feat(main): rewrite and update pod setup

use traefik instead of caddy, use variables where needed
2025-04-20 13:33:44 +03:00 · 2024-04-29 11:00:32 +00:00 · 2024-04-29 11:00:32 +00:00 · 742f74eec2
parent 2e8cc2f51a
commit 742f74eec2
2 changed files with 122 additions and 76 deletions
--- a/forge-pod.yml
+++ b/forge-pod.yml
@ -1,41 +1,82 @@
 # uBlue-OS forge podman deployment
+## variables will be replaces with envsubst when invoked via forge.sh
 ---
 apiVersion: v1
 kind: Pod
 metadata:
-  name: ublue-os_forge
+  name: ${FORGE_POD_NAME_REVERSE_PROXY}
+  labels:
+    traefik.enable: true
+    traefik.http.routers.traefik-dashboard.entrypoints: web,websecure
+    traefik.http.routers.traefik-dashboard.rule: Host(`traefik.${FORGE_DOMAIN_NAME}`)
+    traefik.http.services.traefik-dashboard.loadbalancer.server.port: 8080
+    traefik.http.routers.traefik-dashboard.service: api@internal
+spec:
+  securityContext:
+    seLinuxOptions:
+      type: "container_runtime_t" # needed for podman.sock access
+  restartPolicy: OnFailure
+  volumes:
+    - name: podman-socket
+      hostPath:
+        path: /run/user/${FORGE_HOST_UID}/podman/podman.sock
+        type: Socket
+    - name: ublue-os_forge-certs-pvc
+      persistentVolumeClaim:
+        claimName: ublue-os_forge-certs
+  containers:
+    - name: traefik.${FORGE_DOMAIN_NAME}
+      image: traefik # will be built on pod start
+      resources:
+        limits:
+          memory: 128Mi
+          cpu: 200m
+      volumeMounts:
+        - mountPath: /var/run/podman.sock
+          name: podman-socket
+          readOnly: true
+        - mountPath: /certs
+          name: ublue-os_forge-certs-pvc
+      ports:
+        - containerPort: 80
+          hostPort: 80
+          protocol: TCP
+        - containerPort: 443
+          hostPort: 443
+          protocol: TCP
+        - containerPort: 8080
+          hostPort: 8080
+          protocol: TCP
+  initContainers:
+    - name: minica.${FORGE_DOMAIN_NAME}
+      image: minica
+      volumeMounts:
+        - mountPath: /certs
+          name: ublue-os_forge-certs-pvc
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: ${FORGE_POD_NAME_REGISTRY}
+  labels:
+    traefik.enable: true
+    traefik.http.routers.registry.entryPoints: web,websecure
+    traefik.http.services.registry.loadbalancer.server.port: 5000
+    traefik.http.services.registry.loadbalancer.server.scheme: https
+    traefik.http.routers.registry.rule: Host(`registry.${FORGE_DOMAIN_NAME}`)
 spec:
  restartPolicy: OnFailure
  volumes:
    - name: ublue-os_forge-certs-pvc
      persistentVolumeClaim:
        claimName: ublue-os_forge-certs
-
    - name: ublue-os_forge-registry-pvc
      persistentVolumeClaim:
        claimName: ublue-os_forge-registry
-
-    - name: ublue-os_forge-semaphore-pvc
-      persistentVolumeClaim:
-        claimName: ublue-os_forge-semaphore
-
  containers:
-    - name: rvproxy.ublue.local
-      image: rvproxy
-      resources:
-        limits:
-          memory: 128Mi
-          cpu: 200m
-      volumeMounts:
-        - mountPath: /certs
-          name: ublue-os_forge-certs-pvc
-      ports:
-        - containerPort: 443
-          hostPort: 443
-          protocol: TCP
-
-    - name: registry.ublue.local
-      image: registry
+    - name: docker.${FORGE_DOMAIN_NAME}
+      image: registry # will be built on pod start
      resources:
        limits:
          memory: 512Mi
@ -43,61 +84,44 @@ spec:
      volumeMounts:
        - mountPath: /certs
          name: ublue-os_forge-certs-pvc
-          subPath: _.ublue.local
+          subPath: _.${FORGE_DOMAIN_NAME}
        - mountPath: /var/lib/registry
          name: ublue-os_forge-registry-pvc
      ports:
        - containerPort: 5000
          protocol: TCP

-    - name: semaphore.ublue.local
-      image: semaphore
-      resources:
-        limits:
-          memory: 512Mi
-          cpu: 200m
-      volumeMounts:
-        - mountPath: /var/lib/semaphore
-          name: ublue-os_forge-semaphore-pvc
-        - mountPath: /certs
-          subPath: ssh
-          name: ublue-os_forge-certs-pvc
-          readOnly: true
-      ports:
-        - containerPort: 3000
-          protocol: TCP
-
-    - name: setup.ublue.local
-      image: setup
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: ${FORGE_POD_NAME_SETUP}
+spec:
+  restartPolicy: OnFailure
+  volumes:
+    - name: ublue-os_forge-certs-pvc
+      persistentVolumeClaim:
+        claimName: ublue-os_forge-certs
+  containers:
+    - name: ansible.${FORGE_DOMAIN_NAME}
+      image: ansible # will be built on pod start
      volumeMounts:
        - mountPath: /certs
          name: ublue-os_forge-certs-pvc
          readOnly: true
      env:
-        - name: ANSIBLE_FORGE_HOST_USER
+        - name: ANSIBLE_HOST_USER
          valueFrom:
            secretKeyRef:
              name: ublue-os_forge-secure
-              key: ANSIBLE_FORGE_HOST_USER
+              key: ANSIBLE_HOST_USER

-        - name: ANSIBLE_FORGE_HOST_BECOME_PASSWORD
+        - name: ANSIBLE_HOST_BECOME_PASSWORD
          valueFrom:
            secretKeyRef:
              name: ublue-os_forge-secure
-              key: ANSIBLE_FORGE_HOST_BECOME_PASSWORD
-      workingDir: /ansible
+              key: ANSIBLE_HOST_BECOME_PASSWORD
      command:
        - ansible-playbook
      args:
-        - main.yml
-      resources:
-        limits:
-          memory: 512Mi
-          cpu: 200m
-
-  initContainers:
-    - name: minica.ublue.local
-      image: minica
-      volumeMounts:
-        - mountPath: /certs
-          name: ublue-os_forge-certs-pvc
+        - playbooks/configure_host.yml
--- a/forge.sh
+++ b/forge.sh
@ -1,4 +1,13 @@
 #!/bin/bash
+# Variables
+export FORGE_DOMAIN_NAME="ublue.local"
+export FORGE_NETWORK_NAME="ublue-os_forge"
+export FORGE_HOST_UID=$(id -u)
+export FORGE_POD_CONFIGURATION="forge-pod.yml"
+export FORGE_POD_NAME_PRE_AMBLE="ublue-os_forge-"
+export FORGE_POD_NAME_REVERSE_PROXY=${FORGE_POD_NAME_PRE_AMBLE}rvproxy
+export FORGE_POD_NAME_REGISTRY=${FORGE_POD_NAME_PRE_AMBLE}registry
+export FORGE_POD_NAME_SETUP=${FORGE_POD_NAME_PRE_AMBLE}setup

 # Functions
 function setup {
@ -6,14 +15,16 @@ function setup {
    check_prerequisites
    echo -e "${YELLOW}Creating secret configuration...${ENDCOLOR}"
    create_secrets
+    echo -e "${YELLOW}Creating podman network...${ENDCOLOR}"
+    create_network
    echo -e "${YELLOW}Heating up forge for the first time...${ENDCOLOR}"
-    podman play kube forge-pod.yml --build --replace & PID_BUILD=$!
+    cat ${FORGE_POD_CONFIGURATION} | envsubst | podman play kube --build --replace --network "${FORGE_NETWORK_NAME}" - & PID_BUILD=$!
    wait ${PID_BUILD}
-    echo -e "${YELLOW}Configuring host system...${ENDCOLOR}"
-    configure_host & PID_CONFIG=$!
+    echo -e "${YELLOW}Configuring host system pre-requisites...${ENDCOLOR}"
+    configure_host_prerequisites & PID_CONFIG=$!
    wait ${PID_CONFIG}
-    echo -e "${YELLOW}Configuring forge...${ENDCOLOR}"
-    podman logs --color -f ublue-os_forge-setup.ublue.local
+    echo -e "${YELLOW}Configuring host system...${ENDCOLOR}"
+    podman logs --color --follow "${FORGE_POD_NAME_SETUP}-ansible.${FORGE_DOMAIN_NAME}"
    echo ""
    echo -e "${YELLOW}Cleaning up secrets...${ENDCOLOR}"
    delete_secrets
@ -23,17 +34,19 @@ function setup {

 function up {
    echo -e "${YELLOW}Heating up forge...${ENDCOLOR}"
-    podman pod start ublue-os_forge
+    podman pod start ${FORGE_POD_NAME_REVERSE_PROXY}
+    podman pod start ${FORGE_POD_NAME_REGISTRY}
    echo -e "${GREEN}Done. Happy forging!${ENDCOLOR}"
 }

 function down {
    echo -e "${YELLOW}Cooling down forge...${ENDCOLOR}"
-    podman pod stop ublue-os_forge --ignore
+    podman pod stop "${FORGE_POD_NAME_REVERSE_PROXY}" --ignore
+    podman pod stop "${FORGE_POD_NAME_REGISTRY}" --ignore
    echo -e "${GREEN}Done. Have a nice day${ENDCOLOR}"
 }

-function configure_host {
+function configure_host_prerequisites {
    if [ ! -f ~/.config/.ublue-os_forge-host-setup-done ];
    then
        echo "adding ssh public key to ~/.ssh/authorized_keys"
@ -46,7 +59,7 @@ function configure_host {
        touch ~/.config/.ublue-os_forge-host-setup-done
        echo ""
    else
-        echo "Host system already configured. Nothing to do..."
+        echo "Host system pre-requisites already configured. Nothing to do..."
        echo ""
    fi
 }
@ -54,11 +67,11 @@ function configure_host {
 function create_secrets {
    # Get user input
    echo -e "${YELLOW}Gathering user input${ENDCOLOR}"
-    read -s -p "Enter sudo password for user $USER: " ANSIBLE_FORGE_HOST_BECOME_PASSWORD
+    read -s -p "Enter sudo password for user $USER: " ANSIBLE_HOST_BECOME_PASSWORD
    cat <<EOF | jq '.|map_values(@base64)' | podman secret create ublue-os_forge-secure - >/dev/null
    {
-    "ANSIBLE_FORGE_HOST_USER": "$USER",
-    "ANSIBLE_FORGE_HOST_BECOME_PASSWORD": "${ANSIBLE_FORGE_HOST_BECOME_PASSWORD}"
+    "ANSIBLE_HOST_USER": "$USER",
+    "ANSIBLE_HOST_BECOME_PASSWORD": "${ANSIBLE_HOST_BECOME_PASSWORD}"
    }
 EOF
    echo ""
@ -68,6 +81,15 @@ function delete_secrets {
    podman secret rm ublue-os_forge-secure
 }

+function create_network {
+    if ! podman network inspect "${FORGE_NETWORK_NAME}" &>/dev/null; then
+        echo "Podman network ${FORGE_NETWORK_NAME} does not exist. Creating..."
+        podman network create "${FORGE_NETWORK_NAME}"
+    else
+        echo "Podman network ${FORGE_NETWORK_NAME} already exists."
+    fi
+}
+
 function check_prerequisites {
    echo -e "${YELLOW}Checking sshd service${ENDCOLOR}"
    SSH_SERVICE_STATUS="$(systemctl is-active sshd)"
@ -88,7 +110,7 @@ function check_prerequisites {
        echo -e "${RED}Make sure to install it first.${ENDCOLOR}"
        exit 1
    else
-        echo -e "${GREEN}podman is installed${SSH_SERVICE_STATUS}${ENDCOLOR}"
+        echo -e "${GREEN}podman is installed${ENDCOLOR}"
        echo ""
    fi
    echo -e "${YELLOW}Checking jq installation${ENDCOLOR}"
@ -99,14 +121,14 @@ function check_prerequisites {
        echo -e "${RED}Make sure to install it first.${ENDCOLOR}"
        exit 1
    else
-        echo -e "${GREEN}jq is installed${SSH_SERVICE_STATUS}${ENDCOLOR}"
+        echo -e "${GREEN}jq is installed${ENDCOLOR}"
        echo ""
    fi
 }

 function show_info {
-    VOLUME_DIR="$(podman volume inspect ublue-os_forge-certs | jq -r '.[0].Mountpoint')"
-    echo -e "${GREEN}uBlue forge is available at: https://forge.ublue.local${ENDCOLOR}"
+    echo -e "${GREEN}uBlue forge reverse-proxy is available at: https://traefik.${FORGE_DOMAIN_NAME}${ENDCOLOR}"
+    echo -e "${GREEN}uBlue forge docker registry is available at: registry.${FORGE_DOMAIN_NAME}${ENDCOLOR}"
    echo -e "${GREEN}To trust the certificate in your Browser of choice, make sure to import the root certificate from:${ENDCOLOR}"
    echo -e "${GREEN}$HOME/Downloads/tls/ublue-os_forge-root.pem${ENDCOLOR}"
    echo ""