Compare commits

...

14 Commits

Author SHA1 Message Date
0de3569c5e
Enable memcached-formula
Some checks failed
ci/lysergic/push/pipeline Pipeline failed
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-22 20:40:34 +01:00
f5ab12d735
role.bookstack: include memcached
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:45:56 +01:00
8dd527e5dd
Add memcached role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:45:56 +01:00
c79d6c0082
profile.apache-httpd: manage snippets
- add apache-httpd profile with snippets configuration
- add TLS snippet to apache-httpd role pillar

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:45:30 +01:00
fc63e97803
id.themis: add BookStack configuration
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:45:28 +01:00
54f441aa83
id.themis: add BookStack httpd configuration
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:45:23 +01:00
eaf402b551
Add bookstack profile+role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:35:24 +01:00
c9005950dc
Add web.apache-httpd role
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:35:24 +01:00
e2d3dfacba
Enable apache-formula
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-20 19:35:24 +01:00
a705925aa6 Merge pull request 'Commmit lint: allow pipeline + more characters' (#37) from commit-lint into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #37
2023-02-20 19:34:14 +01:00
0c8e3159d3
pipeline.gommit: allow pipeline + more characters
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
- allow pipeline.* prefix
- allow some special characters in summary

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 22:18:43 +01:00
6e43bbbe44 Merge pull request 'Enable commit message linting' (#36) from commit-lint into production
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Reviewed-on: #36
Reviewed-by: Pratyush Desai <pratyush.desai@liberta.casa>
2023-02-19 20:54:59 +01:00
68e41ceab8
Enable commit linting
All checks were successful
ci/lysergic/push/pipeline Pipeline was successful
Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 20:43:10 +01:00
d082729a66
Add commit linting
- add gommit configuration
- add wrapper script

Signed-off-by: Georg Pfuetzenreuter <mail@georg-pfuetzenreuter.net>
2023-02-19 20:43:09 +01:00
12 changed files with 276 additions and 1 deletions

23
.gommit.toml Normal file
View File

@ -0,0 +1,23 @@
[config]
exclude-merge-commits=true
check-summary-length=true
summary-length=50
[matchers]
all='^(?:(?:Add|Remove|Update|Enable|Disable) |(?:role|profile|id|pipeline)\.\w+: )[\w \.\+\-]+\n(?:(?:\n\- .*)+\n)?(?:\nSigned-off-by: \w+ \w+ <.*@.*>)'
[examples]
summary_variant_one="""
[Add|Remove|Update|Enable|Disable] this and that
"""
summary_variant_two="""
[role.$role|profile.$profile]: this and that
"""
body_message="""
- an optional body line
- another optional body line
Signed-off-by: Max Mandatory <required@example.com>
"""

View File

@ -3,7 +3,17 @@
skip_clone: true
pipeline:
lint:
commit_lint:
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-gommit:latest
secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
when:
event: [push]
commands:
- git clone --single-branch -b $CI_COMMIT_BRANCH $CI_REPO_LINK ../salt-libertacasa-commit-linting
- cd ../salt-libertacasa-commit-linting
- bin/lint-commits.pl production
code_lint:
image: registry.opensuse.org/home/crameleon/libertacasa/containers/containerfile/libertacasa/pipeline-lint:latest
secrets: [ci_netrc_username, ci_netrc_password, ci_netrc_machine]
when:

39
bin/lint-commits.pl Executable file
View File

@ -0,0 +1,39 @@
#!/usr/bin/perl
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
use v5.26;
my ($branch_main) = @ARGV;
if(!$branch_main){
$branch_main = "master"
}
`git ls-remote origin $branch_main` =~ /([a-f0-9]{40})/;
my $refHead = `git rev-parse HEAD`;
my $refTail = $1;
chomp($refHead);
chomp($refTail);
if ($refHead eq $refTail) {
exit 0;
}
system "gommit check range $refTail $refHead";
if ($? > 0) {
exit 1;
}

View File

@ -1,6 +1,8 @@
---
- apache
- firewalld
- keepalived
- memcached
- nginx
- openssh
- postfix

View File

@ -0,0 +1,77 @@
apache:
sites:
BookStack:
interface: '[fd29:8e45:f292:ff80::1]'
port: 443
ServerName: bookstack.themis.backend.syscid.com
DocumentRoot: /srv/www/BookStack/
DirectoryIndex: index.php
Directory:
/srv/www/BookStack/:
Options: 'Indexes FollowSymLinks -MultiViews'
AllowOverride: None
Require: all granted
Formula_Append: |
RewriteEngine On
RewriteCond '%{HTTP:Authorization} .'
RewriteCond '.* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]'
RewriteCond '%{REQUEST_FILENAME} !-d'
RewriteCond '%{REQUEST_URI} (.+)/$'
RewriteCond '^ %1 [L,R=301]'
RewriteCond '%{REQUEST_FILENAME} !-d'
RewriteCond '%{REQUEST_FILENAME} !-f'
RewriteCond '^ index.php [L]'
LogLevel: False
ErrorLog: False
LogFormat: False
CustomLog: False
ServerAdmin: False
ServerAlias: False
Formula_Append: |
Include /etc/apache2/snippets.d/ssl_themis.conf
AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
SetOutputFilter DEFLATE
<FilesMatch '\.php$'>
SetHandler 'proxy:unix:/run/php-fpm/BookStack.sock|fcgi://BookStack'
</FilesMatch>
profile:
bookstack:
app_url: https://libertacasa.info
db_host: ${'secret_bookstack:db_host'}
db_database: ${'secret_bookstack:db_database'}
db_username: ${'secret_bookstack:db_username'}
db_password: ${'secret_bookstack:db_password'}
mail_driver: smtp
mail_from_name: LibertaCasa Documentation
mail_from: mail@libertacasa.info
mail_host: zz0.email
mail_port: 465
mail_username: mail@libertacasa.info
mail_password: ${'secret_bookstack:mail_password'}
mail_encryption: ssl
app_theme: lysergic
cache_driver: memcached
session_driver: memcached
memcached_servers: /run/memcached/memcached.sock
session_secure_cookie: true
session_cookie_name: libertacasa_megayummycookie
app_debug: false
session_lifetime: 240
auth_method: saml2
auth_auto_initiate: true
saml2_name: LibertaCasa SSO
saml2_email_attribute: email
saml2_external_id_attribute: uid
saml2_display_name_attributes: fullname
saml2_idp_entityid: https://libsso.net/realms/libertacasa
saml2_idp_sso: https://libsso.net/realms/libertacasa/protocol/saml
saml2_idp_slo: https://libsso.net/realms/libertacasa/protocol/saml
saml2_idp_x509: ${'secret_bookstack:saml2_idp_x509'}
saml2_autoload_metadata: false
saml2_sp_x509: ${'secret_bookstack:saml2_sp_x509'}
saml2_sp_x509_key: ${'secret_bookstack:saml2_sp_x509_key'}
saml2_user_to_groups: true
saml2_group_attribute: groups
saml2_remove_from_groups: true
queue_connection: database

View File

@ -0,0 +1,2 @@
memcached:
listen_address: /run/memcached/memcached.sock

View File

@ -0,0 +1,13 @@
{%- set host = grains['host'] -%}
{%- set fqdn = grains['fqdn'] -%}
apache:
global:
ServerAdmin: system@lysergic.dev
profile:
apache-httpd:
snippets:
ssl_{{ host }}:
- 'SSLCertificateFile "/etc/ssl/{{ host }}/{{ fqdn }}.crt"'
- 'SSLCertificateKeyFile "/etc/ssl/{{ host }}/{{ fqdn }}.key"'

View File

@ -0,0 +1,31 @@
{%- set snippetsdir = '/etc/apache2/snippets.d' -%}
{%- set mypillar = salt['pillar.get']('profile:apache-httpd', {}) -%}
{{ snippetsdir }}:
file.directory:
- makedirs: True
{%- if 'snippets' in mypillar %}
{%- for snippet, config in mypillar['snippets'].items() %}
{{ snippetsdir }}/{{ snippet }}.conf:
file.managed:
- contents:
{%- for line in config %}
- {{ line }}
{%- endfor %}
- require:
- file: {{ snippetsdir }}
{#- formula dependencies #}
- require_in:
- module: apache-service-running-restart
- service: apache-service-running
- watch_in:
- module: apache-service-running-reload
{%- endfor %}
{%- endif %}
include:
- apache.config

View File

@ -0,0 +1,70 @@
{%- set mypillar = salt['pillar.get']('profile:bookstack', {}) -%}
{%- set configfile = '/etc/sysconfig/BookStack' -%}
bookstack_packages:
pkg.installed:
- names:
- BookStack-config-php-fpm-apache
bookstack_permissions:
file.managed:
- mode: '0640'
- user: root
- group: wwwrun
- names:
- {{ configfile }}
{%- if mypillar | length %}
{{ configfile }}:
file.keyvalue:
- separator: '='
- show_changes: False
- require:
- pkg: bookstack_packages
- key_values:
{%- macro condconf(option) %}
{%- if option in mypillar %}
{{ option | upper }}: {{ mypillar[option] }}
{%- endif %}
{%- endmacro %}
{{ condconf('app_url') }}
{{ condconf('db_host') }}
{{ condconf('db_database') }}
{{ condconf('db_username') }}
{{ condconf('db_password') }}
{{ condconf('mail_driver') }}
{{ condconf('mail_from_name') }}
{{ condconf('mail_from') }}
{{ condconf('mail_host') }}
{{ condconf('mail_port') }}
{{ condconf('mail_username') }}
{{ condconf('mail_password') }}
{{ condconf('mail_encryption') }}
{{ condconf('app_theme') }}
{{ condconf('cache_driver') }}
{{ condconf('session_driver') }}
{{ condconf('memcached_servers') }}
{{ condconf('session_secure_cookie') }}
{{ condconf('session_cookie_name') }}
{{ condconf('app_debug') }}
{{ condconf('session_lifetime') }}
{{ condconf('auth_method') }}
{{ condconf('auth_auto_initiate') }}
{{ condconf('saml2_name') }}
{{ condconf('saml2_email_attribute') }}
{{ condconf('saml2_external_id_attribute') }}
{{ condconf('saml2_display_name_attributes') }}
{{ condconf('saml2_idp_entityid') }}
{{ condconf('saml2_idp_entityid') }}
{{ condconf('saml2_idp_sso') }}
{{ condconf('saml2_idp_slo') }}
{{ condconf('saml2_idp_x509') }}
{{ condconf('saml2_autoload_metadata') }}
{{ condconf('saml2_sp_x509') }}
{{ condconf('saml2_user_to_groups') }}
{{ condconf('saml2_group_attribute') }}
{{ condconf('saml2_remove_from_groups') }}
{{ condconf('saml2_dump_user_details') }}
{{ condconf('queue_connection') }}
{{ condconf('app_views_books') }}
{%- endif %}

4
salt/role/bookstack.sls Normal file
View File

@ -0,0 +1,4 @@
include:
- role.web.apache-httpd
- role.memcached
- profile.bookstack

2
salt/role/memcached.sls Normal file
View File

@ -0,0 +1,2 @@
include:
- memcached.config

View File

@ -0,0 +1,2 @@
include:
- profile.apache-httpd