Diffstat (limited to 'Jenkinsfile')
| -rw-r--r-- | Jenkinsfile | 286 |
1 files changed, 267 insertions, 19 deletions
diff --git a/Jenkinsfile b/Jenkinsfile index 1eb8b20..8633145 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -13,29 +13,110 @@ pipeline { checkout scm sh ''' npm install tailwindcss @tailwindcss/cli @tailwindcss/forms - npx tailwindcss -i static/input.css -o static/output.css --watch + npx tailwindcss -i static/input.css -o static/output.css --minify ''' stash name: 'tailwindcss-output', includes: 'static/output.css' } } - - stage('Build') { - agent { - kubernetes { - defaultContainer 'kaniko' - yaml """ + + stage('Matrix Build') { + matrix { + axes { + axis { + name 'GOOS' + values 'linux' + } + axis { + name 'GOARCH' + values 'arm64', 'amd64' + } + } + stages { + stage('Build') { + agent { + kubernetes { + defaultContainer 'kaniko' + yaml """ apiVersion: v1 kind: Pod metadata: - name: kaniko-sayauz-web namespace: jenkins spec: + nodeSelector: + kubernetes.io/arch: ${GOARCH} containers: - name: kaniko image: gcr.io/kaniko-project/executor:v1.24.0-debug imagePullPolicy: Always command: [ /busybox/cat ] tty: true + resources: + requests: + cpu: "1" + memory: 2Gi + ephemeral-storage: 4Gi + limits: + memory: 4Gi + ephemeral-storage: 8Gi +""" + } + } + environment { + IMAGE_PUSH_DESTINATION="registry.sayag.it/sayauz/web" + } + steps { + checkout scm + unstash 'tailwindcss-output' + container(name: 'kaniko', shell: '/busybox/sh') { + withCredentials([string(credentialsId: 'registry-sayagit-jenkins-password', variable: 'REGISTRY_SAYAGIT_JENKINS_PASSWORD')]) { + withEnv(['PATH+EXTRA=/busybox']) { + script { + env.GIT_COMMIT_SHORT = env.GIT_COMMIT ? env.GIT_COMMIT.take(7) : "unknown" + try { + sh '''#!/busybox/sh + mkdir -p /kaniko/.docker + printf '{"auths":{"registry.sayag.it":{"username":"jenkins","password":"%s"}}}' "$REGISTRY_SAYAGIT_JENKINS_PASSWORD" > /kaniko/.docker/config.json + /kaniko/executor --context `pwd` \ + --custom-platform=linux/${GOARCH} \ + --build-arg TARGETOS=linux \ + --build-arg TARGETARCH=${GOARCH} \ + --destination $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT-$GOARCH + ''' + } catch (Exception e) { + echo "Caught exception: ${e.getMessage()}" + currentBuild.result = 'FAILURE' + throw e + } + } + } + } + } + } + } + } + } + } + stage('Stitch Manifest') { + agent { + kubernetes { + defaultContainer 'manifest-tool' + yaml """ +apiVersion: v1 +kind: Pod +metadata: + namespace: jenkins +spec: + containers: + - name: manifest-tool + image: mplatform/manifest-tool:alpine-v2.2.2 + imagePullPolicy: Always + command: [ 'cat' ] + tty: true + resources: + requests: + cpu: "1" + memory: 2Gi + ephemeral-storage: 4Gi """ } } @@ -43,18 +124,185 @@ spec: IMAGE_PUSH_DESTINATION="registry.sayag.it/sayauz/web" } steps { + script { + env.GIT_COMMIT_SHORT = env.GIT_COMMIT ? env.GIT_COMMIT.take(7) : "unknown" + } + withCredentials([string(credentialsId: 'registry-sayagit-jenkins-password', variable: 'REGISTRY_SAYAGIT_JENKINS_PASSWORD')]) { + sh '''mkdir -p /root/.docker + printf '{"auths":{"registry.sayag.it":{"username":"jenkins","password":"%s"}}}' "$REGISTRY_SAYAGIT_JENKINS_PASSWORD" > /root/.docker/config.json + + manifest-tool push from-args \ + --platforms linux/amd64,linux/arm64 \ + --template $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT-ARCH \ + --target $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT + manifest-tool push from-args \ + --platforms linux/amd64,linux/arm64 \ + --template $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT-ARCH \ + --target $IMAGE_PUSH_DESTINATION:latest + if [ "$TAG_NAME" != "" ]; then + manifest-tool push from-args \ + --platforms linux/amd64,linux/arm64 \ + --template $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT-ARCH \ + --target $IMAGE_PUSH_DESTINATION:stable + manifest-tool push from-args \ + --platforms linux/amd64,linux/arm64 \ + --template $IMAGE_PUSH_DESTINATION:commit-$GIT_COMMIT_SHORT-ARCH \ + --target $IMAGE_PUSH_DESTINATION:$TAG_NAME + fi + ''' + } + } + } + stage('Deploy (Stage)') { + when { branch 'stage' } + agent { + kubernetes { + defaultContainer 'ansible' + yaml """ +apiVersion: v1 +kind: Pod +metadata: + namespace: jenkins +spec: + containers: + - name: ansible + image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2 + command: [ 'cat' ] + tty: true + resources: + requests: + cpu: "500m" + memory: 1Gi +""" + } + } + steps { checkout scm - unstash 'tailwindcss-output' - container(name: 'kaniko', shell: '/busybox/sh') { - withCredentials([file(credentialsId: 'registry-sayagit-jenkins-password', variable: 'REGISTRY_SAYAGIT_JENKINS_PASSWORD')]) { - withEnv(['PATH+EXTRA=/busybox']) { - sh '''#!/busybox/sh - docker login registry.sayag.it -u jenkins -p "$REGISTRY_SAYAGIT_JENKINS_PASSWORD" - pushToTags="$IMAGE_PUSH_DESTINATION:latest $IMAGE_PUSH_DESTINATION:commit-`git rev-parse --short HEAD`" - if [ "$TAG_NAME" != "" ]; then - pushToTags="$pushToTags $IMAGE_PUSH_DESTINATION:stable $IMAGE_PUSH_DESTINATION:$TAG_NAME" - fi - /kaniko/executor --context `pwd` --destination $pushToTags + container('ansible') { + script { + env.GIT_COMMIT_SHORT = env.GIT_COMMIT ? env.GIT_COMMIT.take(7) : "unknown" + + def secretVars = [ + 'sayauz-web-stage-auth-salt' : 'AUTH_SALT', + 'sayauz-web-stage-s3-access-key-id' : 'S3_ACCESS_KEY_ID', + 'sayauz-web-stage-s3-secret-access-key' : 'S3_SECRET_ACCESS_KEY', + 'sayauz-web-stage-mail-salt' : 'MAIL_SALT', + 'sayauz-web-stage-mail-host' : 'MAIL_HOST', + 'sayauz-web-stage-mail-address' : 'MAIL_ADDRESS', + 'sayauz-web-stage-mail-username' : 'MAIL_USERNAME', + 'sayauz-web-stage-mail-password' : 'MAIL_PASSWORD' + ] + def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) } + bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-github', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER') + + withCredentials(bindings) { + sh ''' + ansible-galaxy collection install community.docker + + mkdir -p ~/.ssh + cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts + + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'" + + cd deploy + ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \ + playbook.yml \ + -i inventory.yml \ + -l stage \ + --private-key ~/.ssh/id_ed25519 \ + -u "$SSH_USER" \ + -e saya_today_web_auth_salt="$AUTH_SALT" \ + -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \ + -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \ + -e saya_today_web_environment=stage \ + -e saya_today_web_tag=commit-$GIT_COMMIT_SHORT \ + -e saya_today_web_mail_salt="$MAIL_SALT" \ + -e saya_today_web_mail_host="$MAIL_HOST" \ + -e saya_today_web_mail_address="$MAIL_ADDRESS" \ + -e saya_today_web_mail_username="$MAIL_USERNAME" \ + -e saya_today_web_mail_password="$MAIL_PASSWORD" + ''' + } + } + } + } + } + stage('Deploy (Prod)') { + when { buildingTag() } + agent { + kubernetes { + defaultContainer 'ansible' + yaml """ +apiVersion: v1 +kind: Pod +metadata: + namespace: jenkins +spec: + containers: + - name: ansible + image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2 + command: [ 'cat' ] + tty: true + resources: + requests: + cpu: "500m" + memory: 1Gi +""" + } + } + steps { + checkout scm + container('ansible') { + script { + def secretVars = [ + 'sayauz-web-prod-auth-salt' : 'AUTH_SALT', + 'sayauz-web-prod-s3-access-key-id' : 'S3_ACCESS_KEY_ID', + 'sayauz-web-prod-s3-secret-access-key' : 'S3_SECRET_ACCESS_KEY', + 'sayauz-web-prod-mail-salt' : 'MAIL_SALT', + 'sayauz-web-prod-mail-host' : 'MAIL_HOST', + 'sayauz-web-prod-mail-address' : 'MAIL_ADDRESS', + 'sayauz-web-prod-mail-username' : 'MAIL_USERNAME', + 'sayauz-web-prod-mail-password' : 'MAIL_PASSWORD', + 'sayauz-web-prod-verification-google' : 'GOOGLE_VERIFICATION', + 'sayauz-web-prod-verification-yandex' : 'YANDEX_VERIFICATION', + 'sayauz-web-prod-verification-bing' : 'BING_VERIFICATION' + ] + def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) } + bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-github', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER') + + withCredentials(bindings) { + sh ''' + ansible-galaxy collection install community.docker + + mkdir -p ~/.ssh + cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts + + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'" + + cd deploy + ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \ + playbook.yml \ + -i inventory.yml \ + -l prod \ + --private-key ~/.ssh/id_ed25519 \ + -u "$SSH_USER" \ + -e saya_today_web_auth_salt="$AUTH_SALT" \ + -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \ + -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \ + -e saya_today_web_environment=prod \ + -e saya_today_web_tag=$TAG_NAME \ + -e saya_today_web_mail_salt="$MAIL_SALT" \ + -e saya_today_web_mail_host="$MAIL_HOST" \ + -e saya_today_web_mail_address="$MAIL_ADDRESS" \ + -e saya_today_web_mail_username="$MAIL_USERNAME" \ + -e saya_today_web_mail_password="$MAIL_PASSWORD" \ + -e saya_today_google_verification="$GOOGLE_VERIFICATION" \ + -e saya_today_yandex_verification="$YANDEX_VERIFICATION" \ + -e saya_today_bing_verification="$BING_VERIFICATION" ''' } } |