From dc6c7cbfb78de0e66205030d19233ccd2647688e Mon Sep 17 00:00:00 2001 From: June Date: Sat, 1 Nov 2025 17:53:08 +0100 Subject: [PATCH] sunders(host): deploy sunders using docker compose https://git.hamburg.ccc.de/CCCHH/sunders --- .../chaosknoten/host_vars/sunders.sops.yaml | 9 ++- .../chaosknoten/host_vars/sunders.yaml | 13 +++++ inventories/chaosknoten/hosts.yaml | 3 + .../nginx/acme_challenge.conf | 1 + .../public-reverse-proxy/nginx/nginx.conf | 1 + .../sunders/docker_compose/compose.yaml.j2 | 57 +++++++++++++++++++ .../sunders/nginx/sunders.hamburg.ccc.de.conf | 42 ++++++++++++++ 7 files changed, 123 insertions(+), 3 deletions(-) create mode 100644 inventories/chaosknoten/host_vars/sunders.yaml create mode 100644 resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 create mode 100644 resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf diff --git a/inventories/chaosknoten/host_vars/sunders.sops.yaml b/inventories/chaosknoten/host_vars/sunders.sops.yaml index 98b3917..559bc80 100644 --- a/inventories/chaosknoten/host_vars/sunders.sops.yaml +++ b/inventories/chaosknoten/host_vars/sunders.sops.yaml @@ -1,4 +1,7 @@ ansible_pull__age_private_key: ENC[AES256_GCM,data:tP84jDYh2zeWjf7wqDoefm9zaeg/Q2TWUyIstOcrjYHgrZdGLk64skLuGyH5q4FxQL9QEhe9qBT+AAxxKE6fU630/M1LVOR4Sls=,iv:I9W6KxIoisJFFMtOrN5u8KgnsmuIgF9RvzWanLNGVVM=,tag:w9bhDahR4Ai4/nLLeR58lA==,type:str] +secret__sunders_db_root_password: ENC[AES256_GCM,data:m3Xt6dOKibRflon/rWG9KmdBPHEBbqE/GIpKdFI1Di7Lpl/THxzrgx12mTK6aZnwDrM=,iv:hD/UGwo88ye9CxyTCEQ0SVon2+ipPjeA9NF2/OhYwmc=,tag:DRdQ5hvTgUO5FVae/ul7kQ==,type:str] +secret__sunders_db_camera_password: ENC[AES256_GCM,data:tOt4ImpedgfGvRpcThPO30YyEl/bP244ruJQzAYodJIsEhFuk5LxHpPASEnsqlN6m3M=,iv:rQXBjiYWZlzeUdaqDdTlrdbSSqGaPDeZOPhUaMjgcjU=,tag:lkSlIdJWFowyPfWEjpC/Zg==,type:str] +secret__sunders_db_camera_select_password: ENC[AES256_GCM,data:PveGcD2WmvpMc8bafGY1c45aQ2XH/ym2yj5YacauQPeZO6Xem3kaxU0kwjs0Wd26ugc=,iv:tk288L9i0lxsJbTFq5ET5IiKkJfMQwc6uKNFXILcD7o=,tag:hOIivp3mOtDNBCsKvrSrBw==,type:str] sops: age: - recipient: age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd @@ -10,8 +13,8 @@ sops: S3NiK3R6UWQ5UU0xUmYwa1hqMUo5c28K4EVQwBcALc6k53CNsemfMy2s6AGO5LJf 3U1zeFtEcsvEnUfkvFT//M7cB6pUqQF0KIq1VnnFoQF7IpvSN23lxg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-10-14T23:43:05Z" - mac: ENC[AES256_GCM,data:15TRSKlDhjQy3yMcFhz2Den2YorcrpJmCw0BVl10qlG8u9G7Vw/7aV/hJnZdkCz3w1ZkEbNS6DCKxCLs1Qgf2SEPaG/cRraO2mcl+YH7k4gb5LMzu81fRkbCx66B4LG+DY8fsAJeO4mxui2m0ZAHb2SNFIP4Q4vdLav3jTaiwAc=,iv:71qa6JTc+S5MLynGc27tx1WBGrpvTCSCoEv01SZnPF8=,tag:ju4WP1MK1/sWw7TAitzM0Q==,type:str] + lastmodified: "2025-11-01T16:32:10Z" + mac: ENC[AES256_GCM,data:8Q6DBSFtzwHuVxduRlZYxlRWO0trSoesNGUR8r/dWnp9ashFBSZqVyffXb4Vq6DB5thANJ6/b3PCNsHdiAKn6Ai2UT8G0HimFjUUgNpZxo4xoNGmDhDvfdBgUL6O2pHhY+ojjguUXDYeYc99+eaxfKqZ3w+PAPaySltKm99foz8=,iv:ILOErdiWbUjk9kovXXZYcAqZFQp2Wo1Tm14sgK3niWg=,tag:Q2gT6wbQyhDXjoQEG2Lngw==,type:str] pgp: - created_at: "2025-10-15T08:45:25Z" enc: |- @@ -207,4 +210,4 @@ sops: -----END PGP MESSAGE----- fp: 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533 unencrypted_suffix: _unencrypted - version: 3.10.2 + version: 3.11.0 diff --git a/inventories/chaosknoten/host_vars/sunders.yaml b/inventories/chaosknoten/host_vars/sunders.yaml new file mode 100644 index 0000000..b3d50d8 --- /dev/null +++ b/inventories/chaosknoten/host_vars/sunders.yaml @@ -0,0 +1,13 @@ +docker_compose__compose_file_content: "{{ lookup('ansible.builtin.template', 'resources/chaosknoten/sunders/docker_compose/compose.yaml.j2') }}" + +certbot__version_spec: "" +certbot__acme_account_email_address: le-admin@hamburg.ccc.de +certbot__certificate_domains: + - "sunders.hamburg.ccc.de" +certbot__new_cert_commands: + - "systemctl reload nginx.service" + +nginx__version_spec: "" +nginx__configurations: + - name: sunders.hamburg.ccc.de + content: "{{ lookup('ansible.builtin.file', 'resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf') }}" diff --git a/inventories/chaosknoten/hosts.yaml b/inventories/chaosknoten/hosts.yaml index 1f1445c..b9e6358 100644 --- a/inventories/chaosknoten/hosts.yaml +++ b/inventories/chaosknoten/hosts.yaml @@ -106,6 +106,7 @@ docker_compose_hosts: pretalx: zammad: ntfy: + sunders: nextcloud_hosts: hosts: cloud: @@ -126,6 +127,7 @@ nginx_hosts: wiki: zammad: ntfy: + sunders: public_reverse_proxy_hosts: hosts: public-reverse-proxy: @@ -145,6 +147,7 @@ certbot_hosts: wiki: zammad: ntfy: + sunders: prometheus_node_exporter_hosts: hosts: ccchoir: diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf index 790ca77..165e166 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/acme_challenge.conf @@ -29,6 +29,7 @@ map $host $upstream_acme_challenge_host { wiki.hamburg.ccc.de 172.31.17.146:31820; www.hamburg.ccc.de 172.31.17.151:31820; tickets.hamburg.ccc.de 172.31.17.148:31820; + sunders.hamburg.ccc.de 172.31.17.170:31820; zammad.hamburg.ccc.de 172.31.17.152:31820; eh03.easterhegg.eu 172.31.17.151:31820; eh05.easterhegg.eu 172.31.17.151:31820; diff --git a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf index 87b5408..4a449f5 100644 --- a/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf +++ b/resources/chaosknoten/public-reverse-proxy/nginx/nginx.conf @@ -43,6 +43,7 @@ stream { staging.hamburg.ccc.de 172.31.17.151:8443; spaceapi.hamburg.ccc.de 172.31.17.151:8443; tickets.hamburg.ccc.de 172.31.17.148:8443; + sunders.hamburg.ccc.de 172.31.17.170:8443; zammad.hamburg.ccc.de 172.31.17.152:8443; c3cat.de 172.31.17.151:8443; www.c3cat.de 172.31.17.151:8443; diff --git a/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 b/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 new file mode 100644 index 0000000..a5cfc5b --- /dev/null +++ b/resources/chaosknoten/sunders/docker_compose/compose.yaml.j2 @@ -0,0 +1,57 @@ +# Source: +# https://git.hamburg.ccc.de/CCCHH/sunders/src/branch/main/docker-compose.yml + +services: + db: + image: mariadb:12.0.2 + command: --max_allowed_packet=3250585600 + environment: + MYSQL_ROOT_PASSWORD: "{{ secret__sunders_db_root_password }}" + MYSQL_DATABASE: camera + MYSQL_USER: camera + MYSQL_PASSWORD: "{{ secret__sunders_db_camera_password }}" + volumes: + - mariadb:/var/lib/mysql + healthcheck: + test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-prootpassword"] + interval: 10s + timeout: 5s + start_period: 30s + retries: 5 + + web: + image: git.hamburg.ccc.de/ccchh/sunders/web:latest + environment: + MYSQL_HOST: db + MYSQL_DB: camera + CAMERA_SELECT_USER: camera_select + CAMERA_SELECT_USER_PASSWORD: "{{ secret__sunders_db_camera_select_password }}" + DEFAULT_ZOOM: 12 + DEFAULT_LAT: 0 + DEFAULT_LON: 0 + DEFAULT_LANGUAGE: en + IMPRESSUM_URL: https://hamburg.ccc.de/imprint/ + ports: + - "8080:80" + depends_on: + data_handler: + condition: service_started + + data_handler: + image: git.hamburg.ccc.de/ccchh/sunders/data_handler:latest + environment: + MYSQL_HOST: db + MYSQL_DB: camera + MYSQL_USER: root + MYSQL_PASSWORD: "{{ secret__sunders_db_root_password }}" + CAMERA_USER: camera + CAMERA_USER_PASSWORD: "{{ secret__sunders_db_camera_password }}" + CAMERA_SELECT_USER: camera_select + CAMERA_SELECT_USER_PASSWORD: "{{ secret__sunders_db_camera_select_password }}" + depends_on: + db: + condition: service_healthy + restart: true + +volumes: + mariadb: diff --git a/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf b/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf new file mode 100644 index 0000000..04cc006 --- /dev/null +++ b/resources/chaosknoten/sunders/nginx/sunders.hamburg.ccc.de.conf @@ -0,0 +1,42 @@ +# partly generated 2022-01-08, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration +# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6 +server { + # Listen on a custom port for the proxy protocol. + listen 8443 ssl http2 proxy_protocol; + # Make use of the ngx_http_realip_module to set the $remote_addr and + # $remote_port to the client address and client port, when using proxy + # protocol. + # First set our proxy protocol proxy as trusted. + set_real_ip_from 172.31.17.140; + # Then tell the realip_module to get the addreses from the proxy protocol + # header. + real_ip_header proxy_protocol; + + server_name sunders.hamburg.ccc.de; + + ssl_certificate /etc/letsencrypt/live/sunders.hamburg.ccc.de/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/sunders.hamburg.ccc.de/privkey.pem; + # verify chain of trust of OCSP response using Root CA and Intermediate certs + ssl_trusted_certificate /etc/letsencrypt/live/sunders.hamburg.ccc.de/chain.pem; + + # HSTS (ngx_http_headers_module is required) (63072000 seconds) + add_header Strict-Transport-Security "max-age=63072000" always; + + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Port 443; + # This is https in any case. + proxy_set_header X-Forwarded-Proto https; + # Hide the X-Forwarded header. + proxy_hide_header X-Forwarded; + # Assume we are the only Reverse Proxy (well using Proxy Protocol, but that + # is transparent). + # Also provide "_hidden" for by, since it's not relevant. + proxy_set_header Forwarded "for=$remote_addr;proto=https;host=$host;by=_hidden"; + + location / { + proxy_pass http://127.0.0.1:8080/; + } +}