Initial version of automated TLS proxy

Fix docker build slowness and disk bloat

gitea/Dockerfile.task-executor

@@ -0,0 +1,14 @@
+FROM ubuntu:22.04
+
+# Install basic tools
+RUN apt update && apt install -y gpg curl apt-transport-https ca-certificates lsb-release build-essential
+
+# Add Docker repo
+RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
+
+# Add NodeJS repo
+RUN curl -fsSL https://deb.nodesource.com/setup_18.x | bash -
+
+# Install Docker and NodeJS packages.
+RUN apt update && apt install -y docker-ce nodejs && rm -rf /var/lib/apt/lists/*

gitea/README.md

@@ -1,6 +1,17 @@
-## Deployment notes
+## Deployment Notes
 ### Gitea
+
+#### Build gitea/act_runner Docker Container
+1. To build the `act_runner` container from Gitea, in another directory run:
+```
+git clone https://gitea.com/gitea/act_runner
+cd act_runner
+docker build -t cerc/act-runner:local .
+```
+
+#### Deploy Gitea Stack
 1. `cd ./gitea`
+1. Build the task executor container: `docker build -t cerc/act-runner-task-executor:local -f Dockerfile.task-executor .`
 1. Run the script `./run-this-first.sh`
 1. Bring up the gitea cluster `docker compose up -d`
 1. Run the script `./initialize-gitea.sh`

gitea/config/act-runner-config.yml

@@ -0,0 +1,50 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: info
+
+runner:
+  # Where to store the registration result.
+  file: /data/.runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # # Extra environment variables to run jobs.
+  # envs:
+  #   A_TEST_ENV_NAME_1: a_test_env_value_1
+  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  # # Extra environment variables to run jobs from a file.
+  # # It will be ignored if it's empty or the file doesn't exist.
+  # env_file: .env
+  # # The timeout for a job to be finished.
+  # # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  insecure: false
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+  dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+
+container:
+  # Which network to use for the job containers. Could be bridge, host, none, or the name of a custom network.
+  network_mode: bridge
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: true
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options: --add-host=gitea.local:host-gateway --volume "/var/lib/docker"

gitea/docker-compose.yml

@@ -1,13 +1,7 @@
-version: "3"
-
-networks:
-  gitea:
-    external: false
 
 services:
   server:
-    image: gitea/gitea:1.18.3
-    container_name: gitea
+    image: gitea/gitea:1.19.2
     environment:
       - USER_UID=1000
       - USER_GID=1000
@@ -19,10 +13,11 @@ services:
       - GITEA__server__HTTP_PORT=3000
       - GITEA__server__LOCAL_ROOT_URL=http://gitea.local:3000/
       - GITEA__server__ROOT_URL=http://gitea.local:3000/
+      - GITEA__actions__ENABLED=true
       - GITEA__security__INSTALL_LOCK=true
     restart: always
-    networks:
-      - gitea
+    extra_hosts:
+      - "gitea.local:host-gateway"
     volumes:
       - ./gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -41,7 +36,23 @@ services:
       - POSTGRES_USER=gitea
       - POSTGRES_PASSWORD=gitea
       - POSTGRES_DB=gitea
-    networks:
-      - gitea
+    # Workaround below for lack of docker uid mapping. Change the container's postgres user's uid/gid to match the host user's
+    entrypoint: bash
+    command: -c  'usermod -u ${CERC_HOST_UID:-1000} postgres;groupmod -g ${CERC_HOST_GID:-1000} postgres;exec /usr/local/bin/docker-entrypoint.sh postgres'
     volumes:
       - ./postgres:/var/lib/postgresql/data
+
+  runner:
+    image: cerc/act-runner:local
+    restart: always
+    environment:
+      - GITEA_RUNNER_REGISTRATION_TOKEN=eMdEwIzSo87nBh0UFWZlbp308j6TNWr3WhWxQqIc
+      - GITEA_INSTANCE_URL=http://gitea.local:3000
+      - GITEA_RUNNER_LABELS=ubuntu-latest:docker://cerc/act-runner-task-executor:local,ubuntu-22.04:docker://cerc/act-runner-task-executor:local
+      - CONFIG_FILE=/config/act-runner-config.yml
+    extra_hosts:
+      - "gitea.local:host-gateway"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./act-runner:/data
+      - ./config:/config:ro

gitea/initialize-gitea.sh

@@ -1,4 +1,4 @@
-#!/bin/env bash
+#!/usr/bin/env bash
 # Run this script once after bringing up gitea in docker compose
 # TODO: add a check to detect that gitea has not fully initialized yet (no user relation error)
 GITEA_USER=gitea_admin
@@ -7,19 +7,36 @@ GITEA_USER_EMAIL=${GITEA_USER}@example.com
 GITEA_NEW_ORGANIZATION=cerc-io
 GITEA_URL_PREFIX=http://localhost:3000
 CERC_GITEA_TOKEN_NAME=laconic-so-publication-token
+CERC_GITEA_RUNNER_REGISTRATION_TOKEN=eMdEwIzSo87nBh0UFWZlbp308j6TNWr3WhWxQqIc
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
 # Create admin user
 # First check if it already exists
-docker compose exec --user git server gitea admin user list --admin | grep -v -e "^ID" | awk '{ print $2 }' | grep ${GITEA_USER} > /dev/null
+if [[ -z ${CERC_SO_COMPOSE_PROJECT} ]] ; then
+    compose_command="docker compose"
+else
+    compose_command="docker compose -p ${CERC_SO_COMPOSE_PROJECT}"
+fi
+sleep 15
+${compose_command} exec --user git server gitea admin user list --admin | grep -v -e "^ID" | awk '{ print $2 }' | grep ${GITEA_USER} > /dev/null
 if [[ $? == 1 ]] ; then
     # Then create if it wasn't found
-    docker compose exec --user git server gitea admin user create --admin --username ${GITEA_USER} --password ${GITEA_PASSWORD} --email ${GITEA_USER_EMAIL}
+    ${compose_command} exec --user git server gitea admin user create --admin --username ${GITEA_USER} --password ${GITEA_PASSWORD} --email ${GITEA_USER_EMAIL}
 fi
+# HACK: sleep a bit because if we don't gitea will return empty responses
+sleep 5
 # Check if the token already exists
-curl -s "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
+token_response=$( curl -s "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
   -u ${GITEA_USER}:${GITEA_PASSWORD} \
-  -H "Content-Type: application/json" \
-  | jq --exit-status -r 'to_entries[] | select(.value.name == "'${CERC_GITEA_TOKEN_NAME}'")' > /dev/null
-if [[ $? != 0 ]] ; then
+  -H "Content-Type: application/json")
+if [[ -n ${token_response} ]] ; then
+    echo ${token_response}  | jq --exit-status -r 'to_entries[] | select(.value.name == "'${CERC_GITEA_TOKEN_NAME}'")'
+    if [[ $? == 0 ]] ; then
+        token_found=1
+    fi
+fi
+if [[ ${token_found} != 1 ]] ; then
     # Create access token if not found
     # Note that we either create the token here, or we needed to be passed 
     # the token by the caller. This is because gitea won't release the token
@@ -27,9 +44,10 @@ if [[ $? != 0 ]] ; then
     new_gitea_token=$( curl -s -X POST "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
       -u ${GITEA_USER}:${GITEA_PASSWORD} \
       -H "Content-Type: application/json" \
-      -d '{"name":"'${CERC_GITEA_TOKEN_NAME}'"}' \
+      -d '{"name":"'${CERC_GITEA_TOKEN_NAME}'", "scopes": [ "sudo" ] }' \
       | jq -r .sha1 )
     echo "This is your gitea access token: ${new_gitea_token}. Keep it safe and secure, it can not be fetched again from gitea."
+    echo "To use with laconic-so set this environment variable: export CERC_NPM_AUTH_TOKEN=${new_gitea_token}"
     CERC_GITEA_AUTH_TOKEN=${new_gitea_token}
 else
     # If the token exists, then we must have been passed its value.
@@ -58,4 +76,10 @@ if [[ $? != 0 ]] ; then
       -d '{"username": "'${GITEA_NEW_ORGANIZATION}'"}' > /dev/null
     echo "Created the organization ${GITEA_NEW_ORGANIZATION}"
 fi
+
+
+# Seed a token for act_runner registration.
+docker compose -p ${CERC_SO_COMPOSE_PROJECT} exec db psql -U gitea -d gitea -c "INSERT INTO public.action_runner_token(token, owner_id, repo_id, is_active, created, updated, deleted) VALUES('${CERC_GITEA_RUNNER_REGISTRATION_TOKEN}', 0, 0, 'f', 1679000000, 1679000000, NULL);" >/dev/null
+
+echo "Gitea was configured to use host name: gitea.local, ensure that this resolves to localhost, e.g. with sudo vi /etc/hosts"
 echo "Success, gitea is properly initialized"

gitea/run-this-first.sh

@@ -1,4 +1,7 @@
-#!/bin/env bash
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
 mkdir -p ./gitea
 mkdir -p ./gitea/ssh
-mkdir -p ./postgres
+mkdir -p ./act-runner

tls-proxy/README.md

@@ -0,0 +1,2 @@
+# tls-proxy
+Automated deployment of TLS reverse proxy provisioned with Let's Encrypt certificate

tls-proxy/docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+
+    proxy:
+        image: nginx:stable-bullseye
+        command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+        ports:
+            - 80:80
+            - 443:443
+        volumes:
+            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+            - ./certbot/challenge:/data/certbot-challenge:ro
+            - ./certbot/certificates:/data/certificates:ro
+
+    certbot:
+        image: certbot/certbot:v2.5.0
+        volumes: 
+            - ./certbot/certificates:/etc/letsencrypt
+            - ./certbot/challenge:/data-www-challenge
+        entrypoint: "/bin/sh -c 'sleep 300; trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+    # Hello-world http container useful for test/debugging the proxy
+    # an actual service would be used for production
+    example-webservice:
+        image: crccheck/hello-world
+        ports:
+          - 8000
+

tls-proxy/initialize-tls-proxy.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+# When we're called nginx and certbot container are up and running and certbot is sleeping before executing renew
+# So we can now ask certbot to issue our initial cert
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+rm -rf ${tls_certificate_directory}
+# TODO: pass in email from caller
+# TODO: allow staging/dry-run mode
+docker compose exec certbot \
+    certbot certonly --webroot -w /data-www-challenge \
+    --staging \
+    --email ${EMAIL} \
+    -d ${LACONIC_TLS_DOMAIN} \
+    --rsa-key-size 4096 \
+    --agree-tos \
+    --force-renewal

tls-proxy/nginx-config-template

@@ -0,0 +1,39 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+    server_tokens off;
+    charset utf-8;
+
+    server {
+        listen 80 default_server;
+
+        server_name _;
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+
+        location / {
+            proxy_pass http://webservice:8000/;
+        }
+    }
+
+    server {
+        listen 443 ssl http2;
+        ssl_certificate     /data/certificates/live/${LACONIC_TLS_DOMAIN}/fullchain.pem;
+        ssl_certificate_key /data/certificates/live/${LACONIC_TLS_DOMAIN}/privkey.pem;
+        server_name ${LACONIC_TLS_DOMAIN};
+        root /var/www/html;
+        index index.php index.html index.htm;
+
+        location / {
+            proxy_pass ${LACONIC_ORIGIN_SERVICE_URL};
+        }
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+    }
+}

tls-proxy/run-this-first.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+set -e
+mkdir -p ./nginx
+mkdir -p ./certbot/certificates
+mkdir -p ./certbot/challenge
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+LACONIC_ORIGIN_SERVICE_URL=http://example-webservice:8000/
+# Expand the config template into the nginx config file
+cat ./nginx-config-template | sed 's/${LACONIC_TLS_DOMAIN}/'${LACONIC_TLS_DOMAIN}'/' | \
+	sed 's/${LACONIC_ORIGIN_SERVICE_URL}/'${LACONIC_ORIGIN_SERVICE_URL}'/' > ./nginx/nginx.conf
+# Create a self-signed cert so nginx will start without us changing its config between pre and post certbot invocation.
+# Check if we have a cert already
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_directory_in_container=/etc/letsencrypt/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_file_name=${tls_certificate_directory}/fullchain.pem
+# TODO: this won't work if there's a delay of more than one day between generating the 
+# self signed cert and starting the certbot enrollment process
+if [[ ! -f ${tls_certificate_file_name} ]] ; then
+    echo "Generating self-signed certificate for ${LACONIC_TLS_DOMAIN}:"
+    mkdir -p ${tls_certificate_directory}
+    docker compose run --rm --entrypoint "\
+        openssl req -x509 -nodes -newkey rsa:4096 -days 1 -keyout '${tls_certificate_directory_in_container}/privkey.pem' \
+        -out '${tls_certificate_directory_in_container}/fullchain.pem' -subj '/CN=${LACONIC_TLS_DOMAIN}'" certbot
+echo
+fi