Merge pull request #1254 from moreati/issue1118-update-containers
CI: Build newer test imagespull/1370/head
Alex Willmer
1 week ago
committed by
GitHub
commit
017de4c8e1
@ -1,4 +1,6 @@
|
||||
package_manager_repos:
|
||||
- dest: /etc/apt/sources.list
|
||||
content: |
|
||||
deb http://archive.debian.org/debian stretch main contrib non-free
|
||||
deb http://archive.debian.org/debian/ stretch main contrib non-free
|
||||
deb http://archive.debian.org/debian/ stretch-proposed-updates main contrib non-free
|
||||
deb http://archive.debian.org/debian-security stretch/updates main contrib non-free
|
||||
|
||||
Binary file not shown.
@ -0,0 +1,5 @@
|
||||
- name: Setup container host
|
||||
hosts: localhost
|
||||
become: true
|
||||
roles:
|
||||
- role: container_host
|
||||
@ -1,13 +1,17 @@
|
||||
|
||||
[defaults]
|
||||
any_errors_fatal = true
|
||||
# Ansible >= 6 (ansible-core >= 2.13)
|
||||
callback_result_format = yaml
|
||||
deprecation_warnings = false
|
||||
duplicate_dict_key = error
|
||||
inventory = hosts.ini
|
||||
strategy_plugins = ../../ansible_mitogen/plugins/strategy
|
||||
retry_files_enabled = false
|
||||
display_args_to_stdout = True
|
||||
no_target_syslog = True
|
||||
host_key_checking = False
|
||||
|
||||
[inventory]
|
||||
unparsed_is_fatal = true
|
||||
any_unparsed_is_failed = true
|
||||
host_pattern_mismatch = error
|
||||
unparsed_is_failed = true
|
||||
|
||||
@ -0,0 +1,33 @@
|
||||
DefaultRuntimeDir ${XDG_RUNTIME_DIR}
|
||||
PidFile ${XDG_RUNTIME_DIR}/apache2.pid
|
||||
|
||||
LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so
|
||||
LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
|
||||
LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so
|
||||
LoadModule proxy_module /usr/lib/apache2/modules/mod_proxy.so
|
||||
LoadModule proxy_http_module /usr/lib/apache2/modules/mod_proxy_http.so
|
||||
LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so
|
||||
LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
|
||||
|
||||
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
|
||||
|
||||
KeepAlive On
|
||||
Listen 8090
|
||||
|
||||
<Directory />
|
||||
Require all denied
|
||||
AllowOverride None
|
||||
</Directory>
|
||||
|
||||
<VirtualHost *:8090>
|
||||
ServerName centos-vault-proxy
|
||||
SSLProxyEngine On
|
||||
CustomLog logs/access.log vhost_combined
|
||||
ProxyPass "/" "https://vault.centos.org/"
|
||||
ProxyPassReverse "https://vault.centos.org/" "/"
|
||||
RedirectMatch "^/(.*)" "http://centos-vault-proxy:8090/$1"
|
||||
</VirtualHost>
|
||||
|
||||
# /usr/sbin/apache2 -d . -f apache_proxy.conf -D FOREGROUND
|
||||
|
||||
# vim: syntax=apache
|
||||
@ -1,16 +1,18 @@
|
||||
ansible_version_major_minor: "{{ ansible_version.major }}.{{ ansible_version.minor }}"
|
||||
|
||||
common_packages:
|
||||
- acl
|
||||
- openssh-server
|
||||
- rsync
|
||||
- strace
|
||||
- sudo
|
||||
|
||||
container_image_name: "{{ container_registry }}/{{ inventory_hostname }}-test"
|
||||
container_registry: public.ecr.aws/n5z0e8q9
|
||||
container_registry: ghcr.io/mitogen-hq
|
||||
|
||||
sudo_group:
|
||||
MacOSX: admin
|
||||
Debian: sudo
|
||||
Ubuntu: sudo
|
||||
CentOS: wheel
|
||||
AlmaLinux: wheel
|
||||
|
||||
@ -0,0 +1,5 @@
|
||||
bootstrap_packages: [python3]
|
||||
docker_base: almalinux:9
|
||||
|
||||
packages:
|
||||
- perl-JSON
|
||||
@ -1,6 +1,36 @@
|
||||
bootstrap_packages: [python-simplejson]
|
||||
|
||||
docker_base: astj/centos5-vault
|
||||
docker_base: centos:5
|
||||
|
||||
packages:
|
||||
- perl
|
||||
package_manager_repos:
|
||||
- dest: /etc/yum.repos.d/CentOS-Base.repo
|
||||
content: |
|
||||
[base]
|
||||
name=CentOS-$releasever - Base
|
||||
baseurl=http://centos-vault-proxy:8090/5.11/os/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
|
||||
|
||||
[updates]
|
||||
name=CentOS-$releasever - Updates
|
||||
baseurl=http://centos-vault-proxy:8090/5.11/updates/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
|
||||
|
||||
[extras]
|
||||
name=CentOS-$releasever - Extras
|
||||
baseurl=http://centos-vault-proxy:8090/5.11/extras/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
|
||||
|
||||
- dest: /etc/yum.repos.d/libselinux.repo
|
||||
content: |
|
||||
[libselinux]
|
||||
name=CentOS-$releasever - libselinux
|
||||
baseurl=http://centos-vault-proxy:8090/5.11/centosplus/$basearch/
|
||||
gpgcheck=1
|
||||
enabled=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5
|
||||
includepkgs=libselinux*
|
||||
|
||||
@ -1,6 +1,27 @@
|
||||
bootstrap_packages: [python]
|
||||
|
||||
docker_base: moreati/centos6-vault
|
||||
docker_base: centos:6
|
||||
|
||||
packages:
|
||||
- perl-JSON
|
||||
|
||||
package_manager_repos:
|
||||
- dest: /etc/yum.repos.d/CentOS-Base.repo
|
||||
content: |
|
||||
[base]
|
||||
name=CentOS-$releasever - Base
|
||||
baseurl=http://vault.centos.org/6.10/os/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
|
||||
|
||||
[updates]
|
||||
name=CentOS-$releasever - Updates
|
||||
baseurl=http://vault.centos.org/6.10/updates/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
|
||||
|
||||
[extras]
|
||||
name=CentOS-$releasever - Extras
|
||||
baseurl=http://vault.centos.org/6.10/extras/$basearch/
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-6
|
||||
|
||||
@ -1,11 +1,18 @@
|
||||
bootstrap_packages: [python3, python3-apt]
|
||||
|
||||
docker_base: debian:bullseye
|
||||
docker_base: debian:11
|
||||
|
||||
packages:
|
||||
- doas
|
||||
- libjson-perl
|
||||
- locales
|
||||
- python-is-python3
|
||||
- python2
|
||||
- python3-virtualenv
|
||||
- virtualenv
|
||||
|
||||
package_manager_keys:
|
||||
- src: debian-archive-bullseye-automatic.gpg # Debian 11
|
||||
dest: /etc/apt/trusted.gpg.d/
|
||||
- src: debian-archive-bookworm-automatic.gpg # Debian 12
|
||||
dest: /etc/apt/trusted.gpg.d/
|
||||
|
||||
@ -0,0 +1,8 @@
|
||||
bootstrap_packages: [python3, python3-apt]
|
||||
docker_base: debian:12
|
||||
|
||||
packages:
|
||||
- libjson-perl
|
||||
- locales
|
||||
- opendoas
|
||||
- virtualenv
|
||||
@ -0,0 +1,10 @@
|
||||
bootstrap_packages: [python3, python3-apt]
|
||||
docker_base: ubuntu:22.04
|
||||
|
||||
packages:
|
||||
- doas
|
||||
- libjson-perl
|
||||
- locales
|
||||
- python2
|
||||
- python3-virtualenv
|
||||
- virtualenv
|
||||
@ -0,0 +1,9 @@
|
||||
bootstrap_packages: [python3, python3-apt]
|
||||
docker_base: ubuntu:24.04
|
||||
|
||||
packages:
|
||||
- libjson-perl
|
||||
- locales
|
||||
- opendoas
|
||||
- python3-virtualenv
|
||||
- virtualenv
|
||||
@ -0,0 +1,2 @@
|
||||
bootstrap_packages: []
|
||||
package_manager_repos: []
|
||||
@ -0,0 +1,3 @@
|
||||
- name: Bootstrap
|
||||
raw: "{{ lookup('template', 'bootstrap.sh.j2') }}"
|
||||
changed_when: true
|
||||
@ -0,0 +1,21 @@
|
||||
set -o errexit
|
||||
set -o nounset
|
||||
|
||||
{% for item in package_manager_repos %}
|
||||
cat << "EOF" > "{{ item.dest }}"
|
||||
{{ item.content }}
|
||||
EOF
|
||||
{% endfor %}
|
||||
|
||||
{% if bootstrap_packages %}
|
||||
if command -v apt-get; then
|
||||
apt-get -y update
|
||||
apt-get -y --no-install-recommends install {{ bootstrap_packages | join(' ') }}
|
||||
elif command -v dnf; then
|
||||
dnf -y install {{ bootstrap_packages | join(' ') }}
|
||||
elif command -v yum; then
|
||||
yum -y install {{ bootstrap_packages | join(' ') }}
|
||||
else
|
||||
exit 42
|
||||
fi
|
||||
{% endif %}
|
||||
@ -0,0 +1,6 @@
|
||||
- name: Update GRUB
|
||||
command: update-grub
|
||||
changed_when: true
|
||||
|
||||
- name: Reboot
|
||||
reboot:
|
||||
@ -0,0 +1,27 @@
|
||||
# > If running `docker run --rm -it centos:centos6.7 bash` immediately exits
|
||||
# > with status code 139, check to see if your system has disabled vsyscall:
|
||||
# > ...
|
||||
# > If you do not see a vsyscall mapping, and you need to run a CentOS 6
|
||||
# > container, try adding vsyscall=emulated to the kernel options.
|
||||
# > -- https://hub.docker.com/_/centos
|
||||
|
||||
- name: Check vsyscall enabled
|
||||
command:
|
||||
cmd: grep -c vsyscall /proc/self/maps
|
||||
register: grep_self_maps_result
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
failed_when:
|
||||
# 0 -> match, 1 -> no match, 2 -> error
|
||||
- grep_self_maps_result.rc not in [0, 1]
|
||||
|
||||
- name: Enable vsyscall
|
||||
lineinfile:
|
||||
path: /etc/default/grub
|
||||
regexp: '^GRUB_CMDLINE_LINUX_DEFAULT.+'
|
||||
line: GRUB_CMDLINE_LINUX_DEFAULT="quiet vsyscall=emulate"
|
||||
when:
|
||||
- grep_self_maps_result.rc != 0
|
||||
notify:
|
||||
- Update GRUB
|
||||
- Reboot
|
||||
@ -0,0 +1,14 @@
|
||||
common_packages: []
|
||||
packages: []
|
||||
|
||||
packages_clean_command:
|
||||
apt: apt-get clean
|
||||
dnf: dnf clean all
|
||||
yum: yum clean all
|
||||
|
||||
packages_cleanup_directories:
|
||||
apt:
|
||||
- /var/cache/apt
|
||||
- /var/lib/apt/lists
|
||||
dnf: []
|
||||
yum: []
|
||||
@ -0,0 +1,35 @@
|
||||
- name: Ensure requisite apt packages are installed
|
||||
apt:
|
||||
name: "{{ common_packages + packages }}"
|
||||
state: present
|
||||
install_recommends: false
|
||||
update_cache: true
|
||||
when:
|
||||
- ansible_pkg_mgr == 'apt'
|
||||
|
||||
- name: Ensure requisite yum packages are installed
|
||||
yum:
|
||||
name: "{{ common_packages + packages }}"
|
||||
state: present
|
||||
update_cache: true
|
||||
when:
|
||||
- ansible_pkg_mgr == 'yum'
|
||||
|
||||
- name: Ensure requisite dnf packages are installed
|
||||
dnf:
|
||||
name: "{{ common_packages + packages }}"
|
||||
state: present
|
||||
update_cache: true
|
||||
when:
|
||||
- ansible_pkg_mgr == 'dnf'
|
||||
|
||||
- name: Clean up package cache
|
||||
command:
|
||||
cmd: "{{ packages_clean_command[ansible_pkg_mgr] }}"
|
||||
changed_when: true
|
||||
|
||||
- name: Clean up package directories
|
||||
shell:
|
||||
rm -rf {{ item }}/*
|
||||
with_items: "{{ packages_cleanup_directories }}"
|
||||
changed_when: true
|
||||
@ -1,2 +1,4 @@
|
||||
- name: Restart sshd
|
||||
meta: noop
|
||||
command: "true"
|
||||
changed_when: false
|
||||
check_mode: false
|
||||
|
||||
@ -1,6 +1,17 @@
|
||||
#!/usr/bin/env ansible-playbook
|
||||
|
||||
- include_playbook: _container_create.yml
|
||||
- include_playbook: _container_setup.yml
|
||||
- include_playbook: _user_accounts.yml
|
||||
- include_playbook: _container_finalize.yml
|
||||
- name: Get base images
|
||||
hosts: all
|
||||
# strategy: mitogen_free
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Fetch container base images
|
||||
docker_image:
|
||||
name: "{{ docker_base }}"
|
||||
source: pull # Added in Ansible 2.8, required circa 2.12
|
||||
delegate_to: localhost
|
||||
|
||||
- import_playbook: _container_create.yml
|
||||
- import_playbook: _container_setup.yml
|
||||
- import_playbook: _user_accounts.yml
|
||||
- import_playbook: _container_finalize.yml
|
||||
|
||||
@ -0,0 +1,15 @@
|
||||
#!/usr/bin/env ansible-playbook
|
||||
|
||||
- name: Get base images
|
||||
hosts: all
|
||||
gather_facts: false
|
||||
tasks:
|
||||
- name: Fetch container base images
|
||||
docker_image:
|
||||
name: "{{ docker_base }}"
|
||||
delegate_to: localhost
|
||||
|
||||
- include: _container_create.yml
|
||||
- include: _container_setup.yml
|
||||
- include: _user_accounts.yml
|
||||
- include: _container_finalize.yml
|
||||
Loading…
Reference in New Issue