autoconf - various kubernetes fixes

2021-08-13 16:42:31 +02:00
parent c9a6b6c27d
commit f1d5c07cc1
9 changed files with 180 additions and 177 deletions
--- a/helpers/autoconf.yml
+++ b/helpers/autoconf.yml
@@ -0,0 +1,39 @@
+version: '3'
+
+services:
+
+  mybunkerized:
+    image: bunkerity/bunkerized-nginx
+    restart: always
+    ports:
+      - 80:8080
+      - 443:8443
+    volumes:
+      - ./certs:/etc/letsencrypt
+      - ./www:/www:ro
+      - bunkerized-vol:/etc/nginx
+    environment:
+      - SERVER_NAME=
+      - MULTISITE=yes
+      - AUTO_LETS_ENCRYPT=yes
+    labels:
+      - "bunkerized-nginx.AUTOCONF"
+    networks:
+      - services-net
+
+  myautoconf:
+    image: bunkerity/bunkerized-nginx-autoconf
+    restart: always
+    volumes_from:
+      - mybunkerized
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    depends_on:
+      - mybunkerized
+
+volumes:
+  bunkerized-vol:
+
+networks:
+  services-net:
+    name: services-net
--- a/helpers/kubernetes-ingress.yml
+++ b/helpers/kubernetes-ingress.yml
@@ -1,65 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bunkerized-nginx-ingress
-  labels:
-    bunkerized-nginx: "yes"
-  annotations:
-    # add any global and default environment variables here as annotations with the "bunkerized-nginx." prefix
-    # examples :
-    #bunkerized-nginx.AUTO_LETS_ENCRYPT: "yes"
-    #bunkerized-nginx.USE_ANTIBOT: "javascript"
-    #bunkerized-nginx.REDIRECT_HTTP_TO_HTTPS: "yes"
-    #bunkerized-nginx.app.example.com_REVERSE_PROXY_WS: "yes"
-    #bunkerized-nginx.app.example.com_USE_MODSECURITY: "no"
-
-# add "static" routes here (see https://kubernetes.io/docs/concepts/services-networking/ingress/)
-# and/or add annotations to your services (see https://github.com/bunkerity/bunkerized-nginx/tree/master/examples/kubernetes)
-spec:
-  tls:
-  - hosts:
-    - app.example.com
-  rules:
-  - host: "app.example.com"
-    http:
-      paths:
-      - pathType: Prefix
-        path: "/"
-        backend:
-          service:
-            name: myapp
-            port:
-              number: 80
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: myapp
-  labels:
-    app: myapp
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: myapp
-  template:
-    metadata:
-      labels:
-        app: myapp
-    spec:
-      containers:
-      - name: myapp
-        image: containous/whoami
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: myapp
-spec:
-  type: ClusterIP
-  selector:
-    app: myapp
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 80
--- a/helpers/kubernetes-nginx.yml
+++ b/helpers/kubernetes-nginx.yml
@@ -1,71 +1,4 @@
 apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bunkerized-nginx-ingress-controller
-  labels:
-    app: bunkerized-nginx-autoconf
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: bunkerized-nginx-autoconf
-  template:
-    metadata:
-      labels:
-        app: bunkerized-nginx-autoconf
-    spec:
-      serviceAccountName: bunkerized-nginx-ingress-controller
-      containers:
-      - name: bunkerized-nginx-autoconf
-        image: bunkerity/bunkerized-nginx-autoconf
-        #imagePullPolicy: Always
-        env:
-        - name: KUBERNETES_MODE
-          value: "yes"
-        - name: API_URI
-          value: "/ChangeMeToSomethingHardToGuess"
-        volumeMounts:
-        - name: confs
-          mountPath: /etc/nginx
-        - name: letsencrypt
-          mountPath: /etc/letsencrypt
-        - name: acme-challenge
-          mountPath: /acme-challenge
-        - name: cache
-          mountPath: /cache
-        - name: modsec-confs
-          mountPath: /modsec-confs
-          readOnly: true
-        - name: modsec-crs-confs
-          mountPath: /modsec-crs-confs
-          readOnly: true
-      volumes:
-      - name: confs
-        hostPath:
-          path: /shared/confs
-          type: Directory
-      - name: letsencrypt
-        hostPath:
-          path: /shared/letsencrypt
-          type: Directory
-      - name: acme-challenge
-        hostPath:
-          path: /shared/acme-challenge
-          type: Directory
-      - name: cache
-        hostPath:
-          path: /shared/cache
-          type: Directory
-      - name: modsec-confs
-        hostPath:
-          path: /shared/modsec-confs
-          type: Directory
-      - name: modsec-crs-confs
-        hostPath:
-          path: /shared/modsec-crs-confs
-          type: Directory
---
-apiVersion: apps/v1
 kind: DaemonSet
 metadata:
  name: bunkerized-nginx
@@ -79,12 +12,12 @@ spec:
    metadata:
      labels:
        name: bunkerized-nginx
+        # this label is mandatory
        bunkerized-nginx: "yes"
    spec:
      containers:
      - name: bunkerized-nginx
        image: bunkerity/bunkerized-nginx
-        #imagePullPolicy: Always
        ports:
        - containerPort: 8080
          hostPort: 80
@@ -114,18 +47,6 @@ spec:
        - name: www
          mountPath: /www
          readOnly: true
-        - name: http-confs
-          mountPath: /http-confs
-          readOnly: true
-        - name: server-confs
-          mountPath: /server-confs
-          readOnly: true
-        - name: modsec-confs
-          mountPath: /modsec-confs
-          readOnly: true
-        - name: modsec-crs-confs
-          mountPath: /modsec-crs-confs
-          readOnly: true
      volumes:
      - name: confs
        hostPath:
@@ -143,32 +64,64 @@ spec:
        hostPath:
          path: /shared/www
          type: Directory
-      - name: http-confs
-        hostPath:
-          path: /shared/http-confs
-          type: Directory
-      - name: server-confs
-        hostPath:
-          path: /shared/server-confs
-          type: Directory
-      - name: modsec-confs
-        hostPath:
-          path: /shared/modsec-confs
-          type: Directory
-      - name: modsec-crs-confs
-        hostPath:
-          path: /shared/modsec-crs-confs
-          type: Directory
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: bunkerized-nginx-service
+  # this label is mandatory
  labels:
    bunkerized-nginx: "yes"
+  # this annotation is mandatory
  annotations:
    bunkerized-nginx.AUTOCONF: "yes"
 spec:
  clusterIP: None
  selector:
    name: bunkerized-nginx
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bunkerized-nginx-ingress-controller
+  labels:
+    app: bunkerized-nginx-autoconf
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: bunkerized-nginx-autoconf
+  template:
+    metadata:
+      labels:
+        app: bunkerized-nginx-autoconf
+    spec:
+      serviceAccountName: bunkerized-nginx-ingress-controller
+      containers:
+      - name: bunkerized-nginx-autoconf
+        image: bunkerity/bunkerized-nginx-autoconf
+        env:
+        - name: KUBERNETES_MODE
+          value: "yes"
+        - name: API_URI
+          value: "/ChangeMeToSomethingHardToGuess"
+        volumeMounts:
+        - name: confs
+          mountPath: /etc/nginx
+        - name: letsencrypt
+          mountPath: /etc/letsencrypt
+        - name: acme-challenge
+          mountPath: /acme-challenge
+      volumes:
+      - name: confs
+        hostPath:
+          path: /shared/confs
+          type: Directory
+      - name: letsencrypt
+        hostPath:
+          path: /shared/letsencrypt
+          type: Directory
+      - name: acme-challenge
+        hostPath:
+          path: /shared/acme-challenge
+          type: Directory
--- a/helpers/swarm.yml
+++ b/helpers/swarm.yml
@@ -0,0 +1,67 @@
+version: '3.8'
+
+services:
+
+  nginx:
+    image: bunkerity/bunkerized-nginx
+    ports:
+      - published: 80
+        target: 8080
+        mode: host
+        protocol: tcp
+      - published: 443
+        target: 8443
+        mode: host
+        protocol: tcp
+    volumes:
+      - /shared/confs:/etc/nginx:ro
+      - /shared/www:/www:ro
+      - /shared/letsencrypt:/etc/letsencrypt:ro
+      - /shared/acme-challenge:/acme-challenge:ro
+    environment:
+      - SWARM_MODE=yes
+      - USE_API=yes
+      - API_URI=/ChangeMeToSomethingHardToGuess # must match API_URI from autoconf
+      - MULTISITE=yes
+      - SERVER_NAME=
+      - AUTO_LETS_ENCRYPT=yes
+    networks:
+      - bunkerized-net
+      - services-net
+    deploy:
+      mode: global
+      placement:
+        constraints:
+          - "node.role==worker"
+      # mandatory label
+      labels:
+        - "bunkerized-nginx.AUTOCONF"
+
+  autoconf:
+    image: bunkerity/bunkerized-nginx-autoconf
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - /shared/confs:/etc/nginx
+      - /shared/letsencrypt:/etc/letsencrypt
+      - /shared/acme-challenge:/acme-challenge
+    environment:
+      - SWARM_MODE=yes
+      - API_URI=/ChangeMeToSomethingHardToGuess # must match API_URI from nginx
+    networks:
+      - bunkerized-net
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - "node.role==manager"
+
+# This will create the networks for you
+networks:
+  bunkerized-net:
+    driver: overlay
+    attachable: true
+    name: bunkerized-net
+  services-net:
+    driver: overlay
+    attachable: true
+    name: services-net