- The Netherlands
- https://d1.hackers.moe
- Joined on
2020-03-23 -
-
See 703b18ac0f/sbin/entrypoint.sh for a fairly hairy example of doing this overriding in the entrypoint and having checks for idempotent operation.
Am I right in thinking the entrypoint / command are run every time the stack is deployed
Yes. So, you need to make sure your scripting handles the case where it is run after the first time. Depends on what you need to do. Sometimes it is easy. Like, you can just touch a file or something in the volume (if you have one) for a simple "did I run this already" check.
I was really hopeful to be able to use 3rd-party images unchanged :/
Yeah totally on board with not wanting to change those images, that is kind of the main promise of this approach.
One "integrated" way to run initialisation stuff is to override the entrypoint with your own script, do your custom stuff and then call the original entrypoint script. See 9db9eca2cb/sbin/entrypoint.sh for this approach with the Alerta app. It doesn't always work because $docker. Another approach is to override the command but this often has an even less chance of success in my experience. See https://docs.docker.com/compose/compose-file/#command.
generate secrets, and store in docker secret (and pass) -- see #4 deploy (initially just wrap docker stack deploy to minimise foot-cannons)
One thought was to have a `{cocl
helpers.sh display or otherwise save generated passwords
FYI I've been first manually putting all the secrets under hosts/ in the pass store for our currently deployed infrastructure like Gitea. Yeah it would be nice to have a process / some for of automation for this.
I suppose I'll close this off since not using it.
Seems to have served some sort of purpose in the linked issue!
Maintaining the docker daemon certs for the "deploy to swarm" thing is a bit of a pain so far. Haven't figured out how to auto-refresh them and update the places where those certs need to be loaded. Maybe there is a better approach.
Ah shit, right, this is because I have the new certs (that I refreshed a few days back) setup under the autonomic-cooperative namespace in the drone config and not under yours. The kawaiipunk namespace doesn't have access to the new ones.
Practically speaking, this means doing something like this https://git.autonomic.zone/autonomic-cooperative/infrastructure/src/branch/master/scripts/dockertls.sh#L29.
Will get to this when have a bitta time. Other fix is to move it under the autonomic-cooperative namespace.
Hey, it's fixed. Turns out, I added the docker deploy secrets to the autonomic-cooperative acccount but not your individual repository here. Check the settings tab over at https://drone.autonomic.zone/kawaiipunk/walkaway-wiki/settings. Looks it is good again.
That was also related to https://git.autonomic.zone/autonomic-cooperative/infrastructure/issues/20. Smoked out another issue to be aware of... good to be dog fooding this infrastructure on a trial basis before trying to sell it out ;)