Merge pull request 'fix' (#151) from master into prod

Reviewed-on: #151

.deploy-infra/deploy-dev.yaml

@@ -7,6 +7,7 @@ services:
     networks:
       - common-infra-nginx-development
       - configurator
+      - minio-development
     environment:
       MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
@@ -27,8 +28,29 @@ services:
         parallelism: 1
         # order: stop-first
   
+  clickhouse:
+    image: clickhouse
+    networks:
+      - clickhouse-development
+      - common-infra-nginx-development
+    volumes:
+      - /sprint-data/clickhouse:/var/lib/clickhouse
+    environment:
+      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_DEV
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == development]
+      update_config:
+        parallelism: 1
+
   postgres:
     image: postgres:14-alpine3.19
+    networks:
+      - postgres-development
     volumes:
       - /sprint-data/postgres-data:/var/lib/postgresql/data
     environment:
@@ -55,6 +77,8 @@ services:
 
   mongo:
     image: mongo:6.0.2
+    networks:
+      - mongo-development
     volumes:
       - /sprint-data/mongo:/data/db
     environment:
@@ -74,29 +98,6 @@ services:
         parallelism: 1
         order: start-first 
 
-  rabbitmq:
-    image: rabbitmq:3.10.7-management
-    volumes:
-      - /sprint-data/rabbitmq:/var/lib/rabbitmq
-    ports:
-      - published: 5672
-        target: 5672
-        mode: host
-      - published: 15672
-        target: 15672
-        mode: host
-    environment:
-      RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
-    deploy:
-      mode: replicated
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == development]
-      update_config:
-        parallelism: 1
-        order: start-first
-
   redis:
     image: redis:alpine3.16
     volumes:
@@ -118,6 +119,8 @@ services:
 
   minio:
     image: bitnami/minio:2022.10.8
+    networks:
+      - minio-development
     volumes:
       - minio_data:/data
     environment:
@@ -146,7 +149,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - /sprint-data:/sprint-data
     environment:
-      GITEA_INSTANCE_URL: https://gitea.sprinthub.ru/
+      GITEA_INSTANCE_URL: https://gitea.chocomarsh.com/
       GITEA_RUNNER_REGISTRATION_TOKEN: $REGISTRATION_TOKEN
       GITEA_RUNNER_NAME: dev
       GITEA_RUNNER_LABELS: dev
@@ -169,3 +172,11 @@ networks:
     external: true
   configurator:
     external: true
+  clickhouse-development:
+    external: true
+  postgres-development:
+    external: true
+  mongo-development:
+    external: true
+  minio-development:
+    external: true

.deploy-infra/deploy-prod.yaml

@@ -7,6 +7,7 @@ services:
     networks:
       - common-infra-nginx
       - configurator
+      - minio
     environment:
       MINIO_SECRET_KEY: $MINIO_SECRET_KEY_PROD
     ports:
@@ -27,8 +28,58 @@ services:
         parallelism: 1
         # order: start-first
 
+  grafana:
+    image: grafana/grafana
+    networks:
+      - common-infra-nginx
+      - clickhouse
+    volumes:
+      - /sprint-data/grafana:/var/lib/grafana
+    environment:
+      GF_SERVER_ROOT_URL: https://grafana.chocomarsh.com
+      GF_CORS_ENABLED: "false"
+      GF_AUTH_DISABLE_LOGIN_FORM: "false"
+      GF_CORS_ALLOW_ORIGINS: "*"
+      GF_SECURITY_CONTENT_SECURITY_POLICY: "false"
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+
+  clickhouse:
+    image: clickhouse
+    networks:
+      - clickhouse
+    volumes:
+      - /sprint-data/clickhouse:/var/lib/clickhouse
+    environment:
+      CLICKHOUSE_PASSWORD: $CLICKHOUSE_PASSWORD_PROD
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+      resources:
+        limits:
+          memory: 2048M
+          cpus: '2.0'
+        reservations:
+          memory: 1024M
+          cpus: '1.0'
+
   postgres:
     image: postgres:14-alpine3.19
+    networks:
+      - postgres
     volumes:
       - /sprint-data/postgres-data:/var/lib/postgresql/data
     environment:
@@ -60,6 +111,8 @@ services:
 
   mongo:
     image: mongo:6.0.2
+    networks:
+      - mongo
     volumes:
       - /sprint-data/mongo:/data/db
     environment:
@@ -79,29 +132,6 @@ services:
         parallelism: 1
         order: start-first 
 
-  rabbitmq:
-    image: rabbitmq:3.10.7-management
-    volumes:
-      - /sprint-data/rabbitmq:/var/lib/rabbitmq
-    ports:
-      - published: 5672
-        target: 5672
-        mode: host
-      - published: 15672
-        target: 15672
-        mode: host
-    environment:
-      RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
-    deploy:
-      mode: replicated
-      restart_policy:
-        condition: any
-      placement:
-        constraints: [node.labels.stage == production]
-      update_config:
-        parallelism: 1
-        order: start-first
-
   redis:
     image: redis:alpine3.16
     volumes:
@@ -123,6 +153,8 @@ services:
 
   minio:
     image: bitnami/minio:2022.10.8
+    networks:
+      - minio
     volumes:
       - minio_data:/data
     environment:
@@ -146,7 +178,9 @@ services:
         order: start-first
 
   gitea:
-    image: gitea/gitea:1.22.3
+    image: gitea/gitea:1.24.6
+    networks:
+      - postgres
     volumes:
       - /sprint-data/gitea:/data
       - /etc/timezone:/etc/timezone
@@ -158,7 +192,7 @@ services:
       USER_UID: 1000
       USER_GID: 1000
       GITEA__database__DB_TYPE: postgres
-      GITEA__database__HOST: pg.sprinthub.ru:5432
+      GITEA__database__HOST: postgres:5432
       GITEA__database__NAME: gitea
       GITEA__database__USER: postgres
       GITEA__database__PASSWD: $DB_PASSWORD_PROD
@@ -177,8 +211,9 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /sprint-data:/sprint-data
+      - /root/.cache/act:/root/.cache/act
     environment:
-      GITEA_INSTANCE_URL: https://gitea.sprinthub.ru/
+      GITEA_INSTANCE_URL: https://gitea.chocomarsh.com/
       GITEA_RUNNER_REGISTRATION_TOKEN: $REGISTRATION_TOKEN
       GITEA_RUNNER_NAME: prod
       GITEA_RUNNER_LABELS: prod
@@ -192,35 +227,6 @@ services:
         parallelism: 1
         order: start-first
 
-  keycloak:
-    image: quay.io/keycloak/keycloak
-    ports:
-      - "8443:3000"
-    environment:
-      KC_DB: postgres
-      KC_DB_URL: jdbc:postgresql://0.0.0.0:5432/keycloak
-      KC_DB_USERNAME: postgres
-      KC_DB_PASSWORD: $DB_PASSWORD_PROD
-      KC_HOSTNAME: keycloak.sprinthub.ru
-      JAVA_OPTS_KC_HEAP: "-XX:MaxHeapFreeRatio=50 -XX:MaxRAMPercentage=65"
-    command: start
-    deploy:
-      mode: replicated
-      placement:
-        constraints: [node.labels.stage == production]
-      restart_policy:
-        condition: any
-      update_config:
-        parallelism: 1
-        order: start-first
-      resources:
-        limits:
-          cpus: '1.0'
-          memory: 250M
-        reservations:
-          cpus: '0.50'
-          memory: 125M
-
 volumes:
   minio_data:
     driver: local
@@ -234,3 +240,11 @@ networks:
     external: true
   configurator:
     external: true
+  clickhouse:
+    external: true
+  postgres:
+    external: true
+  mongo:
+    external: true
+  minio:
+    external: true

.deploy-portainer/deploy-prod.yaml

@@ -2,7 +2,7 @@ version: '3.2'
 
 services:
   agent:
-    image: portainer/agent:2.11.1
+    image: portainer/agent:2.33.1
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - /var/lib/docker/volumes:/var/lib/docker/volumes
@@ -14,7 +14,7 @@ services:
         constraints: [node.platform.os == linux]
 
   portainer:
-    image: portainer/portainer-ce:2.11.1
+    image: portainer/portainer-ce:2.33.1
     command: -H tcp://tasks.agent:9001 --tlsskipverify
     ports:
       - "9443:9443"

.gitea/workflows/deploy-dev.yaml

@@ -19,8 +19,6 @@ jobs:
           ref: dev
       - name: build nginx dev
         run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-dev nginx/nginx-dev
-      - name: build gitea runner
-        run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
     runs-on: [ prod ]
@@ -58,6 +56,7 @@ jobs:
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
           DB_PASSWORD_DEV: ${{ secrets.POSTGRES_PASSWORD_DEV }}
+          CLICKHOUSE_PASSWORD_DEV: ${{ secrets.CLICKHOUSE_PASSWORD_DEV }}
           MINIO_PASSWORD_DEV: ${{ secrets.MINIO_PASSWORD_DEV }}
           MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
           REDIS_PASSWORD_DEV: ${{ secrets.REDIS_PASSWORD_DEV }}

.gitea/workflows/deploy-prod.yaml

@@ -16,7 +16,7 @@ jobs:
       - name: checkout
         uses: actions/checkout@v4
         with:
-          ref: dev
+          ref: prod
       - name: build nginx prod
         run: docker build -t mathwave/sprint-repo:sprint-infra-nginx-prod nginx/nginx-prod
       - name: build gitea runner
@@ -40,7 +40,7 @@ jobs:
       - name: checkout
         uses: actions/checkout@v4
         with:
-          ref: dev
+          ref: prod
       - name: prepare
         run: chmod 777 ./prepare/run-production.sh && ./prepare/run-production.sh
   deploy-prod:
@@ -54,17 +54,19 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: prod
-      - name: deploy swarmpit
-        run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-prod.yaml swarmpit
       - name: deploy portainer
         run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-prod.yaml portainer
       - name: deploy infra
         env:
           MONGO_PASSWORD_PROD: ${{ secrets.MONGO_PASSWORD_PROD }}
           DB_PASSWORD_PROD: ${{ secrets.POSTGRES_PASSWORD_PROD }}
+          CLICKHOUSE_PASSWORD_PROD: ${{ secrets.CLICKHOUSE_PASSWORD_PROD }}
           MINIO_PASSWORD_PROD: ${{ secrets.MINIO_PASSWORD_PROD }}
           MINIO_SECRET_KEY_PROD: ${{ secrets.MINIO_SECRET_KEY_PROD }}
           REDIS_PASSWORD_PROD: ${{ secrets.REDIS_PASSWORD_PROD }}
           RABBITMQ_PASSWORD_PROD: ${{ secrets.RABBITMQ_PASSWORD_PROD }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
+          AUTHTHELIA_JWT_SECRET: ${{ secrets.AUTHTHELIA_JWT_SECRET }}
+          AUTHTHELIA_SESSION_SECRET: ${{ secrets.AUTHTHELIA_SESSION_SECRET }}
+          AUTHELIA_STORAGE_ENCRYPTION_KEY: ${{ secrets.AUTHELIA_STORAGE_ENCRYPTION_KEY }}
         run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-prod.yaml infra

gitea-runner/Dockerfile

@@ -3,3 +3,4 @@ FROM gitea/act_runner:nightly
 RUN apk add docker
 RUN apk add git
 RUN apk add --no-cache nodejs
+RUN apk add --no-cache make

nginx/nginx-dev/Dockerfile

@@ -4,8 +4,6 @@ RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
 RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
 COPY refre.sh refre.sh

nginx/nginx-dev/config/nginx.conf

@@ -8,6 +8,17 @@ http {
         '' close;
     }
 
-    include ./hosts.conf;
+    server {
-    include ./sprinthub.conf;
+        listen 80;
+        server_name *.develop.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.dev.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
+    include ./hosts.conf;
 }

nginx/nginx-dev/config/sprinthub.conf

@@ -1,118 +0,0 @@
-
-    server {
-        listen 80;
-        server_name *.develop.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.sprinthub.ru:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name rabbitmq.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name grafana.develop.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        proxy_set_header Host $http_host;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.sprinthub.ru:3000/;
-        }
-
-        location /api/live/ws {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.sprinthub.ru:3000/api/live/ws;
-        }
-    }

nginx/nginx-dev/fullchain.pem

@@ -1,48 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDmTCCAx+gAwIBAgISBmM6pAg0qa3+cxLar5nvn27GMAoGCCqGSM49BAMDMDIx
-CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
-NTAeFw0yNTA1MzAyMTEzMjZaFw0yNTA4MjgyMTEzMjVaMCExHzAdBgNVBAMMFiou
-ZGV2ZWxvcC5zcHJpbnRodWIucnUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATy
-YXxx4cfN6ga0duaq7STjZxNwtFQ7c0ZAO+D7ulmdf/jpK8Xfkj5d0KMX0jhTmTEg
-DUwvBMsH/fpyuuEdHNPWo4ICJDCCAiAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
-MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT1
-FLWsp0ksteuVXXd3pZokXOhj2DAfBgNVHSMEGDAWgBSfK1/PPCFPnQS37SssxMZw
-i9LXDTAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly9lNS5pLmxl
-bmNyLm9yZy8wIQYDVR0RBBowGIIWKi5kZXZlbG9wLnNwcmludGh1Yi5ydTATBgNV
-HSAEDDAKMAgGBmeBDAECATAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8vZTUuYy5s
-ZW5jci5vcmcvNzEuY3JsMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYAEvFONL1T
-ckyEBhnDjz96E/jntWKHiJxtMAWE6+WGJjoAAAGXI0B2OwAABAMARzBFAiBcMmQQ
-PiKhuqhi3fs4yL6lfnQdZ1VlJTBifu8T6t4H3QIhAL/BdDUOafC+9nrlP7USrlCT
-Oo1TA5JG/Yvxk5a/Oe1yAHYA7TxL1ugGwqSiAFfbyyTiOAHfUS/txIbFcA8g3bc+
-P+AAAAGXI0CF1gAABAMARzBFAiAHI0Z170KObyMHOQM6w/GhsazTzUpBilyQnv/b
-Wr+kdwIhALS4DQNUNfiJoea0wszwoTxcnowGI7Whx8qH4Ut6st88MAoGCCqGSM49
-BAMDA2gAMGUCMGdO7CfUNB8wcMaHtED7/dy2ojOtofMze0kN0rzt2I/On55Ce84K
-ZJ0Uj+Bcv/66qwIxAJ9YJTSJ1+owoICDbJekE+ejgzA+GgU2Z+RviZUTNXIdbWbX
-etMXbXfP7WJPjxZ+ng==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
-WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
-a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
-VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
-gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
-ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
-i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
-AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
-BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
-Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
-2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
-bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
-6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
-XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
-koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
-cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
-E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
-K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
-GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
-sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
-VQD9F6Na/+zmXCc=
------END CERTIFICATE-----

nginx/nginx-dev/prepare.py

@@ -6,7 +6,7 @@ from json import loads
 
 
 minio_client = Minio(
-    "minio.develop.sprinthub.ru:9000",
+    "minio:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
     secure=False,
@@ -43,7 +43,10 @@ for host, params in hosts.items():
             add_header X-XSS-Protection "1; mode=block" always;
             add_header X-Content-Type-Options "nosniff" always;
             add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
 
             location / {{
                 resolver 127.0.0.11;

nginx/nginx-dev/privkey.pem

@@ -1,5 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MHcCAQEEIPtfut2MheT8iyX6/EXDHHDR9yvtYLxMUg34mLeCpngpoAoGCCqGSM49
-AwEHoUQDQgAE8mF8ceHHzeoGtHbmqu0k42cTcLRUO3NGQDvg+7pZnX/46SvF35I+
-XdCjF9I4U5kxIA1MLwTLB/36crrhHRzT1g==
------END EC PRIVATE KEY-----

nginx/nginx-prod/Dockerfile

@@ -2,10 +2,8 @@ FROM nginx
 RUN apt-get update
 RUN apt-get install certbot --yes
 RUN apt-get install python3-certbot-nginx python3-pip --yes
-RUN pip3 install --break-system-packages requests minio
+RUN pip3 install --break-system-packages minio
 COPY ./config /etc/nginx
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
-COPY ./privkey.pem /etc/nginx/privkey.pem
 COPY prepare.py prepare.py
 COPY run.sh run.sh
 COPY refre.sh refre.sh

nginx/nginx-prod/config/nginx.conf

@@ -8,6 +8,17 @@ http {
         '' close;
     }
 
-    include ./hosts.conf;
+    server {
-    include ./sprinthub.conf;
+        listen 80;
+        server_name *.sprinthub.ru;
+        return 301 https://$host$request_uri;
+    }
+
+    server {
+        listen 80;
+        server_name *.chocomarsh.com;
+        return 301 https://$host$request_uri;
+    }
+    
+    include ./hosts.conf;
 }

nginx/nginx-prod/config/sprinthub.conf

@@ -1,90 +0,0 @@
-
-    server {
-        listen 80;
-        server_name *.sprinthub.ru;
-        return 301 https://$host$request_uri;
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://dev.sprinthub.ru:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name gitea.sprinthub.ru;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://dev.sprinthub.ru:3000/;
-        }
-    }

nginx/nginx-prod/fullchain.pem

@@ -1,47 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDhzCCAw6gAwIBAgISBXELtGOqEI5IsXNFUC7cue03MAoGCCqGSM49BAMDMDIx
-CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
-NTAeFw0yNTA1MzAyMTQ3MzZaFw0yNTA4MjgyMTQ3MzVaMBkxFzAVBgNVBAMMDiou
-c3ByaW50aHViLnJ1MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoS3M+thgeup/
-F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9azdDRAp+c2OlzJqJQC+ZefswCB
-2xvjNSoL2aOCAhswggIXMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEF
-BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUu+3qfzUyaCAb
-POu7GPUO6ZI2WfswHwYDVR0jBBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wMgYI
-KwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTUuaS5sZW5jci5vcmcv
-MBkGA1UdEQQSMBCCDiouc3ByaW50aHViLnJ1MBMGA1UdIAQMMAowCAYGZ4EMAQIB
-MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy81Ni5jcmww
-ggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sA
-OhQSdgosrLvIKgAAAZcjX78RAAAEAwBHMEUCIDNC6e7jNcTXW1bti1nkseruXw84
-b8dsVzBt96FtE4+aAiEAr7ugvtozhmp6JdkIEfdHKecym9TxcL1h43j6rbKU3d8A
-dQAaBP9J0FQdQK/2oMO/8djEZy9O7O4jQGiYaxdALtyJfQAAAZcjX8BoAAAEAwBG
-MEQCIDezeAIFZ25OWXVV9hmtzEE5ujP0IyFaLxebyXAflYZMAiAy09hFLQXapebE
-5YDtvqfmefapEsr4OaWyfusWjmeaiDAKBggqhkjOPQQDAwNnADBkAjAobO18Vk18
-BG7lBbXEQ0O8RYy+CEV/ef1ni2CBQp+MtmG/ZCWAbfEXFaj2WKng5Q0CMFRR9icx
-p6/tLUixnJfAusGudEtD5Leh2foPDT2jzgazaROaVFVTrCJMGcdgVukuPQ==
------END CERTIFICATE-----
------BEGIN CERTIFICATE-----
-MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
-TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
-cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
-WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
-a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
-VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
-gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
-ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
-i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
-AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
-BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
-Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
-2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
-bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
-6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
-XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
-koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
-cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
-E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
-K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
-GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
-sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
-VQD9F6Na/+zmXCc=
------END CERTIFICATE-----

nginx/nginx-prod/prepare.py

@@ -1,19 +1,32 @@
-from requests import get
 import os
+import sys
 from minio import Minio
+from urllib.request import urlopen
+from json import loads
 
 
 minio_client = Minio(
-    "minio.sprinthub.ru:9000",
+    "minio:9000",
     access_key="serviceminioadmin",
     secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
     secure=False,
 )
 
 
-hosts = get(
+def get(url):
+    with urlopen(url) as response:
+        data = response.read().decode("utf-8")
+        return loads(data)
+
+
+try:
+    response = get(
         "http://configurator/api/v1/fetch?project=certupdater&stage=production"
-).json()["configs"]["hosts"]
+    )
+    hosts = response["configs"]["hosts"]
+except Exception as e:
+    print(f"Error fetching config: {e}", file=sys.stderr)
+    sys.exit(1)
 
 config = ""
 for host, params in hosts.items():
@@ -30,7 +43,10 @@ for host, params in hosts.items():
             add_header X-XSS-Protection "1; mode=block" always;
             add_header X-Content-Type-Options "nosniff" always;
             add_header Referrer-Policy "no-refferer-when-downgrade" always;
-            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
 
             location / {{
                 resolver 127.0.0.11;
@@ -40,18 +56,30 @@ for host, params in hosts.items():
     """.format(
         host=host, target_host=params["host"], port=params["port"]
     )
+    try:
         fullchain = minio_client.get_object(
             "certupdater", f"certificates/{host}/fullchain.pem"
         )
-    privkey = minio_client.get_object("certupdater", f"certificates/{host}/privkey.pem")
+        privkey = minio_client.get_object(
+            "certupdater", f"certificates/{host}/privkey.pem"
+        )
         try:
-        os.mkdir(f"/etc/nginx/{host}")
+            os.makedirs(f"/etc/nginx/{host}", exist_ok=True)
-    except FileExistsError:
+        except OSError as e:
-        ...
+            print(f"Error creating directory: {e}", file=sys.stderr)
+            continue
+
         with open(f"/etc/nginx/{host}/fullchain.pem", "wb") as fp:
             fp.write(fullchain.data)
         with open(f"/etc/nginx/{host}/privkey.pem", "wb") as fp:
             fp.write(privkey.data)
+    except Exception as e:
+        print(f"Error processing host {host}: {e}", file=sys.stderr)
+        continue
 
+try:
     with open("/etc/nginx/hosts.conf", "w") as fp:
         fp.write(config)
+except Exception as e:
+    print(f"Error writing config file: {e}", file=sys.stderr)
+    sys.exit(1)

nginx/nginx-prod/privkey.pem

@@ -1,5 +0,0 @@
------BEGIN EC PRIVATE KEY-----
-MHcCAQEEIL0TAduonJLmbcDpRxDjSfa8bMIqLOh1KQcGQvAeQTIQoAoGCCqGSM49
-AwEHoUQDQgAEoS3M+thgeup/F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9az
-dDRAp+c2OlzJqJQC+ZefswCB2xvjNSoL2Q==
------END EC PRIVATE KEY-----

prepare/run-development.sh

@@ -4,6 +4,8 @@ mkdir /sprint-data/redis || true
 mkdir /sprint-data/rabbitmq || true
 mkdir /sprint-data/certs || true
 mkdir /sprint-data/gitea || true
+mkdir /sprint-data/clickhouse || true
 chmod 777 /sprint-data/redis
 chmod 777 /sprint-data/rabbitmq
 chmod 777 /sprint-data/gitea
+chmod 777 /sprint-data/clickhouse

prepare/run-production.sh

@@ -5,12 +5,30 @@ docker network create -d overlay --attachable common-infra-nginx-development ||
 docker network create -d overlay --attachable queues || true
 docker network create -d overlay --attachable queues-development || true
 docker network create -d overlay --attachable configurator || true
+docker network create -d overlay --attachable monitoring || true
 docker network create -d overlay --attachable configurator-development || true
+docker network create -d overlay --attachable clickhouse || true
+docker network create -d overlay --attachable postgres || true
+docker network create -d overlay --attachable postgres-development || true
+docker network create -d overlay --attachable mongo || true
+docker network create -d overlay --attachable mongo-development || true
+docker network create -d overlay --attachable minio || true
+docker network create -d overlay --attachable minio-development || true
+
 mkdir /sprint-data/mongo || true
 mkdir /sprint-data/redis || true
-mkdir /sprint-data/rabbitmq || true
 mkdir /sprint-data/certs || true
 mkdir /sprint-data/gitea || true
+mkdir /sprint-data/clickhouse || true
+mkdir /sprint-data/grafana || true
+mkdir /sprint-data/authelia || true
+mkdir /sprint-data/authelia/config || true
+mkdir /sprint-data/authelia/data || true
+chmod 777 /sprint-data/authelia
+chmod 777 /sprint-data/authelia/config
+chmod 777 /sprint-data/authelia/data
 chmod 777 /sprint-data/redis
 chmod 777 /sprint-data/rabbitmq
 chmod 777 /sprint-data/gitea
+chmod 777 /sprint-data/clickhouse
+chmod 777 /sprint-data/grafana