diff --git a/.drone.yml b/.drone.yml deleted file mode 100644 index 1f271998..00000000 --- a/.drone.yml +++ /dev/null @@ -1,34 +0,0 @@ ---- -kind: pipeline -type: docker -name: gitleaks - -steps: - - name: gitleaks - image: plugins/gitleaks - settings: - path: . - when: - event: - exclude: - - tag - ---- -kind: pipeline -type: docker -name: ansible-lint -steps: - - name: ansible-lint - image: quay.io/ansible/creator-ee - commands: - - ansible-lint --version - - echo $ANSIBLE_VAULT_PASSWORD > ./vault-pass.yml - - ansible-galaxy install -r requirements.yml - - ansible-lint --force-color --format pep8 - when: - event: - exclude: - - tag - environment: - ANSIBLE_VAULT_PASSWORD: - from_secret: vault-pass diff --git a/.woodpecker/ansible-lint.yml b/.woodpecker/ansible-lint.yml new file mode 100644 index 00000000..53bd46f2 --- /dev/null +++ b/.woodpecker/ansible-lint.yml @@ -0,0 +1,19 @@ +--- +kind: pipeline +type: docker +name: ansible-lint +depends_on: + - gitleaks +steps: + ansible-lint: + image: quay.io/ansible/creator-ee + commands: + - ansible-lint --version + - echo $VAULT-PASS > ./vault-pass.yml # nach des Secret in Großschreibung + - ansible-galaxy install -r requirements.yml + - ansible-lint --force-color --format pep8 + when: + event: + exclude: + - tag + secret: [vault-pass] #dieses Secret darf verwendet werden diff --git a/.woodpecker/gitleaks.yml b/.woodpecker/gitleaks.yml new file mode 100644 index 00000000..fd095d7f --- /dev/null +++ b/.woodpecker/gitleaks.yml @@ -0,0 +1,13 @@ +--- +kind: pipeline +type: docker +name: gitleaks +steps: + gitleaks: + image: zricethezav/gitleaks:latest + commands: + - gitleaks detect --no-git --verbose --source $CI_WORKSPACE + when: + event: + exclude: + - tag diff --git a/docker-compose/drone/docker-compose.yml.j2 b/docker-compose/drone/docker-compose.yml.j2 deleted file mode 100644 index 66faab36..00000000 --- a/docker-compose/drone/docker-compose.yml.j2 +++ /dev/null @@ -1,54 +0,0 @@ -version: '3.3' -services: -# server - drone: - volumes: - - 'data:/data' - environment: - DRONE_GITEA_SERVER: https://git.mgrote.net - DRONE_GITEA_CLIENT_ID: f8f0db2a-0089-4e23-9f5a-a5e52f20d765 - DRONE_GITEA_CLIENT_SECRET: {{ lookup('keepass', 'drone_gitea_client_secret', 'password') }} - DRONE_RPC_SECRET: {{ lookup('keepass', 'drone_rpc_secret', 'password') }} - DRONE_SERVER_HOST: docker10.grote.lan:81 - DRONE_SERVER_PROTO: http - DRONE_USER_CREATE: username:mg,admin:true # Gitea-Nutzer "mg" als Admin - #DRONE_LOGS_DEBUG: true - ports: - - '81:80' - - '444:443' - restart: always - container_name: drone-server - image: 'drone/drone:2' - networks: - - intern - labels: - com.centurylinklabs.watchtower.enable: true - -# runner - drone-runner-docker: - volumes: - - '/var/run/docker.sock:/var/run/docker.sock' - environment: - DRONE_RPC_PROTO: http - # container-name des servers - DRONE_RPC_HOST: drone-server - DRONE_RPC_SECRET: {{ lookup('keepass', 'drone_rpc_secret', 'password') }} - DRONE_RUNNER_CAPACITY: 8 - DRONE_RUNNER_NAME: drone-runner - ports: - - '3000:3000' - restart: always - container_name: drone-runner - image: 'drone/drone-runner-docker:latest' - networks: - - intern - labels: - com.centurylinklabs.watchtower.enable: true - com.centurylinklabs.watchtower.depends-on: drone-server - -######## Volumes ######## -volumes: - data: -######## Networks ######## -networks: - intern: # hier kommunizieren Runner + Server diff --git a/docker-compose/homer/assets/config.yml b/docker-compose/homer/assets/config.yml index 22029a68..768f2b59 100644 --- a/docker-compose/homer/assets/config.yml +++ b/docker-compose/homer/assets/config.yml @@ -33,14 +33,14 @@ services: # - name: "Weather" # location: "Burg" # your location. # locationId: "2941501" # OpenWeatherMap city ID. -# apiKey: "c1ec4c040abfa80b991c72d48b49d4a0" # insert your own API key here. Request one from https://o#penweathermap.org/api. # key deactiviert +# apiKey: "c1ec4c040abfa80b991c72d48b49d4a0" # insert your own API key here. Request one from https://o#penweathermap.org/api. # key deactiviert #gitleaks:allow # units: "metric" # units to display temperature. Can be one of: metric, imperial, kelvin. Defaults to kelvin. # background: "none" # choose which type of background you want behind the image. Can be one of: square, cicle, none. Defaults to none. # type: "OpenWeather" # - name: "Weather" # location: "Magdeburg" # locationId: "2874545" -# apiKey: "c1ec4c040abfa80b991c72d48b49d4a0" +# apiKey: "c1ec4c040abfa80b991c72d48b49d4a0" #gitleaks:allow # units: "metric" # background: "none" # type: "OpenWeather" diff --git a/docker-compose/homer/assets/icons/woodpecker.svg b/docker-compose/homer/assets/icons/woodpecker.svg new file mode 100644 index 00000000..7cf777c4 --- /dev/null +++ b/docker-compose/homer/assets/icons/woodpecker.svg @@ -0,0 +1,10 @@ + + + + diff --git a/docker-compose/homer/assets/mgmt.yml b/docker-compose/homer/assets/mgmt.yml index 4b319722..16ff7c72 100644 --- a/docker-compose/homer/assets/mgmt.yml +++ b/docker-compose/homer/assets/mgmt.yml @@ -51,11 +51,6 @@ services: url: "https://docker10.grote.lan:8443" target: "_blank" subtitle: "WLAN" - - name: "drone.io" - logo: "assets/icons/drone.png" - url: "http://docker10.grote.lan:81" - target: "_blank" - subtitle: "CI/CD" - name: "httpd" logo: "assets/icons/roundcube.png" url: "http://docker10.grote.lan:3344" @@ -66,6 +61,11 @@ services: url: "https://registry.mgrote.net/ui/index.html" target: "_blank" subtitle: "Container-Registry" + - name: "Woodpecker" + logo: "assets/icons/woodpecker.svg" + url: "http://docker10.grote.lan:8000" + target: "_blank" + subtitle: "CI/CD" - name: "Infra" icon: "fas fa-cloud" diff --git a/docker-compose/woodpecker/docker-compose.yml.j2 b/docker-compose/woodpecker/docker-compose.yml.j2 new file mode 100644 index 00000000..f31e1b94 --- /dev/null +++ b/docker-compose/woodpecker/docker-compose.yml.j2 @@ -0,0 +1,57 @@ +# https://woodpecker-ci.org/docs/administration/setup +version: '3' + +services: + woodpecker-server: + container_name: woodpecker-server + image: woodpeckerci/woodpecker-server:latest + ports: + - 8000:8000 + volumes: + - server-data:/var/lib/woodpecker/ + environment: + WOODPECKER_OPEN: false + WOODPECKER_HOST: http://docker10.grote.lan:8000 + WOODPECKER_GITEA: true + WOODPECKER_GITEA_URL: https://git.mgrote.net + WOODPECKER_GITEA_CLIENT: {{ lookup('keepass', 'woodpecker-oauth2-client-id', 'password') }} + WOODPECKER_GITEA_SECRET: {{ lookup('keepass', 'woodpecker-oauth2-client-secret', 'password') }} + WOODPECKER_AGENT_SECRET: {{ lookup('keepass', 'woodpecker-agent-secret', 'password') }} + WOODPECKER_ADMIN: mg + WOODPECKER_LOG_LEVEL: info + WOODPECKER_DEBUG_PRETTY: true + + labels: + com.centurylinklabs.watchtower.enable: true + + woodpecker-agent: + container_name: woodpecker-agent + image: woodpeckerci/woodpecker-agent:latest + command: agent + restart: always + depends_on: + - woodpecker-server + ports: + - 3032:3000 + volumes: + - agent-config:/etc/woodpecker + - /var/run/docker.sock:/var/run/docker.sock + environment: + WOODPECKER_SERVER: woodpecker-server:9000 + WOODPECKER_AGENT_SECRET: {{ lookup('keepass', 'woodpecker-agent-secret', 'password') }} + WOODPECKER_MAX_WORKFLOWS: 4 + WOODPECKER_DEBUG_PRETTY: true + WOODPECKER_LOG_LEVEL: info + WOODPECKER_HEALTHCHECK: true + WOODPECKER_BACKEND: docker + labels: + com.centurylinklabs.watchtower.enable: true + +volumes: + server-data: + agent-config: + +# git.mgrote.net -> Settings -> Applications -> woodpecker +# WOODPECKER_GITEA_CLIENT: {{ lookup('keepass', 'woodpecker-oauth2-client-id', 'password') }} +# WOODPECKER_GITEA_SECRET: {{ lookup('keepass', 'woodpecker-oauth2-client-secret', 'password') }} +# Redirect URL: http://docker10.grote.lan:8000/authorize diff --git a/host_vars/docker10.grote.lan.yml b/host_vars/docker10.grote.lan.yml index df5d2e69..c128054a 100644 --- a/host_vars/docker10.grote.lan.yml +++ b/host_vars/docker10.grote.lan.yml @@ -31,8 +31,6 @@ compose_files: network: traefik - name: homer state: present - - name: drone - state: present - name: nextcloud state: present network: traefik @@ -56,6 +54,8 @@ compose_files: - name: mail-relay state: present network: mail-relay + - name: woodpecker + state: present ### oefenweb.ufw ufw_rules: diff --git a/keepass_db.kdbx b/keepass_db.kdbx index d3116b1a..ec25079f 100644 Binary files a/keepass_db.kdbx and b/keepass_db.kdbx differ