quico-containers/rundeck
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(rundeck): Update to 5.9.0

Browse Source
This commit is contained in:
hygienic-books 2025-02-26 01:49:09 +01:00
parent 868737a915
commit ea46ff1517
16 changed files with 215 additions and 200 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.idea

9
LICENSE
View File

@ -1,9 +0,0 @@
MIT License
Copyright (c) <year> <copyright holders>
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

170
README.md
View File

@ -1,3 +1,7 @@
# FIXME
Search and replace all mentions of FIXME with sensible content in this file and in [compose.yaml](compose.yaml).
# Rundeck Docker Compose files
Docker Compose files to spin up an instance of Rundeck.
@ -9,18 +13,52 @@ Add a `COMPOSE_ENV` file and save its location as a shell variable along with th
When everything's ready start Rundeck with Docker Compose, otherwise head down to [Initial setup](#initial-setup) first.
## Environment
```
export COMPOSE_DIR='/opt/containers/rundeck'
export COMPOSE_CTX='ux_vilnius'
export COMPOSE_PROJECT='rundeck-'"${COMPOSE_CTX}"
export COMPOSE_FILE="${COMPOSE_DIR}"'/docker-compose.yml'
export COMPOSE_FILE="${COMPOSE_DIR}"'/compose.yaml'
export COMPOSE_ENV=<add accordingly>
```
## Context
On your deployment machine create the necessary Docker context to connect to and control the Docker daemon on whatever target host you'll be using, for example:
```
docker context create fully.qualified.domain.name --docker 'host=ssh://root@fully.qualified.domain.name'
```
## Pull
Pull images from Docker Hub verbatim.
```
docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" --profile 'full' pull
```
## Copy to target
Copy images to target Docker host, that is assuming you deploy to a machine that itself has no network route to reach Docker Hub or your private registry of choice. Copying in its simplest form involves a local `docker save` and a remote `docker load`. Consider the helper mini-project [quico.space/Quico/copy-docker](https://quico.space/Quico/copy-docker) where [copy-docker.sh](https://quico.space/Quico/copy-docker/src/branch/main/copy-docker.sh) allows the following workflow:
```
images="$(docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" --profile 'full' config | grep -Pi -- 'image:' | awk '{print $2}' | sort | uniq)"
while IFS= read -u 10 -r image; do
copy-docker "${image}" fully.qualified.domain.name
done 10<<<"${images}"
```
## Start
```
docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" --profile 'full' up --detach
docker --context 'fully.qualified.domain.name' compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" --profile 'full' up --detach
```
## Clean-up
```
docker --context 'fully.qualified.domain.name' system prune -af
docker system prune -af
```
# Initial setup
@ -33,67 +71,89 @@ Create ZFS datasets and set permissions as needed.
* Parent dateset
```
zfs create -o mountpoint=/opt/docker-data 'zpool/docker-data'
export "$(grep -Pi -- '^CONTEXT=' "${COMPOSE_ENV}")"
zfs create -o canmount=off zpool/data/opt
zfs create -o mountpoint=/opt/docker-data zpool/data/opt/docker-data
```
* Container-specific datasets
```
zfs create -p 'zpool/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck'
zfs create -p 'zpool/docker-data/rundeck-'"${COMPOSE_CTX}"'/postgres'
zfs create -p 'zpool/data/opt/docker-data/rundeck-'"${CONTEXT}"'/rundeck/config'
zfs create -p 'zpool/data/opt/docker-data/rundeck-'"${CONTEXT}"'/rundeck/data'
zfs create -p 'zpool/data/opt/docker-data/rundeck-'"${CONTEXT}"'/postgres/data'
```
* Create subdirs
```
mkdir -p '/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck/'{'.ssh','config','data','projects'}
```
* Prefill content
* Rundeck settings in `realm.properties`
At the very least override Rundeck's default `realm.properties` file with one of your own and set a username and a password for local login. Default credentials will otherwise be `admin:admin`. Per [Rundeck's manual on Jetty and JAAS authentication section "PropertyFileLoginModule"](https://docs.rundeck.com/docs/administration/security/authentication.html#propertyfileloginmodule) you're going to need Rundeck's `rundeck.war` file to create a bcrypt hash for your password. Run the official Rundeck Docker image in a throwaway container like so where `rundeck/rundeck:4.13.0` is an example version you want to use:
```
docker run \
--rm \
--tty \
--interactive \
--entrypoint bash \
rundeck/rundeck:4.13.0 \
-c 'java -jar /home/rundeck/rundeck.war --encryptpwd Jetty'
```
This will download `rundeck/rundeck:4.13.0` if needed and open up something along the lines of:
```
Required values are marked with: *
Username (Optional, but necessary for Crypt encoding):
```
Type your desired username, type `<Enter>` and then your plain text password followed by `<Enter>` again. The whole exchange may look like this:
```
Required values are marked with: *
Username (Optional, but necessary for Crypt encoding):
my-username
*Value To Encrypt (The text you want to encrypt):
t0psecr3t
==ENCRYPTED OUTPUT==
bcrypt: BCRYPT:$2a$10$jMWQvKbjpmBrKdA0Qi0/n.UvHot1F7Cvf7/Avlv9afknHpbvT6j7y
obfuscate: OBF:1z0f18qk1xtp1vgv1t331vfz1xtt18qq1z0f
md5: MD5:962aefc8c283c13e13d9c990dafdfba9
crypt: CRYPT:myS5y0c4wMQts
```
Put a single line into an otherwise empty `/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck/config/realm.properties`:
```
my-username: BCRYPT:$2a$10$jMWQvKbjpmBrKdA0Qi0/n.UvHot1F7Cvf7/Avlv9afknHpbvT6j7y,user,admin
```
The account `my-username` will have roles `user` and `admin` and it'll be the only existing account when Rundeck starts.
* SSH `known_hosts` file
Place an empty `known_hosts` file at `/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck/.ssh/known_hosts`. Feel free to optionally prefill it with SSH public host keys.
* Change ownership
```
chown -R 999 '/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/postgres'
chown -R 1000 '/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck'
chown -R 999 '/opt/docker-data/rundeck-'"${CONTEXT}"'/postgres/'*
chown -R 1000 '/opt/docker-data/rundeck-'"${CONTEXT}"'/rundeck/'*
```
## Additional files
### Rundeck settings in `realm.properties`
At the very least override Rundeck's default `realm.properties` file with one of your own and set a username and a password for local login. Default credentials will otherwise be `admin:admin`. Per [Rundeck's manual on Jetty and JAAS authentication section "PropertyFileLoginModule"](https://docs.rundeck.com/docs/administration/security/authentication.html#propertyfileloginmodule) you're going to need Rundeck's `rundeck.war` file to create a bcrypt hash for your password. Run the official Rundeck Docker image in a throwaway container like so where `rundeck/rundeck:4.13.0` is an example version you want to use:
```
docker run \
--rm \
--tty \
--interactive \
--entrypoint bash \
rundeck/rundeck:5.9.0 \
-c 'java -jar /home/rundeck/rundeck.war --encryptpwd Jetty'
```
This will download `rundeck/rundeck:5.9.0` if needed and open up something along the lines of:
```
Required values are marked with: *
Username (Optional, but necessary for Crypt encoding):
```
Type your desired username, type `<Enter>` and then your plain text password followed by `<Enter>` again. The whole exchange may look like this:
```
Required values are marked with: *
Username (Optional, but necessary for Crypt encoding):
my-username
*Value To Encrypt (The text you want to encrypt):
t0psecr3t
==ENCRYPTED OUTPUT==
bcrypt: BCRYPT:$2a$10$jMWQvKbjpmBrKdA0Qi0/n.UvHot1F7Cvf7/Avlv9afknHpbvT6j7y
obfuscate: OBF:1z0f18qk1xtp1vgv1t331vfz1xtt18qq1z0f
md5: MD5:962aefc8c283c13e13d9c990dafdfba9
crypt: CRYPT:myS5y0c4wMQts
```
Put a single line into an otherwise empty `/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck/config/realm.properties`:
```
my-username: BCRYPT:$2a$10$jMWQvKbjpmBrKdA0Qi0/n.UvHot1F7Cvf7/Avlv9afknHpbvT6j7y,user,admin
```
The account `my-username` will have roles `user` and `admin` and it'll be the only existing account when Rundeck starts.
### SSH `known_hosts` file
Place an empty `known_hosts` file at `/opt/docker-data/rundeck-'"${COMPOSE_CTX}"'/rundeck/config/known_hosts`. Feel free to optionally prefill it with SSH public host keys.
When done head back up to [How to run](#how-to-run).
# Development
## Conventional commits
This project uses [Conventional Commits](https://www.conventionalcommits.org/) for its commit messages.
### Commit types
Commit _types_ besides `fix` and `feat` are:
- `refactor`: Keeping functionality while streamlining or otherwise improving function flow
- `docs`: Documentation for project or components
### Commit scopes
The following _scopes_ are known for this project. A Conventional Commits commit message may optionally use one of the following scopes or none:
- `rundeck`: A change to how the `rundeck` service component works
- `postgres`: A change to how the `postgres` service component works
- `build`: Build-related changes such as `Dockerfile` fixes and features.
- `mount`: Volume or bind mount-related changes.
- `net`: Networking, IP addressing, routing changes
- `meta`: Affects the project's repo layout, file names etc.

14
build-context/postgres/Dockerfile
View File

@ -1,14 +0,0 @@
# For the remainder of this Dockerfile EXAMPLE_ARG_FOR_DOCKERFILE will be
# available with a value of 'must_be_available_in_dockerfile', check out the env
# file at 'env/fully.qualified.domain.name.example' for reference.
# ARG EXAMPLE_ARG_FOR_DOCKERFILE
# Another env var, this one's needed in the example build step below:
# ARG POSTGRES_VERSION
# Example
# FROM "postgres:${POSTGRES_VERSION}"
# RUN apt-get update && \
# apt-get -y install \
# somepackage-6.q16-6-extra && \
# rm -rf /var/lib/apt/lists/*

0
build-context/postgres/docker-data/.gitkeep
View File

0
build-context/postgres/extras/.gitkeep
View File

14
build-context/rundeck/Dockerfile
View File

@ -1,14 +0,0 @@
# For the remainder of this Dockerfile EXAMPLE_ARG_FOR_DOCKERFILE will be
# available with a value of 'must_be_available_in_dockerfile', check out the env
# file at 'env/fully.qualified.domain.name.example' for reference.
# ARG EXAMPLE_ARG_FOR_DOCKERFILE
# Another env var, this one's needed in the example build step below:
# ARG RUNDECK_VERSION
# Example
# FROM "rundeck:${RUNDECK_VERSION}"
# RUN apt-get update && \
# apt-get -y install \
# somepackage-6.q16-6-extra && \
# rm -rf /var/lib/apt/lists/*

0
build-context/rundeck/docker-data/.gitkeep
View File

2
build-context/rundeck/docker-data/.ssh/known_hosts
View File

@ -1,2 +0,0 @@
hostname pubkey
another-hostname also-a-pubkey

1
build-context/rundeck/docker-data/config/realm.properties
View File

@ -1 +0,0 @@
my-first-account: BCRYPT:$2a$10$ZcvSOoSNHbnP/foEvJ/6WeKIauGLCr9XCo5.UboJVUJDbHPWrV30K,user,admin

0
build-context/rundeck/extras/.gitkeep
View File

2
common-settings.yml → common-settings.yaml
View File

@ -8,4 +8,4 @@ services:
max-size: "10m"
max-file: "10"
compress: "true"
restart: "${RESTARTPOLICY:-unless-stopped}"
restart: "${RESTARTPOLICY:-always}"

75
compose.yaml Normal file
View File

@ -0,0 +1,75 @@
services:
rundeck:
image: "rundeck/rundeck:${RUNDECK_VERSION}"
container_name: "rundeck-rundeck-${CONTEXT}"
networks:
rundeck-default:
profiles: ["full", "rundeck"]
depends_on:
postgres:
condition: "service_started"
ulimits:
nproc: "${ULIMIT_NPROC:-65535}"
nofile:
soft: "${ULIMIT_NPROC:-65535}"
hard: "${ULIMIT_NPROC:-65535}"
mem_limit: "4g"
extends:
file: "common-settings.yaml"
service: "common-settings"
ports:
- "${RUNDECK_PORT}:4440"
volumes:
- "/opt/docker-data/rundeck-${CONTEXT}/rundeck/data:/home/rundeck/server/data"
- "/opt/docker-data/rundeck-${CONTEXT}/rundeck/config/realm.properties:/home/rundeck/server/config/realm.properties"
- "/opt/docker-data/rundeck-${CONTEXT}/rundeck/config/known_hosts:/home/rundeck/.ssh/known_hosts"
environment:
RUNDECK_DATABASE_DRIVER: "org.postgresql.Driver"
RUNDECK_DATABASE_USERNAME: "${POSTGRES_USER}"
RUNDECK_DATABASE_PASSWORD: "${POSTGRES_PASSWORD}"
RUNDECK_DATABASE_URL: "jdbc:postgresql://postgres/${POSTGRES_DB}?autoReconnect=true&useSSL=false&allowPublicKeyRetrieval=true"
RUNDECK_GRAILS_URL: "${RUNDECK_GRAILS_URL}"
RUNDECK_SERVER_FORWARDED: 'true'
RUNDECK_LOGGING_LOGLEVEL_DEFAULT: "${RUNDECK_LOGGING_LOGLEVEL_DEFAULT:-warn}"
RUNDECK_LOGGING_LOGLEVEL_ROOT: "${RUNDECK_LOGGING_LOGLEVEL_ROOT:-warn}"
RUNDECK_LOGGING_LOGLEVEL_HIBERNATE: "${RUNDECK_LOGGING_LOGLEVEL_HIBERNATE:-warn}"
RUNDECK_LOGGING_LOGLEVEL_SPRING: "${RUNDECK_LOGGING_LOGLEVEL_SPRING:-warn}"
RUNDECK_LOGGING_LOGLEVEL_SPRINGBEAN: "${RUNDECK_LOGGING_LOGLEVEL_SPRINGBEAN:-warn}"
RUNDECK_LOGGING_LOGLEVEL_INTERNALS: "${RUNDECK_LOGGING_LOGLEVEL_INTERNALS:-warn}"
RUNDECK_LOGGING_LOGLEVEL_GRAILS: "${RUNDECK_LOGGING_LOGLEVEL_GRAILS:-warn}"
RUNDECK_LOGGING_LOGLEVEL_JETTY: "${RUNDECK_LOGGING_LOGLEVEL_JETTY:-warn}"
RUNDECK_LOGGING_AUDIT_ENABLED: "${RUNDECK_LOGGING_AUDIT_ENABLED:-}"
TZ: "${TIMEZONE}"
postgres:
image: "postgres:${POSTGRES_VERSION}"
container_name: "rundeck-postgres-${CONTEXT}"
networks:
rundeck-default:
profiles: ["full", "postgres"]
ulimits:
nproc: "${ULIMIT_NPROC:-65535}"
nofile:
soft: "${ULIMIT_NPROC:-65535}"
hard: "${ULIMIT_NPROC:-65535}"
extends:
file: "common-settings.yaml"
service: "common-settings"
ports:
- "${POSTGRES_PORT}:5432"
volumes:
- "/opt/docker-data/rundeck-${CONTEXT}/postgres/data:/var/lib/postgresql/data"
environment:
POSTGRES_DB: "${POSTGRES_DB}"
POSTGRES_USER: "${POSTGRES_USER}"
POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
TZ: "${TIMEZONE}"
networks:
rundeck-default:
name: "rundeck-${CONTEXT}"
driver: "bridge"
driver_opts:
com.docker.network.enable_ipv6: "false"
ipam:
driver: "default"
config:
- subnet: "${SUBNET}"

19
docker-compose.override.yml
View File

@ -1,19 +0,0 @@
services:
rundeck-build:
image: "rundeck:${RUNDECK_VERSION}"
profiles: ["build", "build-rundeck"]
build:
context: "build-context/rundeck"
dockerfile: Dockerfile
args:
EXAMPLE_ARG_FOR_DOCKERFILE: "${EXAMPLE_ARG_FROM_ENV_FILE}"
RUNDECK_VERSION: "${RUNDECK_VERSION}"
postgres-build:
image: "postgres:${POSTGRES_VERSION}"
profiles: ["build", "build-postgres"]
build:
context: "build-context/postgres"
dockerfile: Dockerfile
args:
EXAMPLE_ARG_FOR_DOCKERFILE: "${EXAMPLE_ARG_FROM_ENV_FILE}"
POSTGRES_VERSION: "${POSTGRES_VERSION}"

54
docker-compose.yml
View File

@ -1,54 +0,0 @@
services:
rundeck:
image: "rundeck/rundeck:${RUNDECK_VERSION}"
container_name: "rundeck-rundeck-${CONTEXT}"
networks:
rundeck-default:
profiles: ["full", "rundeck"]
extends:
file: common-settings.yml
service: common-settings
tty: true
ports:
- ${RUNDECK_PORT}:4440
volumes:
- /opt/docker-data/rundeck-${CONTEXT}/rundeck/config/realm.properties:/home/rundeck/server/config/realm.properties
- /opt/docker-data/rundeck-${CONTEXT}/rundeck/data:/home/rundeck/server/data
- /opt/docker-data/rundeck-${CONTEXT}/rundeck/projects:/home/rundeck/projects
- /opt/docker-data/rundeck-${CONTEXT}/rundeck/.ssh/known_hosts:/home/rundeck/.ssh/known_hosts
environment:
RUNDECK_DATABASE_DRIVER: org.postgresql.Driver
RUNDECK_DATABASE_USERNAME: rundeck
RUNDECK_DATABASE_PASSWORD: rundeck
RUNDECK_DATABASE_URL: jdbc:postgresql://postgres/rundeck?autoReconnect=true&useSSL=false&allowPublicKeyRetrieval=true
RUNDECK_GRAILS_URL: https://rundeck.ops.loft.seneve.de
RUNDECK_SERVER_FORWARDED: 'true'
TZ: ${TIMEZONE}
postgres:
image: "postgres:${POSTGRES_VERSION}"
container_name: "rundeck-postgres-${CONTEXT}"
networks:
rundeck-default:
profiles: ["full", "postgres"]
extends:
file: common-settings.yml
service: common-settings
volumes:
- /opt/docker-data/rundeck-${CONTEXT}/postgres:/var/lib/postgresql/data
ports:
- ${POSTGRES_PORT}:5432
environment:
POSTGRES_DB: rundeck
POSTGRES_USER: rundeck
POSTGRES_PASSWORD: rundeck
TZ: ${TIMEZONE}
networks:
rundeck-default:
name: rundeck-${CONTEXT}
driver: bridge
driver_opts:
com.docker.network.enable_ipv6: "false"
ipam:
driver: default
config:
- subnet: ${SUBNET}

54
env/fqdn_context.env.example vendored
View File

@ -1,34 +1,26 @@
CONTEXT=ux_vilnius
# Set something sensible here and uncomment
# ---
# RUNDECK_VERSION=x.y.z
# POSTGRES_VERSION=x.y.z
# RUNDECK_PORT=62256
# POSTGRES_PORT=62257
# Feel free to leave defaults. They apply while these vars are commented out
# ---
# RESTARTPOLICY=unless-stopped
# TIMEZONE=Etc/UTC
# Subnet to use for this Docker Compose project. Docker defaults to
# container networks in prefix 172.16.0.0/12 which is 1 million addresses in
# the range from 172.16.0.0 to 172.31.255.255. Docker uses 172.17.0.0/16 for
# itself. Use any sensible prefix in 172.16.0.0/12 here except for Docker's
# own 172.17.0.0/16.
# ---
POSTGRES_DB=rundeck
POSTGRES_PASSWORD=my-password
POSTGRES_PORT=61001
POSTGRES_USER=rundeck
POSTGRES_VERSION=latest
RUNDECK_GRAILS_URL=https://fully.qualified.domain.name
RUNDECK_LOGGING_AUDIT_ENABLED=true
RUNDECK_PORT=61000
RUNDECK_VERSION=5.9.0
SUBNET=172.30.95.0/24
TIMEZONE=Africa/Nouakchott
# See 'docker-compose.override.yml' for how to make a variable available in
# a Dockerfile
# ---
# EXAMPLE_ARG_FROM_ENV_FILE=must_be_available_in_dockerfile
# Other available defaults
# RESTARTPOLICY=always
#
# Defaults to "warn"
# Can be for example debug, info, warn, error
# RUNDECK_LOGGING_LOGLEVEL_DEFAULT=debug
# RUNDECK_LOGGING_LOGLEVEL_ROOT=debug
# RUNDECK_LOGGING_LOGLEVEL_HIBERNATE=debug
# RUNDECK_LOGGING_LOGLEVEL_SPRING=debug
# RUNDECK_LOGGING_LOGLEVEL_SPRINGBEAN=debug
# RUNDECK_LOGGING_LOGLEVEL_INTERNALS=debug
# RUNDECK_LOGGING_LOGLEVEL_GRAILS=debug
# RUNDECK_LOGGING_LOGLEVEL_JETTY=debug