From 08c301ebf380dfe292cca86355c6110bd999940a Mon Sep 17 00:00:00 2001 From: Paul McGoldrick Date: Thu, 28 Sep 2017 10:03:44 -0700 Subject: initial seed code commit VVP-6 Change-Id: I62f1f86c7a187585e98ccf52b68f57c8d9073175 Signed-off-by: Paul McGoldrick --- assets/gitlab-rb-location.patch | 87 +++++++++++++++++ assets/gitlab.rb | 55 +++++++++++ assets/setup | 81 ++++++++++++++++ assets/sshd_config | 57 ++++++++++++ assets/update-permissions | 81 ++++++++++++++++ assets/wrapper | 202 ++++++++++++++++++++++++++++++++++++++++ 6 files changed, 563 insertions(+) create mode 100755 assets/gitlab-rb-location.patch create mode 100755 assets/gitlab.rb create mode 100755 assets/setup create mode 100755 assets/sshd_config create mode 100755 assets/update-permissions create mode 100755 assets/wrapper (limited to 'assets') diff --git a/assets/gitlab-rb-location.patch b/assets/gitlab-rb-location.patch new file mode 100755 index 0000000..4e39788 --- /dev/null +++ b/assets/gitlab-rb-location.patch @@ -0,0 +1,87 @@ +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +--- etc/gitlab.rb.template.bak 2015-09-22 20:55:42.088202003 +0000 ++++ etc/gitlab.rb.template 2015-09-22 20:55:50.888202003 +0000 +@@ -8,7 +8,7 @@ + ## Url on which GitLab will be reachable. + ## For more details on configuring external_url see: + ## https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/doc/settings/configuration.md#configuring-the-external-url-for-gitlab +-external_url 'GENERATED_EXTERNAL_URL' ++# external_url 'GENERATED_EXTERNAL_URL' # default: http://hostname + + + ## Note: configuration settings below are optional. +--- embedded/cookbooks/gitlab.bak/recipes/remove_accounts.rb 2015-09-22 20:50:46.964202003 +0000 ++++ embedded/cookbooks/gitlab/recipes/remove_accounts.rb 2015-09-22 20:51:49.256202003 +0000 +@@ -16,8 +16,8 @@ + # + + Gitlab[:node] = node +-if File.exists?("/etc/gitlab/gitlab.rb") +- Gitlab.from_file("/etc/gitlab/gitlab.rb") ++if File.exists?("/assets/gitlab.rb") ++ Gitlab.from_file("/assets/gitlab.rb") + end + node.consume_attributes(Gitlab.generate_config(node['fqdn'])) + +--- embedded/cookbooks/gitlab.bak/recipes/show_config.rb 2015-09-22 20:50:46.964202003 +0000 ++++ embedded/cookbooks/gitlab/recipes/show_config.rb 2015-09-22 20:52:02.716202003 +0000 +@@ -16,9 +16,9 @@ + # limitations under the License. + # + +-if File.exists?("/etc/gitlab/gitlab.rb") ++if File.exists?("/assets/gitlab.rb") + Gitlab[:node] = node +- Gitlab.from_file("/etc/gitlab/gitlab.rb") ++ Gitlab.from_file("/assets/gitlab.rb") + end + config = Gitlab.generate_config(node['fqdn']) + +--- embedded/cookbooks/gitlab.bak/recipes/default.rb 2015-09-22 20:50:46.964202003 +0000 ++++ embedded/cookbooks/gitlab/recipes/default.rb 2015-09-22 20:52:13.880202003 +0000 +@@ -31,8 +31,8 @@ + end.run_action(:create) + + Gitlab[:node] = node +-if File.exists?("/etc/gitlab/gitlab.rb") +- Gitlab.from_file("/etc/gitlab/gitlab.rb") ++if File.exists?("/assets/gitlab.rb") ++ Gitlab.from_file("/assets/gitlab.rb") + end + node.consume_attributes(Gitlab.generate_config(node['fqdn'])) diff --git a/assets/gitlab.rb b/assets/gitlab.rb new file mode 100755 index 0000000..18b01fb --- /dev/null +++ b/assets/gitlab.rb @@ -0,0 +1,55 @@ +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +# Docker options +## Prevent Postgres from trying to allocate 25% of total memory +# +postgresql['shared_buffers'] = '1MB' +gitlab_rails['gitlab_email_enabled'] = false +# Manage accounts with docker +manage_accounts['enable'] = false +# Get hostname from shell +external_url ENV.fetch('EXTERNAL_URL', 'https://development.d2ice.att.io') +# Load custom config from environemt variable: GITLAB_OMNIBUS_CONFIG +# Load configuration stored in /etc/gitlab/gitlab.rb +gitlab_rails['rate_limit_requests_per_period'] = 50 +gitlab_workhorse['api_limit'] = 0 +gitlab_rails['rate_limit_period'] = 60 +unicorn['worker_processes'] = 4 +unicorn['worker_timeout'] = 120 +nginx['worker_processes'] = 4 +from_file("/etc/gitlab/gitlab.rb") diff --git a/assets/setup b/assets/setup new file mode 100755 index 0000000..8c431bc --- /dev/null +++ b/assets/setup @@ -0,0 +1,81 @@ +#!/bin/bash +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. + +set -xe + +source /RELEASE + +# Download & Install GitLab +echo "deb https://packages.gitlab.com/gitlab/${PACKAGECLOUD_REPO}/ubuntu/ `lsb_release -cs` main" > /etc/apt/sources.list.d/gitlab_${RELEASE_PACKAGE}.list +wget -q -O - https://packages.gitlab.com/gpg.key | apt-key add - +apt-get update +apt-get install -yq --no-install-recommends ${RELEASE_PACKAGE}=${RELEASE_VERSION} + +# Create sshd daemon +mkdir -p /opt/gitlab/sv/sshd/supervise /opt/gitlab/sv/sshd/log/supervise +mkfifo /opt/gitlab/sv/sshd/supervise/ok /opt/gitlab/sv/sshd/log/supervise/ok +printf "#!/bin/sh\nexec 2>&1\numask 077\nexec /usr/sbin/sshd -D -f /assets/sshd_config -e" > /opt/gitlab/sv/sshd/run +printf "#!/bin/sh\nexec svlogd -tt /var/log/gitlab/sshd" > /opt/gitlab/sv/sshd/log/run +chmod a+x /opt/gitlab/sv/sshd/run /opt/gitlab/sv/sshd/log/run +mkdir -p /var/run/sshd + +# Remove current gitlab.rb file +rm -f /etc/gitlab/gitlab.rb + +# Patch omnibus package +patch -p0 -d /opt/gitlab < /assets/gitlab-rb-location.patch + +# Create groups +groupadd -g 998 git +groupadd -g 999 gitlab-www +groupadd -g 997 gitlab-redis +groupadd -g 996 gitlab-psql +# groupadd -g 995 gitlab-ci +groupadd -g 994 mattermost + +# Create accounts +useradd -m -u 998 -g git -m -s /bin/sh -d /var/opt/gitlab git +useradd -m -u 999 -g gitlab-www -m -s /bin/false -d /var/opt/gitlab/nginx gitlab-www +useradd -m -u 997 -g gitlab-redis -m -s /bin/nologin -d /var/opt/gitlab/redis gitlab-redis +useradd -m -u 996 -g gitlab-psql -m -s /bin/sh -d /var/opt/gitlab/postgresql gitlab-psql +# useradd -m -u 995 -g gitlab-ci -m -s /bin/sh -d /var/opt/gitlab/gitlab-ci gitlab-ci +useradd -m -u 994 -g mattermost -m -s /bin/sh -d /var/opt/gitlab/mattermost mattermost + +# Useful for intraction with api in wrapper +/opt/gitlab/embedded/bin/pip install requests diff --git a/assets/sshd_config b/assets/sshd_config new file mode 100755 index 0000000..e2e7708 --- /dev/null +++ b/assets/sshd_config @@ -0,0 +1,57 @@ +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. +Port 22 +ChallengeResponseAuthentication no +HostKey /etc/gitlab/ssh_host_rsa_key +HostKey /etc/gitlab/ssh_host_ecdsa_key +HostKey /etc/gitlab/ssh_host_ed25519_key +Protocol 2 +PermitRootLogin no +PasswordAuthentication no +MaxStartups 100:30:200 +AllowUsers git +PrintMotd no +PrintLastLog no +PubkeyAuthentication yes + +# Fix: User username not allowed because account is locked +# With "UsePAM yes" the "!" is seen as a password disabled account and not fully locked so ssh public key login works +UsePAM yes + +# Disabling use DNS in ssh since it tends to slow connecting +UseDNS no diff --git a/assets/update-permissions b/assets/update-permissions new file mode 100755 index 0000000..7567c4e --- /dev/null +++ b/assets/update-permissions @@ -0,0 +1,81 @@ +#!/bin/bash +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. + +set -x + +# Fix GitLab permissions +if id -u git; then + # Fix data storage + chown -R git:git /var/opt/gitlab/.ssh + chown -R git:git /var/opt/gitlab/.gitconfig + chown -R git:git /var/opt/gitlab/git-data + chown -R git:git /var/opt/gitlab/gitlab-ci/builds + chown -R git:git /var/opt/gitlab/gitlab-git-http-server + chown -R git:git /var/opt/gitlab/gitlab-rails + chown -R git:git /var/opt/gitlab/gitlab-shell + + # Fix log storage + chown git /var/log/gitlab/gitlab-git-http-server + chown git /var/log/gitlab/gitlab-rails + chown git /var/log/gitlab/gitlab-shell + chown git /var/log/gitlab/sidekiq + chown git /var/log/gitlab/unicorn + chown gitlab-psql /var/log/gitlab/postgresql + chown gitlab-redis /var/log/gitlab/redis + + # Update log files + chown -R git:git /var/log/gitlab/gitlab-rails/*.log + chown -R git:git /var/log/gitlab/gitlab-shell/*.log + chown -R git:git /var/log/gitlab/unicorn/*.log +fi + +# Fix nginx buffering directory permission +if id -u gitlab-www; then + chown -R gitlab-www:gitlab-www /var/opt/gitlab/nginx/*_temp +fi + +# Fix database storage +if id -u gitlab-psql; then + chown -R gitlab-psql:gitlab-psql /var/opt/gitlab/postgresql +fi + +# Fix redis storage +if id -u gitlab-redis; then + chown gitlab-redis:gitlab-redis /var/opt/gitlab/redis +fi diff --git a/assets/wrapper b/assets/wrapper new file mode 100755 index 0000000..5377301 --- /dev/null +++ b/assets/wrapper @@ -0,0 +1,202 @@ +#!/bin/bash +# ============LICENSE_START======================================================= +# org.onap.vvp/gitlab +# =================================================================== +# Copyright © 2017 AT&T Intellectual Property. All rights reserved. +# =================================================================== +# +# Unless otherwise specified, all software contained herein is licensed +# under the Apache License, Version 2.0 (the “License”); +# you may not use this software except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# +# +# Unless otherwise specified, all documentation contained herein is licensed +# under the Creative Commons License, Attribution 4.0 Intl. (the “License”); +# you may not use this documentation except in compliance with the License. +# You may obtain a copy of the License at +# +# https://creativecommons.org/licenses/by/4.0/ +# +# Unless required by applicable law or agreed to in writing, documentation +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# ============LICENSE_END============================================ +# +# ECOMP is a trademark and service mark of AT&T Intellectual Property. + +set -e + +chmod 755 / +echo "setting up /etc/hosts" +echo "127.0.0.1 localhost localhost.localdomain" >>/etc/hosts +chmod 644 /etc/hosts + +echo "setting up resolv.conf" +echo "nameserver 8.8.8.8" >> /etc/resolv.conf +chmod 644 /etc/resolv.conf + +function sigterm_handler() { + echo "SIGTERM signal received, try to gracefully shutdown all services..." + gitlab-ctl stop +} + +trap "sigterm_handler; exit" TERM + +source /RELEASE +echo "Thank you for using GitLab Docker Image!" +echo "Current version: $RELEASE_PACKAGE=$RELEASE_VERSION" +echo "" +if [[ "$PACKAGECLOUD_REPO" == "unstable" ]]; then + echo "You are using UNSTABLE version of $RELEASE_PACKAGE!" + echo "" +fi +echo "Configure GitLab for your system by editing /etc/gitlab/gitlab.rb file" +echo "And restart this container to reload settings." +echo "To do it use docker exec:" +echo +echo " docker exec -it gitlab vim /etc/gitlab/gitlab.rb" +echo " docker restart gitlab" +echo +echo "For a comprehensive list of configuration options please see the Omnibus GitLab readme" +echo "https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/README.md" +echo +echo "If this container fails to start due to permission problems try to fix it by executing:" +echo +echo " docker exec -it gitlab update-permissions" +echo " docker restart gitlab" +echo + +# Copy gitlab.rb for the first time +if [[ ! -e /etc/gitlab/gitlab.rb ]]; then + echo "Installing gitlab.rb config..." + cp /opt/gitlab/etc/gitlab.rb.template /etc/gitlab/gitlab.rb + chmod 0600 /etc/gitlab/gitlab.rb +fi + +# Generate ssh host key for the first time +if [[ ! -f /etc/gitlab/ssh_host_rsa_key ]]; then + echo "Generating ssh_host_rsa_key..." + ssh-keygen -f /etc/gitlab/ssh_host_rsa_key -N '' -t rsa + chmod 0600 /etc/gitlab/ssh_host_rsa_key +fi +if [[ ! -f /etc/gitlab/ssh_host_ecdsa_key ]]; then + echo "Generating ssh_host_ecdsa_key..." + ssh-keygen -f /etc/gitlab/ssh_host_ecdsa_key -N '' -t ecdsa + chmod 0600 /etc/gitlab/ssh_host_ecdsa_key +fi +if [[ ! -f /etc/gitlab/ssh_host_ed25519_key ]]; then + echo "Generating ssh_host_ed25519_key..." + ssh-keygen -f /etc/gitlab/ssh_host_ed25519_key -N '' -t ed25519 + chmod 0600 /etc/gitlab/ssh_host_ed25519_key +fi + +# Remove all services, the reconfigure will create them +echo "Preparing services..." +rm -f /opt/gitlab/service/* +ln -s /opt/gitlab/sv/sshd /opt/gitlab/service +mkdir -p /var/log/gitlab/sshd + +# Start service manager +echo "Starting services..." +GITLAB_OMNIBUS_CONFIG=/opt/gitlab/embedded/bin/runsvdir-start & +/opt/gitlab/embedded/bin/runsvdir-start & + + +# Configure gitlab package +# WARNING: +# the preinst script has the database backup +# It will not be executed, because all services are not yet started +# They will be started when `reconfigure` is executed +echo "Configuring GitLab package..." +/var/lib/dpkg/info/${RELEASE_PACKAGE}.preinst upgrade + +echo "Configuring GitLab..." +gitlab-ctl reconfigure + +echo "Waiting up to three minutes for the postgres socket to appear..." +for f in `seq 12`; do + ls -l "/var/opt/gitlab/postgresql/.s.PGSQL.5432" && break + sleep 15 +done + +[ -e "/var/opt/gitlab/postgresql/.s.PGSQL.5432" ] || { + echo "ERROR: Postgres socket file still unavailable. Aborting." + mount + exit 5 +} + +echo "Attempting to connect to the postgres database..." +su gitlab-psql -c "`which psql` -h /var/opt/gitlab/postgresql/ gitlabhq_production -c \"select 'database up';\"" || { + echo "ERROR: Could not run simple command in postgresql database. Aborting." + mount + exit 6 +} + +# TODO psql is installed. use it to test connection to database. + +if [ "$ADMIN_PASSWORD" ]; then + echo "Setting admin password from environment..." + # set the admin password + gitlab-rails runner ' + u = User.where(id: 1).first + u.password = ENV["ADMIN_PASSWORD"] + u.password_confirmation = ENV["ADMIN_PASSWORD"] + u.password_expires_at = nil + u.reset_password_token = nil + u.reset_password_sent_at = nil + u.password_automatically_set = false + u.authentication_token = ENV["AUTHENTICATION_TOKEN"] + u.save! + ' + echo "[DBG] $0: Passed the gitlab-rails runner" +else + echo "$0: Warning: ADMIN_PASSWORD was not set in the environment." >&2 +fi + +echo "Setting initial jenkins deploy key into admin user ssh keys..." +python -c ' +import requests +import os + +def auth(request): + request.headers["PRIVATE-TOKEN"] = os.environ["AUTHENTICATION_TOKEN"] + return request + +# Delete any old deploy keys +for old_key in requests.get("http://localhost/api/v3/user/keys", + auth=auth).json(): + + if old_key["title"] != "Jenkins deploy key": + continue + + requests.delete("http://localhost/api/v3/user/keys/{id}".format(**old_key), + auth=auth) + +# Set the new deploy key +requests.post("http://localhost/api/v3/user/keys", + params={ + "title": "Jenkins deploy key", + "key": open("/tmp/deploykey/deploykey.pub").read(), + }, + auth=auth) +' + +# Tail all logs +echo "Tailing logs..." +gitlab-ctl tail & + +# Wait for SIGTERM +wait -- cgit 1.2.3-korg