Skip to content

Commit c6ddbc9

Browse files
LukasCuperDTYustinaKvrvladimirhaskosgmvSebastianGode
authored
Feature enable gitea runner on preprod (#1356)
* New syntax for SMTP gateway (#1342) New syntax for SMTP gateway Add SMTP_PORT key for new syntax Reviewed-by: Vladimir Hasko <[email protected]> * Update helm-dependency-bot.yml (#1343) Update helm-dependency-bot.yml Fix path to helm-charts dir Change peter-evans/create-pull-reques version from 5 to 7 Reviewed-by: Vladimir Hasko <[email protected]> * Update helm-dependency-bot.yml (#1344) Update helm-dependency-bot.yml Path to YAMLs changed Reviewed-by: Vladimir Hasko <[email protected]> * Update helm-dependency-bot.yml (#1345) Update helm-dependency-bot.yml Reviewed-by: Vladimir Hasko <[email protected]> * Handling quotation marks (#1348) Handling quotation marks Fix script for work with double, single or no quotation marks at all Reviewed-by: SebastianGode Reviewed-by: Tino Schr * new redirections for internal HC portal (#1349) new redirections for internal HC portal Reviewed-by: Tino Schr * Unbound fix (#1350) Unbound fix Set up the unbound service to run only with ipv4 and on the localhost. Reviewed-by: Vladimir Hasko <[email protected]> * Remove Vova from codowners (#1352) Remove Vova from codowners Remove Vladimir Vshivkov from codowners for this repo Reviewed-by: LukasCuperDT * EoD release 0.1.37 (#1353) EoD release 0.1.37 Fix regex in eod_7 Change auth in eod_7 from basic to header Reviewed-by: Anton Sidelnikov Reviewed-by: Vladimir Hasko <[email protected]> * Remove inactive users from bridge (#1366) Remove inactive users from bridge Remove (enrrou) from bridge and other hosts Remove (gtema) from bridge and other hosts Reviewed-by: Tino Schr * Update Gitea app.ini.j2 to block access through direct IP (#1371) Update Gitea app.ini.j2 to block access through direct IP Reviewed-by: LukasCuperDT * Disable internal metrics for the influx (#1370) Disable internal metrics for the influx Reviewed-by: SebastianGode Reviewed-by: Tino Schr * Adding gitea behind proxy (#1372) Adding gitea behind proxy Reviewed-by: Tino Schr * Adding gitea behind proxy (#1373) Adding gitea behind proxy Reviewed-by: Tino Schr * Adding gitea behind proxy (#1374) Adding gitea behind proxy Reviewed-by: Tino Schr * Update nginx-site.conf in swiss int to not allow unsafe URL characters (#1377) Update nginx-site.conf in swiss int to not allow unsafe URL characters Reviewed-by: Tino Schr * Fix SSRF possibility on all helpcenter websites (#1378) Fix SSRF possibility on all helpcenter websites Reviewed-by: Tino Schr * updating public key for user (#1381) updating public key for user Reviewed-by: Tino Schr * Gitea3 setup (#1382) Gitea3 setup Reviewed-by: Vladimir Hasko <[email protected]> Reviewed-by: Tino Schr * Add Ubuntu noble to sources list (#1384) Add Ubuntu noble to sources list Reviewed-by: Vladimir Hasko <[email protected]> * Ubuntu noble (#1385) Ubuntu noble Reviewed-by: Vladimir Hasko <[email protected]> * Enabling gitea runner in k8s * Enabling persistance --------- Co-authored-by: Yustina Kvrivishvili <[email protected]> Co-authored-by: Vladimir Hasko <[email protected]> Co-authored-by: Sergei Martynov <[email protected]> Co-authored-by: SebastianGode <[email protected]>
1 parent fb2fb0e commit c6ddbc9

File tree

36 files changed

+812
-52
lines changed

36 files changed

+812
-52
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
# Admins must approve changes to systems configuration
2-
* @otcbot @vladimirhasko @vladimirvshivkov @tischrei @LukasCuperDT
2+
* @otcbot @vladimirhasko @tischrei @LukasCuperDT

‎.github/scripts/check_helm_dependencies.py‎

Lines changed: 46 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -163,27 +163,55 @@ def update_chart_dependencies_for_app(app_data):
163163

164164
for dep in updates:
165165
file_path = dep['file_path']
166-
current_version = dep['current_version']
167-
latest_version = dep['latest_version']
166+
current_version = str(dep['current_version']).strip('"\'')
167+
latest_version = str(dep['latest_version']).strip('"\'')
168168

169169
try:
170170
with open(file_path, 'r') as f:
171-
lines = f.readlines()
172-
173-
updated_lines = []
174-
for line in lines:
175-
if f'name: {dep["name"]}' in line:
176-
updated_lines.append(line)
177-
elif 'version:' in line and len(updated_lines) > 0 and f'name: {dep["name"]}' in updated_lines[-1]:
178-
updated_line = line.replace(f'"{current_version}"', f'"{latest_version}"')
179-
updated_lines.append(updated_line)
180-
else:
181-
updated_lines.append(line)
182-
183-
with open(file_path, 'w') as f:
184-
f.writelines(updated_lines)
185-
186-
logging.info("Version has been updated for %s in %s", dep['name'], file_path)
171+
content = f.read()
172+
173+
logging.info("Updating %s from %s to %s in %s", dep['name'], current_version, latest_version, file_path)
174+
175+
updated = False
176+
pattern_used = ""
177+
178+
# Double quotes
179+
old_pattern = f'version: "{current_version}"'
180+
new_pattern = f'version: "{latest_version}"'
181+
if old_pattern in content:
182+
content = content.replace(old_pattern, new_pattern)
183+
updated = True
184+
pattern_used = "double quotes"
185+
186+
# Single quotes
187+
if not updated:
188+
old_pattern = f"version: '{current_version}'"
189+
new_pattern = f"version: '{latest_version}'"
190+
if old_pattern in content:
191+
content = content.replace(old_pattern, new_pattern)
192+
updated = True
193+
pattern_used = "single quotes"
194+
195+
# No quotes
196+
if not updated:
197+
lines = content.split('\n')
198+
for i, line in enumerate(lines):
199+
if f'version: {current_version}' in line and line.strip().endswith(current_version):
200+
lines[i] = line.replace(f'version: {current_version}', f'version: {latest_version}')
201+
updated = True
202+
pattern_used = "no quotes"
203+
break
204+
205+
if updated:
206+
content = '\n'.join(lines)
207+
208+
if updated:
209+
with open(file_path, 'w') as f:
210+
f.write(content)
211+
logging.info("Version has been updated for %s in %s (used pattern: %s)",
212+
dep['name'], file_path, pattern_used)
213+
else:
214+
logging.error("Error during update %s in %s: could not find version pattern", dep['name'], file_path)
187215

188216
except Exception as e:
189217
logging.error("Error during update %s in %s: %s", dep['name'], file_path, str(e))

‎.github/workflows/helm-dependency-bot.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
push:
88
branches: [ main ]
99
paths:
10-
- 'kubernetes/argocd-apps/system/**/Chart.yaml'
10+
- 'kubernetes/helm_charts/**/Chart.yaml'
1111

1212
jobs:
1313
check-helm-dependencies:
@@ -40,11 +40,11 @@ jobs:
4040
run: python .github/scripts/check_helm_dependencies.py
4141
env:
4242
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43-
CHART_PATH: "kubernetes/argocd-apps/system"
43+
CHART_PATH: "kubernetes/helm_charts"
4444

4545
- name: Create Pull Request
4646
if: steps.dependency-check.outputs.has_updates == 'true'
47-
uses: peter-evans/create-pull-request@v5 # don't update this action version!!!
47+
uses: peter-evans/create-pull-request@v7
4848
with:
4949
token: ${{ secrets.GITHUB_TOKEN }}
5050
commit-message: "chore: update helm chart dependencies"
@@ -53,5 +53,5 @@ jobs:
5353
branch: helm-dep-updates
5454
delete-branch: true
5555
add-paths: |
56-
kubernetes/argocd-apps/system/**/*
56+
kubernetes/helm_charts/**/*
5757
labels: dependencies, helm-charts

‎inventory/base/group_vars/all.yaml‎

Lines changed: 2 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -38,26 +38,13 @@ unbound_forward_zones: []
3838
# When adding new users, always pick a UID larger than the last UID, do not
3939
# fill in holes in the middle of the range.
4040
all_users:
41-
gtema:
42-
comment: A. G.
43-
key: |
44-
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDBBVL8LJ14SfFPK2zNeuO8rglURUJ32LFQXn0IzinZ7Y3ic8vtmF+UBvg+h8th56GZ3/DR9b+zcXfbA+0cdfTr+BWlDCYwcLab2vgU/S9FyQBzYr7ZWxtEFOmb5ztVp2b5wFt/DD7YBfyJNzM9SpVQDO4furwNZDq5af0+D67KOsV2BPLXL4/zMGkLR3TSFNzdJCSLrWML96NWK1FvpEjDroyKXFTVVcLBTgtBnFtpjpUzmlJSntaUxTQq1htiWLTGQL3ApLqx7YYctxDDkeBrWGSQPZgFppqhk5U8sWE9ieGztGuVyYzAhvz8YO9nm8M26izVebjwe+9u1hqa3Pk9 artem.goncharov
45-
[email protected] AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIFhfujbhx20AzKf2okw9WnduPe2keIWkFDhsSLNlvMd6AAAABHNzaDo= gtema@yubikey
46-
uid: 2000
47-
gid: 2000
4841

4942
vhasko:
5043
comment: V. H.
5144
key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCvurvAWz7ourNA8rGKFK94qP4qNtSGO28hd5mx76LdbFoNAj0vMj+Uwsxjz00zQjGvWWoL8aRVP/It5P/eAz4C/kzhQcB5s+mOSKcwus5bZMtefyusEN1jr2035bOVpdrV5h8OpNUZ4WJRxfUNb46sz89Y/C49dUPsWY+ZpwDFk4xrYmihPQQyogEJ5PDXvdtNbcW/QA2gj4U+HFWY7vnmiC7tfViX1d3Ne0d4pb1XKiTMiFyQH0jRAF4ydIku4kIG7sqw9HAKoDeOzIbh+LYBO6qbefpH8jF/VVJyc+jmBx49VFAfiNfOg58QwrnKmXWF640O5J1UhDrvoAT8A2y1 vladimir.hasko
5245
uid: 2002
5346
gid: 2002
5447

55-
enrrou:
56-
comment: V. V.
57-
key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDF0YWXjTSh8DOgVH8nZPEP+9ZaTvRP3TF4qTUxZ7knHM1H6Rx0IROHa60l19J4+X7Cmu7dsNtSVslXAAVCEO5Wcrm5cU8IbczBPQKoGYpAvGaYqneuzl9Yp8MH3HpPs6nJ1REA3lwB1TcmuyDJklb2sG86Iug4+D3EnovMnzrv+75ypuEOTMxQzj2h7f3twSKX5DFulrKsHW0+HWRhTXMD/k/HnJrXsbm/H9KAg+916zbykUitggRl1pznlUzjD5zm1cvg6bO0mnb8dE9KoE28cXJacMOV/8/KKIpL0EU4WAIcRKmjZ3k/gNSrl6ONvP2OxyeESyjN0BSobspsu71V [email protected]
58-
uid: 2003
59-
gid: 2003
60-
6148
ibakhter:
6249
comment: I. B.
6350
key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPcpgCsi22OOoMNuzQG04YFU3pb2W0ZU/iLsFCWbrtkH ibakhter
@@ -92,7 +79,7 @@ all_users:
9279
key: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpHyuVlTQDcE+YBqHj40ci7kBXMI7qnytu3kv2KhlUqAa/nrl1rSz52bY1ON+3e+rUNL+qtPHTfd9ryQHXviYZ20atxeP9yx4OmAtvf8QiBbCO8C+LPDWU9TGSl1RB4AiArZbS3y9lQI+7OooI4zGeqvfed00sqVDgCKrbqdUqWofz56Cqst587KJfZlXjl7YGfU6W3JmpynyIH3krxwFtqyfPxBuo0iR5FSP82SdAcka0PR5Dcji9QQ5fA7BSjnGZPDg9esBGmGnaXQB/6E9G78utenQ6uHeOoH+qAgkAbZxjGuJcuLmXjXPQQD7IEsTdkMGvQbs8wAJ08JQDVKbj smartynov
9380
uid: 2034
9481
gid: 2034
95-
82+
9683
magnus:
9784
comment: N. M.
9885
key: ssh-rsa AAAAB3NzaC1yc2EAAAAEQAAAgQAAAQEAosSxGuQH2SWqZugOMGiw4F3HzdORT9ZO1m+9p48IjQVzf57N6o08NLJFvRWTFHR8VxI1Y5o2w1fsCEPL3njtKl6MpIDSbvBDXugEK9pHcVZDMUllbKYtD8v6UHSJ70FqeE9VpAVHN/+/RklpsfPfmfxdScqJsrCSmFGCSYPj1bl6SVlYefKfu7NXYBK8seWp4l+iiVbX0M1D0R90xq2oPRkdlW5TntvTW5TJDPwxhd6y/qfQsSOmPUTHMc7XnzqcdPaHalzU3Uuvo+1PXeap9b6q3EA1/Jnu+QnNrZ6K0aCDrfIVtpB8ZtuLWUR2IcyTAN/gQLwHv5U7zn2O7/HRzw==
@@ -113,15 +100,13 @@ all_users:
113100

114101
lcuper:
115102
comment: L. C.
116-
key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBrioFxInmU3lhbsOTTHJieHZ7h4G+dR6/OJNHyQv+3m
103+
key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAao5SSjPTNQeH+fXaqzH56VrW/8/loNLFys35zXvCI3 A200014817@T00248c62a
117104
uid: 2037
118105
gid: 2037
119106

120107
# List of users to install on all hosts
121108
base_users:
122-
- gtema
123109
- vhasko
124-
- enrrou
125110
- smartynov
126111
- magnus
127112
- yustina

‎inventory/base/hosts.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,16 @@ all:
337337
region: "eu-de"
338338
host_keys:
339339
- 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMwpqYLQ4fhqdGm6NHsDuQIjwpXUJJOSqDRCoPBA4hzwGD67q+2YnSLnxHk78WhFEEhERaA0U4Rpxpt9hkjoG38='
340+
gitea3.eco.tsi-dev.otc-service.com:
341+
ansible_host: 192.168.170.201
342+
ansible_user: automation
343+
public_v4: 192.168.170.201
344+
location:
345+
cloud: "otc_vault_448_de_eco_infra"
346+
az: "eu-de-03"
347+
region: "eu-de"
348+
host_keys:
349+
- 'ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKmIa77z0yhdJj4aXvF0T78spnOYxqhimAhfTzMy2mK8TPycf3ICzsIivooOPtjz9y2LsuOGe+S5bX42QQJh8bo='
340350
keycloak1.eco.tsi-dev.otc-service.com:
341351
ansible_host: 192.168.170.90
342352
ansible_user: automation

‎inventory/service/group_vars/proxy.yaml‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,31 @@ proxy_backends:
238238
address: "192.168.171.6:443"
239239
opts: "ssl verify none"
240240

241+
- name: "gitea"
242+
options:
243+
- "http-check send hdr Host gitea.eco.tsi-dev.otc-service.com"
244+
- "option forwardfor"
245+
- "default-server check inter 5s fall 5 rise 1"
246+
# Block access by IP address, only allow domain name
247+
- "acl valid_host hdr(host) -i gitea.eco.tsi-dev.otc-service.com"
248+
- "acl valid_host hdr(host) -i gitea.eco.tsi-dev.otc-service.com:443"
249+
- "acl valid_host hdr(host) -i gitea.eco.tsi-dev.otc-service.com:2222"
250+
- "http-request deny if !valid_host"
251+
# Set proper host header for backend
252+
- "http-request set-header Host gitea.eco.tsi-dev.otc-service.com"
253+
domain_names:
254+
- "gitea.eco.tsi-dev.otc-service.com"
255+
servers:
256+
- name: "gitea1"
257+
address: "192.168.170.200:3000"
258+
opts: "check cookie gitea1 ssl verify none"
259+
- name: "gitea2"
260+
address: "192.168.150.200:3000"
261+
opts: "check cookie gitea2 ssl verify none"
262+
- name: "gitea3"
263+
address: "192.168.170.201:3000"
264+
opts: "check cookie gitea3 ssl verify none"
265+
241266
proxy_frontends:
242267
- name: "influx"
243268
bind: "*:8086 ssl crt /etc/ssl/{{ inventory_hostname }}/haproxy"
@@ -251,7 +276,11 @@ proxy_frontends:
251276
bind: "*:8200 ssl crt /etc/ssl/{{ inventory_hostname }}/haproxy"
252277
backend: "vault"
253278

279+
- name: "gitea-ssh"
280+
bind: "*:2222"
281+
backend: "gitea"
282+
254283
statsd_host: "192.168.14.12"
255284
statsd_port: "8125"
256285

257-
haproxy_expose_ports: ['80', '443', '8086', '8200', '8448']
286+
haproxy_expose_ports: ['80', '443', '2222', '8086', '8200', '8448']

‎inventory/service/groups.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ groups:
182182
- vault3.eco.tsi-dev.otc-service.com
183183
- gitea1.eco.tsi-dev.otc-service.com
184184
- gitea2.eco.tsi-dev.otc-service.com
185+
- gitea3.eco.tsi-dev.otc-service.com
185186
- keycloak1.eco.tsi-dev.otc-service.com
186187
- db1.cloudmon.eco.tsi-dev.otc-service.com
187188
- db2.cloudmon.eco.tsi-dev.otc-service.com
@@ -253,6 +254,7 @@ groups:
253254
gitea:
254255
- gitea1.eco.tsi-dev.otc-service.com
255256
- gitea2.eco.tsi-dev.otc-service.com
257+
- gitea3.eco.tsi-dev.otc-service.com
256258

257259
keycloak:
258260
- keycloak1.eco.tsi-dev.otc-service.com

‎inventory/service/host_vars/gitea3.eco.tsi-dev.otc-service.com.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
image: "Standard_Ubuntu_24.04_amd64_uefi_latest"
2+
flavor: "c4.xlarge.4"
3+
security_groups: ["common_sg", "gitea_sg"]
4+
nics:
5+
- fixed_ip: "192.168.170.201"
6+
net-name: "infra-net"
7+
root_volume:
8+
size: 20
9+
type: "SSD"
10+
encrypted: true
11+
kms_id: "49602830-d588-4d66-bd86-e57ea29eaed2"
12+
auto_ip: false
13+
14+
data_volumes:
15+
- name: "var"
16+
size: 100
17+
type: "SSD"
18+
encrypted: true
19+
kms_id: "49602830-d588-4d66-bd86-e57ea29eaed2"
20+
- name: "home"
21+
size: 20
22+
type: "SSD"
23+
encrypted: true
24+
kms_id: "49602830-d588-4d66-bd86-e57ea29eaed2"
25+
- name: "gitea3"
26+
size: 1024
27+
type: "SSD"
28+
encrypted: true
29+
kms_id: "49602830-d588-4d66-bd86-e57ea29eaed2"
30+
userdata: |
31+
#cloud-config
32+
disk_setup:
33+
/dev/vdb:
34+
table_type: 'mbr'
35+
layout:
36+
- 100
37+
/dev/vdc:
38+
table_type: 'mbr'
39+
layout:
40+
- 100
41+
/dev/vdd:
42+
table_type: 'mbr'
43+
layout:
44+
- 100
45+
fs_setup:
46+
- label: var
47+
filesystem: ext4
48+
device: '/dev/vdb1'
49+
- label: home
50+
filesystem: ext4
51+
device: '/dev/vdc1'
52+
- label: gitea3
53+
filesystem: ext4
54+
device: '/dev/vdd1'
55+
mounts:
56+
- [ "LABEL=home", "/home", "auto", "defaults", "0", "2" ]
57+
groups:
58+
- automation
59+
users:
60+
- default
61+
- name: automation
62+
primary_group: automation
63+
ssh_authorized_keys:
64+
- "{{ bastion_public_key }}"
65+
sudo: ALL=(ALL) NOPASSWD:ALL
66+
runcmd:
67+
- mkdir /mnt/vdb && mount /dev/vdb1 /mnt/vdb
68+
- cp -a /var/* /mnt/vdb/
69+
- umount /mnt/vdb && rmdir /mnt/vdb
70+
- echo "LABEL=var /var auto defaults,comment=cloudconfig 0 2" >> /etc/fstab
71+
- echo "LABEL=gitea3 /var/lib/gitea auto defaults 0 2" >> /etc/fstab
72+
- mount /var
73+
- mkdir -p /var/lib/gitea
74+
- mount /var/lib/gitea
75+
76+
ssl_certs:
77+
gitea:
78+
- "gitea3.eco.tsi-dev.otc-service.com"
79+
- "gitea.eco.tsi-dev.otc-service.com"
80+
gitea_cert: "gitea"
81+
82+
firewalld_extra_services_enable: ['https']
83+
firewalld_extra_ports_enable: ['2222/tcp']

‎inventory/service/host_vars/proxy1.eco.tsi-dev.otc-service.com.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ ssl_certs:
2828
- "opensearch-stg.eco.tsi-dev.otc-service.com"
2929
- "opensearch-stg-dashboard.eco.tsi-dev.otc-service.com"
3030
- "keycloak.eco.tsi-dev.otc-service.com"
31+
- "gitea.eco.tsi-dev.otc-service.com"
3132
matrix:
3233
- "matrix.otc-service.com"
3334
docs:

‎inventory/service/host_vars/proxy2.eco.tsi-dev.otc-service.com.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ ssl_certs:
2929
- "opensearch-stg.eco.tsi-dev.otc-service.com"
3030
- "opensearch-stg-dashboard.eco.tsi-dev.otc-service.com"
3131
- "keycloak.eco.tsi-dev.otc-service.com"
32+
- "gitea.eco.tsi-dev.otc-service.com"
3233
matrix:
3334
- "matrix.otc-service.com"
3435
docs:

0 commit comments

Comments
 (0)