382 lines
16 KiB
YAML
382 lines
16 KiB
YAML
---
|
|
|
|
- name: Deploy Gitea Action
|
|
hosts: raspberries:&local:!gitea # do not deploy on machine with gitea instance
|
|
|
|
roles:
|
|
- arcodange.factory.gitea_token # generate gitea_api_token used to replace generated token with set name if required
|
|
|
|
tasks:
|
|
|
|
- name: Fetch Gitea Token for Action Runner registration
|
|
delegate_to: "{{ groups.gitea[0] }}"
|
|
delegate_facts: false
|
|
ansible.builtin.command:
|
|
docker exec gitea su git -c "gitea actions generate-runner-token"
|
|
register: gitea_runner_token_cmd
|
|
|
|
- name: Deploy Gitea Action Docker Compose configuration
|
|
include_role:
|
|
name: arcodange.factory.deploy_docker_compose
|
|
vars:
|
|
dockercompose_content:
|
|
name: arcodange_factory_gitea_action
|
|
services:
|
|
gitea_action:
|
|
image: gitea/act_runner:latest
|
|
container_name: gitea_action
|
|
restart: always
|
|
environment:
|
|
CONFIG_FILE: /config.yaml
|
|
GITEA_INSTANCE_URL: >-
|
|
http://{{ hostvars[groups.gitea[0]].ansible_host }}:3000
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: "{{ gitea_runner_token_cmd.stdout }}"
|
|
GITEA_RUNNER_NAME: arcodange_global_runner_{{ inventory_hostname }}
|
|
GITEA_RUNNER_LABELS: ubuntu-latest:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca,ubuntu-latest-ca:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
- /etc/ssl/certs:/etc/ssl/certs:ro
|
|
- /usr/local/share/ca-certificates/:/usr/local/share/ca-certificates/:ro
|
|
configs:
|
|
- config.yaml
|
|
configs:
|
|
config.yaml:
|
|
content: |
|
|
# You don't have to copy this file to your instance,
|
|
# just run `./act_runner generate-config > config.yaml` to generate a config file.
|
|
|
|
#log:
|
|
# # The level of logging, can be trace, debug, info, warn, error, fatal
|
|
# level: info
|
|
|
|
runner:
|
|
# Where to store the registration result.
|
|
file: .runner
|
|
# Execute how many tasks concurrently at the same time.
|
|
capacity: 2
|
|
# Extra environment variables to run jobs.
|
|
envs:
|
|
A_TEST_ENV_NAME_1: a_test_env_value_1
|
|
A_TEST_ENV_NAME_2: a_test_env_value_2
|
|
# Extra environment variables to run jobs from a file.
|
|
# It will be ignored if it's empty or the file doesn't exist.
|
|
env_file: .env
|
|
# The timeout for a job to be finished.
|
|
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
|
|
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
|
|
timeout: 3h
|
|
# Whether skip verifying the TLS certificate of the Gitea instance.
|
|
insecure: true
|
|
# The timeout for fetching the job from the Gitea instance.
|
|
fetch_timeout: 5s
|
|
# The interval for fetching the job from the Gitea instance.
|
|
fetch_interval: 2s
|
|
# The labels of a runner are used to determine which jobs the runner can run, and how to run them.
|
|
# Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
|
# Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
|
|
# If it's empty when registering, it will ask for inputting labels.
|
|
# If it's empty when execute `daemon`, will use labels in `.runner` file.
|
|
labels:
|
|
- "ubuntu-latest:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca"
|
|
- "ubuntu-latest-ca:docker://gitea.arcodange.lab/arcodange-org/runner-images:ubuntu-latest-ca"
|
|
|
|
cache:
|
|
# Enable cache server to use actions/cache.
|
|
enabled: true
|
|
# The directory to store the cache data.
|
|
# If it's empty, the cache data will be stored in $HOME/.cache/actcache.
|
|
dir: ""
|
|
# The host of the cache server.
|
|
# It's not for the address to listen, but the address to connect from job containers.
|
|
# So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
|
|
host: "{{ ansible_default_ipv4.address }}"
|
|
# The port of the cache server.
|
|
# 0 means to use a random available port.
|
|
port: 0
|
|
# The external cache server URL. Valid only when enable is true.
|
|
# If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
|
|
# The URL should generally end with "/".
|
|
external_server: ""
|
|
|
|
container:
|
|
# Specifies the network to which the container will connect.
|
|
# Could be host, bridge or the name of a custom network.
|
|
# If it's empty, act_runner will create a network automatically.
|
|
network: ""
|
|
# Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
|
|
privileged: false
|
|
# And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
|
|
options:
|
|
# The parent directory of a job's working directory.
|
|
# NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
|
|
# If the path starts with '/', the '/' will be trimmed.
|
|
# For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
|
|
# If it's empty, /workspace will be used.
|
|
workdir_parent:
|
|
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
|
|
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
|
|
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
|
|
# valid_volumes:
|
|
# - data
|
|
# - /src/*.json
|
|
# If you want to allow any volume, please use the following configuration:
|
|
# valid_volumes:
|
|
# - '**'
|
|
valid_volumes: []
|
|
# overrides the docker client host with the specified one.
|
|
# If it's empty, act_runner will find an available docker host automatically.
|
|
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
|
|
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
|
|
docker_host: ""
|
|
# Pull docker image(s) even if already present
|
|
force_pull: true
|
|
# Rebuild docker image(s) even if already present
|
|
force_rebuild: false
|
|
|
|
host:
|
|
# The parent directory of a job's working directory.
|
|
# If it's empty, $HOME/.cache/act/ will be used.
|
|
workdir_parent:
|
|
- name: Deploy Gitea Action with Docker Compose
|
|
community.docker.docker_compose_v2:
|
|
project_src: "/home/pi/arcodange/docker_composes/arcodange_factory_gitea_action"
|
|
pull: missing
|
|
state: "{{ docker_compose_down_then_up }}"
|
|
register: deploy_result
|
|
loop: ["absent", "present"]
|
|
loop_control:
|
|
loop_var: docker_compose_down_then_up
|
|
|
|
# - name: Set PACKAGES_TOKEN secret to upload packages from CI
|
|
# run_once: True
|
|
# block:
|
|
# - name: Generate cicd PACKAGES_TOKEN
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_token
|
|
# vars:
|
|
# gitea_token_name: PACKAGES_TOKEN
|
|
# gitea_token_fact_name: cicd_PACKAGES_TOKEN
|
|
# gitea_token_scopes: write:package
|
|
# gitea_token_replace: true
|
|
|
|
# - name: Register cicd PACKAGES_TOKEN secrets
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_secret
|
|
# vars:
|
|
# gitea_secret_name: PACKAGES_TOKEN
|
|
# gitea_secret_value: "{{ cicd_PACKAGES_TOKEN }}"
|
|
# loop: ["organization", "user"]
|
|
# loop_control:
|
|
# loop_var: gitea_owner_type # Peut être "user" ou "organization"
|
|
|
|
# - name: Set HOMELAB_CA_CERT secret to validate self signed ssl
|
|
# run_once: True
|
|
# block:
|
|
# - name: Download homelab CA certificate
|
|
# ansible.builtin.uri:
|
|
# url: "https://ssl-ca.arcodange.lab:8443/roots.pem"
|
|
# return_content: yes
|
|
# validate_certs: no
|
|
# register: homelab_ca_cert
|
|
# - name: Debug cert
|
|
# debug:
|
|
# msg: "{{ homelab_ca_cert.content }}..."
|
|
# - name: Register cicd HOMELAB_CA_CERT secrets
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_secret
|
|
# vars:
|
|
# gitea_secret_name: HOMELAB_CA_CERT
|
|
# gitea_secret_value: "{{ homelab_ca_cert.content | b64encode }}"
|
|
# loop: ["organization", "user"]
|
|
# loop_control:
|
|
# loop_var: gitea_owner_type # Peut être "user" ou "organization"
|
|
|
|
# post_tasks:
|
|
# - include_role:
|
|
# name: arcodange.factory.gitea_token
|
|
# vars:
|
|
# gitea_token_delete: true
|
|
|
|
|
|
# - name: Deploy Argo CD
|
|
# hosts: localhost
|
|
# roles:
|
|
# - role: arcodange.factory.gitea_token # generate gitea_api_token used to replace generated token with set name if required
|
|
# tags:
|
|
# - gitea_sync
|
|
# tasks:
|
|
# - name: Set factory repo
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_repo
|
|
# vars:
|
|
# gitea_repo_name: factory
|
|
# - name: Sync other repos
|
|
# tags: gitea_sync
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_sync
|
|
# apply:
|
|
# tags: gitea_sync
|
|
# - name: Generate Argo CD token
|
|
# include_role:
|
|
# name: arcodange.factory.gitea_token
|
|
# vars:
|
|
# gitea_token_name: ARGOCD_TOKEN
|
|
# gitea_token_fact_name: argocd_token
|
|
# gitea_token_scopes: read:repository,read:package
|
|
# gitea_token_replace: true
|
|
# - name: Figure out k3s master node
|
|
# shell:
|
|
# kubectl get nodes -l node-role.kubernetes.io/control-plane=true -o name | sed s'#node/##'
|
|
# register: get_k3s_master_node
|
|
# changed_when: false
|
|
# - name: Get kubernetes server internal url
|
|
# command: >-
|
|
# echo https://kubernetes.default.svc
|
|
# # {%raw%}
|
|
# # kubectl get svc/kubernetes -o template="{{.spec.clusterIP}}:{{(index .spec.ports 0).port}}"
|
|
# # {%endraw%}
|
|
# register: get_k3s_internal_server_url
|
|
# changed_when: false
|
|
# - set_fact:
|
|
# k3s_master_node: "{{ get_k3s_master_node.stdout }}"
|
|
# k3s_internal_server_url: "{{ get_k3s_internal_server_url.stdout }}"
|
|
# - name: Read Step CA root certificate from k3s master
|
|
# become: true
|
|
# delegate_to: "{{ k3s_master_node }}"
|
|
# slurp:
|
|
# src: /home/step/.step/certs/root_ca.crt
|
|
# register: step_ca_root_cert
|
|
# - name: Decode Step CA root certificate
|
|
# set_fact:
|
|
# step_ca_root_cert_pem: "{{ step_ca_root_cert.content | b64decode }}"
|
|
# - name: Install Argo CD
|
|
# become: true
|
|
# delegate_to: "{{ k3s_master_node }}"
|
|
# vars:
|
|
# gitea_credentials:
|
|
# username: arcodange
|
|
# password: "{{ argocd_token }}"
|
|
# argocd_helm_values: # https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
|
|
# global:
|
|
# domain: argocd.arcodange.lab
|
|
# configs:
|
|
# cm:
|
|
# kustomize.buildOptions: "--enable-helm"
|
|
# helm.enablePostRenderer: "true"
|
|
# exec.enabled: "true"
|
|
# params:
|
|
# server.insecure: true # let k3s traefik do TLS termination
|
|
# ansible.builtin.copy:
|
|
# dest: /var/lib/rancher/k3s/server/manifests/argocd.yaml
|
|
# content: |-
|
|
# apiVersion: v1
|
|
# kind: Namespace
|
|
# metadata:
|
|
# name: argocd
|
|
# ---
|
|
# apiVersion: v1
|
|
# kind: ConfigMap
|
|
# metadata:
|
|
# name: argocd-tls-certs-cm
|
|
# namespace: argocd
|
|
# data:
|
|
# gitea.arcodange.lab: |
|
|
# {{ step_ca_root_cert_pem | indent(4) }}
|
|
# ---
|
|
# apiVersion: helm.cattle.io/v1
|
|
# kind: HelmChart
|
|
# metadata:
|
|
# name: argocd
|
|
# namespace: kube-system
|
|
# spec:
|
|
# repo: https://argoproj.github.io/argo-helm
|
|
# chart: argo-cd
|
|
# targetNamespace: argocd
|
|
# valuesContent: |-
|
|
# {{ argocd_helm_values | to_nice_yaml | indent( width=4 ) }}
|
|
# ---
|
|
# apiVersion: networking.k8s.io/v1
|
|
# kind: Ingress
|
|
# metadata:
|
|
# name: argocd-server-ingress
|
|
# namespace: argocd
|
|
# annotations:
|
|
# # For Traefik v2.x
|
|
# traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
# traefik.ingress.kubernetes.io/router.tls: "true"
|
|
# traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
|
|
# traefik.ingress.kubernetes.io/router.tls.domains.0.main: arcodange.lab
|
|
# traefik.ingress.kubernetes.io/router.tls.domains.0.sans: argocd.arcodange.lab
|
|
# traefik.ingress.kubernetes.io/router.middlewares: localIp@file
|
|
# spec:
|
|
# rules:
|
|
# - host: argocd.arcodange.lab
|
|
# http:
|
|
# paths:
|
|
# - path: /
|
|
# pathType: Prefix
|
|
# backend:
|
|
# service:
|
|
# name: argocd-server
|
|
# port:
|
|
# number: 80 #TLS is terminated at Traefik
|
|
# ---
|
|
# apiVersion: v1
|
|
# kind: Secret
|
|
# metadata:
|
|
# name: gitea-arcodangeorg-factory-repo
|
|
# namespace: argocd
|
|
# labels:
|
|
# argocd.argoproj.io/secret-type: repository
|
|
# stringData:
|
|
# type: git
|
|
# url: https://gitea.arcodange.lab/arcodange-org/factory
|
|
# ---
|
|
# apiVersion: v1
|
|
# kind: Secret
|
|
# metadata:
|
|
# name: gitea-arcodangeorg-repo-creds
|
|
# namespace: argocd
|
|
# labels:
|
|
# argocd.argoproj.io/secret-type: repo-creds
|
|
# stringData:
|
|
# type: git
|
|
# url: https://gitea.arcodange.lab/arcodange-org
|
|
# password: {{ gitea_credentials.password }}
|
|
# username: {{ gitea_credentials.username }}
|
|
# ---
|
|
# apiVersion: argoproj.io/v1alpha1
|
|
# kind: Application
|
|
# metadata:
|
|
# name: factory
|
|
# namespace: argocd
|
|
# spec:
|
|
# project: default
|
|
# source:
|
|
# repoURL: https://gitea.arcodange.lab/arcodange-org/factory
|
|
# targetRevision: HEAD
|
|
# path: argocd
|
|
# destination:
|
|
# server: {{ k3s_internal_server_url }}
|
|
# namespace: argocd
|
|
# syncPolicy:
|
|
# automated:
|
|
# prune: true
|
|
# selfHeal: true
|
|
# - name: touch manifests/argocd.yaml to trigger update
|
|
# delegate_to: "{{ k3s_master_node }}"
|
|
# ansible.builtin.file:
|
|
# path: /var/lib/rancher/k3s/server/manifests/argocd.yaml
|
|
# state: touch
|
|
# become: true
|
|
# post_tasks:
|
|
# - include_role:
|
|
# name: arcodange.factory.gitea_token
|
|
# apply:
|
|
# tags: gitea_sync
|
|
# tags:
|
|
# - gitea_sync
|
|
# vars:
|
|
# gitea_token_delete: true |