diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml new file mode 100644 index 0000000..0b7d42a --- /dev/null +++ b/.gitea/workflows/container.yml @@ -0,0 +1,45 @@ +name: Build and Push Docker Image + +on: + push: + branches: [ main, dev ] + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + env: + GIT_SSL_NO_VERIFY: true + + - name: Login to Registry + uses: docker/login-action@v2 + with: + registry: ${{ vars.REGISTRY_HOST }} + username: ${{ secrets.REGISTRY_USER }} + password: ${{ secrets.REGISTRY_PASSWORD }} + + - name: Build Docker Image + env: + BRANCH_NAME: ${{ github.ref_name }} + SHORT_HASH: ${{ github.sha }} + run: | + # Build the image with the commit hash tag + docker build --build-arg BUILD_IDENTIFIER=${SHORT_HASH:0:5} -t ${{ vars.REGISTRY_HOST }}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} . + + # Tag the same image as "latest" + docker tag ${{ vars.REGISTRY_HOST }}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} ${{ vars.REGISTRY_HOST }}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-latest + + - name: Push Docker Images + env: + BRANCH_NAME: ${{ github.ref_name }} + SHORT_HASH: ${{ github.sha }} + run: | + docker push ${{ vars.REGISTRY_HOST }}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-${SHORT_HASH:0:5} + docker push ${{ vars.REGISTRY_HOST }}/${GITHUB_REPOSITORY}:${BRANCH_NAME}-latest + + - name: Log out from registry + if: always() + run: docker logout ${{ vars.REGISTRY_HOST }} + diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a5f09de..d3b6f8b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -27,6 +27,8 @@ test: stage: test image: "$CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID" script: + - node --version + - npm --version - python --version - nikola --version - pip --version @@ -37,8 +39,9 @@ deploy: - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY script: - docker pull $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID - - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:latest - - docker push $CI_REGISTRY_IMAGE:latest + - docker tag $CI_REGISTRY_IMAGE:job-$CI_PIPELINE_ID $CI_REGISTRY_IMAGE:${CI_COMMIT_REF_SLUG:-latest} + - echo "deploying $CI_REGISTRY_IMAGE:${CI_COMMIT_REF_SLUG:-latest}" + - docker push $CI_REGISTRY_IMAGE:${CI_COMMIT_REF_SLUG:-latest} include: - template: Security/SAST.gitlab-ci.yml - template: Security/Container-Scanning.gitlab-ci.yml diff --git a/Dockerfile b/Dockerfile index 74bd758..4e0e9d0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,13 +1,21 @@ +FROM docker.io/library/alpine:3.23 AS cabuilder +RUN apk add --no-cache ca-certificates python3 py3-requests +ADD bin/fetch_letsencrypt_ca_certs.py /usr/local/bin/fetch_letsencrypt_ca_certs.py +RUN /usr/local/bin/fetch_letsencrypt_ca_certs.py /usr/local/share/ca-certificates/ +RUN update-ca-certificates + FROM docker.io/library/python:3.11-alpine -RUN apk --no-cache add sshpass openssh-client lftp; mkdir -p /opt/app +RUN apk --no-cache add sshpass openssh-client lftp nodejs npm; mkdir -p /opt/app WORKDIR /opt/app ADD requirements.txt /root/ ADD Dockerfile /root/ ADD bin/*.sh /usr/local/bin/ +COPY --from=cabuilder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt # ignore "Running pip as root" warning ENV PIP_ROOT_USER_ACTION=ignore +ENV REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt RUN chmod 755 /usr/local/bin/*.sh && pip install -r /root/requirements.txt && pip freeze && rm -Rf "$(pip cache dir)" diff --git a/README.md b/README.md index 966be18..2c7e363 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # deployment-helper für Nikola based Websites -# ENV-Variables +## ENV-Variables * LFTP_PASSWORD (Deployment-Passwort for sftp-Upload) * SSH_HOST (Deployment-Host for sftp-Upload) @@ -11,6 +11,27 @@ This image is based on the python:3.11-alpine image and includes additional Python-packages for building nikola-sites. +## Configure your project + +| Variable | Default | Description | +| --------------------------- | --------------- | ---------------------------------------- | +| DEPLOY_HELPER_ENABLE_NIKOLA | true | Build Nikola-Website in `website/` | +| DEPLOY_HELPER_ENABLE_NODE | false | Enable nodejs Build in `node/` | +| DEPLOY_HELPER_CONTENT_DIR | website/output/ | Default Content-Directory for publishing | + + +Create a configuration file in your git-repo: `.deployment-helper`: + +``` +DEPLOY_HELPER_ENABLE_NIKOLA=false +DEPLOY_HELPER_ENABLE_NODE=true +DEPLOY_HELPER_CONTENT_DIR="node/.output/public/" +``` + +This example disables the niko build and enables node. The finished +website is copied from the `node/.output/public/` directory to the +target server. + ## lftp for sftp-Uploads This image includes `lftp` to upload files to a sftp-server and use diff --git a/bin/build.sh b/bin/build.sh index 727aa8f..9311cd3 100644 --- a/bin/build.sh +++ b/bin/build.sh @@ -1,18 +1,76 @@ #!/bin/sh -if ! test -d website +# Default configurations: +DEPLOY_HELPER_ENABLE_NIKOLA=true +DEPLOY_HELPER_ENABLE_NODE=false + +if test -f .deployment-helper then - echo "Website directory not found" - exit 1 + # shellcheck source=/dev/null + . .deployment-helper fi -if ! command -v nikola >/dev/null 2>&1 + + +if $DEPLOY_HELPER_ENABLE_NODE then - echo "nikola command not found" - exit 1 + if ! command -v node >/dev/null 2>&1 + then + echo "node not found" 1>&2 + exit 1 + fi + if ! command -v npm >/dev/null 2>&1 + then + echo "npm not found" 1>&2 + exit 1 + fi + if ! test -d node + then + echo "Node directory not found" 1>&2 + exit 1 + fi + + cd node || { echo 'Directory "node" not found'; exit 1;} + if ! npm install + then + echo "Error installing node-dependencies" 1>&2 + exit 1 + fi + if test -f nuxt.config.ts + then + # Build for nuxi based Sites + if ! npx nuxi build + then + echo "Error nuxi build" 1>&2 + exit 1 + fi + if ! npx nuxi generate + then + echo "Error nuxi generate" 1>&2 + exit 1 + fi + else + echo "No supportet node website type found" 1>&2 + exit 1 + fi + cd .. fi -cd website +if $DEPLOY_HELPER_ENABLE_NIKOLA +then + if ! test -d website + then + echo "Website directory not found" 1>&2 + exit 1 + fi -nikola build + if ! command -v nikola >/dev/null 2>&1 + then + echo "nikola command not found" 1>&2 + exit 1 + fi + cd website || { echo 'Directory "website" not found'; exit 1;} + nikola build + cd .. +fi exit "$?" diff --git a/bin/deploy.sh b/bin/deploy.sh index bdf78f1..154fa0f 100755 --- a/bin/deploy.sh +++ b/bin/deploy.sh @@ -1,7 +1,16 @@ #!/bin/sh +# Default configurations: +DEPLOY_HELPER_CONTENT_DIR="website/output" -if ! test -d website/output +if test -f .deployment-helper +then + # shellcheck source=/dev/null + . .deployment-helper +fi + + +if ! test -d "${DEPLOY_HELPER_CONTENT_DIR}" then echo "Website-Build not found" exit 1 @@ -16,6 +25,9 @@ then fi -lftp -e 'set sftp:auto-confirm yes; mirror -R ./website/output/ ./web/; bye' --env-password -u ${SSH_USER} sftp://${SSH_HOST} +lftp -e "set sftp:auto-confirm yes; mirror -R ${DEPLOY_HELPER_CONTENT_DIR} ./web/; bye" \ + --env-password \ + -u ${SSH_USER} \ + sftp://${SSH_HOST} diff --git a/bin/fetch_letsencrypt_ca_certs.py b/bin/fetch_letsencrypt_ca_certs.py new file mode 100755 index 0000000..85eb8f3 --- /dev/null +++ b/bin/fetch_letsencrypt_ca_certs.py @@ -0,0 +1,109 @@ +#!/usr/bin/env python3 + +import os +import sys +import requests +from html.parser import HTMLParser +from urllib.parse import urljoin + +LETSENCRYPT_CERT_PAGE = "https://letsencrypt.org/certificates/" +DEFAULT_TARGET_DIR = "./letsencrypt-ca" + + +class PemLinkParser(HTMLParser): + def __init__(self): + super().__init__() + self.pem_links = set() + + def handle_starttag(self, tag, attrs): + if tag.lower() != "a": + return + for attr, value in attrs: + if attr == "href" and value.lower().endswith(".pem"): + self.pem_links.add(value) + + +def fetch_certificate_page(): + resp = requests.get(LETSENCRYPT_CERT_PAGE, timeout=15) + resp.raise_for_status() + return resp.text + + +def extract_pem_links(html): + parser = PemLinkParser() + parser.feed(html) + return sorted( + urljoin(LETSENCRYPT_CERT_PAGE, link) + for link in parser.pem_links + ) + + +def download_and_store(url, target_dir): + base_name = os.path.basename(url) + # Zielname = .crt statt .pem + target_name = os.path.splitext(base_name)[0] + ".crt" + target_path = os.path.join(target_dir, target_name) + + if os.path.exists(target_path): + print(f"[=] Bereits vorhanden: {target_name}") + return target_name + + print(f"[+] Lade herunter: {base_name}") + resp = requests.get(url, timeout=15) + resp.raise_for_status() + + if b"BEGIN CERTIFICATE" not in resp.content: + print(f"[!] Ungültiges Zertifikat: {base_name}") + return None + + # Direkt als .crt speichern (PEM-Inhalt) + with open(target_path, "wb") as f: + f.write(resp.content) + + return target_name + + +def list_local_crt_files(target_dir): + return { + f for f in os.listdir(target_dir) + if f.lower().endswith(".crt") + } + + +def main(): + target_dir = sys.argv[1] if len(sys.argv) > 1 else DEFAULT_TARGET_DIR + os.makedirs(target_dir, exist_ok=True) + + print(f"[*] Zielverzeichnis: {os.path.abspath(target_dir)}") + print("[*] Format: PEM-Inhalt mit .crt-Endung") + + html = fetch_certificate_page() + pem_urls = extract_pem_links(html) + + # Remote-Dateinamen im .crt-Format + remote_files = { + os.path.splitext(os.path.basename(url))[0] + ".crt" + for url in pem_urls + } + + for url in pem_urls: + download_and_store(url, target_dir) + + local_files = list_local_crt_files(target_dir) + orphaned = sorted(local_files - remote_files) + + print("\n" + "=" * 60) + if orphaned: + print("[!] Lokal vorhanden, aber nicht mehr gelistet:") + for f in orphaned: + print(f" - {f}") + else: + print("[✓] Keine veralteten Dateien gefunden") + print("=" * 60) + print("[✓] Fertig.") + + +if __name__ == "__main__": + main() + +