iac/rproxy
3
0
Fork 0
Code Issues Pull Requests Packages Releases 9 Activity

dev #3

Merged
mpavlov merged 28 commits from dev into master 2024-07-11 01:21:55 +03:00
Conversation 0 Commits 28 Files Changed 7 +195 -60
7 changed files with 195 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
Jenkinsfile vendored
View File

@@ -4,16 +4,57 @@ pipeline {
string(name: "target_host", defaultValue: "", trim: true, description: "Target host")
string(name: "username", defaultValue: "", trim: true, description: "Ansible user")
password(name: "password", defaultValue: "", description: "Ansible password")
booleanParam(name: "rproxy_install", defaultValue: true, description: "Install Rproxy")
base64File(name: "rootca", description: "RootCA (only for 'Install Rproxy')")
base64File(name: "rootca_key", description: "RootCA key (only for 'Install Rproxy')")
booleanParam(name: "config_add", defaultValue: true, description: "Add config")
string(name: "rproxy_service_name", defaultValue: "", trim: true, description: "Service name (for 'Add config' job only)")
string(name: "rproxy_service_port", defaultValue: "", trim: true, description: "Service port (for 'Add config' job only)")
string(name: "rproxy_service_address", defaultValue: "", trim: true, description: "Service address (for 'Add config' job only)")
}
stages {
stage('Download') {
stage('Save certs') {
when {
expression {
return params.rproxy_install
}
}
steps {
git branch: 'master', url:'${git_url}/Ansible/rproxy.git', credentialsId: 'git'
withFileParameter('rootca') {
sh 'mv ${rootca} roles/rproxy/files/RootCA.crt'
}
withFileParameter('rootca_key') {
sh 'mv ${rootca_key} roles/rproxy/files/RootCA.key'
}
}
}
stage('Run') {
stage('Install Rproxy') {
when {
expression {
return params.rproxy_install
}
}
steps {
sh 'ansible-playbook rproxy.yml -i ${target_host}, -u ${username} -e "ansible_password=${password}"'
script {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: params.password]]]) {
sh 'ansible-playbook rproxy.yml -i ${target_host}, -t install -u ${username} -e "ansible_password=${password} rproxy_service_name=${rproxy_service_name} rproxy_service_port=${rproxy_service_port} rproxy_service_address=${rproxy_service_address}"'
}
}
}
}
stage('Add config') {
when {
expression {
return params.config_add
}
}
steps {
script {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: params.password]]]) {
sh 'ansible-playbook rproxy.yml -i ${target_host}, -t add_config -u ${username} -e "ansible_password=${password} rproxy_service_name=${rproxy_service_name} rproxy_service_port=${rproxy_service_port} rproxy_service_address=${rproxy_service_address}"'
}
}
}
}
}

7
roles/rproxy/files/nginx.conf
View File

@@ -1,4 +1,3 @@
load_module modules/ngx_http_headers_more_filter_module.so;
user nginx;
worker_processes auto;
@@ -20,14 +19,8 @@ http {
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/sites/*.conf;
server_tokens off;
}

128
roles/rproxy/tasks/main.yml
View File

@@ -3,44 +3,106 @@
ansible.builtin.shell:
cmd: hostname -d
register: domain
tags:
- install
- add_config
- name: Install dependencies
ansible.builtin.apt:
name:
- docker.io
- docker-compose
update_cache: yes
- name: Install rproxy
block:
- name: Install dependencies
ansible.builtin.apt:
name:
- docker.io
- docker-compose
update_cache: yes
- name: Remove rproxy dir
ansible.builtin.file:
path: {{ rproxy_dir }}
state: absent
- name: Remove rproxy dir
ansible.builtin.file:
path: "{{ rproxy_dir }}"
state: absent
- name: Create rproxy dir
ansible.builtin.file:
path: {{ rproxy_dir }}
state: directory
- name: Create rproxy dir
ansible.builtin.file:
path: "{{ rproxy_dir }}"
state: directory
- name: Create sites dir
ansible.builtin.file:
path: "{{ rproxy_dir }}/sites"
state: directory
- name: Create sites dir
ansible.builtin.file:
path: "{{ rproxy_dir }}/sites"
state: directory
- name: Copy docker-compose
ansible.builtin.template:
src: templates/docker-compose.yml.j2
dest: "{{ rproxy_dir }}/docker-compose.yml"
- name: Create certs dir
ansible.builtin.file:
path: "{{ rproxy_dir }}/certs"
state: directory
- name: Copy nginx.conf
ansible.builtin.copy:
src: files/nginx.conf
dest: "{{ rproxy_dir }}/nginx.conf"
- name: Copy docker-compose
ansible.builtin.template:
src: templates/docker-compose.yml.j2
dest: "{{ rproxy_dir }}/docker-compose.yml"
- name: Copy server.conf
ansible.builtin.template:
src: templates/server.conf.j2
dest: "{{ rproxy_dir }}/sites/server.conf"
- name: Copy nginx.conf
ansible.builtin.copy:
src: files/nginx.conf
dest: "{{ rproxy_dir }}/nginx.conf"
- name: Copy RootCA certificate
ansible.builtin.copy:
src: files/RootCA.crt
dest: '{{ rproxy_dir }}/certs/RootCA.crt'
- name: Copy RootCA key
ansible.builtin.copy:
src: files/RootCA.key
dest: '{{ rproxy_dir }}/certs/RootCA.key'
- name: Start rproxy
community.docker.docker_compose:
project_src: "{{ rproxy_dir }}"
tags: install
- name: Create configs
block:
- name: Copy server.conf
ansible.builtin.template:
src: templates/server.conf.j2
dest: "{{ rproxy_dir }}/sites/{{ rproxy_service_name }}.conf"
- name: Copy server certificate cnf
ansible.builtin.template:
src: templates/server.cnf.j2
dest: '{{ rproxy_dir }}/certs/{{ rproxy_service_name }}.cnf'
- name: Generate server key
ansible.builtin.shell:
cmd: 'openssl genrsa -out {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.key 2048'
- name: Generate server csr
ansible.builtin.shell:
cmd: 'openssl req -key {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.key -new -out {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.csr -config {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.cnf'
- name: Sign server certificate
ansible.builtin.shell:
cmd: 'openssl x509 -req -CA {{ rproxy_dir }}/certs/RootCA.crt -CAkey {{ rproxy_dir }}/certs/RootCA.key -in {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.csr -out {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.crt -CAcreateserial -extfile {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.cnf -days 365 -extensions v3_x509'
- name: Create fullchain certificate
ansible.builtin.shell:
cmd: 'cat {{ rproxy_dir }}/certs/RootCA.crt >> {{ rproxy_dir }}/certs/{{ rproxy_service_name }}.crt'
- name: Delete csr
ansible.builtin.file:
path: "{{ rproxy_dir }}/certs/{{ rproxy_service_name }}.csr"
state: absent
- name: Delete cnf
ansible.builtin.file:
path: "{{ rproxy_dir }}/certs/{{ rproxy_service_name }}.cnf"
state: absent
- name: Restart rproxy
community.docker.docker_compose:
project_src: "{{ rproxy_dir }}"
build: false
restarted: true
tags: add_config
- name: Start rproxy
community.docker.docker_compose:
project_src: "{{ rproxy_dir }}"

6
roles/rproxy/templates/docker-compose.yml.j2
View File

@@ -3,14 +3,12 @@ version: '3.3'
services:
nginx:
image: nginx:latest
container_name: nginx
container_name: rproxy
restart: always
volumes:
- {{ rproxy_dir }}/nginx.conf:/etc/nginx/nginx.conf
- {{ rproxy_dir }}/sites:/etc/nginx/sites
- {{ rproxy_dir }}/sites/default.conf:/etc/nginx/conf.d/default.conf
- {{ rproxy_dir }}/{{ domain.stdout }}.crt:/etc/nginx/{{ domain.stdout }}.crt
- {{ rproxy_dir }}/{{ domain.stdout }}.key:/etc/nginx/{{ domain.stdout }}.key
- {{ rproxy_dir }}/certs:/etc/nginx/certs
ports:
- 443:443
- 80:80

29
roles/rproxy/templates/server.cnf.j2 Normal file
View File

@@ -0,0 +1,29 @@
[ req ]
prompt = no
distinguished_name = {{ rproxy_service_name }}.{{ domain.stdout }}
req_extensions = v3_req
x509_extensions = v3_x509
[ {{ rproxy_service_name }}.{{ domain.stdout }} ]
countryName = RU
stateOrProvinceName = RU
localityName = MSK
organizationName = {{ domain.stdout }}
organizationalUnitName = IT
commonName = {{ rproxy_service_name }}.{{ domain.stdout }}
emailAddress = admin@{{ domain.stdout }}
[ v3_req ]
basicConstraints = CA:false
keyUsage = digitalSignature, keyEncipherment
subjectAltName = @sans
[ v3_x509 ]
basicConstraints = CA:false
keyUsage = digitalSignature, keyEncipherment
subjectAltName = @sans
[ sans ]
DNS.1 = {{ rproxy_service_name }}.{{ domain.stdout }}
IP.1 = {{ rproxy_service_address }}

25
roles/rproxy/templates/server.conf.j2
View File

@@ -1,32 +1,35 @@
{% for rproxy_service in rproxy_service_list %}
upstream {{ rproxy_service_name }}.{{ domain.stdout }} {
server {{ rproxy_service_address }}:{{ rproxy_service_port }};
}
server {
listen 80;
server_name {{ rproxy_service }}.{{ domain.stdout }};
access_log /var/log/nginx/{{ rproxy_service }}.access.log;
error_log /var/log/nginx/{{ rproxy_service }}.error.log;
server_name {{ rproxy_service_name }}.{{ domain.stdout }};
access_log /var/log/nginx/{{ rproxy_service_name }}.access.log;
error_log /var/log/nginx/{{ rproxy_service_name }}.error.log;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
server_name {{ rproxy_service }}.{{ domain.stdout }};
access_log /var/log/nginx/{{ rproxy_service }}.access.log;
error_log /var/log/nginx/{{ rproxy_service }}.error.log;
ssl_certificate /etc/nginx/{{ domain.stdout }}.crt;
ssl_certificate_key /etc/nginx/{{ domain.stdout }}.key;
server_name {{ rproxy_service_name }}.{{ domain.stdout }};
access_log /var/log/nginx/{{ rproxy_service_name }}.access.log;
error_log /var/log/nginx/{{ rproxy_service_name }}.error.log;
ssl_certificate /etc/nginx/certs/{{ rproxy_service_name }}.crt;
ssl_certificate_key /etc/nginx/certs/{{ rproxy_service_name }}.key;
ssl_protocols TLSv1.2;
ssl_ciphers EECDH:+AES256:-3DES:!RSA+AES:!RSA+3DES:!NULL:!RC4;
ssl_prefer_server_ciphers on;
proxy_connect_timeout 600s;
fastcgi_request_buffering off;
fastcgi_buffers 64 4K;
location / {
proxy_pass_header Server;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass https://{{ rproxy_service }}.{{ domain.stdout }}/;
proxy_pass http://{{ rproxy_service_name }}.{{ domain.stdout }}/;
}
}
{% endfor %}

11
rproxy.yml
View File

@@ -5,7 +5,16 @@
vars:
ansible_python_interpreter: /usr/bin/python3
rproxy_dir: /opt/rproxy
rproxy_service_list: [jenkins]
vars_prompt:
- name: rproxy_service_name
prompt: Enter service for rproxy
- name: rproxy_service_port
prompt: Enter service for rproxy
- name: rproxy_service_address
prompt: Enter service for rproxy
roles:
- rproxy