Add drone CI server and runner containers
This commit is contained in:
Francesco Antognazza
parent
9b576d7c60
commit
3aec908b68
8
containers/drone-runner/files/drone-runner-gc.service
Normal file
8
containers/drone-runner/files/drone-runner-gc.service
Normal file
@ -0,0 +1,8 @@
|
||||
|
||||
[Unit]
|
||||
Description=Remove unused podman resources spawned by drone runner
|
||||
Wants=drone-runner-gc.timer
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/bin/podman system prune --filter label=io.drone=true --volumes -f
|
||||
11
containers/drone-runner/files/drone-runner-gc.timer
Normal file
11
containers/drone-runner/files/drone-runner-gc.timer
Normal file
@ -0,0 +1,11 @@
|
||||
[Unit]
|
||||
Description=Remove unused podman resources spawned by drone runner
|
||||
Requires=drone-runner-gc.service
|
||||
|
||||
[Timer]
|
||||
Unit=drone-runner-gc.service
|
||||
OnCalendar=hourly
|
||||
RandomizedDelaySec=600
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
108
containers/drone-runner/tasks.yml
Normal file
108
containers/drone-runner/tasks.yml
Normal file
@ -0,0 +1,108 @@
|
||||
---
|
||||
- hosts: all
|
||||
name: Drone CI runner agent
|
||||
tasks:
|
||||
- name: Get containers UID
|
||||
ansible.builtin.command: "id -u containers"
|
||||
register: uid_containers
|
||||
changed_when: uid_containers.rc != 0
|
||||
|
||||
- name: Create podman networks
|
||||
containers.podman.podman_network:
|
||||
name: "{{ item }}"
|
||||
recreate: false
|
||||
state: "present"
|
||||
become_user: containers
|
||||
become: true
|
||||
loop:
|
||||
- traefik-drone-runner
|
||||
|
||||
# - name: Login to private registry and create ${XDG_RUNTIME_DIR}/containers/auth.json
|
||||
# become_user: containers
|
||||
# become: true
|
||||
# containers.podman.podman_login:
|
||||
# username: "{{ vault_private_docker_registry_username }}"
|
||||
# password: "{{ vault_private_docker_registry_password }}"
|
||||
# registry: "{{ vault_private_docker_registry_url }}"
|
||||
|
||||
- name: Pull an image
|
||||
become_user: containers
|
||||
become: true
|
||||
containers.podman.podman_image:
|
||||
name: docker.io/drone/drone-runner-docker:linux-{{ [ansible_architecture] | map('extract', arch_friendly_name) | first }}
|
||||
|
||||
- name: Add a drone runner
|
||||
become_user: containers
|
||||
become: true
|
||||
containers.podman.podman_container:
|
||||
name: drone-runner
|
||||
image: docker.io/drone/drone-runner-docker:linux-{{ [ansible_architecture] | map('extract', arch_friendly_name) | first }}
|
||||
state: present
|
||||
network:
|
||||
- traefik-drone-runner
|
||||
security_opt:
|
||||
- label=type:container_runtime_t
|
||||
volume:
|
||||
- /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
|
||||
label:
|
||||
io.containers.autoupdate: "registry"
|
||||
traefik.enable: "true"
|
||||
traefik.http.routers.drone-runner.entrypoints: "https"
|
||||
traefik.http.routers.drone-runner.rule: "PathPrefix(`/drone-runner`)"
|
||||
traefik.http.routers.drone-runner.tls: "true"
|
||||
traefik.http.routers.drone-runner.tls.certresolver: "wildcard"
|
||||
traefik.http.routers.drone-runner.service: "drone-runner"
|
||||
traefik.http.routers.drone-runner.middlewares: "authelia@file"
|
||||
traefik.http.services.drone-runner.loadbalancer.server.port: "3000"
|
||||
traefik.docker.network: "traefik-drone-runner"
|
||||
env:
|
||||
# https://docs.drone.io/runner/reference/
|
||||
DRONE_RPC_PROTO: "https"
|
||||
DRONE_RPC_HOST: "{{ vault_drone_server_url }}"
|
||||
DRONE_RPC_SECRET: "{{ vault_drone_rpc_secret }}"
|
||||
DRONE_RUNNER_NAME: "{{ inventory_hostname_short }}"
|
||||
DRONE_RUNNER_LABELS: "hostname:{{ inventory_hostname_short }}"
|
||||
DRONE_RUNNER_CAPACITY: 4
|
||||
DRONE_RUNNER_PRIVILEGED_IMAGES: "plugins/docker"
|
||||
DRONE_UI_USERNAME: "{{ vault_drone_runner_user }}"
|
||||
DRONE_UI_PASSWORD: "{{ vault_drone_runner_password }}"
|
||||
# DRONE_DEBUG: "true"
|
||||
generate_systemd:
|
||||
path: /home/containers/.config/systemd/user/
|
||||
restart_policy: on-failure
|
||||
names: true
|
||||
new: true
|
||||
|
||||
- name: Start containers at boot
|
||||
become_user: containers
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
scope: user
|
||||
name: container-{{ item }}.service
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
loop:
|
||||
- drone-runner
|
||||
|
||||
- name: Add systemd timer to periodically clean unused volumes
|
||||
become_user: containers
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: files/
|
||||
dest: /home/containers/.config/systemd/user/
|
||||
owner: containers
|
||||
group: containers
|
||||
mode: "0644"
|
||||
|
||||
- name: Start garbage collector systemd timer
|
||||
become_user: containers
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
scope: user
|
||||
name: "{{ item }}.timer"
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
loop:
|
||||
- drone-runner-gc
|
||||
87
containers/drone-server/tasks.yml
Normal file
87
containers/drone-server/tasks.yml
Normal file
@ -0,0 +1,87 @@
|
||||
---
|
||||
- hosts: all
|
||||
name: Drone CI server coordinator
|
||||
tasks:
|
||||
- name: Create podman volumes
|
||||
containers.podman.podman_volume:
|
||||
state: present
|
||||
name: "{{ item }}"
|
||||
become_user: containers
|
||||
become: true
|
||||
loop:
|
||||
- drone
|
||||
|
||||
- name: Create podman networks
|
||||
containers.podman.podman_network:
|
||||
name: "{{ item }}"
|
||||
recreate: false
|
||||
state: "present"
|
||||
become_user: containers
|
||||
become: true
|
||||
loop:
|
||||
- traefik-drone
|
||||
- gitea-drone
|
||||
|
||||
- name: Pull container images
|
||||
become_user: containers
|
||||
become: true
|
||||
containers.podman.podman_image:
|
||||
name: docker.io/{{ item }}
|
||||
loop:
|
||||
- drone/drone:latest
|
||||
|
||||
- name: Add a drone-server container
|
||||
become_user: containers
|
||||
become: true
|
||||
containers.podman.podman_container:
|
||||
name: drone-server
|
||||
image: docker.io/drone/drone:latest
|
||||
state: present
|
||||
network:
|
||||
- traefik-drone
|
||||
- gitea-drone
|
||||
volume:
|
||||
- drone:/data:Z
|
||||
label:
|
||||
io.containers.autoupdate: "registry"
|
||||
traefik.enable: "true"
|
||||
traefik.http.routers.drone-server.entrypoints: "https"
|
||||
traefik.http.routers.drone-server.rule: "PathPrefix(`/drone`)"
|
||||
traefik.http.routers.drone-server.tls: "true"
|
||||
traefik.http.routers.drone-server.tls.certresolver: "wildcard"
|
||||
traefik.http.routers.drone-server.service: "drone-server"
|
||||
traefik.http.routers.drone-server.middlewares: "authelia@file"
|
||||
traefik.http.services.drone-server.loadbalancer.server.port: "80"
|
||||
traefik.docker.network: "traefik-drone"
|
||||
env:
|
||||
# https://docs.drone.io/server/reference/
|
||||
DRONE_GITEA_CLIENT_ID: "{{ vault_drone_gitea_client_id }}"
|
||||
DRONE_GITEA_CLIENT_SECRET: "{{ vault_drone_gitea_cliet_secret }}"
|
||||
DRONE_GITEA_SERVER: "https://{{ inventory_hostname }}/git"
|
||||
DRONE_GIT_ALWAYS_AUTH: "false"
|
||||
DRONE_RPC_SECRET: "{{ vault_drone_rpc_secret }}"
|
||||
DRONE_SERVER_HOST: "{{ inventory_hostname }}/drone"
|
||||
DRONE_SERVER_PROTO: "https"
|
||||
DRONE_AGENTS_ENABLED: "true"
|
||||
DRONE_LOGS_TEXT: "true"
|
||||
DRONE_LOGS_PRETTY: "true"
|
||||
DRONE_LOGS_COLOR: "true"
|
||||
DRONE_LOGS_DEBUG: "true"
|
||||
# DRONE_DEBUG: "true"
|
||||
generate_systemd:
|
||||
path: /home/containers/.config/systemd/user/
|
||||
restart_policy: on-failure
|
||||
names: true
|
||||
new: true
|
||||
|
||||
- name: Start containers at boot
|
||||
become_user: containers
|
||||
become: true
|
||||
ansible.builtin.systemd:
|
||||
scope: user
|
||||
name: container-{{ item }}.service
|
||||
enabled: true
|
||||
state: started
|
||||
daemon_reload: true
|
||||
loop:
|
||||
- drone-server
|
||||
Loading…
Reference in New Issue
Block a user