Merge pull request 'fix' (#151) from master into prod

Reviewed-on: #151

.deploy-infra/deploy-dev.yaml

@@ -7,6 +7,7 @@ services:
     networks:
       - common-infra-nginx-development
       - configurator
+      - minio-development
     environment:
       MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
@@ -31,6 +32,7 @@ services:
     image: clickhouse
     networks:
       - clickhouse-development
+      - common-infra-nginx-development
     volumes:
       - /sprint-data/clickhouse:/var/lib/clickhouse
     environment:
@@ -47,6 +49,8 @@ services:
 
   postgres:
     image: postgres:14-alpine3.19
+    networks:
+      - postgres-development
     volumes:
       - /sprint-data/postgres-data:/var/lib/postgresql/data
     environment:
@@ -73,6 +77,8 @@ services:
 
   mongo:
     image: mongo:6.0.2
+    networks:
+      - mongo-development
     volumes:
       - /sprint-data/mongo:/data/db
     environment:
@@ -92,29 +98,6 @@ services:
         parallelism: 1
         order: start-first 
 
-  rabbitmq:
-    image: rabbitmq:3.10.7-management
-    volumes:
-      - /sprint-data/rabbitmq:/var/lib/rabbitmq
-    ports:
-      - published: 5672
-        target: 5672
-        mode: host
-      - published: 15672
-        target: 15672
-        mode: host
-    environment:
-      RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
-    deploy:
-      mode: replicated
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == development]
-      update_config:
-        parallelism: 1
-        order: start-first
-
   redis:
     image: redis:alpine3.16
     volumes:
@@ -136,6 +119,8 @@ services:
 
   minio:
     image: bitnami/minio:2022.10.8
+    networks:
+      - minio-development
     volumes:
       - minio_data:/data
     environment:
@@ -164,7 +149,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - /sprint-data:/sprint-data
     environment:
-      GITEA_INSTANCE_URL: https://gitea.sprinthub.ru/
+      GITEA_INSTANCE_URL: https://gitea.chocomarsh.com/
       GITEA_RUNNER_REGISTRATION_TOKEN: $REGISTRATION_TOKEN
       GITEA_RUNNER_NAME: dev
       GITEA_RUNNER_LABELS: dev
@@ -189,3 +174,9 @@ networks:
     external: true
   clickhouse-development:
     external: true
+  postgres-development:
+    external: true
+  mongo-development:
+    external: true
+  minio-development:
+    external: true

.deploy-infra/deploy-prod.yaml

@@ -7,6 +7,7 @@ services:
     networks:
       - common-infra-nginx
       - configurator
+      - minio
     environment:
       MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
     ports:
@@ -31,10 +32,15 @@ services:
     image: grafana/grafana
     networks:
       - common-infra-nginx
+      - clickhouse
     volumes:
       - /sprint-data/grafana:/var/lib/grafana
     environment:
-      - GF_SERVER_ROOT_URL=https://grafana.chocomarsh.com
+      GF_SERVER_ROOT_URL: https://grafana.chocomarsh.com
+      GF_CORS_ENABLED: "false"
+      GF_AUTH_DISABLE_LOGIN_FORM: "false"
+      GF_CORS_ALLOW_ORIGINS: "*"
+      GF_SECURITY_CONTENT_SECURITY_POLICY: "false"
     deploy:
       mode: replicated
       replicas: 1
@@ -62,9 +68,18 @@ services:
         constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
+      resources:
+        limits:
+          memory: 2048M
+          cpus: '2.0'
+        reservations:
+          memory: 1024M
+          cpus: '1.0'
 
   postgres:
     image: postgres:14-alpine3.19
+    networks:
+      - postgres
     volumes:
       - /sprint-data/postgres-data:/var/lib/postgresql/data
     environment:
@@ -96,6 +111,8 @@ services:
 
   mongo:
     image: mongo:6.0.2
+    networks:
+      - mongo
     volumes:
       - /sprint-data/mongo:/data/db
     environment:
@@ -136,6 +153,8 @@ services:
 
   minio:
     image: bitnami/minio:2022.10.8
+    networks:
+      - minio
     volumes:
       - minio_data:/data
     environment:
@@ -159,7 +178,9 @@ services:
         order: start-first
 
   gitea:
-    image: gitea/gitea:1.22.3
+    image: gitea/gitea:1.24.6
+    networks:
+      - postgres
     volumes:
       - /sprint-data/gitea:/data
       - /etc/timezone:/etc/timezone
@@ -171,7 +192,7 @@ services:
       USER_UID: 1000
       USER_GID: 1000
       GITEA__database__DB_TYPE: postgres
-      GITEA__database__HOST: pg.sprinthub.ru:5432
+      GITEA__database__HOST: postgres:5432
       GITEA__database__NAME: gitea
       GITEA__database__USER: postgres
       GITEA__database__PASSWD: $DB_PASSWORD_PROD
@@ -190,8 +211,9 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /sprint-data:/sprint-data
+      - /root/.cache/act:/root/.cache/act
     environment:
-      GITEA_INSTANCE_URL: https://gitea.sprinthub.ru/
+      GITEA_INSTANCE_URL: https://gitea.chocomarsh.com/
       GITEA_RUNNER_REGISTRATION_TOKEN: $REGISTRATION_TOKEN
       GITEA_RUNNER_NAME: prod
       GITEA_RUNNER_LABELS: prod
@@ -220,3 +242,9 @@ networks:
     external: true
   clickhouse:
     external: true
+  postgres:
+    external: true
+  mongo:
+    external: true
+  minio:
+    external: true

.deploy-portainer/deploy-prod.yaml

@@ -2,7 +2,7 @@ version: '3.2'
 
 services:
   agent:
-    image: portainer/agent:2.11.1
+    image: portainer/agent:2.33.1
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /var/lib/docker/volumes:/var/lib/docker/volumes
@@ -14,7 +14,7 @@ services:
         constraints: [node.platform.os == linux]
 
   portainer:
-    image: portainer/portainer-ce:2.11.1
+    image: portainer/portainer-ce:2.33.1
     command: -H tcp://tasks.agent:9001 --tlsskipverify
     ports:
       - "9443:9443"

.gitea/workflows/deploy-dev.yaml

@@ -19,8 +19,6 @@ jobs:
           ref: dev
       - name: build nginx dev
         run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-dev nginx/nginx-dev
-      - name: build gitea runner
-        run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
     runs-on: [ prod ]

.gitea/workflows/deploy-prod.yaml

@@ -54,8 +54,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: prod
-      - name: deploy swarmpit
-        run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-prod.yaml swarmpit
       - name: deploy portainer
         run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-prod.yaml portainer
       - name: deploy infra
@@ -68,4 +66,7 @@ jobs:
           REDIS_PASSWORD_PROD: ${{ secrets.REDIS_PASSWORD_PROD }}
           RABBITMQ_PASSWORD_PROD: ${{ secrets.RABBITMQ_PASSWORD_PROD }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
+          AUTHTHELIA_JWT_SECRET: ${{ secrets.AUTHTHELIA_JWT_SECRET }}
+          AUTHTHELIA_SESSION_SECRET: ${{ secrets.AUTHTHELIA_SESSION_SECRET }}
+          AUTHELIA_STORAGE_ENCRYPTION_KEY: ${{ secrets.AUTHELIA_STORAGE_ENCRYPTION_KEY }}
         run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-prod.yaml infra

gitea-runner/Dockerfile

@@ -3,3 +3,4 @@ FROM gitea/act_runner:nightly
 RUN apk add docker
 RUN apk add git
 RUN apk add --no-cache nodejs
+RUN apk add --no-cache make

nginx/nginx-dev/prepare.py

@@ -6,7 +6,7 @@ from json import loads
 
 
 minio_client = Minio(
-    "minio.develop.sprinthub.ru:9000",
+    "minio:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
     secure=False,
@@ -43,7 +43,10 @@ for host, params in hosts.items():
             add_header X-XSS-Protection "1; mode=block" always;
             add_header X-Content-Type-Options "nosniff" always;
             add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
 
             location / {{
                 resolver 127.0.0.11;

nginx/nginx-prod/prepare.py

@@ -6,7 +6,7 @@ from json import loads
 
 
 minio_client = Minio(
-    "minio.sprinthub.ru:9000",
+    "minio:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
     secure=False,
@@ -43,7 +43,10 @@ for host, params in hosts.items():
             add_header X-XSS-Protection "1; mode=block" always;
             add_header X-Content-Type-Options "nosniff" always;
             add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
 
             location / {{
                 resolver 127.0.0.11;

prepare/run-production.sh

@@ -8,14 +8,25 @@ docker network create -d overlay --attachable configurator || true
 docker network create -d overlay --attachable monitoring || true
 docker network create -d overlay --attachable configurator-development || true
 docker network create -d overlay --attachable clickhouse || true
-docker network create -d overlay --attachable clickhouse-development || true
+docker network create -d overlay --attachable postgres || true
+docker network create -d overlay --attachable postgres-development || true
+docker network create -d overlay --attachable mongo || true
+docker network create -d overlay --attachable mongo-development || true
+docker network create -d overlay --attachable minio || true
+docker network create -d overlay --attachable minio-development || true
+
 mkdir /sprint-data/mongo || true
 mkdir /sprint-data/redis || true
-mkdir /sprint-data/rabbitmq || true
 mkdir /sprint-data/certs || true
 mkdir /sprint-data/gitea || true
 mkdir /sprint-data/clickhouse || true
 mkdir /sprint-data/grafana || true
+mkdir /sprint-data/authelia || true
+mkdir /sprint-data/authelia/config || true
+mkdir /sprint-data/authelia/data || true
+chmod 777 /sprint-data/authelia
+chmod 777 /sprint-data/authelia/config
+chmod 777 /sprint-data/authelia/data
 chmod 777 /sprint-data/redis
 chmod 777 /sprint-data/rabbitmq
 chmod 777 /sprint-data/gitea