Drone, OIDC, smtpauth
continuous-integration/drone/push Build is failing
Details
continuous-integration/drone/push Build is failing
Details
This commit is contained in:
parent
f4f0ec9b7f
commit
1ddb432f16
19
.drone.yml
19
.drone.yml
|
@ -0,0 +1,19 @@
|
|||
---
|
||||
kind: pipeline
|
||||
name: deploy to swarm-test.autonomic.zone
|
||||
steps:
|
||||
- name: deployment
|
||||
image: decentral1se/stack-ssh-deploy:latest
|
||||
settings:
|
||||
host: swarm-test.autonomic.zone
|
||||
stack: ${REPO_NAME_SNAKE}
|
||||
purge: true
|
||||
deploy_key:
|
||||
from_secret: drone_ssh_swarm_test
|
||||
environment:
|
||||
DOMAIN: ${REPO_NAME_KEBAB}.swarm-test.autonomic.zone
|
||||
STACK_NAME: ${REPO_NAME_SNAKE}
|
||||
LETS_ENCRYPT_ENV: production
|
||||
trigger:
|
||||
branch:
|
||||
- main
|
|
@ -33,3 +33,11 @@ PENPOT_SMTP_DEFAULT_REPLY_TO=penpot@example.com
|
|||
#PENPOT_SMTP_PASSWORD=password
|
||||
#PENPOT_SMTP_TLS=true
|
||||
#PENPOT_SMTP_SSL=false
|
||||
|
||||
SECRET_DB_PASSWORD_VERSION=v1
|
||||
SECRET_SMTP_PASSWORD_VERSION=v1
|
||||
|
||||
#PENPOT_OIDC_BASE_URI=
|
||||
#PENPOT_OIDC_CLIENT_ID=
|
||||
#PENPOT_OIDC_CLIENT_SECRET=
|
||||
#SECRET_OIDC_CLIENT_SECRET_VERSION=v1
|
||||
|
|
|
@ -0,0 +1 @@
|
|||
/.envrc
|
|
@ -0,0 +1,2 @@
|
|||
export APP_ENTRYPOINT_CONF_VERSION=v1
|
||||
export BACKEND_ENTRYPOINT_CONF_VERSION=v3
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
app:
|
||||
environment:
|
||||
# - PENPOT_OIDC_CLIENT_ID
|
||||
- PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
|
||||
penpot-backend:
|
||||
environment:
|
||||
# - PENPOT_OIDC_CLIENT_SECRET_FILE=/run/secrets/oidc_client_secret
|
||||
# - PENPOT_OIDC_CLIENT_ID
|
||||
# - PENPOT_OIDC_BASE_URI
|
||||
# - PENPOT_OIDC_CLIENT_SECRET=cdbafaf5-eec7-424d-8449-4393481cba2a
|
||||
- PENPOT_GITHUB_CLIENT_ID=af6c1b2e4709ede26aa8
|
||||
- PENPOT_GITHUB_CLIENT_SECRET=a4faabb76fb5e1916328498af202fe85a81873fd
|
||||
secrets:
|
||||
- oidc_client_secret
|
||||
|
||||
secrets:
|
||||
oidc_client_secret:
|
||||
external: true
|
||||
name: ${STACK_NAME}_oidc_client_secret_${SECRET_OIDC_CLIENT_SECRET_VERSION}
|
|
@ -0,0 +1,19 @@
|
|||
---
|
||||
version: "3.8"
|
||||
|
||||
services:
|
||||
app:
|
||||
environment:
|
||||
- PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
|
||||
secrets:
|
||||
- smtp_password
|
||||
penpot-backend:
|
||||
environment:
|
||||
- PENPOT_SMTP_PASSWORD_FILE=/var/run/secrets/smtp_password
|
||||
secrets:
|
||||
- smtp_password
|
||||
|
||||
secrets:
|
||||
smtp_password:
|
||||
external: true
|
||||
name: ${STACK_NAME}_smtp_password_${SECRET_SMTP_PASSWORD_VERSION}
|
79
compose.yml
79
compose.yml
|
@ -1,7 +1,27 @@
|
|||
version: "3.8"
|
||||
|
||||
x-environment:
|
||||
&default-env
|
||||
- PENPOT_PUBLIC_URI=https://{domain}
|
||||
- PENPOT_DATABASE_URI=postgresql://postgres/penpot
|
||||
- PENPOT_DATABASE_USERNAME=penpot
|
||||
- PENPOT_DATABASE_PASSWORD_FILE=/run/secrets/db_password
|
||||
- PENPOT_REDIS_URI=redis://redis/0
|
||||
- PENPOT_STORAGE_BACKEND
|
||||
- PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
|
||||
- PENPOT_TELEMETRY_ENABLED
|
||||
- PENPOT_SMTP_ENABLED
|
||||
- PENPOT_SMTP_DEFAULT_FROM
|
||||
- PENPOT_SMTP_DEFAULT_REPLY_TO
|
||||
- PENPOT_SMTP_HOST
|
||||
- PENPOT_SMTP_PORT
|
||||
- PENPOT_SMTP_USERNAME
|
||||
- PENPOT_SMTP_TLS
|
||||
- PENPOT_SMTP_SSL
|
||||
|
||||
services:
|
||||
app:
|
||||
image: "penpotapp/frontend:1.6.5-alpha"
|
||||
image: "penpotapp/frontend:1.7.1-alpha"
|
||||
networks:
|
||||
- proxy
|
||||
- backend
|
||||
|
@ -10,6 +30,14 @@ services:
|
|||
depends_on:
|
||||
- penpot-backend
|
||||
- penpot-exporter
|
||||
environment: *default-env
|
||||
entrypoint: /entrypoint.override.sh
|
||||
secrets:
|
||||
- db_password
|
||||
configs:
|
||||
- source: app_entrypoint
|
||||
target: /entrypoint.override.sh
|
||||
mode: 0555
|
||||
deploy:
|
||||
restart_policy:
|
||||
condition: on-failure
|
||||
|
@ -25,30 +53,20 @@ services:
|
|||
- "traefik.http.middlewares.${STACK_NAME}-redirect.headers.SSLHost=${DOMAIN}"
|
||||
- coop-cloud.${STACK_NAME}.app.version=1.4.0-alpha-5d926f43
|
||||
penpot-backend:
|
||||
image: "penpotapp/backend:1.6.5-alpha"
|
||||
image: "penpotapp/backend:1.7.1-alpha"
|
||||
volumes:
|
||||
- penpot_assets:/opt/data
|
||||
depends_on:
|
||||
- postgres
|
||||
- redis
|
||||
environment:
|
||||
- PENPOT_PUBLIC_URI=https://{domain}
|
||||
- PENPOT_DATABASE_URI=postgresql://postgres/penpot
|
||||
- PENPOT_DATABASE_USERNAME=penpot
|
||||
- PENPOT_DATABASE_PASSWORD=penpot
|
||||
- PENPOT_REDIS_URI=redis://redis/0
|
||||
- PENPOT_STORAGE_BACKEND=${PENPOT_STORAGE_BACKEND}
|
||||
- PENPOT_STORAGE_FS_DIRECTORY=/opt/data/assets
|
||||
- PENPOT_TELEMETRY_ENABLED=${PENPOT_TELEMETRY_ENABLED}
|
||||
- PENPOT_SMTP_ENABLED=${PENPOT_SMTP_ENABLED}
|
||||
- PENPOT_SMTP_DEFAULT_FROM=${PENPOT_SMTP_DEFAULT_FROM}
|
||||
- PENPOT_SMTP_DEFAULT_REPLY_TO=${PENPOT_SMTP_DEFAULT_REPLY_TO}
|
||||
- PENPOT_SMTP_HOST=${PENPOT_SMTP_HOST}
|
||||
- PENPOT_SMTP_PORT=${PENPOT_SMTP_PORT}
|
||||
- PENPOT_SMTP_USERNAME=${PENPOT_SMTP_USERNAME}
|
||||
- PENPOT_SMTP_PASSWORD=${PENPOT_SMTP_PASSWORD}
|
||||
- PENPOT_SMTP_TLS=${PENPOT_SMTP_TLS}
|
||||
- PENPOT_SMTP_SSL=${PENPOT_SMTP_SSL}
|
||||
environment: *default-env
|
||||
secrets:
|
||||
- db_password
|
||||
configs:
|
||||
- source: backend_entrypoint
|
||||
target: /docker-entrypoint.sh
|
||||
mode: 0555
|
||||
entrypoint: /docker-entrypoint.sh
|
||||
networks:
|
||||
- backend
|
||||
# FIXME 3wc: this is only required for email
|
||||
|
@ -57,7 +75,7 @@ services:
|
|||
labels:
|
||||
- coop-cloud.${STACK_NAME}.penpot-backend.version=1.4.0-alpha-
|
||||
penpot-exporter:
|
||||
image: "penpotapp/exporter:1.6.5-alpha"
|
||||
image: "penpotapp/exporter:1.7.1-alpha"
|
||||
environment:
|
||||
# Don't touch it; this uses internal docker network to
|
||||
# communicate with the frontend.
|
||||
|
@ -70,11 +88,13 @@ services:
|
|||
postgres:
|
||||
image: "postgres:13"
|
||||
stop_signal: SIGINT
|
||||
secrets:
|
||||
- db_password
|
||||
environment:
|
||||
- POSTGRES_INITDB_ARGS=--data-checksums
|
||||
- POSTGRES_DB=penpot
|
||||
- POSTGRES_USER=penpot
|
||||
- POSTGRES_PASSWORD=penpot
|
||||
- POSTGRES_PASSWORD_FILE=/run/secrets/db_password
|
||||
volumes:
|
||||
- postgres:/var/lib/postgresql/data
|
||||
networks:
|
||||
|
@ -89,10 +109,25 @@ services:
|
|||
deploy:
|
||||
labels:
|
||||
- coop-cloud.${STACK_NAME}.redis.version=6-e10f55f9
|
||||
|
||||
networks:
|
||||
proxy:
|
||||
external: true
|
||||
backend:
|
||||
|
||||
volumes:
|
||||
postgres:
|
||||
penpot_assets:
|
||||
|
||||
configs:
|
||||
app_entrypoint:
|
||||
name: ${STACK_NAME}_app_entrypoint_${APP_ENTRYPOINT_CONF_VERSION}
|
||||
file: entrypoint-app.sh
|
||||
backend_entrypoint:
|
||||
name: ${STACK_NAME}_backend_entrypoint_${BACKEND_ENTRYPOINT_CONF_VERSION}
|
||||
file: entrypoint-backend.sh
|
||||
|
||||
secrets:
|
||||
db_password:
|
||||
external: true
|
||||
name: ${STACK_NAME}_db_password_${SECRET_DB_PASSWORD_VERSION}
|
||||
|
|
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "PENPOT_DATABASE_PASSWORD"
|
||||
file_env "PENPOT_SMTP_PASSWORD"
|
||||
file_env "PENPOT_LDAP_BIND_PASSWORD"
|
||||
file_env "PENPOT_GOOGLE_CLIENT_SECRET"
|
||||
file_env "PENPOT_GITHUB_CLIENT_SECRET"
|
||||
file_env "PENPOT_GITLAB_CLIENT_SECRET"
|
||||
file_env "PENPOT_OIDC_CLIENT_SECRET"
|
||||
}
|
||||
|
||||
main() {
|
||||
set -eu
|
||||
|
||||
load_vars
|
||||
}
|
||||
|
||||
main
|
||||
|
||||
# 3wc: upstream ENTRYPOINT
|
||||
# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.frontend
|
||||
/docker-entrypoint.sh nginx -g "daemon off;"
|
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
file_env() {
|
||||
# 3wc: Load $VAR_FILE into $VAR - useful for secrets. See
|
||||
# https://medium.com/@adrian.gheorghe.dev/using-docker-secrets-in-your-environment-variables-7a0609659aab
|
||||
local var="$1"
|
||||
local fileVar="${var}_FILE"
|
||||
local def="${2:-}"
|
||||
|
||||
if [ "${!var:-}" ] && [ "${!fileVar:-}" ]; then
|
||||
echo >&2 "error: both $var and $fileVar are set (but are exclusive)"
|
||||
exit 1
|
||||
fi
|
||||
local val="$def"
|
||||
if [ "${!var:-}" ]; then
|
||||
val="${!var}"
|
||||
elif [ "${!fileVar:-}" ]; then
|
||||
val="$(< "${!fileVar}")"
|
||||
fi
|
||||
export "$var"="$val"
|
||||
unset "$fileVar"
|
||||
}
|
||||
|
||||
load_vars() {
|
||||
file_env "PENPOT_DATABASE_PASSWORD"
|
||||
file_env "PENPOT_SMTP_PASSWORD"
|
||||
file_env "PENPOT_LDAP_BIND_PASSWORD"
|
||||
file_env "PENPOT_GOOGLE_CLIENT_SECRET"
|
||||
file_env "PENPOT_GITHUB_CLIENT_SECRET"
|
||||
file_env "PENPOT_GITLAB_CLIENT_SECRET"
|
||||
file_env "PENPOT_OIDC_CLIENT_SECRET"
|
||||
}
|
||||
|
||||
main() {
|
||||
set -eu
|
||||
|
||||
load_vars
|
||||
}
|
||||
|
||||
main
|
||||
|
||||
# 3wc: upstream ENTRYPOINT
|
||||
# https://github.com/penpot/penpot/blob/develop/docker/images/Dockerfile.backend
|
||||
./run.sh
|
Loading…
Reference in New Issue