greyn/deployment
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Compare commits

base: greyn:aa42c247354523efb27277f181d60378cd84f21a
Branches Tags
greyn:main
greyn:release
greyn:service
greyn:predev
greyn:3
greyn:2
greyn:1
..
compare: greyn:816bcff09daac19903bbadbecca712623f1c35ea
Branches Tags
greyn:main
greyn:release
greyn:service
greyn:predev
greyn:3
greyn:2
greyn:1

No commits in common. "aa42c247354523efb27277f181d60378cd84f21a" and "816bcff09daac19903bbadbecca712623f1c35ea" have entirely different histories.
aa42c24735 ... 816bcff09d

1 changed files with 42 additions and 50 deletions
Show Stats Expand all files Collapse all files

92
scripts/1clickservice.groovy
View File

@ -83,75 +83,67 @@ pipeline {
while [ -z "\$strRes" ]; while [ -z "\$strRes" ];
do do
sleep 5; sleep 5;
curl -X GET -s -u ${env.JENKINS_USR}:'${env.JENKINS_PSW}' \ strRes=\$(curl -X GET -s -u ${env.JENKINS_USR}:'${env.JENKINS_PSW}' \
alloces.lan:8080/job/gitea.arg.rip/api/json > f.json alloces.lan:8080/job/gitea.arg.rip/api/json \
strRes=\$(jq '.jobs' f.json | jq '.[] | select(.name==\"${env.servicename}\")') | jq ".jobs.[] | select(.name==\"${env.servicename}\")")
rm f.json
done done
""" """
} }
withCredentials([sshUserPrivateKey(credentialsId: 'f42347e9-e3b5-44af-a1af-c5e7b9775fee', keyFileVariable: 'PK')]) { sshagent(['f42347e9-e3b5-44af-a1af-c5e7b9775fee']) {
sh """#!/bin/bash sh """
git clone 'ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git'
pushd ${servicename}
#mkdir -p ~/.ssh dbstartline=\$(sed -n '/---dbstart---]/=' Jenkinsfile)
#ssh-keyscan -t ed25519 gitea.arg.rip >> ~/.ssh/known_hosts dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
#cat ~/.ssh/known_hosts
#shit doesn't work. ssh in, git clone, get your shit set up for keys.
git -c core.sshCommand="ssh -i '$PK'\" clone ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git
#fyi, future me: pushd is useless here, it pops out. Like it's loading a script and exiting.
""" """
script { //there's no "if" "step" so any "if" must be in a "script" step script { //there's no "if" "step" so any "if" must be in a "script" step
if(database){ if(params.database){
sh """#!/bin/bash sh """
pushd ${servicename} sed -i -e '${dbstartline}d;${dbendline}d;' Jenkinsfile
dbstartline=\$(sed -n '/---dbstart---/=' Jenkinsfile)
dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
echo \"yes db\"
sed -i -e '\${dbstartline}d;\${dbendline}d;' Jenkinsfile
databasecredsid=\$(uuidgen) databasecredsid=\$(uuidgen)
CRUMB=\$(curl -s \"http://${env.JENKINS_USR}:'${env.JENKINS_PSW}'@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)\") CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
echo \$CRUMB echo $CRUMB
curl -H \$CRUMB -X POST \"http://${env.JENKINS_USR}:'${env.JENKINS_PSW}\'@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \ curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
--data-urlencode 'json={ --data-urlencode 'json={
"": "0", "": "0",
"credentials": { "credentials": {
"scope": "GLOBAL", "scope": "GLOBAL",
"id": "\$databasecredsid", "id": "$databasecredsid",
"secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;", "secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;",
"description": "database connection string", "description": "database connection string",
"\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl" "\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
} }
}' }'
sed -i 's/productiondatabase_connectionString=creds/productiondatabase_connectionString=credentials('\$databasecredsid')/' Jenkinsfile sed -i 's/productiondatabase_connectionString=creds/productiondatabase_connectionString=credentials('$databasecredsid')/' Jenkinsfile
git add . git add .
git commit -m "set up for database" git commit -m "set up for database"
""" """
} }
else{ else{
sh """#!/bin/bash sh """
echo \"no db\" sed -i -e '${dbstartline},${dbendline}d;' Jenkinsfile
pushd ${servicename}
sed -i -e '\${dbstartline},\${dbendline}d;' Jenkinsfile
git add . git add .
git commit -m "stripped database lines" git commit -m "stripped database lines"
""" """
} }
sh """ sh """
popd
usernameCredsId=\$(uuidgen) env.usernameCredsId=\$(uuidgen)
CRUMB=\$(curl 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)') CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
echo \$CRUMB echo $CRUMB
curl -H \$CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \ curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
--data-urlencode 'json={ --data-urlencode 'json={
"": "0", "": "0",
"credentials": { "credentials": {
"scope": "GLOBAL", "scope": "GLOBAL",
"id": "\$usernameCredsId", "id": "$env.usernameCredsId",
"username": "${servicename}", "username": "${servicename}",
"password": "${env.pw_linuxserviceaccount}", "password": "${env.pw_linuxserviceaccount}",
"description": "service account login", "description": "service account login",
@ -166,18 +158,18 @@ pipeline {
privatekeycontent=\$(cat ${servicename})) privatekeycontent=\$(cat ${servicename}))
pubkeycontent=\$(cat ${servicename}.pub)) pubkeycontent=\$(cat ${servicename}.pub))
CRUMB=\$(url -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)') CRUMB=\$(url -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
echo \$CRUMB echo $CRUMB
curl -H \$CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \ curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
--data-urlencode 'json={ --data-urlencode 'json={
"": "0", "": "0",
"credentials": { "credentials": {
"scope": "GLOBAL", "scope": "GLOBAL",
"id": "\$usernameCredsId", "id": "$env.usernameCredsId",
"username": "${servicename}", "username": "${servicename}",
"password": "", "password": "",
"privateKeySource": { "privateKeySource": {
"stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey\$DirectEntryPrivateKeySource", "stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey$DirectEntryPrivateKeySource",
"privateKey": "\$privatekeycontent", "privateKey": "$privatekeycontent",
}, },
"description": "${servicename}", "description": "${servicename}",
"stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey" "stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey"
@ -206,15 +198,15 @@ pipeline {
sshagent([SUDOERSSH]) sshagent([SUDOERSSH])
{ {
sh """ssh -tt ${SUDOER_USR}@${targetHost} username=${servicename} password=${env.pw_linuxserviceaccount} pubkeycontent=${env.pubkeycontent} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH' sh """ssh -tt ${SUDOER_USR}@${targetHost} username=${servicename} password=${env.pw_linuxserviceaccount} pubkeycontent=${env.pubkeycontent} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
useradd -m -s /bin/bash \$username useradd -m -s /bin/bash $username
echo "\$username:\$password" | chpasswd echo "$username:$password" | chpasswd
loginctl enable-linger \$username loginctl enable-linger $username
cd ~/home/\$username cd ~/home/$username
mkdir .ssh mkdir .ssh
pushd .ssh pushd .ssh
echo \$pubkeycontent > authorized_keys echo $pubkeycontent > authorized_keys
popd popd
chown -R \$username:\$username .ssh chown -R $username:$username .ssh
ENDSSH ENDSSH
""" """
} }
@ -238,9 +230,9 @@ pipeline {
service_dev="${servicename}_dev" service_dev="${servicename}_dev"
sudo -u postgres psql && bash -s << 'ENDPSQL' sudo -u postgres psql && bash -s << 'ENDPSQL'
create database \$service_dev; create database $service_dev;
create user \$service_dev with encrypted password '\$pw_developmentdatabase'; create user $service_dev with encrypted password '$pw_developmentdatabase';
grant all privileges on database \$service_dev to \$service_dev; grant all privileges on database $service_dev to $service_dev;
ENDPSQL ENDPSQL
ENDSSH""" ENDSSH"""
@ -252,11 +244,11 @@ pipeline {
steps{ steps{
sshagent([SUDOERSSH]) sshagent([SUDOERSSH])
{ {
sh 'scp ${servicename}.service ${servicename}@${targetHost}:~/.config/systemd/user/${servicename}.service' sh 'scp $servicename.service $servicename@${targetHost}:~/.config/systemd/user/$servicename.service'
sh """ssh -tt $SUDOER_USR@${targetHost} servicename=${servicename} pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH' sh """ssh -tt SUDOER_USR@${targetHost} servicename=$servicename pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
sudo -u ${servicename} && bash -s << 'ENDASSERVICE' sudo -u ${servicename} && bash -s << 'ENDASSERVICE'
systemctl --user daemon-reload systemctl --user daemon-reload
systemctl --user enable ${servicename}.service systemctl --user enable $servicename.service
ENDASSERVICE ENDASSERVICE
ENDSSH""" ENDSSH"""
} }