fix

Reviewed-on: #21

.deploy/deploy-dev.yaml

@@ -6,15 +6,22 @@ services:
     image: mathwave/sprint-repo:certupdater
     command: worker
     environment:
-      MONGO_HOST: "mongo.develop.sprinthub.ru"
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
       MONGO_PASSWORD: $MONGO_PASSWORD_DEV
       STAGE: "development"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
     networks:
       - configurator
+      - queues-development
+      - minio-development
+      - mongo-development
     deploy:
       mode: replicated
       restart_policy:
         condition: any
+      placement:
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -22,3 +29,9 @@ services:
 networks:
   configurator:
     external: true
+  queues-development:
+    external: true
+  minio-development:
+    external: true
+  mongo-development:
+    external: true

.deploy/deploy-prod.yaml

@@ -2,44 +2,36 @@ version: "3.4"
 
 
 services:
-  worker:
+  certupdater:
-    image: mathwave/sprint-repo:pizda-bot
+    image: mathwave/sprint-repo:certupdater
     command: worker
     environment:
-      MONGO_HOST: "mongo.sprinthub.ru"
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
       MONGO_PASSWORD: $MONGO_PASSWORD_PROD
       STAGE: "production"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
     networks:
-      - queues
       - configurator
+      - queues
+      - minio
+      - mongo
     deploy:
       mode: replicated
       restart_policy:
         condition: any
-      update_config:
+      placement:
-        parallelism: 1
+        constraints: [node.labels.stage == production]
-        order: start-first
-
-  pizda-bot-nginx:
-    image: mathwave/sprint-repo:pizda-bot
-    command: api
-    environment:
-      MONGO_HOST: "mongo.sprinthub.ru"
-      MONGO_PASSWORD: $MONGO_PASSWORD_PROD
-    networks:
-      - common-infra-nginx
-    deploy:
-      mode: replicated
-      restart_policy:
-        condition: any
       update_config:
         parallelism: 1
         order: start-first
 
 networks:
-  common-infra-nginx:
+  configurator:
     external: true
   queues:
     external: true
-  configurator:
+  minio:
+    external: true
+  mongo:
     external: true

.gitea/workflows/deploy-dev.yaml

@@ -18,14 +18,14 @@ jobs:
         with:
           ref: dev
       - name: build
-        run: docker build -t mathwave/sprint-repo:pizda-bot .
+        run: docker build -t mathwave/sprint-repo:certupdater .
   push:
     name: Push
     runs-on: [ dev ]
     needs: build
     steps:
       - name: push
-        run: docker push mathwave/sprint-repo:pizda-bot
+        run: docker push mathwave/sprint-repo:certupdater
   deploy-dev:
     name: Deploy dev
     runs-on: [prod]
@@ -40,4 +40,5 @@ jobs:
       - name: deploy
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
-        run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-dev.yaml pizda-bot-development
+          MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
+        run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-dev.yaml certupdater-development

.gitea/workflows/deploy-prod.yaml

@@ -18,14 +18,14 @@ jobs:
         with:
           ref: prod
       - name: build
-        run: docker build -t mathwave/sprint-repo:pizda-bot .
+        run: docker build -t mathwave/sprint-repo:certupdater .
   push:
     name: Push
     runs-on: [ dev ]
     needs: build
     steps:
       - name: push
-        run: docker push mathwave/sprint-repo:pizda-bot
+        run: docker push mathwave/sprint-repo:certupdater
   deploy-prod:
     name: Deploy prod
     runs-on: [prod]
@@ -40,4 +40,5 @@ jobs:
       - name: deploy
         env:
           MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
-        run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-prod.yaml pizda-bot
+          MINIO_SECRET_KEY_PROD: ${{ secrets.MINIO_SECRET_KEY_PROD }}
+        run: docker stack deploy --with-registry-auth -c ./.deploy/deploy-prod.yaml certupdater

Dockerfile

@@ -2,8 +2,14 @@ FROM docker:dind
 
 ENV PYTHONUNBUFFERED=1
 RUN apk add --update --no-cache python3 py3-pip && ln -sf python3 /usr/bin/python
+RUN mkdir /code
+WORKDIR /code
 RUN python3 -m venv venv
 RUN venv/bin/python3 -m ensurepip
 RUN venv/bin/pip3 install --no-cache --upgrade pip setuptools
 
+COPY requirements.txt requirements.txt
+RUN venv/bin/pip3 install -r requirements.txt
+COPY . .
+
 ENTRYPOINT [ "venv/bin/python3", "main.py" ]

blob.py

@@ -1,7 +1,7 @@
 import os
 from minio import Minio
 
-MINIO_HOST = os.getenv("MINIO_HOST", "localhost") + ":9000"
+MINIO_HOST = "minio:9000"
 MINIO_ACCESS_KEY = os.getenv("MINIO_ACCESS_KEY", "serviceminioadmin")
 MINIO_SECRET_KEY = os.getenv("MINIO_SECRET_KEY", "minioadmin")
 

configurator.py

@@ -1,88 +0,0 @@
-import json
-import os
-import urllib.parse
-from threading import Thread
-from time import sleep
-
-from requests import get
-
-
-class ConfiguratorClient:
-    def __init__(self, app_name: str, stage: str, need_poll: bool = True):
-        self.app_name = app_name
-        self.stage = stage
-        self.endpoint = 'http://configurator/'
-        self.fetch_url = urllib.parse.urljoin(self.endpoint, '/api/v1/fetch')
-        self.config_storage = {}
-        self.experiment_storage = {}
-        self.staff_storage = {}
-        self.poll_data()
-        if need_poll:
-            self.poll_data_in_thread()
-
-    def poll_data_in_thread(self):
-        def inner():
-            while True:
-                sleep(30)
-                self.fetch()
-
-        Thread(target=inner, daemon=True).start()
-
-    def poll_data(self):
-        self.fetch(with_exception=True)
-
-    def request_with_retries(self, url, params, with_exception=False, retries_count=3):
-        exception_to_throw = None
-        for _ in range(retries_count):
-            try:
-                response = get(
-                    url,
-                    params=params
-                )
-                if response.status_code == 200:
-                    return response.json()
-                print(f'Failed to request {url}, status_code={response.status_code}')
-                exception_to_throw = Exception('Not 200 status')
-            except Exception as exc:
-                print(exc)
-                exception_to_throw = exc
-            sleep(1)
-        print(f'Failed fetching with retries: {url}, {params}')
-        if with_exception:
-            raise exception_to_throw
-
-    def fetch(self, with_exception=False):
-        if self.stage == 'local':
-            local_platform = json.loads(open('local_platform.json', 'r').read())
-            self.config_storage = local_platform['configs']
-            self.experiment_storage = local_platform['experiments']
-            self.staff_storage = {
-                key: set(value)
-                for key, value in local_platform['platform_staff'].items()
-            }
-            return
-        response_data = self.request_with_retries(self.fetch_url, {
-            'project': self.app_name,
-            'stage': self.stage,
-        }, with_exception)
-        self.config_storage = response_data['configs']
-        self.experiment_storage = response_data['experiments']
-        self.staff_storage = {
-            key: set(value)
-            for key, value in response_data['platform_staff'].items()
-        }
-
-    def is_staff(self, **kwargs):
-        for key, value in kwargs.items():
-            if value in self.staff_storage[key]:
-                return True
-        return False
-
-    def get_config(self, name):
-        return self.config_storage[name]
-
-    def get_experiment(self, name):
-        return self.experiment_storage[name]
-
-
-configurator = ConfiguratorClient("certupdater", os.getenv("STAGE"))

main.py

@@ -1,7 +1,10 @@
 import datetime
+import io
+import os
 import subprocess
 import time
-from configurator import configurator
+
+from requests import get, post
 from mongo import mongo
 from blob import minio
 
@@ -12,33 +15,136 @@ class Response:
     err: str
 
 
+def send_notification(text: str):
+    post(
+        "http://queues:1239/api/v1/put",
+        headers={"queue": "botalka_mailbox"},
+        json={
+            "payload": {
+                "project": "notifications-bot",
+                "name": "telegram-bot",
+                "body": {
+                    "text": text,
+                    "chat_id": 84367486,
+                },
+            },
+            "seconds_to_execute": 1,
+            "delay": None,
+        },
+    )
+
+
 def call(command: str) -> Response:
-    p = subprocess.Popen(command, stderr=subprocess.PIPE, stdout=subprocess.PIPE, shell=True)
+    p = subprocess.Popen(
+        command, stderr=subprocess.PIPE, stdout=subprocess.PIPE, shell=True
+    )
     resp = p.wait()
     response = Response()
     response.code = resp
-    response.out, response.err = p.stdout.read().decode('utf-8'), p.stderr.read().decode('utf-8')
+    response.out, response.err = p.stdout.read().decode(
+        "utf-8"
+    ), p.stderr.read().decode("utf-8")
     return response
 
 
 def get_hosts() -> list[str]:
-    return list(set(configurator.get_config("hosts") + ["platform.chocomarsh.com"]))
+    response = get(
+        f"http://configurator/api/v1/fetch?project=certupdater&stage={os.getenv("STAGE")}"
+    ).json()
+    hosts = response["configs"]["hosts"]
+    return list(hosts)
 
 
-def update_host(host: str):
+def update_host(host: str) -> str | None:
-    gen_cert = call(f"docker exec $(docker ps -q -f name=infra_nginx) certbot --nginx --email emmtvv@gmail.com --agree-tos -d \"{host}\"")
+    if os.getenv("STAGE") == "development":
+        container_id_run = call("echo $(docker ps -q -f name=infra-development_nginx)")
+    else:
+        container_id_run = call("echo $(docker ps -q -f name=infra_nginx)")
+    if container_id_run.code != 0:
+        return container_id_run.err
+    container_name = container_id_run.out.strip()
+    if not container_name:
+        return "no nginx container"
+
+    gen_command = f'docker exec {container_name} certbot --nginx --email emmtvv@gmail.com --agree-tos --non-interactive -d "{host}"'
+
+    gen_cert = call(gen_command)
     if gen_cert.code != 0:
-        print("failed generating certificate")
+        log = call(
-        return
+            f"docker exec {container_name} cat /var/log/letsencrypt/letsencrypt.log"
+        ).out
+        return f"failed generating certificate: {log}"
+
+    fullchain_command = call(
+        f"docker exec {container_name} cat /etc/letsencrypt/live/{host}/fullchain.pem"
+    )
+    if fullchain_command.code != 0:
+        return f"failed getting fullchain: {fullchain_command.err}"
+
+    privkey_command = call(
+        f"docker exec {container_name} cat /etc/letsencrypt/live/{host}/privkey.pem"
+    )
+    if privkey_command.code != 0:
+        return f"failed getting fullchain: {privkey_command.err}"
+
+    fullchain = fullchain_command.out.encode("utf-8")
+    privkey = privkey_command.out.encode("utf-8")
+    minio.put_object(
+        "certupdater",
+        f"certificates/{host}/fullchain.pem",
+        io.BytesIO(fullchain),
+        len(fullchain),
+    )
+    minio.put_object(
+        "certupdater",
+        f"certificates/{host}/privkey.pem",
+        io.BytesIO(privkey),
+        len(privkey),
+    )
+    return None
 
 
+if __name__ == "__main__":
+    while True:
+        now = datetime.datetime.now()
+        mongo_hosts = mongo.hosts
+        hosts = get_hosts()
+        print(f"got hosts {hosts}")
+        updated = False
+        for host in hosts:
+            if (
+                now + datetime.timedelta(days=14)
+                > mongo_hosts.get(
+                    host, {"expire_time": datetime.datetime.fromtimestamp(1)}
+                )["expire_time"]
+            ):
+                success = update_host(host)
+                if success:
+                    print(success)
+                    send_notification(
+                        f"host {host} was not updated with an error: {success}"
+                    )
+                else:
+                    mongo.update_date(host)
+                    updated = True
+                    send_notification(f"host {host} updated")
+            else:
+                print(f"Host {host} does not need to be updated")
+        if updated:
+            if os.getenv("STAGE") == "development":
+                container_id_run = call(
+                    "echo $(docker ps -q -f name=infra-development_nginx)"
+                )
+            else:
+                container_id_run = call("echo $(docker ps -q -f name=infra_nginx)")
 
-while True:
+            print(container_id_run.code, container_id_run.out, container_id_run.err)
-    now = datetime.datetime.now()
+
-    mongo_hosts = mongo.hosts
+            command = f"docker exec {container_id_run.out.strip()} ./refre.sh"
-    for host in get_hosts():
+            print(command)
-        if now() + datetime.timedelta(days=14) > mongo_hosts[host]["expire_time"]:
+
-            update_host(host)
+            restart = call(command)
-            print(f"Host {host} updated")
+            print(restart.code, restart.out, restart.err)
-    minio.put_object("certupdater", "nginx.conf", )
+            send_notification(f"Balancer for {os.getenv("STAGE")} was restarted")
-    time.sleep(5 * 60)
+
+        time.sleep(30)

mongo.py

@@ -4,12 +4,11 @@ import os
 
 MONGO_USER = os.getenv("MONGO_USER", "mongo")
 MONGO_PASSWORD = os.getenv("MONGO_PASSWORD", "password")
-MONGO_HOST = os.getenv("MONGO_HOST", "localhost")
 
 
 class Mongo:
     def __init__(self):
-        url = f"mongodb://{MONGO_USER}:{MONGO_PASSWORD}@{MONGO_HOST}:27017/"
+        url = f"mongodb://{MONGO_USER}:{MONGO_PASSWORD}@mongo:27017/"
         self.client: pymongo.MongoClient = pymongo.MongoClient(url)
         self.database = self.client.get_database("certupdater")
         self.hosts_collection.create_index([

requirements.txt

@@ -0,0 +1,14 @@
+argon2-cffi==23.1.0
+argon2-cffi-bindings==21.2.0
+certifi==2025.4.26
+cffi==1.17.1
+charset-normalizer==3.4.2
+dnspython==2.7.0
+idna==3.10
+minio==7.2.15
+pycparser==2.22
+pycryptodome==3.23.0
+pymongo==4.13.0
+requests==2.32.3
+typing_extensions==4.13.2
+urllib3==2.4.0

storage.py

@@ -1,42 +0,0 @@
-from cachetools import TTLCache
-import os
-
-from utils.mongo import mongo
-
-CACHE_SIZE = int(os.getenv("CACHE_SIZE", 1000))
-CACHE_TTL = int(os.getenv("CACHE_TTL", 3600))
-
-cache = TTLCache(CACHE_SIZE, CACHE_TTL)
-
-
-def get_chat_info(chat_id: int) -> dict:
-    cached_info = cache.get(chat_id)
-    if cached_info is not None:
-        return cached_info
-    mongo_info = mongo.chats_collection.find_one({"chat_id": chat_id})
-    if mongo_info is not None:
-        cache[chat_id] = mongo_info
-        return mongo_info
-    chat_info = {"chat_id": chat_id, "state": "default", "probability": 100}
-    mongo.chats_collection.insert_one(chat_info)
-    cache[chat_id] = chat_info
-    return chat_info
-
-
-def set_values(chat_id: int, **values):
-    cached_info = cache.get(chat_id)
-    if cached_info is None:
-        mongo_info = mongo.chats_collection.find_one({"chat_id": chat_id})
-        if mongo_info is None:
-            chat_info = {"chat_id": chat_id, "state": "default", "probability": 100}
-            chat_info.update(values)
-            mongo.chats_collection.insert_one(chat_info)
-            cache[chat_id] = chat_info
-        else:
-            mongo.chats_collection.update_one({"chat_id": chat_id}, {"$set": values})
-            mongo_info = dict(mongo_info)
-            mongo_info.update(values)
-            cache[chat_id] = mongo_info
-    else:
-        cached_info.update(values)
-        mongo.chats_collection.update_one({"chat_id": chat_id}, {"$set": values})