.
|
|
||||||
- alert: WebinarCheckerNoSuccessfulCheck
|
|
||||||
expr: |
|
|
||||||
((time() - webinar_check_last_success_timestamp_seconds) > 300)
|
|
||||||
and (webinar_check_last_success_timestamp_seconds > 0)
|
|
||||||
and (webinar_check_last_run_timestamp_seconds > 0)
|
|
||||||
for: 2m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Webinar checker has no successful check for 5m"
|
|
||||||
description: "edu-master/webinar-checker: last successful webinar check was {{ $value | humanizeDuration }} ago. Checks are failing or hanging (see consecutive failures alert). Notifications about new webinars are NOT being sent."
|
|
||||||
|
|
||||||
# Checks are running but none has ever succeeded since pod start.
|
|
||||||
# Split out from the rule above so a zeroed gauge never feeds
|
|
||||||
# humanizeDuration.
|
|
||||||
- alert: WebinarCheckerNeverSucceeded
|
|
||||||
expr: |
|
|
||||||
(webinar_check_last_success_timestamp_seconds == 0)
|
|
||||||
and (webinar_check_last_run_timestamp_seconds > 0)
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Webinar checker has never completed a successful check"
|
|
||||||
description: 'edu-master/webinar-checker: checks have been running for 10m but not one has ever succeeded since the pod started, so every check is failing. Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
|
|
||||||
|
|
||||||
# Fast path: 3 consecutive failures (~6+ min at 2-min interval).
|
|
||||||
- alert: WebinarCheckerConsecutiveFailures
|
|
||||||
expr: |
|
|
||||||
webinar_check_consecutive_failures >= 3
|
|
||||||
for: 5m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Webinar checker failing consecutively"
|
|
||||||
description: 'edu-master/webinar-checker: {{ $value }} consecutive webinar check failures (timeout / playwright error / page error). Check pod logs (Loki: {namespace="edu-master", container="webinar-checker"}).'
|
|
||||||
|
|
||||||
# Metrics endpoint not scraped for 10m: pod down, metrics server dead, or ServiceMonitor broken.
|
|
||||||
- alert: WebinarCheckerScrapeDown
|
|
||||||
expr: |
|
|
||||||
absent(webinar_check_last_run_timestamp_seconds) == 1
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Webinar checker metrics missing"
|
|
||||||
description: "edu-master/webinar-checker: no metrics series for 10m. Pod may be down, metrics server dead, or ServiceMonitor/Service broken. Webinar checks are unobserved."
|
|
||||||
|
|
||||||
# EDU session lost: session-keeper down or credentials expired. Without PHPSESSID every check is skipped.
|
|
||||||
- alert: EduPhpsessidMissing
|
|
||||||
expr: |
|
|
||||||
edu_phpsessid_present == 0
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "EDU_PHPSESSID missing"
|
|
||||||
description: "edu-master: EDU_PHPSESSID absent from redis for 10m. Webinar/diari/schedule checks are all skipped. Check session-keeper logs and EDU credentials."
|
|
||||||
|
|
||||||
# Hard deps: checker and playwright deployments unavailable.
|
|
||||||
- alert: WebinarCheckerDeploymentDown
|
|
||||||
expr: |
|
|
||||||
kube_deployment_status_replicas_unavailable{deployment="webinar-checker", namespace="edu-master"} > 0
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Webinar checker deployment unavailable"
|
|
||||||
description: "edu-master/webinar-checker deployment has {{ $value }} unavailable replica(s) for 10m."
|
|
||||||
|
|
||||||
- alert: PlaywrightServiceDown
|
|
||||||
expr: |
|
|
||||||
kube_deployment_status_replicas_unavailable{deployment="playwright-service", namespace="edu-master"} > 0
|
|
||||||
for: 10m
|
|
||||||
labels:
|
|
||||||
severity: critical
|
|
||||||
annotations:
|
|
||||||
summary: "Playwright service unavailable"
|
|
||||||
description: "edu-master/playwright-service deployment has {{ $value }} unavailable replica(s) for 10m. All webinar/diari/schedule checks fail without it."
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: edu-master
|
|
||||||
@@ -1,69 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: playwright-service
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
app: edu-master-playwright
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: edu-master-playwright
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: edu-master-playwright
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: playwright
|
|
||||||
# renovate: datasource=docker depName=mcr.microsoft.com/playwright versioning=docker
|
|
||||||
image: mcr.microsoft.com/playwright:v1.56.0-jammy
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
# p95 412M, max 478M over 7 days, no limit before. Request is set at p95
|
|
||||||
# so the pod is not an eviction candidate; the limit stays above 2x the
|
|
||||||
# request because browser page lifetimes are unpredictable.
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: "200m"
|
|
||||||
memory: "416Mi"
|
|
||||||
limits:
|
|
||||||
memory: "1Gi"
|
|
||||||
command:
|
|
||||||
- npx
|
|
||||||
- -y
|
|
||||||
- playwright@1.56.0
|
|
||||||
- run-server
|
|
||||||
- --port
|
|
||||||
- "3000"
|
|
||||||
- --path
|
|
||||||
- /ws
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 3000
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 3
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: 3000
|
|
||||||
initialDelaySeconds: 15
|
|
||||||
periodSeconds: 20
|
|
||||||
timeoutSeconds: 3
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: playwright-service
|
|
||||||
namespace: edu-master
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: edu-master-playwright
|
|
||||||
ports:
|
|
||||||
- name: ws
|
|
||||||
port: 3000
|
|
||||||
targetPort: 3000
|
|
||||||
@@ -1,75 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: redis
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
app: edu-master-redis
|
|
||||||
spec:
|
|
||||||
serviceName: redis
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: edu-master-redis
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: edu-master-redis
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: redis
|
|
||||||
image: redis:8.10.2-alpine
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
ports:
|
|
||||||
- containerPort: 6379
|
|
||||||
volumeMounts:
|
|
||||||
- name: redis-data
|
|
||||||
mountPath: /data
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 25m
|
|
||||||
memory: 32Mi
|
|
||||||
limits:
|
|
||||||
cpu: 250m
|
|
||||||
memory: 128Mi
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command: ["redis-cli", "ping"]
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
timeoutSeconds: 3
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command: ["redis-cli", "ping"]
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 3
|
|
||||||
volumes:
|
|
||||||
- name: redis-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: redis-data-pvc
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: redis-data-pvc
|
|
||||||
namespace: edu-master
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 1Gi
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: redis
|
|
||||||
namespace: edu-master
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: edu-master-redis
|
|
||||||
ports:
|
|
||||||
- name: redis
|
|
||||||
port: 6379
|
|
||||||
targetPort: 6379
|
|
||||||
@@ -1,50 +0,0 @@
|
|||||||
# One-time Job to migrate redis state from docker compose to k8s (maintenance window).
|
|
||||||
# The .example file is not applied by the deploy pipeline (mask *.example.yaml).
|
|
||||||
#
|
|
||||||
# Runbook:
|
|
||||||
# 1. docker compose -f <repo>/edu_master/compose.yaml stop # SIGTERM -> redis will flush dump.rdb
|
|
||||||
# 2. docker run --rm -v edu_master_redis-data:/data \
|
|
||||||
# -v /tmp/edu-master-backup:/backup \
|
|
||||||
# redis:alpine sh -c "cp /data/dump.rdb /backup/ && ls -la /backup"
|
|
||||||
# 3. kubectl apply -f edu_master/k8s/namespace.yaml
|
|
||||||
# 4. kubectl apply -f <only the PVC from redis.yaml> # seed must come BEFORE redis pod starts
|
|
||||||
# 5. kubectl apply -f edu_master/k8s/restore-seed-job.yaml.example
|
|
||||||
# kubectl wait --for=condition=complete job/redis-restore-seed -n edu-master --timeout=120s
|
|
||||||
# 6. kubectl delete job redis-restore-seed -n edu-master
|
|
||||||
# 7. kubectl apply -f edu_master/k8s/ -R # apply remaining manifests
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
name: redis-restore-seed
|
|
||||||
namespace: edu-master
|
|
||||||
spec:
|
|
||||||
backoffLimit: 2
|
|
||||||
ttlSecondsAfterFinished: 3600
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
restartPolicy: Never
|
|
||||||
containers:
|
|
||||||
- name: seed
|
|
||||||
image: redis:alpine
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -ec
|
|
||||||
- |
|
|
||||||
ls -la /backup
|
|
||||||
cp /backup/dump.rdb /data/dump.rdb
|
|
||||||
chmod 644 /data/dump.rdb
|
|
||||||
ls -la /data
|
|
||||||
volumeMounts:
|
|
||||||
- name: redis-data
|
|
||||||
mountPath: /data
|
|
||||||
- name: backup
|
|
||||||
mountPath: /backup
|
|
||||||
readOnly: true
|
|
||||||
volumes:
|
|
||||||
- name: redis-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: redis-data-pvc
|
|
||||||
- name: backup
|
|
||||||
hostPath:
|
|
||||||
path: /tmp/edu-master-backup
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
@@ -1,29 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: edu-master-secrets
|
|
||||||
namespace: edu-master
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
# Session keeper credentials
|
|
||||||
KEEPER_LOGIN: ""
|
|
||||||
KEEPER_PASSWORD: ""
|
|
||||||
KEEPER_INTERVAL: "10"
|
|
||||||
# EDU links
|
|
||||||
EDU_URL_BASE: "https://edu.edu.vn.ua"
|
|
||||||
EDU_URL_LOGIN: "/user/login"
|
|
||||||
EDU_URL_COURSES: "/course/userlist"
|
|
||||||
EDU_URL_WEBINAR: "/webinar/useractive"
|
|
||||||
# Playwright
|
|
||||||
USER_AGENT: ""
|
|
||||||
PLAYWRIGHT_WS: "ws://playwright-service:3000/ws"
|
|
||||||
# Webinar-checker
|
|
||||||
WEBINAR_TELEGRAM_TOKEN: ""
|
|
||||||
WEBINAR_ADMIN_ID: ""
|
|
||||||
WEBINAR_CHECK_INTERVAL: "60"
|
|
||||||
# Prometheus metrics endpoint (scraped via ServiceMonitor, alerts in k8s/alerts.yaml)
|
|
||||||
METRICS_PORT: "8000"
|
|
||||||
# Database
|
|
||||||
REDIS_HOST: "redis"
|
|
||||||
REDIS_PORT: "6379"
|
|
||||||
TZ: "Europe/Kyiv"
|
|
||||||
@@ -1,15 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: webinar-checker
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
app: edu-master-webinar-checker
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: edu-master-webinar-checker
|
|
||||||
ports:
|
|
||||||
- name: metrics
|
|
||||||
port: 8000
|
|
||||||
targetPort: metrics
|
|
||||||
protocol: TCP
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
apiVersion: monitoring.coreos.com/v1
|
|
||||||
kind: ServiceMonitor
|
|
||||||
metadata:
|
|
||||||
name: webinar-checker
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
release: prometheus-stack
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: edu-master-webinar-checker
|
|
||||||
endpoints:
|
|
||||||
- port: metrics
|
|
||||||
path: /metrics
|
|
||||||
interval: 30s
|
|
||||||
scrapeTimeout: 10s
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
reloader.stakater.com/auto: "true"
|
|
||||||
name: session-keeper
|
|
||||||
namespace: edu-master
|
|
||||||
labels:
|
|
||||||
app: edu-master-session-keeper
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: edu-master-session-keeper
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: edu-master-session-keeper
|
|
||||||
spec:
|
|
||||||
initContainers:
|
|
||||||
- name: wait-redis
|
|
||||||
image: redis:8.10.2-alpine
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -ec
|
|
||||||
- |
|
|
||||||
i=0
|
|
||||||
until redis-cli -h redis ping | grep -q PONG; do
|
|
||||||
i=$((i+1))
|
|
||||||
[ "$i" -ge 300 ] && echo "TIMEOUT: redis not ready" && exit 1
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
echo "redis is ready"
|
|
||||||
containers:
|
|
||||||
- name: session-keeper
|
|
||||||
image: gcr.forust.xyz/forust/session-keeper:prod
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: edu-master-secrets
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 25m
|
|
||||||
memory: 32Mi
|
|
||||||
limits:
|
|
||||||
cpu: 250m
|
|
||||||
memory: 128Mi
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command: ["/bin/sh", "-ec", "redis-cli -h redis EXISTS EDU_PHPSESSID | grep -q 1"]
|
|
||||||
initialDelaySeconds: 15
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 5
|
|
||||||
failureThreshold: 10
|
|
||||||
Loaded 100 of 474 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user