Merge pull request 'fix' (#57) from master into dev

Reviewed-on: #57

.deploy-infra/deploy-dev.yaml

@@ -5,20 +5,27 @@ services:
   nginx:
     image: mathwave/sprint-repo:sprint-infra-nginx-dev
     networks:
-      - common-infra-nginx
+      - common-infra-nginx-development
+      - configurator
+    environment:
+      MINIO_SECRET_KEY: $MINIO_SECRET_KEY_DEV
     ports:
-      - "80:80"
-      - "443:443"
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
-        order: start-first
+        # order: stop-first
 
   postgres:
     image: postgres:14-alpine3.19
@@ -33,13 +40,15 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - "5432:5432"
+      - published: 5432
+        target: 5432
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -52,13 +61,15 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_DEV
     ports:
-      - "27017:27017"
+      - published: 27017
+        target: 27017
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first 
@@ -68,8 +79,12 @@ services:
     volumes:
       - /sprint-data/rabbitmq:/var/lib/rabbitmq
     ports:
-      - "5672:5672"
-      - "15672:15672"
+      - published: 5672
+        target: 5672
+        mode: host
+      - published: 15672
+        target: 15672
+        mode: host
     environment:
       RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_DEV
     deploy:
@@ -77,7 +92,7 @@ services:
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -87,14 +102,16 @@ services:
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - "6379:6379"
+      - published: 6379
+        target: 6379
+        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_DEV
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       update_config:
         parallelism: 1
         order: start-first
@@ -107,12 +124,16 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_DEV
     ports:
-      - "9000:9000"
-      - "9001:9001"
+      - published: 9000
+        target: 9000
+        mode: host
+      - published: 9001
+        target: 9001
+        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       restart_policy:
         condition: any
       update_config:
@@ -132,7 +153,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == development]
       restart_policy:
         condition: any
       update_config:
@@ -144,7 +165,7 @@ volumes:
     driver: local
 
 networks:
-  net:
-    driver: overlay
-  common-infra-nginx:
+  common-infra-nginx-development:
+    external: true
+  configurator:
     external: true

.deploy-infra/deploy-prod.yaml

@@ -7,18 +7,22 @@ services:
     networks:
       - common-infra-nginx
     ports:
-      - "80:80"
-      - "443:443"
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
     deploy:
       mode: replicated
       replicas: 1
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
-        order: start-first
+        # order: start-first
 
   postgres:
     image: postgres:14-alpine3.19
@@ -33,13 +37,15 @@ services:
       start_period: 20s
       timeout: 10s
     ports:
-      - "5432:5432"
+      - published: 5432
+        target: 5432
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first
@@ -57,13 +63,15 @@ services:
       MONGO_INITDB_ROOT_USERNAME: mongo
       MONGO_INITDB_ROOT_PASSWORD: $MONGO_PASSWORD_PROD
     ports:
-      - "27017:27017"
+      - published: 27017
+        target: 27017
+        mode: host
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first 
@@ -73,8 +81,12 @@ services:
     volumes:
       - /sprint-data/rabbitmq:/var/lib/rabbitmq
     ports:
-      - "5672:5672"
-      - "15672:15672"
+      - published: 5672
+        target: 5672
+        mode: host
+      - published: 15672
+        target: 15672
+        mode: host
     environment:
       RABBITMQ_DEFAULT_PASS: $RABBITMQ_PASSWORD_PROD
     deploy:
@@ -82,7 +94,7 @@ services:
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first
@@ -92,14 +104,16 @@ services:
     volumes:
       - /sprint-data/redis:/data
     ports:
-      - "6379:6379"
+      - published: 6379
+        target: 6379
+        mode: host
     command: redis-server --requirepass $REDIS_PASSWORD_PROD
     deploy:
       mode: replicated
       restart_policy:
         condition: any
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       update_config:
         parallelism: 1
         order: start-first
@@ -112,12 +126,16 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: $MINIO_PASSWORD_PROD
     ports:
-      - "9000:9000"
-      - "9001:9001"
+      - published: 9000
+        target: 9000
+        mode: host
+      - published: 9001
+        target: 9001
+        mode: host
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
@@ -144,7 +162,7 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
@@ -164,13 +182,42 @@ services:
     deploy:
       mode: replicated
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
       restart_policy:
         condition: any
       update_config:
         parallelism: 1
         order: start-first
 
+  keycloak:
+    image: quay.io/keycloak/keycloak
+    ports:
+      - "8443:3000"
+    environment:
+      KC_DB: postgres
+      KC_DB_URL: jdbc:postgresql://0.0.0.0:5432/keycloak
+      KC_DB_USERNAME: postgres
+      KC_DB_PASSWORD: $DB_PASSWORD_PROD
+      KC_HOSTNAME: keycloak.sprinthub.ru
+      JAVA_OPTS_KC_HEAP: "-XX:MaxHeapFreeRatio=50 -XX:MaxRAMPercentage=65"
+    command: start
+    deploy:
+      mode: replicated
+      placement:
+        constraints: [node.labels.stage == production]
+      restart_policy:
+        condition: any
+      update_config:
+        parallelism: 1
+        order: start-first
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 250M
+        reservations:
+          cpus: '0.50'
+          memory: 125M
+
 volumes:
   minio_data:
     driver: local

.deploy-nginx/deploy-dev.yaml

@@ -0,0 +1,29 @@
+version: "3.6"
+
+services:
+
+  nginx:
+    image: mathwave/sprint-repo:sprint-infra-nginx-dev
+    networks:
+      - common-infra-nginx-development
+    ports:
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == development]
+      update_config:
+        parallelism: 1
+        # order: stop-first
+
+networks:
+  common-infra-nginx-development:
+    external: true

.deploy-nginx/deploy-prod.yaml

@@ -0,0 +1,29 @@
+version: "3.6"
+
+services:
+
+  nginx:
+    image: mathwave/sprint-repo:sprint-infra-nginx-prod
+    networks:
+      - common-infra-nginx
+    ports:
+      - published: 80
+        target: 80
+        mode: host
+      - published: 443
+        target: 443
+        mode: host
+    deploy:
+      mode: replicated
+      replicas: 1
+      restart_policy:
+        condition: any
+      placement:
+        constraints: [node.labels.stage == production]
+      update_config:
+        parallelism: 1
+        # order: start-first
+
+networks:
+  common-infra-nginx:
+    external: true

.deploy-portainer/deploy-dev.yaml

@@ -1,39 +0,0 @@
-version: '3.2'
-
-services:
-  agent:
-    image: portainer/agent:2.11.1
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /var/lib/docker/volumes:/var/lib/docker/volumes
-    networks:
-      - agent_network
-    deploy:
-      mode: global
-      placement:
-        constraints: [node.platform.os == linux]
-
-  portainer:
-    image: portainer/portainer-ce:2.11.1
-    command: -H tcp://tasks.agent:9001 --tlsskipverify
-    ports:
-      - "9443:9443"
-      - "8888:9000"
-      - "8000:8000"
-    volumes:
-      - portainer_data:/data
-    networks:
-      - agent_network
-    deploy:
-      mode: replicated
-      replicas: 1
-      placement:
-        constraints: [node.role == manager]
-
-networks:
-  agent_network:
-    driver: overlay
-    attachable: true
-
-volumes:
-  portainer_data:

.deploy-portainer/deploy-prod.yaml

@@ -28,7 +28,7 @@ services:
       mode: replicated
       replicas: 1
       placement:
-        constraints: [node.role == manager]
+        constraints: [node.labels.stage == production]
 
 networks:
   agent_network:

.deploy-swarmpit/deploy-dev.yaml

@@ -1,83 +0,0 @@
-version: '3.3'
-
-services:
-  app:
-    image: swarmpit/swarmpit:latest
-    environment:
-      - SWARMPIT_DB=http://db:5984
-      - SWARMPIT_INFLUXDB=http://influxdb:8086
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080"]
-      interval: 60s
-      timeout: 10s
-      retries: 3
-    networks:
-      - net
-    ports:
-      - "888:8080"
-    deploy:
-      resources:
-        limits:
-          memory: 1024M
-        reservations:
-          memory: 512M
-      placement:
-        constraints:
-          - node.role == manager
-  db:
-    image: treehouses/couchdb:2.3.1
-    volumes:
-      - db-data:/opt/couchdb/data
-    networks:
-      - net
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-        reservations:
-          memory: 128M
-
-  influxdb:
-    image: influxdb:1.7
-    volumes:
-      - influx-data:/var/lib/influxdb
-    networks:
-      - net
-    deploy:
-      resources:
-        limits:
-          memory: 256M
-        reservations:
-          memory: 128M
-
-  agent:
-    image: swarmpit/agent:latest
-    environment:
-      - DOCKER_API_VERSION=1.35
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - net
-    deploy:
-      mode: global
-      labels:
-        swarmpit.agent: 'true'
-      resources:
-        limits:
-          memory: 64M
-        reservations:
-          memory: 32M
-
-networks:
-  net:
-    driver: overlay
-  swarmpit-nginx:
-    external: true
-
-volumes:
-  db-data:
-    driver: local
-  influx-data:
-    driver: local

.deploy-swarmpit/deploy-prod.yaml

@@ -24,12 +24,10 @@ services:
         reservations:
           memory: 512M
       placement:
-        constraints:
-          - node.role == manager
+        constraints: [node.labels.stage == production]
+
   db:
     image: treehouses/couchdb:2.3.1
-    volumes:
-      - db-data:/opt/couchdb/data
     networks:
       - net
     deploy:
@@ -41,8 +39,6 @@ services:
 
   influxdb:
     image: influxdb:1.7
-    volumes:
-      - influx-data:/var/lib/influxdb
     networks:
       - net
     deploy:
@@ -73,11 +69,3 @@ services:
 networks:
   net:
     driver: overlay
-  swarmpit-nginx:
-    external: true
-
-volumes:
-  db-data:
-    driver: local
-  influx-data:
-    driver: local

.gitea/workflows/deploy-dev.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -23,15 +23,15 @@ jobs:
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     needs: build
     steps:
       - name: push nginx dev
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-dev
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
-  deploy-dev:
-    name: Deploy dev
+  prepare:
+    name: prepare
     runs-on: [dev]
     needs: push
     steps:
@@ -41,16 +41,26 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: dev
-      - name: deploy swarmpit
-        run: docker stack deploy --with-registry-auth -c ./.deploy-swarmpit/deploy-dev.yaml swarmpit
-      - name: deploy portainer
-        run: docker stack deploy --with-registry-auth -c ./.deploy-portainer/deploy-dev.yaml portainer
+      - name: prepare
+        run: chmod 777 ./prepare/run-development.sh && ./prepare/run-development.sh
+  deploy-dev:
+    name: Deploy dev
+    runs-on: [prod]
+    needs: prepare
+    steps:
+      - name: login
+        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: dev
       - name: deploy infra
         env:
           MONGO_PASSWORD_DEV: ${{ secrets.MONGO_PASSWORD_DEV }}
           DB_PASSWORD_DEV: ${{ secrets.POSTGRES_PASSWORD_DEV }}
           MINIO_PASSWORD_DEV: ${{ secrets.MINIO_PASSWORD_DEV }}
+          MINIO_SECRET_KEY_DEV: ${{ secrets.MINIO_SECRET_KEY_DEV }}
           REDIS_PASSWORD_DEV: ${{ secrets.REDIS_PASSWORD_DEV }}
           RABBITMQ_PASSWORD_DEV: ${{ secrets.RABBITMQ_PASSWORD_DEV }}
           REGISTRATION_TOKEN: ${{ secrets.REGISTRATION_TOKEN }}
-        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra
+        run: docker stack deploy --with-registry-auth -c ./.deploy-infra/deploy-dev.yaml infra-development

.gitea/workflows/deploy-prod.yaml

@@ -9,7 +9,7 @@ on:
 jobs:
   build:
     name: Build
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     steps:
       - name: login
         run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -23,13 +23,26 @@ jobs:
         run: docker build -t mathwave/sprint-repo:gitea-runner gitea-runner
   push:
     name: Push
-    runs-on: [ dev ]
+    runs-on: [ prod ]
     needs: build
     steps:
       - name: push nginx prod
         run: docker push mathwave/sprint-repo:sprint-infra-nginx-prod
       - name: push gitea runner
         run: docker push mathwave/sprint-repo:gitea-runner
+  prepare:
+    name: prepare
+    runs-on: [prod]
+    needs: push
+    steps:
+      - name: login
+        run: docker login -u mathwave -p ${{ secrets.DOCKERHUB_PASSWORD }}
+      - name: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: dev
+      - name: prepare
+        run: chmod 777 ./prepare/run-production.sh && ./prepare/run-production.sh
   deploy-prod:
     name: Deploy prod
     runs-on: [prod]

gitlab-runner/Dockerfile

@@ -1,14 +0,0 @@
-FROM gitlab/gitlab-runner
-
-
-RUN apt-get update
-RUN apt-get install --yes ca-certificates curl gnupg lsb-release
-RUN mkdir -p /etc/apt/keyrings
-RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-RUN echo \
-  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
-  $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
-RUN apt-get update --yes
-RUN apt-get install --yes docker-ce docker-ce-cli containerd.io docker-compose-plugin
-RUN mkdir /etc/builds/
-RUN chmod 777 /etc/builds

nginx/nginx-dev/Dockerfile

@@ -1,4 +1,11 @@
 FROM nginx
+RUN apt-get update
+RUN apt-get install certbot --yes
+RUN apt-get install python3-certbot-nginx python3-pip --yes
+RUN pip3 install --break-system-packages requests minio
 COPY ./config /etc/nginx
-COPY ./privkey.pem /etc/nginx/privkey.pem
-COPY ./fullchain.pem /etc/nginx/fullchain.pem
+COPY prepare.py prepare.py
+COPY run.sh run.sh
+ENV PYTHONUNBUFFERED=1
+RUN chmod 777 run.sh
+ENTRYPOINT ["./run.sh"]

nginx/nginx-dev/config/guavo.conf

@@ -1,162 +0,0 @@
-
-    # server {
-    #     listen 80;
-    #     server_name *.develop.guavo.tech;
-    #     return 301 https://$host$request_uri;
-    # }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name swarmpit.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:888/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name portainer.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:8888/;
-        }
-
-        location /api/websocket/ {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.guavo.tech:8888/api/websocket/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name rabbitmq.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:15672/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name minio.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:9001/;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name grafana.develop.guavo.tech;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        proxy_set_header Host $http_host;
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-
-        location / {
-            proxy_pass http://develop.guavo.tech:3000/;
-        }
-
-        location /api/live/ws {
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection $connection_upgrade;
-            proxy_set_header Host $host;
-            proxy_pass http://develop.guavo.tech:3000/api/live/ws;
-        }
-    }
-
-    server {
-        listen      443 ssl http2;
-        listen      [::]:443 ssl http2;
-        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        ssl_certificate     /etc/nginx/fullchain.pem;
-        ssl_certificate_key /etc/nginx/privkey.pem;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header        X-Real-IP       $remote_addr;
-
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }
-
-    server {
-        listen      80;
-        server_name ~^(?<domain>.*)\.develop\.guavo\.tech$;
-
-        resolver 127.0.0.11 ipv6=off;
-
-        add_header X-Frame-Options "SAMEORIGIN" always;
-        add_header X-XSS-Protection "1; mode=block" always;
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Referrer-Policy "no-refferer-when-downgrade" always;
-        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
-        proxy_set_header Host            $host;
-        proxy_set_header X-Forwarded-For $remote_addr;
-        proxy_set_header        X-Real-IP       $remote_addr;
-
-        location / {
-            proxy_pass http://$domain-nginx:1238$request_uri;
-        }
-    }

nginx/nginx-dev/config/nginx.conf

@@ -8,6 +8,6 @@ http {
         '' close;
     }
     
-    include ./guavo.conf;
+    include ./hosts.conf;
     include ./sprinthub.conf;
 }

nginx/nginx-dev/fullchain.pem

@@ -1,58 +1,48 @@
 -----BEGIN CERTIFICATE-----
-MIIE+zCCA+OgAwIBAgISA1gLQJEHOf44GcYLUSr2vDoDMA0GCSqGSIb3DQEBCwUA
-MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
-EwNSMTEwHhcNMjQwODE4MTcwNTE0WhcNMjQxMTE2MTcwNTEzWjAhMR8wHQYDVQQD
-DBYqLmRldmVsb3Auc3ByaW50aHViLnJ1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAu5dE0JYsLqqYrqulQkDeApuAPp5ckTFbg72UhSrfo2SbbP0S2//P
-75hvn4aUAsPPWsUk8PDYQn8tOd0/1TrLMmh8xhJxTUUcO3fgP0mbgiYsQep/z5LU
-BgzGC5R2zQhl4O+SdYlCC56zz1GHNK+IWhXgaLz0dnaKXEIpsVnu2r9THEFAoXRx
-j2J64WwdDSC63Qqs2juvMsU9zizYpOnQr6wxIYNIe+jnUJoGeg84gYz7RMzmEYQh
-9Ut36apABFt7vyo9YXKPA7X9GLGHiWBkisxhtXhyg27aHwYF8E9+C98qczbbBenG
-CqFcfAlYNaje8a1yOan/zFUWShOqDVS8gQIDAQABo4ICGTCCAhUwDgYDVR0PAQH/
-BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8E
-AjAAMB0GA1UdDgQWBBSYER0/itBzQ4e89Jz45eNBs2IHtDAfBgNVHSMEGDAWgBTF
-z0ak6vTDwHpslcQtsF6SLybjuTBXBggrBgEFBQcBAQRLMEkwIgYIKwYBBQUHMAGG
-Fmh0dHA6Ly9yMTEuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6Ly9yMTEu
-aS5sZW5jci5vcmcvMCEGA1UdEQQaMBiCFiouZGV2ZWxvcC5zcHJpbnRodWIucnUw
-EwYDVR0gBAwwCjAIBgZngQwBAgEwggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgAZ
-mBBxCfDWUi4wgNKeP2S7g24ozPkPUo7u385KPxa0ygAAAZFmqM41AAAEAwBHMEUC
-ICafD/B6cYgX6M7zYU0SaMx8mfJZiqvuGWGU15Xk+1ntAiEA86dLxeYXXRVDXU56
-4+fgStSswCsjvaHvzX2nND1f95EAdQB2/4g/Crb7lVHCYcz1h7o0tKTNuyncaEIK
-n+ZnTFo6dAAAAZFmqM59AAAEAwBGMEQCIB/YExYTmuWxHl2kxLy+NO3txOaobvIZ
-pxkV69p4Yrg6AiB0PGckYcU3+eqiTyPKV21T/tXu2Sl6FTGn14991RqCxjANBgkq
-hkiG9w0BAQsFAAOCAQEAVdTUq5zdSfk7060jhQ5KeIzOjsX/A59psnT3YD+5SSJ+
-K4NFSG2MYGt32W+CcEglCF9PiPAq0++61TL9KTAlREwmReRRvhhwd6tHd/2hL9FN
-bIy34fXtd173FiFs2cmq70bChyNlnZHdgMEccfuqoamuwFnySqFFeUIPC36eD0XD
-+5FBgleiaEM2OL8ZelGj7wil4I8a5XT7U/Kzl3HXy94mHXHqf4d0tiJnAsrLhfvy
-Yl+5gXOMXvL5qZdQC0FR9mVQQF9oClRxsdDp681cJIM63b2KazEN1NhJP/rfn1ZO
-v9QdRNWZEIEp8dvYDoNNxwy5ibUcvdGOV1Mm0NVORQ==
+MIIDmTCCAx+gAwIBAgISBmM6pAg0qa3+cxLar5nvn27GMAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NTAeFw0yNTA1MzAyMTEzMjZaFw0yNTA4MjgyMTEzMjVaMCExHzAdBgNVBAMMFiou
+ZGV2ZWxvcC5zcHJpbnRodWIucnUwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATy
+YXxx4cfN6ga0duaq7STjZxNwtFQ7c0ZAO+D7ulmdf/jpK8Xfkj5d0KMX0jhTmTEg
+DUwvBMsH/fpyuuEdHNPWo4ICJDCCAiAwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT1
+FLWsp0ksteuVXXd3pZokXOhj2DAfBgNVHSMEGDAWgBSfK1/PPCFPnQS37SssxMZw
+i9LXDTAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly9lNS5pLmxl
+bmNyLm9yZy8wIQYDVR0RBBowGIIWKi5kZXZlbG9wLnNwcmludGh1Yi5ydTATBgNV
+HSAEDDAKMAgGBmeBDAECATAtBgNVHR8EJjAkMCKgIKAehhxodHRwOi8vZTUuYy5s
+ZW5jci5vcmcvNzEuY3JsMIIBBAYKKwYBBAHWeQIEAgSB9QSB8gDwAHYAEvFONL1T
+ckyEBhnDjz96E/jntWKHiJxtMAWE6+WGJjoAAAGXI0B2OwAABAMARzBFAiBcMmQQ
+PiKhuqhi3fs4yL6lfnQdZ1VlJTBifu8T6t4H3QIhAL/BdDUOafC+9nrlP7USrlCT
+Oo1TA5JG/Yvxk5a/Oe1yAHYA7TxL1ugGwqSiAFfbyyTiOAHfUS/txIbFcA8g3bc+
+P+AAAAGXI0CF1gAABAMARzBFAiAHI0Z170KObyMHOQM6w/GhsazTzUpBilyQnv/b
+Wr+kdwIhALS4DQNUNfiJoea0wszwoTxcnowGI7Whx8qH4Ut6st88MAoGCCqGSM49
+BAMDA2gAMGUCMGdO7CfUNB8wcMaHtED7/dy2ojOtofMze0kN0rzt2I/On55Ce84K
+ZJ0Uj+Bcv/66qwIxAJ9YJTSJ1+owoICDbJekE+ejgzA+GgU2Z+RviZUTNXIdbWbX
+etMXbXfP7WJPjxZ+ng==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIFBjCCAu6gAwIBAgIRAIp9PhPWLzDvI4a9KQdrNPgwDQYJKoZIhvcNAQELBQAw
+MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
 TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
 cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
-WhcNMjcwMzEyMjM1OTU5WjAzMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
-RW5jcnlwdDEMMAoGA1UEAxMDUjExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
-CgKCAQEAuoe8XBsAOcvKCs3UZxD5ATylTqVhyybKUvsVAbe5KPUoHu0nsyQYOWcJ
-DAjs4DqwO3cOvfPlOVRBDE6uQdaZdN5R2+97/1i9qLcT9t4x1fJyyXJqC4N0lZxG
-AGQUmfOx2SLZzaiSqhwmej/+71gFewiVgdtxD4774zEJuwm+UE1fj5F2PVqdnoPy
-6cRms+EGZkNIGIBloDcYmpuEMpexsr3E+BUAnSeI++JjF5ZsmydnS8TbKF5pwnnw
-SVzgJFDhxLyhBax7QG0AtMJBP6dYuC/FXJuluwme8f7rsIU5/agK70XEeOtlKsLP
-Xzze41xNG/cLJyuqC0J3U095ah2H2QIDAQABo4H4MIH1MA4GA1UdDwEB/wQEAwIB
-hjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwEgYDVR0TAQH/BAgwBgEB
-/wIBADAdBgNVHQ4EFgQUxc9GpOr0w8B6bJXELbBeki8m47kwHwYDVR0jBBgwFoAU
-ebRZ5nu25eQBc4AIiMgaWPbpm24wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAC
-hhZodHRwOi8veDEuaS5sZW5jci5vcmcvMBMGA1UdIAQMMAowCAYGZ4EMAQIBMCcG
-A1UdHwQgMB4wHKAaoBiGFmh0dHA6Ly94MS5jLmxlbmNyLm9yZy8wDQYJKoZIhvcN
-AQELBQADggIBAE7iiV0KAxyQOND1H/lxXPjDj7I3iHpvsCUf7b632IYGjukJhM1y
-v4Hz/MrPU0jtvfZpQtSlET41yBOykh0FX+ou1Nj4ScOt9ZmWnO8m2OG0JAtIIE38
-01S0qcYhyOE2G/93ZCkXufBL713qzXnQv5C/viOykNpKqUgxdKlEC+Hi9i2DcaR1
-e9KUwQUZRhy5j/PEdEglKg3l9dtD4tuTm7kZtB8v32oOjzHTYw+7KdzdZiw/sBtn
-UfhBPORNuay4pJxmY/WrhSMdzFO2q3Gu3MUBcdo27goYKjL9CTF8j/Zz55yctUoV
-aneCWs/ajUX+HypkBTA+c8LGDLnWO2NKq0YD/pnARkAnYGPfUDoHR9gVSp/qRx+Z
-WghiDLZsMwhN1zjtSC0uBWiugF3vTNzYIEFfaPG7Ws3jDrAMMYebQ95JQ+HIBD/R
-PBuHRTBpqKlyDnkSHDHYPiNX3adPoPAcgdF3H2/W0rmoswMWgTlLn1Wu0mrks7/q
-pdWfS6PJ1jty80r2VKsM/Dj3YIDfbjXKdaFU5C+8bhfJGqU3taKauuz0wHVGT3eo
-6FlWkWYtbt4pgdamlwVeZEW+LM7qZEJEsMNPrfC03APKmZsJgpWCDWOKZvkZcvjV
-uYkQ4omYCTX5ohy+knMjdOmdH9c7SpqEWBDC86fiNex+O0XOMEZSa8DA
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
+a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
+VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
+i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
+2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
+bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
+6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
+XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
+koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
+cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
+E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
+K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
+GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
+sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
+VQD9F6Na/+zmXCc=
 -----END CERTIFICATE-----

nginx/nginx-dev/prepare.py

@@ -0,0 +1,47 @@
+from requests import get
+import os
+from minio import Minio
+
+
+minio_client = Minio(
+    "minio.develop.sprinthub.ru:9000",
+    access_key="serviceminioadmin",
+    secret_key=os.getenv("MINIO_SECRET_KEY", "minioadmin"),
+    secure=False
+)
+
+
+hosts = get('http://configurator/api/v1/fetch?project=certupdater&stage=development').json()['configs']['hosts']
+hosts = list(set(hosts + ['platform.develop.sprinthub.ru']))
+
+config = ''
+for host in hosts:
+    config += '''
+        server {{
+            listen      443 ssl http2;
+            listen      [::]:443 ssl http2;
+            server_name {host};
+
+            ssl_certificate     /etc/nginx/{host}/fullchain.pem;
+            ssl_certificate_key /etc/nginx/{host}/privkey.pem;
+
+            add_header X-Frame-Options "SAMEORIGIN" always;
+            add_header X-XSS-Protection "1; mode=block" always;
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Referrer-Policy "no-refferer-when-downgrade" always;
+            add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+            location / {{
+                proxy_pass http://{pre_domain}-nginx:1238$request_uri;
+            }}
+        }}\n\n
+    '''.format(host=host, pre_domain=host.split('.')[0])
+    fullchain = minio_client.get_object("certupdater", f'certificates/{host}/fullchain.pem')
+    privkey = minio_client.get_object("certupdater", f'certificates/{host}/privkey.pem')
+    with open(f"/etc/nginx/{host}/fullchain.pem", 'wb') as fp:
+        fp.write(fullchain.data)
+    with open(f"/etc/nginx/{host}/privkey.pem", 'wb') as fp:
+        fp.write(privkey.data)
+
+with open('/etc/nginx/hosts.conf', 'w') as fp:
+    fp.write(config)

nginx/nginx-dev/privkey.pem

@@ -1,28 +1,5 @@
------BEGIN PRIVATE KEY-----
-MIIEwAIBADANBgkqhkiG9w0BAQEFAASCBKowggSmAgEAAoIBAQC7l0TQliwuqpiu
-q6VCQN4Cm4A+nlyRMVuDvZSFKt+jZJts/RLb/8/vmG+fhpQCw89axSTw8NhCfy05
-3T/VOssyaHzGEnFNRRw7d+A/SZuCJixB6n/PktQGDMYLlHbNCGXg75J1iUILnrPP
-UYc0r4haFeBovPR2dopcQimxWe7av1McQUChdHGPYnrhbB0NILrdCqzaO68yxT3O
-LNik6dCvrDEhg0h76OdQmgZ6DziBjPtEzOYRhCH1S3fpqkAEW3u/Kj1hco8Dtf0Y
-sYeJYGSKzGG1eHKDbtofBgXwT34L3ypzNtsF6cYKoVx8CVg1qN7xrXI5qf/MVRZK
-E6oNVLyBAgMBAAECggEBAKEV26TWX+hO3D+Z65ZCB6Lrjyu2ZzzSyogNQr07vMEd
-Qo5Ln2dFe3R+TNQLB4x8QtHqWrd/yeUIOnjm8cqT6ytFKGgaLCszPnQek3UlKyGO
-0BBmYwyHRARR8bq96WpVXM7USssda5Z42GUd2GG4nfjlskeegro7PsLMmerOlFpH
-2aYY/KTb6M45qSwZboFvg+s6bGFXjYafZ+Mktj+iJBLuNvxI0Hj6R5aX8XB3Ef68
-BiZA12z/jnzERm9zRiLmnGK0xdSRXVyNbeDcP4f8qlqk5N5ga0yxnJpEyTYzfGXy
-820TwpFh8G2AKdanbhAGKtI2vGPpO146dUaJdhYGxGUCgYEA66h58ttJKrAR0AP5
-+pU0yLo5myOBuRoBDn1k5+ppExqPi1bOQSebnkRRLpWuY1NfanFr3nbDjMi2FI8P
-VYTf5AECQQvvwXrbsRl0mFBlL4Q8r4yxTLTUBOvEQX63SyYvUwbsmYQSFuIOvr5L
-BV31UMR5CEuBGCCYUm6kZV6HeJsCgYEAy8ic9qwDxoYSdq5J9dbqtPjn5cIwpLhd
-o/0OJrkEptU8oIDyey/X5vlDV/FLfdsChjiMFjY661tOgXuTvDGTDzI51U6meKk7
-ogLpuURFVJIvWhPBilL+HvPY/oiZjmRyGgvlvpDPjAsWo155WqMrWPh4lfhXjY3z
-p5lofNB6axMCgYEAyjTT/ujeTTyq7BydYMCqfBoe19mNs/B2O6Ko9L6UzomZ5evk
-Ks/7nb/tENXqvtuJIeKUtlydyq1mXxmqBK1xF0kuT/YYEaKD4+B9xTwmtrD3CYLl
-l3YJ/vb2fWRnjpoDPXDRj6BdjTkHge/ym3ZVyqnrWIzBBpzhVsoNUdXc1EUCgYEA
-wniKQmTZnYSo7hVZg4A7r8SxGPP+k9NVmX+PF6kNJWDtYIZt4N1Bfqx1deFRl6N/
-fzNLjI7oH16dRrf1vmzY2HGn+0X5W8C0peF9xk2+k/yFr8KWujiFRmiStiUJ1XdJ
-5E1iTD/JsO2MBw/LY5G/dkJ4YTYD55SF53Vg32vcx30CgYEAog3coA0caJ8uAA5K
-UzcQ/vlX5twEt/DRBnrBbGtV/x4y36hRucahIDyTLEyCA9G0TFgQKMEUdUVkoLvQ
-cgtLLq340NYN+jFdpFDwAVSBi2Z3NVyh2rX5Q2saYzpOxVaaEe06dOC8Bl6le1EC
-cLTZ2YqFcCrRLrzy/hhKO7HImt4=
------END PRIVATE KEY-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIPtfut2MheT8iyX6/EXDHHDR9yvtYLxMUg34mLeCpngpoAoGCCqGSM49
+AwEHoUQDQgAE8mF8ceHHzeoGtHbmqu0k42cTcLRUO3NGQDvg+7pZnX/46SvF35I+
+XdCjF9I4U5kxIA1MLwTLB/36crrhHRzT1g==
+-----END EC PRIVATE KEY-----

nginx/nginx-dev/run.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+python3 prepare.py
+/docker-entrypoint.sh nginx -g daemon off;

nginx/nginx-prod/fullchain.pem

@@ -1,58 +1,47 @@
 -----BEGIN CERTIFICATE-----
-MIIE7TCCA9WgAwIBAgISBDL/ZyXlpK88JpU+aNYTYbZcMA0GCSqGSIb3DQEBCwUA
-MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
-EwNSMTAwHhcNMjQwODE4MTczMDAxWhcNMjQxMTE2MTczMDAwWjAZMRcwFQYDVQQD
-DA4qLnNwcmludGh1Yi5ydTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
-AKwZZehw3dlvH5AvVfnaybqjB5K3YixMDkE3ygHvPL1d7c3QzmuIsPkpSQOt+fEY
-ERQEcXype1tmT6jmZs+WdP8ASXDW7V8pHrYBffZ5Hoxc6vydr/ArZJWblfm+bYaA
-68ZRj9sv1cGK0dk34v4QYa8EqQRezxFRT0lvfB2vyfZ/4xQ/ZPDzVjivUcWoWrC5
-+4WTg6e4ZtKQXiXBHS1z/FGhmTbudXXU9zi2Hyq+eEPwtU7hIZLtyAzc2TWJVHfw
-YJQMlSklpOMvKDSbgEW6LNsQcwYFJ/1MvX3C7TZX/uNuwssi5cMKmhecDf7g5pK4
-EqJnNFYZ9lZ0ofNFSj6qVu0CAwEAAaOCAhMwggIPMA4GA1UdDwEB/wQEAwIFoDAd
-BgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNV
-HQ4EFgQU9g2CK2s4AK0F9lDh/iDOAgl9GJQwHwYDVR0jBBgwFoAUu7zDR6XkvKnG
-w6RyDBCNojXhyOgwVwYIKwYBBQUHAQEESzBJMCIGCCsGAQUFBzABhhZodHRwOi8v
-cjEwLm8ubGVuY3Iub3JnMCMGCCsGAQUFBzAChhdodHRwOi8vcjEwLmkubGVuY3Iu
-b3JnLzAZBgNVHREEEjAQgg4qLnNwcmludGh1Yi5ydTATBgNVHSAEDDAKMAgGBmeB
-DAECATCCAQUGCisGAQQB1nkCBAIEgfYEgfMA8QB2AD8XS0/XIkdYlB1lHIS+DRLt
-kDd/H4Vq68G/KIXs+GRuAAABkWa/gHgAAAQDAEcwRQIhAOSEdIX9kjdYohZb942J
-dk5pUAYQl68bIBwIvHQF6Ru1AiAzNtoqdj11Uy4+lr0TbU8SE2tBgTGDxZRksCpC
-Kt83wQB3AHb/iD8KtvuVUcJhzPWHujS0pM27KdxoQgqf5mdMWjp0AAABkWa/iHcA
-AAQDAEgwRgIhAPzli2g23TY0uFoU6LMrlqe3CPBWC8BWq/rnfOm/cOaJAiEAoefO
-g0i2LU8pUqkurW34EfXEQQUqSjy3ze8c9FKPUnYwDQYJKoZIhvcNAQELBQADggEB
-AMUvd2yvRsrp4iZk9rTd87Zjv0nWkAunwirx1jNhzRvP/vKGh1Zn1GPohr7TQQZ5
-EkJK+4w1+uq5ZrDrI3t+SKx15sv4iAJu7EAh6z0/oGkb27LlduXVSQ4hs5o/E4cL
-wdRONWKrKIchcM9vblicKOxFxCKUOXPMxH8YSDkkWK8KhCvE1sSzm0DzeRQVOwuK
-aWMJXoEF0pY6lOVGiGIxtozY3Q5IooBDX+bwDEq/SkwY38yig2NszpTwJKmVIV+E
-DjBoRHWoYYtEL1y2rh/OonQBGxSCUYSIrG3+BdqWwLL9LmgZk+A2X5Qa09aZQvnc
-hsfvAxxU+C7lArtjpA/pWYk=
+MIIDhzCCAw6gAwIBAgISBXELtGOqEI5IsXNFUC7cue03MAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NTAeFw0yNTA1MzAyMTQ3MzZaFw0yNTA4MjgyMTQ3MzVaMBkxFzAVBgNVBAMMDiou
+c3ByaW50aHViLnJ1MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoS3M+thgeup/
+F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9azdDRAp+c2OlzJqJQC+ZefswCB
+2xvjNSoL2aOCAhswggIXMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAUBggrBgEF
+BQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUu+3qfzUyaCAb
+POu7GPUO6ZI2WfswHwYDVR0jBBgwFoAUnytfzzwhT50Et+0rLMTGcIvS1w0wMgYI
+KwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTUuaS5sZW5jci5vcmcv
+MBkGA1UdEQQSMBCCDiouc3ByaW50aHViLnJ1MBMGA1UdIAQMMAowCAYGZ4EMAQIB
+MC0GA1UdHwQmMCQwIqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy81Ni5jcmww
+ggEDBgorBgEEAdZ5AgQCBIH0BIHxAO8AdgDd3Mo0ldfhFgXnlTL6x5/4PRxQ39sA
+OhQSdgosrLvIKgAAAZcjX78RAAAEAwBHMEUCIDNC6e7jNcTXW1bti1nkseruXw84
+b8dsVzBt96FtE4+aAiEAr7ugvtozhmp6JdkIEfdHKecym9TxcL1h43j6rbKU3d8A
+dQAaBP9J0FQdQK/2oMO/8djEZy9O7O4jQGiYaxdALtyJfQAAAZcjX8BoAAAEAwBG
+MEQCIDezeAIFZ25OWXVV9hmtzEE5ujP0IyFaLxebyXAflYZMAiAy09hFLQXapebE
+5YDtvqfmefapEsr4OaWyfusWjmeaiDAKBggqhkjOPQQDAwNnADBkAjAobO18Vk18
+BG7lBbXEQ0O8RYy+CEV/ef1ni2CBQp+MtmG/ZCWAbfEXFaj2WKng5Q0CMFRR9icx
+p6/tLUixnJfAusGudEtD5Leh2foPDT2jzgazaROaVFVTrCJMGcdgVukuPQ==
 -----END CERTIFICATE-----
 -----BEGIN CERTIFICATE-----
-MIIFBTCCAu2gAwIBAgIQS6hSk/eaL6JzBkuoBI110DANBgkqhkiG9w0BAQsFADBP
-MQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFy
-Y2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTAeFw0yNDAzMTMwMDAwMDBa
-Fw0yNzAzMTIyMzU5NTlaMDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBF
-bmNyeXB0MQwwCgYDVQQDEwNSMTAwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
-AoIBAQDPV+XmxFQS7bRH/sknWHZGUCiMHT6I3wWd1bUYKb3dtVq/+vbOo76vACFL
-YlpaPAEvxVgD9on/jhFD68G14BQHlo9vH9fnuoE5CXVlt8KvGFs3Jijno/QHK20a
-/6tYvJWuQP/py1fEtVt/eA0YYbwX51TGu0mRzW4Y0YCF7qZlNrx06rxQTOr8IfM4
-FpOUurDTazgGzRYSespSdcitdrLCnF2YRVxvYXvGLe48E1KGAdlX5jgc3421H5KR
-mudKHMxFqHJV8LDmowfs/acbZp4/SItxhHFYyTr6717yW0QrPHTnj7JHwQdqzZq3
-DZb3EoEmUVQK7GH29/Xi8orIlQ2NAgMBAAGjgfgwgfUwDgYDVR0PAQH/BAQDAgGG
-MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATASBgNVHRMBAf8ECDAGAQH/
-AgEAMB0GA1UdDgQWBBS7vMNHpeS8qcbDpHIMEI2iNeHI6DAfBgNVHSMEGDAWgBR5
-tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcBAQQmMCQwIgYIKwYBBQUHMAKG
-Fmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0gBAwwCjAIBgZngQwBAgEwJwYD
-VR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVuY3Iub3JnLzANBgkqhkiG9w0B
-AQsFAAOCAgEAkrHnQTfreZ2B5s3iJeE6IOmQRJWjgVzPw139vaBw1bGWKCIL0vIo
-zwzn1OZDjCQiHcFCktEJr59L9MhwTyAWsVrdAfYf+B9haxQnsHKNY67u4s5Lzzfd
-u6PUzeetUK29v+PsPmI2cJkxp+iN3epi4hKu9ZzUPSwMqtCceb7qPVxEbpYxY1p9
-1n5PJKBLBX9eb9LU6l8zSxPWV7bK3lG4XaMJgnT9x3ies7msFtpKK5bDtotij/l0
-GaKeA97pb5uwD9KgWvaFXMIEt8jVTjLEvwRdvCn294GPDF08U8lAkIv7tghluaQh
-1QnlE4SEN4LOECj8dsIGJXpGUk3aU3KkJz9icKy+aUgA+2cP21uh6NcDIS3XyfaZ
-QjmDQ993ChII8SXWupQZVBiIpcWO4RqZk3lr7Bz5MUCwzDIA359e57SSq5CCkY0N
-4B6Vulk7LktfwrdGNVI5BsC9qqxSwSKgRJeZ9wygIaehbHFHFhcBaMDKpiZlBHyz
-rsnnlFXCb5s8HKn5LsUgGvB24L7sGNZP2CX7dhHov+YhD+jozLW2p9W4959Bz2Ei
-RmqDtmiXLnzqTpXbI+suyCsohKRg6Un0RC47+cpiVwHiXZAW+cn8eiNIjqbVgXLx
-KPpdzvvtTnOPlC7SQZSYmdunr3Bf9b77AiC/ZidstK36dRILKz7OA54=
+MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
+a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
+VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
+i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
+2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
+bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
+6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
+XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
+koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
+cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
+E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
+K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
+GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
+sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
+VQD9F6Na/+zmXCc=
 -----END CERTIFICATE-----

nginx/nginx-prod/nginx-prod.conf

@@ -164,6 +164,25 @@ http {
         }
     }
 
+    server {
+        listen      443 ssl http2;
+        listen      [::]:443 ssl http2;
+        server_name keycloak.sprinthub.ru;
+
+        ssl_certificate     /etc/nginx/fullchain.pem;
+        ssl_certificate_key /etc/nginx/privkey.pem;
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-refferer-when-downgrade" always;
+        add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
+
+        location / {
+            proxy_pass http://dev.sprinthub.ru:8443/;
+        }
+    }
+
     server {
         listen      443 ssl http2;
         listen      [::]:443 ssl http2;

nginx/nginx-prod/privkey.pem

@@ -1,28 +1,5 @@
------BEGIN PRIVATE KEY-----
-MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCsGWXocN3Zbx+Q
-L1X52sm6oweSt2IsTA5BN8oB7zy9Xe3N0M5riLD5KUkDrfnxGBEUBHF8qXtbZk+o
-5mbPlnT/AElw1u1fKR62AX32eR6MXOr8na/wK2SVm5X5vm2GgOvGUY/bL9XBitHZ
-N+L+EGGvBKkEXs8RUU9Jb3wdr8n2f+MUP2Tw81Y4r1HFqFqwufuFk4OnuGbSkF4l
-wR0tc/xRoZk27nV11Pc4th8qvnhD8LVO4SGS7cgM3Nk1iVR38GCUDJUpJaTjLyg0
-m4BFuizbEHMGBSf9TL19wu02V/7jbsLLIuXDCpoXnA3+4OaSuBKiZzRWGfZWdKHz
-RUo+qlbtAgMBAAECggEAUfpfMtPguZxXWqVRvQzdHwxdpSO5ngQ0nhhnH3jIZCQE
-DRAz48FfG7Dw2NHcx12BdRmQvaM14ZngxEHMI4I2BOosEZYvyC6cNHKNgAS96nqw
-bNjoX+0roqBUVnzBS1rJ9NQRRIWKuwDXaTNX61H+VhJQOIa4+DTVIdP7OWDtQX9t
-DyQM/vvGM0gHmUKvd15n8iU5obxMZm+2ntUYe38dSCKANuVgmT/+/mJHt7SWYXuD
-PAQX5IWVK2sMT+snPTW7ERXwOwHn4Sl57Juqz4lOGKYAsveFqi0F1UNyQ61ggjXU
-I17bSHONBxK1MPYKQyjiVGvMylpyTd0RWAUSUs3yQQKBgQDkKuKG+4ndxkxIpe/6
-ENkP2cvlhkO2BdQKfYsw20pxIZqOVwlatZ0OlFMkFJFWhIRP+aYi0+69THOpV1Dk
-E33+438fxBJLAZXUY5PJs47JBLq/bUCWgblshe3QAW3gZLbDb3+i0CI7YA7b6Vo4
-Rf0mkyjo10VmpjK9x7hvbtMfCQKBgQDBF6L+5jwlOHUV8FHRO2AlrRUMNHcEt3JN
-JDgoxPidHq1gYHsDC+tp2C+x1z5zSruOfIQPt0JnED+H+0l8gnPKMFbdrgJBExGq
-4z0FQIqysVE+8kPh6ikOMrec6RSHsW1e+y0v1Mn7zHb4a+6JfIukjsqPm07wSWFe
-9DXlGKANxQKBgQCok/rcalq5Tbqs7lU4+Fu3t15LjgDXKsU4nvtJNKxym7ZatnnF
-2GtbC0HGZZ/gQXaUtEoIb3dzy1mlY0rzyGcN/L2/FZnCa0BtNMlLfGvhn6nup2TS
-DrSWNvm29mddJGxYRzgRbh/sqJMx7d5nt2ZLquzN48d2CRNyXm6pfkNkKQKBgAur
-mw1e6vmw7NqzmK5VsVz1lhUTwrHFSKJC8yX7qa8NYJs3mZe4i7Ts/Qz5nmunc6iL
-/AtbHydNgxl75Zgh5k+tFkL1tmsqdOHoNBLyMK/WKbvtNo8b8PlLtW9FYxlEbwDT
-m4qNiNuwIuym0Vb78RC0FKgTUfUR6lGr3uoGz/2lAoGBANQrHCOr+2eOZawiWlQ3
-jPJQVRwzpPHPGnElcGJBMcA03UQCO/HXSJl/V5OGZjVH4zZ3iRInYvq4NR+KeQC8
-VXU4AWS9QIyx7UAGO8eDzENz6JG4Q1txkPsGIipvROdCCWFqaudyxRuWnKsXEwYn
-RGyseajshyNkpwLoMk2gx67+
------END PRIVATE KEY-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIL0TAduonJLmbcDpRxDjSfa8bMIqLOh1KQcGQvAeQTIQoAoGCCqGSM49
+AwEHoUQDQgAEoS3M+thgeup/F6JS7kVNJCWee8xzLkoIUcZNgNqmoovVSP02K9az
+dDRAp+c2OlzJqJQC+ZefswCB2xvjNSoL2Q==
+-----END EC PRIVATE KEY-----

prepare/run-development.sh

@@ -0,0 +1,9 @@
+docker login -u mathwave -p $DOCKERHUB_PASSWORD
+mkdir /sprint-data/mongo || true
+mkdir /sprint-data/redis || true
+mkdir /sprint-data/rabbitmq || true
+mkdir /sprint-data/certs || true
+mkdir /sprint-data/gitea || true
+chmod 777 /sprint-data/redis
+chmod 777 /sprint-data/rabbitmq
+chmod 777 /sprint-data/gitea

prepare/run-production.sh

@@ -0,0 +1,16 @@
+docker login -u mathwave -p $DOCKERHUB_PASSWORD
+docker network create -d overlay --attachable swarmpit-nginx || true
+docker network create -d overlay --attachable common-infra-nginx || true
+docker network create -d overlay --attachable common-infra-nginx-development || true
+docker network create -d overlay --attachable queues || true
+docker network create -d overlay --attachable queues-development || true
+docker network create -d overlay --attachable configurator || true
+docker network create -d overlay --attachable configurator-development || true
+mkdir /sprint-data/mongo || true
+mkdir /sprint-data/redis || true
+mkdir /sprint-data/rabbitmq || true
+mkdir /sprint-data/certs || true
+mkdir /sprint-data/gitea || true
+chmod 777 /sprint-data/redis
+chmod 777 /sprint-data/rabbitmq
+chmod 777 /sprint-data/gitea