adam
7130f70aaf
All checks were successful
gitea.arg.rip/deployment/pipeline/head This commit looks good
i know I went to HS with a girl called "mallory". you can tell i'm L O S T because I'm like "what's she up to these days?" but can't remember anything other than she exists and has that name. Pretty sure black hair? lmao
267 lines
14 KiB
Groovy
267 lines
14 KiB
Groovy
pipeline {
|
|
agent any
|
|
parameters {
|
|
string(name: 'servicename', description: "service name")
|
|
string(name: 'svcdesc', description: "service description")
|
|
string(name: 'targetHost', description: "system to live on", defaultValue: "alloces.lan")
|
|
booleanParam(name: 'database', description: "service has a database", defaultValue: true)
|
|
}
|
|
environment {
|
|
pw_linuxserviceaccount=""
|
|
pw_productiondatabase=""
|
|
pw_developmentdatabase=""
|
|
SUDOER=credentials('') //going to be set based on target host
|
|
SUDOERSSH=credentials('2c48e1a9-22b2-455c-9959-6b29e86d3fb5')
|
|
JENKINS=credentials('68391381-e095-4b47-b956-d23055b0808e')
|
|
}
|
|
stages {
|
|
stage("environment setup") {
|
|
steps {
|
|
script {
|
|
if (servicename.isEmpty()) {
|
|
error("servicename mandatory")
|
|
}
|
|
if (servicename.contains(' ')) {
|
|
error("servicename cannot have spaces. try dashes.")
|
|
}
|
|
|
|
switch (targetHost) {
|
|
case "alloces.lan":
|
|
SUDOER=credentials('a674f816-2b35-4d60-ba60-7b66e86f3c5c')
|
|
case "moloryb.lan":
|
|
SUDOER=credentials('1f3b965e-bcc0-4074-99f2-b64dddbf7de7')
|
|
break
|
|
default:
|
|
error("target host not recognized. btw: yes .lan, all lowercase.")
|
|
}
|
|
|
|
env.pw_linuxserviceaccount=sh(returnStdout: true, script: "mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")
|
|
echo env.pw_linuxserviceaccount
|
|
env.pw_productiondatabase=sh(returnStdout: true, script: "mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")
|
|
echo env.pw_productiondatabase
|
|
env.pw_developmentdatabase=sh(returnStdout: true, script: "mktemp -u XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")
|
|
echo env.pw_developmentdatabase
|
|
}
|
|
}
|
|
}
|
|
stage("gitea project"){
|
|
environment {
|
|
GITEA = credentials('0bd7c8f5-046c-44b9-9c77-7a28a219ae31')
|
|
}
|
|
steps{
|
|
sh """
|
|
curl -X 'POST' \
|
|
'https://gitea.arg.rip/api/v1/repos/greyn/_service-template/generate' \
|
|
-H 'accept: application/json' \
|
|
-H 'Authorization: token $GITEA_PSW' \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{
|
|
"description": "${svcdesc}",
|
|
"git_content": true,
|
|
"git_hooks": true,
|
|
"labels": true,
|
|
"name": "${servicename}",
|
|
"owner": "greyn",
|
|
"private": false,
|
|
"protected_branch": true,
|
|
"topics": true,
|
|
"webhooks": true
|
|
}'
|
|
"""
|
|
}
|
|
}
|
|
stage("jenkins pipeline"){
|
|
steps{
|
|
sh """
|
|
curl -X POST -L --user ${env.JENKINS_USR}:${env.JENKINS_PSW} \
|
|
alloces.lan:8080/job/gitea.arg.rip/build
|
|
"""
|
|
|
|
timeout(time: 5, unit: 'MINUTES') {
|
|
sh """
|
|
strRes=""
|
|
while [ -z "$strRes" ];
|
|
do
|
|
sleep 5;
|
|
strRes=\$(curl -X GET -s -u ${env.JENKINS_USR}:${env.JENKINS_PSW} \
|
|
alloces.lan:8080/job/gitea.arg.rip/api/json | jq '.jobs.[] | select(.name=="${env.servicename}")')
|
|
done
|
|
"""
|
|
}
|
|
sshagent(['f42347e9-e3b5-44af-a1af-c5e7b9775fee']) {
|
|
sh """
|
|
git clone 'ssh://git@gitea.arg.rip:8022/greyn/${servicename}.git'
|
|
pushd ${servicename}
|
|
|
|
dbstartline=\$(sed -n '/---dbstart---]/=' Jenkinsfile)
|
|
dbendline=\$(sed -n '/---dbend---/=' Jenkinsfile)
|
|
"""
|
|
script { //there's no "if" "step" so any "if" must be in a "script" step
|
|
if(params.database){
|
|
sh """
|
|
sed -i -e '${dbstartline}d;${dbendline}d;' Jenkinsfile
|
|
|
|
databasecredsid=\$(uuidgen)
|
|
|
|
CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
|
|
echo $CRUMB
|
|
curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
|
|
--data-urlencode 'json={
|
|
"": "0",
|
|
"credentials": {
|
|
"scope": "GLOBAL",
|
|
"id": "$databasecredsid",
|
|
"secret": "Host=${targetHost};Database=${servicename};Username=${servicename};Password=${env.pw_productiondatabase};IncludeErrorDetail=true;",
|
|
"description": "database connection string",
|
|
"\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
|
|
}
|
|
}'
|
|
sed -i 's/productiondatabase_connectionString=creds/productiondatabase_connectionString=credentials('$databasecredsid')/' Jenkinsfile
|
|
|
|
git add .
|
|
git commit -m "set up for database"
|
|
"""
|
|
}
|
|
else{
|
|
sh """
|
|
sed -i -e '${dbstartline},${dbendline}d;' Jenkinsfile
|
|
git add .
|
|
git commit -m "stripped database lines"
|
|
"""
|
|
}
|
|
|
|
sh """
|
|
popd
|
|
|
|
env.usernameCredsId=\$(uuidgen)
|
|
|
|
CRUMB=\$(curl -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
|
|
echo $CRUMB
|
|
curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
|
|
--data-urlencode 'json={
|
|
"": "0",
|
|
"credentials": {
|
|
"scope": "GLOBAL",
|
|
"id": "$env.usernameCredsId",
|
|
"username": "${servicename}",
|
|
"password": "${env.pw_linuxserviceaccount}",
|
|
"description": "service account login",
|
|
"\$class": "com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl"
|
|
}
|
|
}'
|
|
|
|
certCredsId=\$(uuidgen)
|
|
|
|
|
|
ssh-keygen -t ed25519 -f "${servicename}" -N ""
|
|
privatekeycontent=\$(cat ${servicename}))
|
|
pubkeycontent=\$(cat ${servicename}.pub))
|
|
CRUMB=\$(url -s 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)')
|
|
echo $CRUMB
|
|
curl -H $CRUMB -X POST 'http://${env.JENKINS_USR}:${env.JENKINS_PSW}@alloces.lan:8080/job/gitea.arg.rip/job/${servicename}/credentials/store/folder/domain/greyn%20services/createCredentials' \
|
|
--data-urlencode 'json={
|
|
"": "0",
|
|
"credentials": {
|
|
"scope": "GLOBAL",
|
|
"id": "$env.usernameCredsId",
|
|
"username": "${servicename}",
|
|
"password": "",
|
|
"privateKeySource": {
|
|
"stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey$DirectEntryPrivateKeySource",
|
|
"privateKey": "$privatekeycontent",
|
|
},
|
|
"description": "${servicename}",
|
|
"stapler-class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey"
|
|
},
|
|
"description": "service account ssh",
|
|
"\$class": "com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey"
|
|
}
|
|
}'
|
|
privatekeycontent=
|
|
|
|
sed -i 's/linuxServiceAccount=creds/linuxServiceAccount=credentials('${env.usernameCredsId}')/' Jenkinsfile
|
|
sed -i 's/targetHost=string/targetHost="${targetHost}"/' Jenkinsfile
|
|
|
|
"""
|
|
sh """
|
|
git push
|
|
popd
|
|
"""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
stage("service account"){
|
|
steps{
|
|
script {
|
|
sshagent([SUDOERSSH])
|
|
{
|
|
sh """ssh -tt ${SUDOER_USR}@${targetHost} username=${servicename} password=${env.pw_linuxserviceaccount} pubkeycontent=${env.pubkeycontent} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
useradd -m -s /bin/bash $username
|
|
echo "$username:$password" | chpasswd
|
|
loginctl enable-linger $username
|
|
cd ~/home/$username
|
|
mkdir .ssh
|
|
pushd .ssh
|
|
echo $pubkeycontent > authorized_keys
|
|
popd
|
|
chown -R $username:$username .ssh
|
|
ENDSSH
|
|
"""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
stage("db init"){
|
|
when { expression { return params.database } }
|
|
steps {
|
|
//i'm pretty sure "update" with nothing will init?
|
|
//meaning we don't have to init, first update will init
|
|
script {
|
|
sshagent([SUDOERSSH])
|
|
{
|
|
sh """ssh -tt SUDOER_USR@${targetHost} servicename=$servicename pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
sudo -u postgres psql && bash -s << 'ENDPSQL'
|
|
create database $servicename;
|
|
create user $servicename with encrypted password '$pw_productiondatabase';
|
|
grant all privileges on database $servicename to $servicename;
|
|
ENDPSQL
|
|
|
|
service_dev="${servicename}_dev"
|
|
sudo -u postgres psql && bash -s << 'ENDPSQL'
|
|
create database $service_dev;
|
|
create user $service_dev with encrypted password '$pw_developmentdatabase';
|
|
grant all privileges on database $service_dev to $service_dev;
|
|
ENDPSQL
|
|
|
|
ENDSSH"""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
stage("initial service setup"){
|
|
steps{
|
|
sshagent([SUDOERSSH])
|
|
{
|
|
sh 'scp $servicename.service $servicename@${targetHost}:~/.config/systemd/user/$servicename.service'
|
|
sh """ssh -tt SUDOER_USR@${targetHost} servicename=$servicename pw_productiondatabase=${env.pw_productiondatabase} pw_developmentdatabase=${env.pw_developmentdatabase} 'echo "$SUDOER_PSW" | sudo -Sv && bash -s' << 'ENDSSH'
|
|
sudo -u ${servicename} && bash -s << 'ENDASSERVICE'
|
|
systemctl --user daemon-reload
|
|
systemctl --user enable $servicename.service
|
|
ENDASSERVICE
|
|
ENDSSH"""
|
|
}
|
|
}
|
|
}
|
|
}
|
|
post {
|
|
failure {
|
|
matrixSendMessage hostname: 'https://greyn.club:8448', accessTokenCredentialsId: '040b63d1-2f14-4692-badb-114bddd7c5a5', roomId: '!QmOCACetHdGDlNFsZP:greyn.club', body: '1-click service failed :('
|
|
|
|
}
|
|
success {
|
|
matrixSendMessage hostname: 'https://greyn.club:8448', accessTokenCredentialsId: '040b63d1-2f14-4692-badb-114bddd7c5a5', roomId: '!QmOCACetHdGDlNFsZP:greyn.club', body: '1-click service success! go pick up the credentials!'
|
|
//TODO: archiveArtifacts the password data, then store them somewhere
|
|
}
|
|
}
|
|
} |