From 4e8f3bc5f48b9b9e80687e8c84418d40563b60c8 Mon Sep 17 00:00:00 2001 From: Freyja Odinthrir Date: Thu, 8 Feb 2024 13:58:52 -0800 Subject: [PATCH] test ci --- .docker/.conf/nginx/conf.d/http/main.conf | 8 + .docker/.conf/nginx/nginx.conf | 69 +++++++++ .docker/.conf/nginx/snippets/fastcgi.conf | 26 ++++ .docker/.conf/nginx/snippets/mime-types.conf | 48 ++++++ .docker/.conf/nginx/snippets/proxy.conf | 10 ++ .docker/.conf/nginx/snippets/scgi.conf | 17 +++ .docker/.conf/nginx/snippets/uwsgi.conf | 17 +++ .docker/.conf/supervisor/supervisord.conf | 15 ++ .docker/Dockerfile | 15 ++ .gitea/workflows/deploy.yml | 151 +++++++------------ .github/FUNDING.yml | 3 - .github/dependabot.yml | 11 -- .github/workflows/build.yml | 108 ------------- 13 files changed, 278 insertions(+), 220 deletions(-) create mode 100644 .docker/.conf/nginx/conf.d/http/main.conf create mode 100644 .docker/.conf/nginx/nginx.conf create mode 100644 .docker/.conf/nginx/snippets/fastcgi.conf create mode 100644 .docker/.conf/nginx/snippets/mime-types.conf create mode 100644 .docker/.conf/nginx/snippets/proxy.conf create mode 100644 .docker/.conf/nginx/snippets/scgi.conf create mode 100644 .docker/.conf/nginx/snippets/uwsgi.conf create mode 100644 .docker/.conf/supervisor/supervisord.conf create mode 100644 .docker/Dockerfile delete mode 100644 .github/FUNDING.yml delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/build.yml diff --git a/.docker/.conf/nginx/conf.d/http/main.conf b/.docker/.conf/nginx/conf.d/http/main.conf new file mode 100644 index 0000000..09a29aa --- /dev/null +++ b/.docker/.conf/nginx/conf.d/http/main.conf @@ -0,0 +1,8 @@ +server { + listen 80; + location / { + root /var/www/build; + autoindex off; + try_files $uri $uri/ =404; + } +} diff --git a/.docker/.conf/nginx/nginx.conf b/.docker/.conf/nginx/nginx.conf new file mode 100644 index 0000000..eac684b --- /dev/null +++ b/.docker/.conf/nginx/nginx.conf @@ -0,0 +1,69 @@ +worker_processes 4; +pid /run/nginx.pid; + + +error_log /dev/stderr info; + + +events { + worker_connections 1024; + multi_accept off; +} + +http { + + + ## asynchronous input/output policy. + tcp_nopush on; + sendfile on; + + + ## Security policy + ssl_protocols TLSv1.3 TLSv1.2; + ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA HIGH !RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"; + server_tokens off; # disable server version response header. + add_header X-Content-Type-Options nosniff; # Disable sniffing + add_header X-Frame-Options SAMEORIGIN always; # Prevent clickjacking. + add_header "X-XSS-Protection" "1; mode=block"; # Prevent cross-site-scripting + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; # Force HSTS, prevent mitm attack between 301 redirect for http, and https server. + + + ## Log file policy. + log_format logformat '$remote_addr - $remote_user [$time_local] "$request" ' + '$status $body_bytes_sent "$http_referer" ' + '"$http_user_agent" "$http_x_forwarded_for"'; + access_log /dev/stdout logformat; + + + ## Temp file policy. + client_body_temp_path /tmp/client_temp; + fastcgi_temp_path /tmp/fastcgi_temp; + uwsgi_temp_path /tmp/uwsgi_temp; + proxy_temp_path /tmp/proxy_temp; + scgi_temp_path /tmp/scgi_temp; + + + ## Buffer Policy. + client_body_buffer_size 1K; + client_header_buffer_size 1k; + client_max_body_size 1k; + large_client_header_buffers 2 1k; + + + ## Client timeout policy + client_body_timeout 10; + client_header_timeout 10; + keepalive_timeout 5 5; + send_timeout 10; + + + ## Default mime type. + include snippets/mime-types.conf; + default_type text/html; + + + ## http vhosts + include conf.d/http/*.conf; + + +} \ No newline at end of file diff --git a/.docker/.conf/nginx/snippets/fastcgi.conf b/.docker/.conf/nginx/snippets/fastcgi.conf new file mode 100644 index 0000000..091738c --- /dev/null +++ b/.docker/.conf/nginx/snippets/fastcgi.conf @@ -0,0 +1,26 @@ + +fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; +fastcgi_param QUERY_STRING $query_string; +fastcgi_param REQUEST_METHOD $request_method; +fastcgi_param CONTENT_TYPE $content_type; +fastcgi_param CONTENT_LENGTH $content_length; + +fastcgi_param SCRIPT_NAME $fastcgi_script_name; +fastcgi_param REQUEST_URI $request_uri; +fastcgi_param DOCUMENT_URI $document_uri; +fastcgi_param DOCUMENT_ROOT $document_root; +fastcgi_param SERVER_PROTOCOL $server_protocol; +fastcgi_param REQUEST_SCHEME $scheme; +fastcgi_param HTTPS $https if_not_empty; + +fastcgi_param GATEWAY_INTERFACE CGI/1.1; +fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; + +fastcgi_param REMOTE_ADDR $remote_addr; +fastcgi_param REMOTE_PORT $remote_port; +fastcgi_param SERVER_ADDR $server_addr; +fastcgi_param SERVER_PORT $server_port; +fastcgi_param SERVER_NAME $server_name; + +# PHP only, required if PHP was built with --enable-force-cgi-redirect +fastcgi_param REDIRECT_STATUS 200; diff --git a/.docker/.conf/nginx/snippets/mime-types.conf b/.docker/.conf/nginx/snippets/mime-types.conf new file mode 100644 index 0000000..62bd4b6 --- /dev/null +++ b/.docker/.conf/nginx/snippets/mime-types.conf @@ -0,0 +1,48 @@ +types { + text/html html htm shtml; + text/css css; + text/xml xml rss; + image/gif gif; + image/jpeg jpeg jpg; + application/x-javascript js; + text/plain txt; + text/x-component htc; + text/mathml mml; + image/png png; + image/x-icon ico; + image/x-jng jng; + image/vnd.wap.wbmp wbmp; + application/java-archive jar war ear; + application/mac-binhex40 hqx; + application/pdf pdf; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/zip zip; + application/octet-stream deb; + application/octet-stream bin exe dll; + application/octet-stream dmg; + application/octet-stream eot; + application/octet-stream iso img; + application/octet-stream msi msp msm; + audio/mpeg mp3; + audio/x-realaudio ra; + video/mpeg mpeg mpg; + video/quicktime mov; + video/x-flv flv; + video/x-msvideo avi; + video/x-ms-wmv wmv; + video/x-ms-asf asx asf; + video/x-mng mng; +} \ No newline at end of file diff --git a/.docker/.conf/nginx/snippets/proxy.conf b/.docker/.conf/nginx/snippets/proxy.conf new file mode 100644 index 0000000..34af2fe --- /dev/null +++ b/.docker/.conf/nginx/snippets/proxy.conf @@ -0,0 +1,10 @@ +proxy_redirect off; +proxy_set_header Host $host; +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +client_max_body_size 10m; +client_body_buffer_size 128k; +proxy_connect_timeout 90; +proxy_send_timeout 90; +proxy_read_timeout 90; +proxy_buffers 32 4k; \ No newline at end of file diff --git a/.docker/.conf/nginx/snippets/scgi.conf b/.docker/.conf/nginx/snippets/scgi.conf new file mode 100644 index 0000000..6d4ce4f --- /dev/null +++ b/.docker/.conf/nginx/snippets/scgi.conf @@ -0,0 +1,17 @@ + +scgi_param REQUEST_METHOD $request_method; +scgi_param REQUEST_URI $request_uri; +scgi_param QUERY_STRING $query_string; +scgi_param CONTENT_TYPE $content_type; + +scgi_param DOCUMENT_URI $document_uri; +scgi_param DOCUMENT_ROOT $document_root; +scgi_param SCGI 1; +scgi_param SERVER_PROTOCOL $server_protocol; +scgi_param REQUEST_SCHEME $scheme; +scgi_param HTTPS $https if_not_empty; + +scgi_param REMOTE_ADDR $remote_addr; +scgi_param REMOTE_PORT $remote_port; +scgi_param SERVER_PORT $server_port; +scgi_param SERVER_NAME $server_name; diff --git a/.docker/.conf/nginx/snippets/uwsgi.conf b/.docker/.conf/nginx/snippets/uwsgi.conf new file mode 100644 index 0000000..09c732c --- /dev/null +++ b/.docker/.conf/nginx/snippets/uwsgi.conf @@ -0,0 +1,17 @@ + +uwsgi_param QUERY_STRING $query_string; +uwsgi_param REQUEST_METHOD $request_method; +uwsgi_param CONTENT_TYPE $content_type; +uwsgi_param CONTENT_LENGTH $content_length; + +uwsgi_param REQUEST_URI $request_uri; +uwsgi_param PATH_INFO $document_uri; +uwsgi_param DOCUMENT_ROOT $document_root; +uwsgi_param SERVER_PROTOCOL $server_protocol; +uwsgi_param REQUEST_SCHEME $scheme; +uwsgi_param HTTPS $https if_not_empty; + +uwsgi_param REMOTE_ADDR $remote_addr; +uwsgi_param REMOTE_PORT $remote_port; +uwsgi_param SERVER_PORT $server_port; +uwsgi_param SERVER_NAME $server_name; diff --git a/.docker/.conf/supervisor/supervisord.conf b/.docker/.conf/supervisor/supervisord.conf new file mode 100644 index 0000000..11c40b8 --- /dev/null +++ b/.docker/.conf/supervisor/supervisord.conf @@ -0,0 +1,15 @@ +[supervisord] +nodaemon=true +logfile=/dev/null +logfile_maxbytes=0 +pidfile=/run/supervisord.pid + + +[program:nginx] +command=nginx -g 'daemon off;' +stdout_logfile=/dev/stdout +stdout_logfile_maxbytes=0 +stderr_logfile=/dev/stderr +stderr_logfile_maxbytes=0 +autorestart=true +startretries=3 diff --git a/.docker/Dockerfile b/.docker/Dockerfile new file mode 100644 index 0000000..a1940b5 --- /dev/null +++ b/.docker/Dockerfile @@ -0,0 +1,15 @@ +#### +## +## Build a docker image out of the static html book generated by mdbook. +## Used by automation. Can be built manually for testing. +## +#### +FROM alpine:3.17 +RUN apk add nginx supervisor +RUN mkdir -p /var/www +RUN rm -rf /etc/nginx +COPY build /var/www/build +COPY .conf/nginx /etc/nginx +COPY .conf/supervisor/supervisord.conf /etc/supervisor/conf.d/supervisord.conf +CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"] +EXPOSE 80 \ No newline at end of file diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 21c3b0d..4808604 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -7,11 +7,11 @@ on: # - "templates/**" branches: - "master" - - "gdb.lgbtqi.app-production" + - "ci-testing" jobs: job1: - name: Build static site, docker image, upload artifact... + name: Build static site. runs-on: catthehacker-ubuntu steps: - @@ -21,48 +21,18 @@ jobs: - name: Checkout the git repo... uses: actions/checkout@v3 - with: - ref: master - - - name: Set up docker buildx... - uses: docker/setup-buildx-action@v3 - - - name: Login to gitea registry - uses: docker/login-action@v3 - with: - registry: gitea.raer.me - username: ${{ secrets.PRODUCTION_REGISTRY_USERNAME }} - password: ${{ secrets.PRODUCTION_REGISTRY_TOKEN }} - name: Install required system packages... run: | export DEBIAN_FRONTEND=noninteractive apt update apt upgrade -y - apt install -y curl tar p7zip-full graphicsmagick + apt install -y curl graphicsmagick - name: Use Node.js ${{ matrix.node-version }} uses: actions/setup-node@v2 with: node-version: '14' - cache: 'npm' - - - name: Restore node_modules cache - uses: actions/cache@v2 - with: - path: node_modules - key: ${{ runner.os }}-node_modules-${{ hashFiles('**/package-lock.json') }} - restore-keys: | - ${{ runner.os }}-node_modules - - - name: Restore Asset Cache - uses: actions/cache@v2 - with: - key: if-cache - path: | - ./if-cache/* - ./if-cache.json - ./twitter-cache.json - name: Install node dependencies run: npm ci @@ -72,73 +42,58 @@ jobs: - name: Build site run: npm run build - - - name: Create artifact... - run: 7z a -mx=9 ./artifact.7z dist - name: Upload artifact... - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: - name: artifact_${{ steps.date.outputs.date }} - path: ./artifact.7z + name: build_artifact + path: dist retention-days: 7 - - - uses: actions/checkout@v4 - with: - ref: gdb.lgbtqi.app-production - - - name: Build and push docker image to gitea package store - uses: docker/build-push-action@v5 - with: - context: . - push: true - platforms: linux/amd64 - tags: gitea.raer.me/${{ gitea.repository }}:${{ gitea.ref_name }} - job2: - needs: job1 - name: Connect to deployment host, update, and redeploy docs website. - runs-on: ubuntu-latest - steps: - - - name: Install required system packages... - run: | - export DEBIAN_FRONTEND=noninteractive - apt update - apt upgrade -y - apt install -y iputils-ping - - - name: Configure SSH... - env: - SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }} - SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }} - SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }} - run: | - mkdir -p ~/.ssh/ - echo "$SSH_KEY" > ~/.ssh/staging.key - chmod 600 ~/.ssh/staging.key - cat >> ~/.ssh/config < ~/.ssh/staging.key + # chmod 600 ~/.ssh/staging.key + # cat >> ~/.ssh/config <