Update initialize script for 1.20

Add documentation on debugging Gitea

gitea/Dockerfile.task-executor

@@ -0,0 +1,14 @@
+FROM ubuntu:22.04
+
+# Install basic tools
+RUN apt update && apt install -y gpg curl apt-transport-https ca-certificates lsb-release build-essential
+
+# Add Docker repo
+RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+# Add NodeJS repo
+RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash -
+
+# Install Docker and NodeJS packages.
+RUN apt update && apt install -y docker-ce nodejs && rm -rf /var/lib/apt/lists/*

gitea/README.md

@@ -1,3 +1,27 @@
-## Manual deployment notes
+## Deployment Notes
 ### Gitea
-1. Create admin user in web UI on initial setup
+
+#### Build gitea/act_runner Docker Container
+1. To build the `act_runner` container from Gitea, in another directory run:
+```
+git clone https://gitea.com/gitea/act_runner
+cd act_runner
+docker build -t cerc/act-runner:local .
+```
+
+#### Deploy Gitea Stack
+1. `cd ./gitea`
+1. Build the task executor container: `docker build -t cerc/act-runner-task-executor:local -f Dockerfile.task-executor .`
+1. Run the script `./run-this-first.sh`
+1. Bring up the gitea cluster `docker compose up -d`
+1. Run the script `./initialize-gitea.sh`
+1. Note the access token printed, it will be needed to publish packages.
+
+#### Debugging
+Gitea server logs can be seen via docker logs <container-id>.
+To enable more verbose log output add an environment variable definition like:
+```
+GITEA__log__LEVEL=TRACE
+```
+to the `server` definition in `docker-compose.yml` and re-start.
+Details on how to setup remote debugging of the gitea server inside its container can be found [here](gitea-debugging.md).

gitea/config/act-runner-config.yml

@@ -0,0 +1,48 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: /data/.runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # # Extra environment variables to run jobs.
+  # envs:
+  #   A_TEST_ENV_NAME_1: a_test_env_value_1
+  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  # # Extra environment variables to run jobs from a file.
+  # # It will be ignored if it's empty or the file doesn't exist.
+  # env_file: .env
+  # # The timeout for a job to be finished.
+  # # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+
+container:
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: true
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options: --add-host=gitea.local:host-gateway --volume "/var/lib/docker"

gitea/delete-repo.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Script that calls the Giteap API to delete one repo
+
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+
+if ! [[ $# -eq 1 ]]; then
+    echo "Illegal number of parameters" >&2
+    exit 1
+fi
+repo_to_delete=$1
+
+if [[ -z "${CERC_GITEA_AUTH_TOKEN}" ]]; then
+    echo "CERC_GITEA_AUTH_TOKEN is not set" >&2
+    exit 1
+fi
+if [[ -z "${CERC_GITEA_API_URL}" ]]; then
+    echo "CERC_GITEA_API_URL is not set" >&2
+    exit 1
+fi
+if [[ "${CERC_GITEA_MIRROR_REPO}" == "true" ]]; then
+    is_mirror=true
+else
+    is_mirror=false
+fi
+
+gitea_target_org=$(dirname ${repo_to_delete})
+gitea_target_repo_name=$(basename ${repo_to_delete})
+# Sanity check the repo name
+if [[ -z "${gitea_target_org}" ]]; then
+    echo "${repo_to_delete} is not a valid repo name" >&2
+    exit 1
+fi
+if [[ -z "${gitea_target_repo_name}" ]]; then
+    echo "${repo_to_delete} is not a valid repo name" >&2
+    exit 1
+fi
+
+echo "****** DELETING repo: ${repo_to_delete}"
+# Note use: --trace-ascii - \ below to see the raw request
+delete_response=$( curl -s -X DELETE "${CERC_GITEA_API_URL}/api/v1/repos/${repo_to_delete}" \
+      -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+      -H  "accept: application/json" \
+)
+echo ${delete_response} | jq -r

gitea/docker-compose.yml

@@ -1,13 +1,7 @@
-version: "3"
-
-networks:
-  gitea:
-    external: false
 
 services:
   server:
-    image: gitea/gitea:1.17.1
-    container_name: gitea
+    image: gitea/gitea:1.20
     environment:
       - USER_UID=1000
       - USER_GID=1000
@@ -19,9 +13,11 @@ services:
       - GITEA__server__HTTP_PORT=3000
       - GITEA__server__LOCAL_ROOT_URL=http://gitea.local:3000/
       - GITEA__server__ROOT_URL=http://gitea.local:3000/
+      - GITEA__actions__ENABLED=true
+      - GITEA__security__INSTALL_LOCK=true
     restart: always
-    networks:
-      - gitea
+    extra_hosts:
+      - "gitea.local:host-gateway"
     volumes:
       - ./gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -40,7 +36,23 @@ services:
       - POSTGRES_USER=gitea
       - POSTGRES_PASSWORD=gitea
       - POSTGRES_DB=gitea
-    networks:
-      - gitea
+    # Workaround below for lack of docker uid mapping. Change the container's postgres user's uid/gid to match the host user's
+    entrypoint: bash
+    command: -c  'usermod -u ${CERC_HOST_UID:-1000} postgres;groupmod -g ${CERC_HOST_GID:-1000} postgres;exec /usr/local/bin/docker-entrypoint.sh postgres'
     volumes:
       - ./postgres:/var/lib/postgresql/data
+
+  runner:
+    image: cerc/act-runner:local
+    restart: always
+    environment:
+      - GITEA_RUNNER_REGISTRATION_TOKEN=eMdEwIzSo87nBh0UFWZlbp308j6TNWr3WhWxQqIc
+      - GITEA_INSTANCE_URL=http://gitea.local:3000
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://cerc/act-runner-task-executor:local,ubuntu-22.04:docker://cerc/act-runner-task-executor:local
+      - CONFIG_FILE=/config/act-runner-config.yml
+    extra_hosts:
+      - "gitea.local:host-gateway"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./act-runner:/data
+      - ./config:/config:ro

gitea/gitea-debugging.md

@@ -0,0 +1,175 @@
+## Notes using a debugger with Gitea
+
+### Changes to Gitea
+Assuming the Gitea repository cloned at `/path/to/gitea` (adjust below for your actual location),
+make the following changes to a cloned gitea repository then build a new container with:
+```
+$ docker build -t my-org/gitea:debug -f Dockerfile .
+```
+
+Gitea project changes:
+Dockerfile adds delve debugger binary, adjust compiler flags to suit debugging, expose port 40000 for remote debugging.
+```
+diff --git a/Dockerfile b/Dockerfile
+index 06481cdf5..a49fd0266 100644
+--- a/Dockerfile
++++ b/Dockerfile
+@@ -16,6 +16,10 @@ RUN apk --no-cache add build-base git nodejs npm
+ COPY . ${GOPATH}/src/code.gitea.io/gitea
+ WORKDIR ${GOPATH}/src/code.gitea.io/gitea
+
++RUN go install github.com/go-delve/delve/cmd/dlv@latest
++
++ENV EXTRA_GOFLAGS '-gcflags="all=-N -l"'
++
+ #Checkout version if set
+ RUN if [ -n "${GITEA_VERSION}" ]; then git checkout "${GITEA_VERSION}"; fi \
+  && make clean-all build
+@@ -26,7 +30,7 @@ RUN go build contrib/environment-to-ini/environment-to-ini.go
+ FROM docker.io/library/alpine:3.18
+ LABEL maintainer="maintainers@gitea.io"
+
+-EXPOSE 22 3000
++EXPOSE 22 3000 40000
+
+ RUN apk --no-cache add \
+     bash \
+@@ -65,6 +69,7 @@ COPY docker/root /
+ COPY --from=build-env /go/src/code.gitea.io/gitea/gitea /app/gitea/gitea
+ COPY --from=build-env /go/src/code.gitea.io/gitea/environment-to-ini /usr/local/bin/environment-to-ini
+ COPY --from=build-env /go/src/code.gitea.io/gitea/contrib/autocompletion/bash_autocomplete /etc/profile.d/gitea_bash_autocomplete.sh
++COPY --from=build-env  /go/bin/dlv /usr/local/bin/
+ RUN chmod 755 /usr/bin/entrypoint /app/gitea/gitea /usr/local/bin/gitea /usr/local/bin/environment-to-ini
+ RUN chmod 755 /etc/s6/gitea/* /etc/s6/openssh/* /etc/s6/.s6-svscan/*
+ RUN chmod 644 /etc/profile.d/gitea_bash_autocomplete.sh
+ ```
+Makefile removes linker flags that strip symbols:
+ ```
+diff --git a/Makefile b/Makefile
+index 16841796b..35fdaf1de 100644
+--- a/Makefile
++++ b/Makefile
+@@ -789,7 +789,7 @@ check: test
+
+ .PHONY: install $(TAGS_PREREQ)
+ install: $(wildcard *.go)
+-       CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) install -v -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)'
++       CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) install -v -tags '$(TAGS)' -ldflags '$(LDFLAGS)'
+
+ .PHONY: build
+ build: frontend backend
+@@ -817,7 +817,7 @@ security-check:
+        go run $(GOVULNCHECK_PACKAGE) ./...
+
+ $(EXECUTABLE): $(GO_SOURCES) $(TAGS_PREREQ)
+-       CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '-s -w $(LDFLAGS)' -o $@
++       CGO_CFLAGS="$(CGO_CFLAGS)" $(GO) build $(GOFLAGS) $(EXTRA_GOFLAGS) -tags '$(TAGS)' -ldflags '$(LDFLAGS)' -o $@
+
+ .PHONY: release
+ release: frontend generate release-windows release-linux release-darwin release-freebsd release-copy release-compress vendor release-sources release-docs release-check
+```
+run script inserts delve as the executed binary, with appropriate commands for it to spawn the gitea binary on startup:
+``` 
+diff --git a/docker/root/etc/s6/gitea/run b/docker/root/etc/s6/gitea/run
+index 7b858350f..26bd2eeb3 100755
+--- a/docker/root/etc/s6/gitea/run
++++ b/docker/root/etc/s6/gitea/run
+@@ -1,6 +1,25 @@
+ #!/bin/bash
++if [ -n "$CERC_SCRIPT_DEBUG" ]; then
++    set -x
++fi
++
+ [[ -f ./setup ]] && source ./setup
+
++GITEA="/app/gitea/gitea"
++WORK_DIR="/app/gitea"
++CUSTOM_PATH="/data/gitea"
++
++# Provide docker defaults
++export GITEA_WORK_DIR="${GITEA_WORK_DIR:-$WORK_DIR}"
++export GITEA_CUSTOM="${GITEA_CUSTOM:-$CUSTOM_PATH}"
++
++# exec -a "$0" "$GITEA" $CONF_ARG "$@"
++
++START_CMD="/usr/local/bin/gitea"
++if [ "true" == "$CERC_REMOTE_DEBUG" ] && [ -x "/usr/local/bin/dlv" ]; then
++    START_CMD="/usr/local/bin/dlv --listen=:40000 --headless=true --api-version=2 --accept-multiclient exec "$GITEA"  --continue --"
++fi
++
+ pushd /app/gitea >/dev/null
+-exec su-exec $USER /usr/local/bin/gitea web
++exec su-exec $USER $START_CMD $CONF_ARG web
+ popd
+```
+
+### Changes to the compose config
+
+1. Specify the newly build container image.
+1. Enable remote debugging with `CERC_REMOTE_DEBUG=true`
+1. Enable trace logging with `GITEA__log__LEVEL=Trace`
+1. Mount the project source into the container (path must be the same absolute path as on the host)
+1. Map the go debug port (40000 in this case) into the host.
+
+```
+diff --git a/gitea/docker-compose.yml b/gitea/docker-compose.yml
+index 59fea80..35feed0 100644
+--- a/gitea/docker-compose.yml
++++ b/gitea/docker-compose.yml
+@@ -1,8 +1,9 @@
+
+ services:
+   server:
+-    image: gitea/gitea:1.19.3
++    image: my-org/gitea:debug
+     environment:
++      - CERC_REMOTE_DEBUG=true
+       - USER_UID=1000
+       - USER_GID=1000
+       - GITEA__database__DB_TYPE=postgres
+@@ -15,6 +16,7 @@ services:
+       - GITEA__server__ROOT_URL=http://gitea.local:3000/
+       - GITEA__actions__ENABLED=true
+       - GITEA__security__INSTALL_LOCK=true
++      - GITEA__log__LEVEL=Trace
+     restart: always
+     extra_hosts:
+       - "gitea.local:host-gateway"
+@@ -22,10 +24,12 @@ services:
+       - ./gitea:/data
+       - /etc/timezone:/etc/timezone:ro
+       - /etc/localtime:/etc/localtime:ro
++      - /path/to/gitea:/path/to/gitea:ro
+     # TODO: remove fixed host port number
+     ports:
+       - "3000:3000"
+       - "222:22"
++      - "40000:40000"
+     depends_on:
+       - db
+```
+### Debug with VSCode
+Use a `launch.json` file like this:
+```
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Container gitea",
+            "type": "go",
+            "request": "attach",
+            "mode": "remote",
+            "remotePath": "/path/to/gitea",
+            "port": 40000,
+            "host": "127.0.0.1",
+            "substitutePath": [
+                { "from": "/path/to/gitea", "to": "/go/src/code.gitea.io/gitea" }
+            ]
+        }
+    ]
+}
+```
+With the gitea container running it should now be possible to "Run with debugging" and set breakpoints in the source code. If the breakpoints are not solid dots, something is wrong.

gitea/initialize-gitea.sh

@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Run this script once after bringing up gitea in docker compose
+# TODO: add a check to detect that gitea has not fully initialized yet (no user relation error)
+GITEA_USER=gitea_admin
+GITEA_PASSWORD=admin1234
+GITEA_USER_EMAIL=${GITEA_USER}@example.com
+GITEA_NEW_ORGANIZATION=cerc-io
+GITEA_URL_PREFIX=http://localhost:3000
+CERC_GITEA_TOKEN_NAME=laconic-so-publication-token
+CERC_GITEA_RUNNER_REGISTRATION_TOKEN=eMdEwIzSo87nBh0UFWZlbp308j6TNWr3WhWxQqIc
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+# Create admin user
+# First check if it already exists
+if [[ -z ${CERC_SO_COMPOSE_PROJECT} ]] ; then
+    compose_command="docker compose"
+else
+    compose_command="docker compose -p ${CERC_SO_COMPOSE_PROJECT}"
+fi
+sleep 15
+${compose_command} exec --user git server gitea admin user list --admin | grep -v -e "^ID" | awk '{ print $2 }' | grep ${GITEA_USER} > /dev/null
+if [[ $? == 1 ]] ; then
+    # Then create if it wasn't found
+    ${compose_command} exec --user git server gitea admin user create --admin --username ${GITEA_USER} --password ${GITEA_PASSWORD} --email ${GITEA_USER_EMAIL}
+fi
+# HACK: sleep a bit because if we don't gitea will return empty responses
+sleep 5
+# Check if the token already exists
+token_response=$( curl -s "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
+  -u ${GITEA_USER}:${GITEA_PASSWORD} \
+  -H "Content-Type: application/json")
+if [[ -n ${token_response} ]] ; then
+    echo ${token_response}  | jq --exit-status -r 'to_entries[] | select(.value.name == "'${CERC_GITEA_TOKEN_NAME}'")'
+    if [[ $? == 0 ]] ; then
+        token_found=1
+    fi
+fi
+if [[ ${token_found} != 1 ]] ; then
+    # Create access token if not found
+    # Note that we either create the token here, or we needed to be passed 
+    # the token by the caller. This is because gitea won't release the token
+    # plaintext post-creation.
+    new_gitea_token=$( curl -s -X POST "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
+      -u ${GITEA_USER}:${GITEA_PASSWORD} \
+      -H "Content-Type: application/json" \
+      -d '{"name":"'${CERC_GITEA_TOKEN_NAME}'", "scopes": [ "read:admin", "write:admin", "read:organization", "write:organization", "read:repository", "write:repository", "read:package", "write:package" ] }' \
+      | jq -r .sha1 )
+    echo "This is your gitea access token: ${new_gitea_token}. Keep it safe and secure, it can not be fetched again from gitea."
+    echo "To use with laconic-so set this environment variable: export CERC_NPM_AUTH_TOKEN=${new_gitea_token}"
+    CERC_GITEA_AUTH_TOKEN=${new_gitea_token}
+else
+    # If the token exists, then we must have been passed its value.
+    # If we were not, then we fail hard here.
+    if [[ -z ${CERC_GITEA_AUTH_TOKEN} ]] ; then
+        echo "FATAL error: gitea auth token \"${CERC_GITEA_TOKEN_NAME}\" already exists but no CERC_GITEA_AUTH_TOKEN was provided"
+        exit 1
+    fi
+fi
+# Now that we're sure the token exists and is set in CERC_GITEA_AUTH_TOKEN,
+# we can proceed with token-authenticated API requests below
+# Create org
+# First check if it already exists
+curl -s "${GITEA_URL_PREFIX}/api/v1/admin/users/${GITEA_USER}/orgs" \
+  -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+  -H "Content-Type: application/json" \
+  -H  "accept: application/json" \
+  | jq --exit-status -r 'to_entries[] | select(.value.name == "'${GITEA_NEW_ORGANIZATION}'")' > /dev/null
+if [[ $? != 0 ]] ; then
+    # If it doesn't exist, create it
+    # See: https://discourse.gitea.io/t/create-remove-organization-through-api/478
+    curl -s -X POST "${GITEA_URL_PREFIX}/api/v1/admin/users/${GITEA_USER}/orgs" \
+      -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -H  "accept: application/json" \
+      -d '{"username": "'${GITEA_NEW_ORGANIZATION}'"}' > /dev/null
+    echo "Created the organization ${GITEA_NEW_ORGANIZATION}"
+fi
+
+
+# Seed a token for act_runner registration.
+docker compose -p ${CERC_SO_COMPOSE_PROJECT} exec db psql -U gitea -d gitea -c "INSERT INTO public.action_runner_token(token, owner_id, repo_id, is_active, created, updated, deleted) VALUES('${CERC_GITEA_RUNNER_REGISTRATION_TOKEN}', 0, 0, 'f', 1679000000, 1679000000, NULL);" >/dev/null
+
+echo "Gitea was configured to use host name: gitea.local, ensure that this resolves to localhost, e.g. with sudo vi /etc/hosts"
+echo "Success, gitea is properly initialized"

gitea/migrate-repo.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Script that calls the Giteap API to migrate one repo from
+# a source hosting platform into that Gitea instance
+
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+
+if ! [[ $# -eq 1 ]]; then
+    echo "Illegal number of parameters" >&2
+    exit 1
+fi
+repo_to_migrate=$1
+
+if [[ -z "${CERC_GITEA_AUTH_TOKEN}" ]]; then
+    echo "CERC_GITEA_AUTH_TOKEN is not set" >&2
+    exit 1
+fi
+if [[ -z "${CERC_GITEA_API_URL}" ]]; then
+    echo "CERC_GITEA_API_URL is not set" >&2
+    exit 1
+fi
+if [[ "${CERC_GITEA_MIRROR_REPO}" == "true" ]]; then
+    is_mirror=true
+else
+    is_mirror=false
+fi
+
+gitea_target_org=$(dirname ${repo_to_migrate})
+gitea_target_repo_name=$(basename ${repo_to_migrate})
+# Sanity check the repo name
+if [[ -z "${gitea_target_org}" ]]; then
+    echo "${repo_to_migrate} is not a valid repo name" >&2
+    exit 1
+fi
+if [[ -z "${gitea_target_repo_name}" ]]; then
+    echo "${repo_to_migrate} is not a valid repo name" >&2
+    exit 1
+fi
+
+github_repo_url="https://github.com/${repo_to_migrate}"
+echo "Migrating repo: ${repo_to_migrate} (mirror:${is_mirror})"
+# Note use: --trace-ascii - \ below to see the raw request
+migrate_response=$( curl -s -X POST "${CERC_GITEA_API_URL}/api/v1/repos/migrate" \
+      -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -H  "accept: application/json" \
+      -d @- << EOF
+{
+    "clone_addr": "${github_repo_url}",
+    "mirror": ${is_mirror},
+    "repo_name": "${gitea_target_repo_name}",
+    "repo_owner": "${gitea_target_org}"
+}
+EOF
+)
+echo Migrated to: $(echo ${migrate_response} | jq -r .html_url)

gitea/run-this-first.sh

@@ -1,4 +1,7 @@
-#!/bin/sh
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
 mkdir -p ./gitea
 mkdir -p ./gitea/ssh
-mkdir -p ./postgres
+mkdir -p ./act-runner

tls-proxy/README.md

@@ -0,0 +1,2 @@
+# tls-proxy
+Automated deployment of TLS reverse proxy provisioned with Let's Encrypt certificate

tls-proxy/docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+
+    proxy:
+        image: nginx:stable-bullseye
+        command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+        ports:
+            - 80:80
+            - 443:443
+        volumes:
+            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+            - ./certbot/challenge:/data/certbot-challenge:ro
+            - ./certbot/certificates:/data/certificates:ro
+
+    certbot:
+        image: certbot/certbot:v2.5.0
+        volumes: 
+            - ./certbot/certificates:/etc/letsencrypt
+            - ./certbot/challenge:/data-www-challenge
+        entrypoint: "/bin/sh -c 'sleep 300; trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+    # Hello-world http container useful for test/debugging the proxy
+    # an actual service would be used for production
+    example-webservice:
+        image: crccheck/hello-world
+        ports:
+          - 8000
+

tls-proxy/initialize-tls-proxy.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+# When we're called nginx and certbot container are up and running and certbot is sleeping before executing renew
+# So we can now ask certbot to issue our initial cert
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+rm -rf ${tls_certificate_directory}
+# TODO: pass in email from caller
+# TODO: allow staging/dry-run mode
+docker compose exec certbot \
+    certbot certonly --webroot -w /data-www-challenge \
+    --staging \
+    --email ${EMAIL} \
+    -d ${LACONIC_TLS_DOMAIN} \
+    --rsa-key-size 4096 \
+    --agree-tos \
+    --force-renewal

tls-proxy/nginx-config-template

@@ -0,0 +1,39 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+    server_tokens off;
+    charset utf-8;
+
+    server {
+        listen 80 default_server;
+
+        server_name _;
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+
+        location / {
+            proxy_pass ${LACONIC_ORIGIN_SERVICE_URL};
+        }
+    }
+
+    server {
+        listen 443 ssl http2;
+        ssl_certificate     /data/certificates/live/${LACONIC_TLS_DOMAIN}/fullchain.pem;
+        ssl_certificate_key /data/certificates/live/${LACONIC_TLS_DOMAIN}/privkey.pem;
+        server_name ${LACONIC_TLS_DOMAIN};
+        root /var/www/html;
+        index index.php index.html index.htm;
+
+        location / {
+            proxy_pass ${LACONIC_ORIGIN_SERVICE_URL};
+        }
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+    }
+}

tls-proxy/run-this-first.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+set -e
+mkdir -p ./nginx
+mkdir -p ./certbot/certificates
+mkdir -p ./certbot/challenge
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+LACONIC_ORIGIN_SERVICE_URL=http://example-webservice:8000/
+# Expand the config template into the nginx config file
+cat ./nginx-config-template | sed 's/${LACONIC_TLS_DOMAIN}/'${LACONIC_TLS_DOMAIN}'/' | \
+	sed 's/${LACONIC_ORIGIN_SERVICE_URL}/'${LACONIC_ORIGIN_SERVICE_URL}'/' > ./nginx/nginx.conf
+# Create a self-signed cert so nginx will start without us changing its config between pre and post certbot invocation.
+# Check if we have a cert already
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_directory_in_container=/etc/letsencrypt/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_file_name=${tls_certificate_directory}/fullchain.pem
+# TODO: this won't work if there's a delay of more than one day between generating the 
+# self signed cert and starting the certbot enrollment process
+if [[ ! -f ${tls_certificate_file_name} ]] ; then
+    echo "Generating self-signed certificate for ${LACONIC_TLS_DOMAIN}:"
+    mkdir -p ${tls_certificate_directory}
+    docker compose run --rm --entrypoint "\
+        openssl req -x509 -nodes -newkey rsa:4096 -days 1 -keyout '${tls_certificate_directory_in_container}/privkey.pem' \
+        -out '${tls_certificate_directory_in_container}/fullchain.pem' -subj '/CN=${LACONIC_TLS_DOMAIN}'" certbot
+echo
+fi