mirror of
https://github.com/bashclub/zamba-lxc-toolbox.git
synced 2024-11-07 19:31:58 +01:00
Add ansible semaphore container
This commit is contained in:
parent
8d8618acfa
commit
322f64759c
35
src/ansible-semaphore/constants-service.conf
Normal file
35
src/ansible-semaphore/constants-service.conf
Normal file
@ -0,0 +1,35 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Authors:
|
||||||
|
# (C) 2021 Idea an concept by Christian Zengel <christian@sysops.de>
|
||||||
|
# (C) 2021 Script design and prototype by Markus Helmke <m.helmke@nettwarker.de>
|
||||||
|
# (C) 2021 Script rework and documentation by Thorsten Spille <thorsten@spille-edv.de>
|
||||||
|
|
||||||
|
# This file contains the project constants on service level
|
||||||
|
|
||||||
|
# Debian Version, which will be installed
|
||||||
|
LXC_TEMPLATE_VERSION="debian-12-standard"
|
||||||
|
|
||||||
|
# Create sharefs mountpoint
|
||||||
|
LXC_MP="0"
|
||||||
|
|
||||||
|
# Create unprivileged container
|
||||||
|
LXC_UNPRIVILEGED="1"
|
||||||
|
|
||||||
|
# enable nesting feature
|
||||||
|
LXC_NESTING="1"
|
||||||
|
|
||||||
|
# Sets the minimum amount of RAM the service needs for operation
|
||||||
|
LXC_MEM_MIN=1024
|
||||||
|
|
||||||
|
# Defines the name from the SQL database
|
||||||
|
SEMAPHORE_DB_NAME="semaphore"
|
||||||
|
|
||||||
|
# Defines the name from the SQL user
|
||||||
|
SEMAPHORE_DB_USR="semaphore"
|
||||||
|
|
||||||
|
# Build a strong password for the SQL user - could be overwritten with something fixed
|
||||||
|
SEMAPHORE_DB_PWD="$(random_password)"
|
||||||
|
|
||||||
|
# service dependent meta tags
|
||||||
|
SERVICE_TAGS="postgresql,nginx"
|
||||||
214
src/ansible-semaphore/install-service.sh
Normal file
214
src/ansible-semaphore/install-service.sh
Normal file
@ -0,0 +1,214 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Authors:
|
||||||
|
# (C) 2021 Idea an concept by Christian Zengel <christian@sysops.de>
|
||||||
|
# (C) 2021 Script design and prototype by Markus Helmke <m.helmke@nettwarker.de>
|
||||||
|
# (C) 2021 Script rework and documentation by Thorsten Spille <thorsten@spille-edv.de>
|
||||||
|
|
||||||
|
source /root/functions.sh
|
||||||
|
source /root/zamba.conf
|
||||||
|
source /root/constants-service.conf
|
||||||
|
|
||||||
|
wget -q -O - https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/nginx.key >/dev/null
|
||||||
|
echo "deb [signed-by=/etc/apt/trusted.gpg.d/nginx.key] http://nginx.org/packages/debian $(lsb_release -cs) nginx" | tee /etc/apt/sources.list.d/nginx.list
|
||||||
|
|
||||||
|
wget -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/postgresql.key >/dev/null
|
||||||
|
echo "deb [signed-by=/etc/apt/trusted.gpg.d/postgresql.key] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | tee /etc/apt/sources.list.d/pgdg.list
|
||||||
|
|
||||||
|
apt update
|
||||||
|
|
||||||
|
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt install --no-install-recommends -y -qq postgresql nginx git ssl-cert unzip zip ansible ansible-lint
|
||||||
|
|
||||||
|
systemctl enable --now postgresql
|
||||||
|
|
||||||
|
su - postgres <<EOF
|
||||||
|
psql -c "CREATE USER semaphore WITH PASSWORD '${SEMAPHORE_DB_PWD}';"
|
||||||
|
psql -c "CREATE DATABASE ${SEMAPHORE_DB_NAME} ENCODING UTF8 TEMPLATE template0 OWNER ${SEMAPHORE_DB_USR};"
|
||||||
|
echo "Postgres User ${SEMAPHORE_DB_USR} and database ${SEMAPHORE_DB_NAME} created."
|
||||||
|
EOF
|
||||||
|
|
||||||
|
curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb
|
||||||
|
|
||||||
|
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install /opt/semaphore_linux_amd64.deb
|
||||||
|
|
||||||
|
cat << EOF > /usr/local/bin/update-semaphore
|
||||||
|
PATH="/bin:/usr/bin:/usr/local/bin"
|
||||||
|
echo "Checking github for new semaphore version"
|
||||||
|
current_version=\$(curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep "tag_name" | cut -d '"' -f4)
|
||||||
|
installed_version=\$(semaphore version)
|
||||||
|
echo "Installed semaphore version is \$installed_version"
|
||||||
|
if [ \$installed_version != \$current_version ]; then
|
||||||
|
echo "New semaphore version \$current_version available. Stopping semaphore.service"
|
||||||
|
systemctl stop semaphore.service
|
||||||
|
echo "Downloading semaphore version \$current_version..."
|
||||||
|
curl -s https://api.github.com/repos/ansible-semaphore/semaphore/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep 'linux_amd64.deb$' | wget -i - -O /opt/semaphore_linux_amd64.deb
|
||||||
|
DEBIAN_FRONTEND=noninteractive DEBIAN_PRIORITY=critical apt -y -qq install /opt/semaphore_linux_amd64.deb
|
||||||
|
echo "Starting semaphore.service..."
|
||||||
|
systemctl start semaphore.service
|
||||||
|
echo "semaphore update finished!"
|
||||||
|
else
|
||||||
|
echo "semaphore version is up-to-date!"
|
||||||
|
fi
|
||||||
|
EOF
|
||||||
|
chmod +x /usr/local/bin/update-semaphore
|
||||||
|
|
||||||
|
cat << EOF > /etc/apt/apt.conf.d/80-semaphore-apt-hook
|
||||||
|
DPkg::Post-Invoke {"/usr/local/bin/update-semaphore";};
|
||||||
|
EOF
|
||||||
|
chmod +x /etc/apt/apt.conf.d/80-semaphore-apt-hook
|
||||||
|
|
||||||
|
cat << EOF > /etc/systemd/system/semaphore.service
|
||||||
|
[Unit]
|
||||||
|
Description=Semaphore Ansible
|
||||||
|
Documentation=https://github.com/ansible-semaphore/semaphore
|
||||||
|
Wants=network-online.target
|
||||||
|
After=network-online.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
ExecReload=/bin/kill -HUP \$MAINPID
|
||||||
|
ExecStart=/usr/bin/semaphore service --config=/etc/semaphore/config.json
|
||||||
|
SyslogIdentifier=semaphore
|
||||||
|
Restart=always
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
mkdir -p /etc/semaphore
|
||||||
|
|
||||||
|
cat << EOF > /etc/semaphore/config.json
|
||||||
|
{
|
||||||
|
"mysql": {
|
||||||
|
"host": "",
|
||||||
|
"user": "",
|
||||||
|
"pass": "",
|
||||||
|
"name": "",
|
||||||
|
"options": null
|
||||||
|
},
|
||||||
|
"bolt": {
|
||||||
|
"host": "",
|
||||||
|
"user": "",
|
||||||
|
"pass": "",
|
||||||
|
"name": "",
|
||||||
|
"options": null
|
||||||
|
},
|
||||||
|
"postgres": {
|
||||||
|
"host": "127.0.0.1:5432",
|
||||||
|
"user": "${SEMAPHORE_DB_USR}",
|
||||||
|
"pass": "${SEMAPHORE_DB_PWD}",
|
||||||
|
"name": "${SEMAPHORE_DB_NAME}",
|
||||||
|
"options": {
|
||||||
|
"sslmode": "disable"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dialect": "postgres",
|
||||||
|
"port": "",
|
||||||
|
"interface": "",
|
||||||
|
"tmp_path": "/tmp/semaphore",
|
||||||
|
"cookie_hash": "$(head -c32 /dev/urandom | base64)",
|
||||||
|
"cookie_encryption": "$(head -c32 /dev/urandom | base64)",
|
||||||
|
"access_key_encryption": "$(head -c32 /dev/urandom | base64)",
|
||||||
|
"email_sender": "",
|
||||||
|
"email_host": "",
|
||||||
|
"email_port": "",
|
||||||
|
"email_username": "",
|
||||||
|
"email_password": "",
|
||||||
|
"web_host": "",
|
||||||
|
"ldap_binddn": "",
|
||||||
|
"ldap_bindpassword": "",
|
||||||
|
"ldap_server": "",
|
||||||
|
"ldap_searchdn": "",
|
||||||
|
"ldap_searchfilter": "",
|
||||||
|
"ldap_mappings": {
|
||||||
|
"dn": "",
|
||||||
|
"mail": "",
|
||||||
|
"uid": "",
|
||||||
|
"cn": ""
|
||||||
|
},
|
||||||
|
"telegram_chat": "",
|
||||||
|
"telegram_token": "",
|
||||||
|
"slack_url": "",
|
||||||
|
"max_parallel_tasks": 0,
|
||||||
|
"email_alert": false,
|
||||||
|
"email_secure": false,
|
||||||
|
"telegram_alert": false,
|
||||||
|
"slack_alert": false,
|
||||||
|
"ldap_enable": false,
|
||||||
|
"ldap_needtls": false,
|
||||||
|
"ssh_config_path": "~/.ssh/",
|
||||||
|
"demo_mode": false,
|
||||||
|
"git_client": ""
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
if [ -f /etc/nginx/sites-enabled/default ]; then
|
||||||
|
unlink /etc/nginx/sites-enabled/default
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat << EOF > /etc/nginx/conf.d/default.conf
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
server_name _;
|
||||||
|
|
||||||
|
server_tokens off;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/semaphore.access.log;
|
||||||
|
error_log /var/log/nginx/semaphore.error.log;
|
||||||
|
|
||||||
|
location /.well-known/ {
|
||||||
|
root /var/www/html;
|
||||||
|
}
|
||||||
|
|
||||||
|
return 301 https://${LXC_HOSTNAME}.${LXC_DOMAIN}\$request_uri;
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 443 ssl http2;
|
||||||
|
listen [::]:443 ssl http2;
|
||||||
|
|
||||||
|
server_name ${LXC_HOSTNAME}.${LXC_DOMAIN};
|
||||||
|
|
||||||
|
server_tokens off;
|
||||||
|
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
|
||||||
|
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
|
||||||
|
|
||||||
|
ssl_protocols TLSv1.3 TLSv1.2;
|
||||||
|
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:EECDH+AESGCM:EDH+AESGCM;
|
||||||
|
ssl_dhparam /etc/nginx/dhparam.pem;
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
ssl_session_cache shared:SSL:10m;
|
||||||
|
ssl_session_timeout 180m;
|
||||||
|
|
||||||
|
ssl_stapling on;
|
||||||
|
ssl_stapling_verify on;
|
||||||
|
|
||||||
|
resolver 1.1.1.1 1.0.0.1;
|
||||||
|
|
||||||
|
add_header Strict-Transport-Security "max-age=31536000" always;
|
||||||
|
|
||||||
|
access_log /var/log/nginx/semaphore.access.log;
|
||||||
|
error_log /var/log/nginx/semaphore.error.log;
|
||||||
|
|
||||||
|
client_max_body_size 50M;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_set_header X-Real-IP \$remote_addr;
|
||||||
|
proxy_set_header Host \$host;
|
||||||
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||||
|
proxy_pass http://127.0.0.1:3000;
|
||||||
|
proxy_read_timeout 90;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
echo "source <(semaphore completion bash)" >> /root/.bashrc
|
||||||
|
semaphore user add --admin --login ${SEMAPHORE_ADMIN} --name ${SEMAPHORE_ADMIN_DISPLAY_NAME} --email ${SEMAPHORE_ADMIN_EMAIL} --password ${SEMAPHORE_ADMIN_PASSWORD} --config /etc/semaphore/config.json
|
||||||
|
|
||||||
|
|
||||||
|
openssl dhparam -out /etc/nginx/dhparam.pem 4096
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable --now semaphore.service
|
||||||
|
systemctl restart nginx.service
|
||||||
Loading…
Reference in New Issue
Block a user