greyn/deployment
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

cert id
All checks were successful
gitea.arg.rip/deployment/pipeline/head This commit looks good
Details

Browse Source
This commit is contained in:
adam 2024-12-13 17:01:31 -05:00
parent f085dc4aa4
commit 88419c8985
3 changed files with 33 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
scripts/1clickservice.groovy
View File

@ -4,7 +4,6 @@ pipeline {
string(name: 'servicename', description: "service name") string(name: 'servicename', description: "service name")
string(name: 'svcdesc', description: "service description") string(name: 'svcdesc', description: "service description")
string(name: 'targetHost', description: "system to live on", defaultValue: "moloryb.lan") string(name: 'targetHost', description: "system to live on", defaultValue: "moloryb.lan")
booleanParam(name: 'database', description: "service has a database", defaultValue: true)
} }
environment { environment {
SUDOER_ALLOCES = credentials('a674f816-2b35-4d60-ba60-7b66e86f3c5c') SUDOER_ALLOCES = credentials('a674f816-2b35-4d60-ba60-7b66e86f3c5c')
@ -16,7 +15,7 @@ pipeline {
GITEA_USR='jenkins' GITEA_USR='jenkins'
} }
stages { stages {
stage("environment setup") { stage("environment setup") { //my environment, here.
steps { steps {
script { script {
if (servicename.isEmpty()) { if (servicename.isEmpty()) {
@ -124,52 +123,37 @@ pipeline {
git -c core.sshCommand="ssh -i '$PK'\" clone ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git git -c core.sshCommand="ssh -i '$PK'\" clone ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git
#fyi, future me: pushd is useless here, it pops out. Like it's loading a script and exiting. #fyi, future me: pushd is useless here, it pops out. Like it's loading a script and exiting.
""" """
script { //there's no "if" "step" so any "if" must be in a "script" step script {
if(database){ sh """#!/bin/bash
sh """#!/bin/bash
pushd ${servicename} pushd ${servicename}
dbstartline=\$(sed -n '/---dbstart---/=' Jenkinsfile)
dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
echo \"yes db.\"
sed -i \"\${dbstartline}d;\${dbendline}d\" Jenkinsfile
databasecredsid=\$(uuidgen) databasecredsid=\$(uuidgen)
httpBasicAuth=\"http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/\" httpBasicAuth=\"http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/\"
echo \"\${httpBasicAuth}\" echo \"\${httpBasicAuth}\"
urlGetData=\"crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\\":\\",//crumb)\" urlGetData=\"crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\\":\\",//crumb)\"
CRUMB=\$(curl -s -c cookies.txt \"\${httpBasicAuth}\${urlGetData}\") CRUMB=\$(curl -s -c cookies.txt \"\${httpBasicAuth}\${urlGetData}\")
echo "crumb anyway. \$CRUMB" echo "crumb anyway. \$CRUMB"
curl -H \$CRUMB -X POST \"http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/_/createCredentials\" \ curl -H \$CRUMB -X POST \"http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/_/createCredentials\" \
--data-urlencode 'json={ --data-urlencode 'json={
"": "0", "": "0",
"credentials": { "credentials": {
"scope": "GLOBAL", "scope": "GLOBAL",
"id": "'"\$databasecredsid"'", "id": "'"\$databasecredsid"'",
"secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;", "secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;",
"description": "database connection string", "description": "database connection string",
"\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl" "\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
} }
}' }'
credsStr="productiondatabase_connectionString=credentials(\\"\$databasecredsid\\")" credsStr="productiondatabase_connectionString=credentials(\\"\$databasecredsid\\")"
sed -i "s/productiondatabase_connectionString=creds/\$credsStr/" Jenkinsfile sed -i "s/productiondatabase_connectionString=creds/\$credsStr/" Jenkinsfile
rm cookies.txt rm cookies.txt
git add . git add .
git commit -m \"set up for database\" git commit -m \"set up for database\"
""" """
}
else{
sh """#!/bin/bash
echo \"no db\"
pushd ${servicename}
sed -i '\${dbstartline},\${dbendline}d;' Jenkinsfile
git add .
git commit -m "stripped database lines"
"""
}
sh """#!/bin/bash sh """#!/bin/bash
@ -192,10 +176,7 @@ pipeline {
certCredsId=\$(uuidgen) certCredsId=\$(uuidgen)
# you git cloned ${servicename}. that's why it "already exists".
ssh-keygen -t ed25519 -f "${servicename}-ssh" -N "" ssh-keygen -t ed25519 -f "${servicename}-ssh" -N ""
#chmod 600 \"${servicename}-ssh\"
#chmod 600 \"${servicename}-ssh.pub\"
privatekeycontent=\$(cat ${servicename}-ssh) privatekeycontent=\$(cat ${servicename}-ssh)
pubkeycontent=\$(cat ${servicename}-ssh.pub) pubkeycontent=\$(cat ${servicename}-ssh.pub)
CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)') CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
@ -205,7 +186,7 @@ pipeline {
"": "0", "": "0",
"credentials": { "credentials": {
"scope": "GLOBAL", "scope": "GLOBAL",
"id": "'"\$usernameCredsId"'", "id": "'"\$certCredsId"'",
"username": "${servicename}", "username": "${servicename}",
"password": "", "password": "",
"privateKeySource": { "privateKeySource": {
@ -224,7 +205,9 @@ pipeline {
pushd ${servicename} pushd ${servicename}
linuxServiceAccountStr="linuxServiceAccount=credentials(\\"\$usernameCredsId\\")" linuxServiceAccountStr="linuxServiceAccount=credentials(\\"\$usernameCredsId\\")"
linuxServiceAccountIDStr="linuxServiceAccountID=\\"\$certCredsId\\""
sed -i "s/linuxServiceAccount=creds/\$linuxServiceAccountStr/" Jenkinsfile sed -i "s/linuxServiceAccount=creds/\$linuxServiceAccountStr/" Jenkinsfile
sed -i "s/linuxServiceAccountID=string/\$linuxServiceAccountIDStr/" Jenkinsfile
sed -i 's/targetHost=string/targetHost="${targetHost}"/' Jenkinsfile sed -i 's/targetHost=string/targetHost="${targetHost}"/' Jenkinsfile
git add . git add .
git commit -m "linux account, service host" git commit -m "linux account, service host"
@ -260,7 +243,6 @@ pipeline {
} }
} }
stage("db init"){ stage("db init"){
when { expression { return params.database } }
steps { steps {
//i'm pretty sure "update" with nothing will init? //i'm pretty sure "update" with nothing will init?
//meaning we don't have to init, first update will init //meaning we don't have to init, first update will init

5
scripts/databases.sh
View File

@ -9,11 +9,6 @@ function restofscript(){
sudo -u postgres psql -c "create database $servicename;" sudo -u postgres psql -c "create database $servicename;"
sudo -u postgres psql -c "create user $servicename with encrypted password '$pw_productiondatabase';" sudo -u postgres psql -c "create user $servicename with encrypted password '$pw_productiondatabase';"
sudo -u postgres psql -c "grant all privileges on database $servicename to $servicename;" sudo -u postgres psql -c "grant all privileges on database $servicename to $servicename;"
sudo -u postgres psql -c "create database $service_dev;"
sudo -u postgres psql -c "create user $service_dev with encrypted password '$pw_developmentdatabase';"
sudo -u postgres psql -c "grant all privileges on database $service_dev to $service_dev;"
} }
echo "${SUDOER_PSW}" | sudo -S bash -c "$(declare -f restofscript); restofscript" echo "${SUDOER_PSW}" | sudo -S bash -c "$(declare -f restofscript); restofscript"

2
scripts/serviceaccount.sh
View File

@ -9,7 +9,7 @@ function restofscript(){
echo "${USERNAMETOADD}:${PASSWORDTOADD}" | chpasswd echo "${USERNAMETOADD}:${PASSWORDTOADD}" | chpasswd
loginctl enable-linger ${USERNAMETOADD} loginctl enable-linger ${USERNAMETOADD}
mkdir /home/${USERNAMETOADD}/.ssh mkdir /home/${USERNAMETOADD}/.ssh
touch /home/${USERNAMETOADD}/authorized_keys touch /home/${USERNAMETOADD}/.ssh/authorized_keys
cat ssh.pub >> /home/${USERNAMETOADD}/.ssh/authorized_keys cat ssh.pub >> /home/${USERNAMETOADD}/.ssh/authorized_keys
chmod 600 /home/${USERNAMETOADD}/authorized_keys chmod 600 /home/${USERNAMETOADD}/authorized_keys
chown -R "${USERNAMETOADD}:${USERNAMETOADD}" /home/${USERNAMETOADD}/.ssh chown -R "${USERNAMETOADD}:${USERNAMETOADD}" /home/${USERNAMETOADD}/.ssh