|
|
|
|
@ -1,90 +0,0 @@
|
|
|
|
|
pipeline {
|
|
|
|
|
agent any
|
|
|
|
|
parameters {
|
|
|
|
|
string(name: 'servicename', description: "service name")
|
|
|
|
|
string(name: 'svcdesc', description: "service description")
|
|
|
|
|
boolean(name: 'database', description: "service has a database", defaultValue: true)
|
|
|
|
|
}
|
|
|
|
|
environment {
|
|
|
|
|
pw_linuxserviceaccount=""
|
|
|
|
|
pw_productiondatabase=""
|
|
|
|
|
pw_developmentdatabase=""
|
|
|
|
|
ALLOCES = credentials('//TODO: its usually a uuid')
|
|
|
|
|
}
|
|
|
|
|
stages {
|
|
|
|
|
stage("type strengthening") {
|
|
|
|
|
steps {
|
|
|
|
|
script {
|
|
|
|
|
if (servicename.isEmpty()) {
|
|
|
|
|
error("servicename mandatory")
|
|
|
|
|
}
|
|
|
|
|
if (servicename.contains(' ')) {
|
|
|
|
|
error("servicename cannot have spaces. try dashes.")
|
|
|
|
|
}
|
|
|
|
|
sh env.pw_linuxserviceaccount=$(mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
|
|
|
|
|
sh env.pw_productiondatabase=$(mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
|
|
|
|
|
sh env.pw_developmentdatabase=$(mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)
|
|
|
|
|
//TODO: save them somewhere. probably better to not lock myself out of these accounts from moment 0
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
stage("gitea project"){
|
|
|
|
|
steps{
|
|
|
|
|
//TODO: clone _template-service. Must be under greyn.
|
|
|
|
|
//TODO: if not database version, strip out database stuff
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
stage("jenkins pipeline"){
|
|
|
|
|
steps{
|
|
|
|
|
//TODO: tell jenkins to scan greyn pipeline
|
|
|
|
|
//TODO: find this new service in jenkins
|
|
|
|
|
//TODO: add the shared secrets to jenkins
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
stage("service account"){
|
|
|
|
|
steps{
|
|
|
|
|
script {
|
|
|
|
|
//jenkins, the user trying to SSH, must be able to ssh in and sudo
|
|
|
|
|
ssh user@host username=$servicename password=${env.pw_linuxserviceaccount} 'echo "$ALLOCES_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
|
|
|
useradd -m -s /bin/bash $username
|
|
|
|
|
echo "$username:$password" | chpasswd
|
|
|
|
|
loginctl enable-linger $username
|
|
|
|
|
ENDSSH
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
stage("db init"){
|
|
|
|
|
when { expression { return params.database } }
|
|
|
|
|
steps {
|
|
|
|
|
//i'm pretty sure "update" with nothing will init?
|
|
|
|
|
//meaning we don't have to init, first update will init
|
|
|
|
|
script {
|
|
|
|
|
ssh user@host servicename=$servicename pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$ALLOCES_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
|
|
|
sudo -u postgres psql && bash -s << 'ENDPSQL'
|
|
|
|
|
create database $servicename;
|
|
|
|
|
create user $servicename with encrypted password '$pw_productiondatabase';
|
|
|
|
|
grant all privileges on database $servicename to $servicename;
|
|
|
|
|
ENDPSQL
|
|
|
|
|
|
|
|
|
|
service_dev="${servicename}_dev"
|
|
|
|
|
sudo -u postgres psql && bash -s << 'ENDPSQL'
|
|
|
|
|
create database $service_dev;
|
|
|
|
|
create user $service_dev with encrypted password '$pw_developmentdatabase';
|
|
|
|
|
grant all privileges on database $service_dev to $service_dev;
|
|
|
|
|
ENDPSQL
|
|
|
|
|
|
|
|
|
|
ENDSSH
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
stage("initial service setup"){
|
|
|
|
|
steps{
|
|
|
|
|
sh 'scp $servicename.service user@server:~/.config/systemd/user/$servicename.service'
|
|
|
|
|
ssh user@host servicename=$servicename svcpw=$ARG2 'echo "$ALLOCES_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
|
|
|
systemctl --user daemon-reload
|
|
|
|
|
systemctl --user enable $servicename.service
|
|
|
|
|
ENDSSH
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|