manifest.jps

jpsVersion: 1.3
jpsType: install
application:
  id: shopozor-ci
  name: Shopozor Continuous Integration
  version: 0.0
  baseUrl: https://raw.githubusercontent.com/shopozor/ci/master

  # if a local private registry is necessary, then add to the current manifest the manifest code from here: https://github.com/HidoraSwiss/manifest-registry/blob/master/manifest.jps

  settings:
    fields:
      - type: space 
        caption: Environments 
      - name: nginxVersion
        caption: Nginx version 
        type: string 
        required: true 
        default: 1.16.1
      - name: jenkinsPort
        caption: Jenkins port
        type: string
        required: true 
        default: 8080
      - type: spacer
        caption: Product
      - name: productName
        caption: Product name
        type: string
        required: true
      - type: spacer
        caption: softozor.ch credentials
      - name: softozorUsername
        caption: Username
        type: string
        required: true
      - name: softozorPassword
        caption: Password
        type: string
        inputType: password
        required: true
      - type: spacer
        caption: Github credentials
      - name: githubUsername
        caption: Full permissions user
        type: string
        required: true
      - name: githubPassword
        caption: Password
        type: string
        inputType: password
        required: true
      - name: ghprbSecret
        caption: GHPRB Secret 
        type: string
        required: true
      - type: spacer 
        caption: Docker credentials
      - name: dockerUsername
        caption: User
        type: string
        required: true
      - name: dockerPassword
        caption: Password
        type: string
        inputType: password
        required: true
      - type: spacer
        caption: Jelastic credentials
      - name: jelasticUrl
        caption: Hoster URL
        type: string
        required: true
      - name: jelasticAppId
        caption: AppId
        type: string
        required: true
      - name: jelasticUsername
        caption: User
        type: string
        required: true
      - name: jelasticPassword
        caption: Password
        type: string
        inputType: password
        required: true
      - type: spacer
        caption: E2E JPS
      - name: jpsBaseUrl
        caption: BE Url
        type: string
        required: true
        default: https://raw.githubusercontent.com/shopozor/services/dev/
      - type: spacer
        caption: User accounts
      - name: username1
        caption: Username 1
        type: string
        required: true
        default: zadigus 

  globals:
    JENKINS_PLUGINS_FILENAME: listOfJenkinsPlugins.txt
    CREDENTIAL_FILENAME: credential.xml
    SECRET_CREDENTIAL_FILENAME: secret.xml
    GITHUB_CREDENTIAL_FILENAME: github-credentials.xml
    SOFTOZOR_CREDENTIAL_FILENAME: softozor-credentials.xml
    DOCKER_CREDENTIAL_FILENAME: docker-credentials.xml
    JELASTIC_USER_CREDENTIAL_FILENAME: jelastic-credentials.xml
    JELASTIC_APP_CREDENTIAL_FILENAME: jelastic-app-credentials.xml
    SERVICES_CREDENTIAL_FILENAME: services-name-credentials.xml
    CREDENTIAL_SCRIPT: CreateCredential.sh
    USER_ACCOUNT_CREATION_SCRIPT: CreateUserAccount.sh
    GITHUB_CREDENTIALS_ID: github-credentials
    SOFTOZOR_CREDENTIALS_ID: softozor-credentials
    DOCKER_CREDENTIALS_ID: docker-credentials
    JELASTIC_USER_CREDENTIALS_ID: jelastic-credentials
    JELASTIC_APP_CREDENTIALS_ID: jelastic-app-credentials
    SERVICES_CREDENTIALS_ID: services-baseurl-credentials
    GHPRBTRIGGER_PLUGIN_CONFIG: org.jenkinsci.plugins.ghprb.GhprbTrigger.xml
    GLOBAL_LIBRARIES_PLUGIN_CONFIG: org.jenkinsci.plugins.workflow.libs.GlobalLibraries.xml
    USER_PASSWORD1: ${fn.password(10)}
    PRODUCT_CREDENTIAL_FILENAME: product-credentials.xml
    PRODUCT_CREDENTIALS_ID: product-name-credentials
    DHPARAM_FILENAME: /var/lib/nginx/dhparam.pem

  env:
    topology:
        nodes:
          - nodeGroup: bl
            nodeType: nginx-dockerized
            tag: ${settings.nginxVersion}
            displayName: Node balancing
            count: 1
            fixedCloudlets: 1
            cloudlets: 32
            env:
              DOCKER_EXPOSED_PORT: 22,80,443
          - image: jenkins/jenkins:lts
            count: 1
            fixedCloudlets: 1
            cloudlets: 32
            nodeGroup: cp
            env:
              # By default, Jelastic redirects Jenkins port 8080 to port 80;
              # this has the side-effect that docker can't get access to the internet,
              # therefore requiring the option --network=host in the docker build command.
              # To avoid that, we disable that redirection by setting the following variable
              JELASTIC_EXPOSE: DISABLED

  onInstall:
    - installDocker
    - installPlugins
    - installAptPackages
    - createUserAccounts
    - setupCredentials
    - setupJobs
    - setupJobViews
    - secure 
    - restart
    - sendEmailWithPasswords

  actions:
    installDocker:
      - cmd [cp]:
        - curl -fsSL ${baseUrl}/scripts/InstallDocker.sh | /bin/bash
    installPlugins:
      - cmd [cp]:
          - cd /tmp
          - wget --quiet ${baseUrl}/config/plugins/${globals.JENKINS_PLUGINS_FILENAME}
          - curl -fsSL ${baseUrl}/scripts/InstallPlugins.sh | /bin/bash -s ${globals.JENKINS_PLUGINS_FILENAME}
      - upload:
          - nodeGroup: cp
            sourcePath: ${baseUrl}/config/plugins/${globals.GHPRBTRIGGER_PLUGIN_CONFIG}
            destPath: /var/jenkins_home/${globals.GHPRBTRIGGER_PLUGIN_CONFIG}
          - nodeGroup: cp
            sourcePath: ${baseUrl}/config/plugins/${globals.GLOBAL_LIBRARIES_PLUGIN_CONFIG}
            destPath: /var/jenkins_home/${globals.GLOBAL_LIBRARIES_PLUGIN_CONFIG}
      - api:
          - method: environment.file.ReplaceInBody
            params: 
              path: /var/jenkins_home/${globals.GHPRBTRIGGER_PLUGIN_CONFIG}
              pattern: GITHUB_CREDENTIAL_ID
              replacement: ${globals.GITHUB_CREDENTIALS_ID}
              nodeGroup: cp
          - method: environment.file.ReplaceInBody
            params: 
              path: /var/jenkins_home/${globals.GHPRBTRIGGER_PLUGIN_CONFIG}
              pattern: GHPRB_SHARED_SECRET
              replacement: ${settings.ghprbSecret}
              nodeGroup: cp
          - method: environment.file.ReplaceInBody
            params: 
              path: /var/jenkins_home/${globals.GLOBAL_LIBRARIES_PLUGIN_CONFIG}
              pattern: GITHUB_CREDENTIAL_ID
              replacement: ${globals.GITHUB_CREDENTIALS_ID}
              nodeGroup: cp
      - restart
    installAptPackages:
      - installTools
    installTools:
      - cmd [cp]:
        - apt install -y jq dos2unix sshpass
      - installYarn
      - installPickles
      - installHasuraClient
      - installPrecommit
    installYarn:
      cmd [cp]:
        - curl -sL https://deb.nodesource.com/setup_10.x | bash -
        - curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
        - echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
        - apt update 
        - apt install -y yarn nodejs
    installPickles:
      cmd [cp]:
        - apt install -y mono-runtime mono-complete
        - wget https://github.com/picklesdoc/pickles/releases/download/v2.20.1/Pickles-exe-2.20.1.zip
        - unzip Pickles-exe-2.20.1.zip -d /opt/pickles
    installHasuraClient:
      cmd [cp]:
        - wget https://github.com/hasura/graphql-engine/releases/download/v1.0.0-beta.9/cli-hasura-linux-amd64 -O /usr/local/bin/hasura
        - chmod a+x /usr/local/bin/hasura
        - hasura update-cli
    installPrecommit:
      cmd [cp]:
        - apt install -y python3-pip 
        - pip3 install pre-commit
    fillPasswordCredentials:
      - api:
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: GLOBAL_OR_SYSTEM
              replacement: ${this.globalOrSystem}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: CREDENTIAL_ID
              replacement: ${this.credentialID}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: USERNAME
              replacement: ${this.username}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: PASSWORD
              replacement: ${this.password}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: DESCRIPTION
              replacement: ${this.description}
              nodeGroup: ${this.nodeGroup}
    fillSecretCredentials:
      - api:
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: GLOBAL_OR_SYSTEM
              replacement: ${this.globalOrSystem}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: CREDENTIAL_ID
              replacement: ${this.credentialID}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: SECRET
              replacement: ${this.secret}
              nodeGroup: ${this.nodeGroup}
          - method: environment.file.ReplaceInBody
            params: 
              path: ${this.filename}
              pattern: DESCRIPTION
              replacement: ${this.description}
              nodeGroup: ${this.nodeGroup}
    setupCredentials:
      - cmd [cp]:
          - cd /tmp
          - wget --quiet ${baseUrl}/config/${globals.CREDENTIAL_FILENAME}
          - cp ${globals.CREDENTIAL_FILENAME} ${globals.GITHUB_CREDENTIAL_FILENAME}
          - cp ${globals.CREDENTIAL_FILENAME} ${globals.SOFTOZOR_CREDENTIAL_FILENAME}
          - cp ${globals.CREDENTIAL_FILENAME} ${globals.DOCKER_CREDENTIAL_FILENAME}
          - cp ${globals.CREDENTIAL_FILENAME} ${globals.JELASTIC_USER_CREDENTIAL_FILENAME}
          - cp ${globals.CREDENTIAL_FILENAME} ${globals.JELASTIC_APP_CREDENTIAL_FILENAME}
          - wget --quiet ${baseUrl}/config/${globals.SECRET_CREDENTIAL_FILENAME}
          - cp ${globals.SECRET_CREDENTIAL_FILENAME} ${globals.SERVICES_CREDENTIAL_FILENAME}
          - cp ${globals.SECRET_CREDENTIAL_FILENAME} ${globals.PRODUCT_CREDENTIAL_FILENAME}
      - fillPasswordCredentials:
          filename: /tmp/${globals.GITHUB_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.GITHUB_CREDENTIALS_ID}
          username: ${settings.githubUsername}
          password: ${settings.githubPassword}
          description: Github credentials
          nodeGroup: cp
      - fillPasswordCredentials:
          filename: /tmp/${globals.SOFTOZOR_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.SOFTOZOR_CREDENTIALS_ID}
          username: ${settings.softozorUsername}
          password: ${settings.softozorPassword}
          description: Softozor.ch credentials
          nodeGroup: cp
      - fillPasswordCredentials:
          filename: /tmp/${globals.DOCKER_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.DOCKER_CREDENTIALS_ID}
          username: ${settings.dockerUsername}
          password: ${settings.dockerPassword}
          description: Docker hub credentials
          nodeGroup: cp
      - fillPasswordCredentials:
          filename: /tmp/${globals.JELASTIC_USER_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.JELASTIC_USER_CREDENTIALS_ID}
          username: ${settings.jelasticUsername}
          password: ${settings.jelasticPassword}
          description: Jelastic user credentials
          nodeGroup: cp
      - fillPasswordCredentials:
          filename: /tmp/${globals.JELASTIC_APP_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.JELASTIC_APP_CREDENTIALS_ID}
          username: ${settings.jelasticUrl}
          password: ${settings.jelasticAppId}
          description: Jelastic app credentials (hoster url and app id)
          nodeGroup: cp
      - fillSecretCredentials:
          filename: /tmp/${globals.SERVICES_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.SERVICES_CREDENTIALS_ID}
          secret: ${settings.jpsBaseUrl}
          description: Base raw jps url of the services repo
          nodeGroup: cp
      - fillSecretCredentials:
          filename: /tmp/${globals.PRODUCT_CREDENTIAL_FILENAME}
          globalOrSystem: GLOBAL
          credentialID: ${globals.PRODUCT_CREDENTIALS_ID}
          secret: ${settings.productName}
          description: Product name
          nodeGroup: cp
      - cmd [cp]:
          - wget --quiet ${baseUrl}/scripts/${globals.CREDENTIAL_SCRIPT} -O /tmp/${globals.CREDENTIAL_SCRIPT}
          - chmod u+x /tmp/${globals.CREDENTIAL_SCRIPT}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.GITHUB_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.SOFTOZOR_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.DOCKER_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.JELASTIC_USER_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.JELASTIC_APP_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.SERVICES_CREDENTIAL_FILENAME}
          - /tmp/${globals.CREDENTIAL_SCRIPT} /tmp/${globals.PRODUCT_CREDENTIAL_FILENAME}
    createUserAccounts:
      - createUserAccount:
          username: ${settings.username1}
          password: ${globals.USER_PASSWORD1}
    createUserAccount:
      - cmd [cp]:
        - cd /tmp
        - wget --quiet ${baseUrl}/scripts/${globals.USER_ACCOUNT_CREATION_SCRIPT} -O /tmp/${globals.USER_ACCOUNT_CREATION_SCRIPT}
        - chmod u+x /tmp/${globals.USER_ACCOUNT_CREATION_SCRIPT}
        - /tmp/${globals.USER_ACCOUNT_CREATION_SCRIPT} "${this.username}" "${this.password}" "admin" "$(cat /var/jenkins_home/secrets/initialAdminPassword)"
    secure:
      - redirectHttpToHttps
      - secureJenkinsConfiguration
      - configureSSL
      - installTrustedCertificate
    redirectHttpToHttps:
      - cmd [bl]:
        - wget https://raw.githubusercontent.com/shopozor/jelastic-configuration/master/nginx/${settings.nginxVersion}/nginx-jelastic.conf -O /etc/nginx/nginx-jelastic.conf
        user: root 
    secureJenkinsConfiguration:
      - cmd [cp]:
        - wget https://raw.githubusercontent.com/shopozor/jelastic-configuration/master/jenkins/web.xml -O /var/jenkins_home/war/WEB-INF/web.xml
    configureSSL:
      - installAddon:
          id: letsencrypt
      - cmd [bl]:
        - wget https://raw.githubusercontent.com/shopozor/jelastic-configuration/master/nginx/${settings.nginxVersion}/conf.d/ssl.conf -O /etc/nginx/conf.d/ssl.conf
      - replaceJenkinsPlaceholders:
          filename: /etc/nginx/conf.d/ssl.conf
      - cmd [bl]:
        - openssl dhparam -out ${globals.DHPARAM_FILENAME} 4096
      - replaceDhparamPlaceholders:
          filename: /etc/nginx/conf.d/ssl.conf
    replaceJenkinsPlaceholders:
      - replaceInFile:
          path: ${this.filename}
          replacements:
            - pattern: JENKINS_IP_ADDRESS
              replacement: ${nodes.cp.intIP}
            - pattern: JENKINS_PORT
              replacement: ${settings.jenkinsPort}
        nodeType: bl
    replaceDhparamPlaceholders:
      - replaceInFile:
          path: ${this.filename}
          replacements:
            - pattern: PATH_TO_PEM_FILE
              replacement: ${globals.DHPARAM_FILENAME}
        nodeType: bl
    installTrustedCertificate: 
      - installCertbot
      # - getAndInstallCertificate
    installCertbot:
      - cmd [bl]:
        - wget https://dl.eff.org/certbot-auto
        - mv certbot-auto /usr/local/bin/certbot-auto
        - chown root /usr/local/bin/certbot-auto
        - chmod 0755 /usr/local/bin/certbot-auto
        user: root
    getAndInstallCertificate:
      - cmd [bl]:
        # This needs further arguments apparently + ssl.conf adaption?
        - /usr/local/bin/certbot-auto --nginx
        user: root
    setupJobs:
      # It was necessary to put the job setup in a separate jps.
      # Putting the code written in the job-setup.jps here directly 
      # always fails for an unknown reason.
      - install:
          jps: ${baseUrl}/config/job-setup.jps
          envName: ${env.envName}
          settings:
            username: admin 
            password: doYouReallyBelieveThisIsTheAdminPassword?
    setupJobViews:
      - cmd [cp]:
        - mv /var/jenkins_home/config.xml /var/jenkins_home/config.xml.bak
      - upload:
        - nodeGroup: cp
          sourcePath: ${baseUrl}/config/main-config.xml
          destPath: /var/jenkins_home/config.xml
    sendEmailWithPasswords:
      return:
        result: success
        email: |
          # User accounts
          * **${settings.username1}**: ${globals.USER_PASSWORD1}
    restart:  
      - restartContainers:
        - nodeGroup: cp
        - nodeGroup: bl

  addons:
    - id: letsencrypt
      name: letsencrypt
      onInstall:
        - install:
            envName: ${env.envName}
            jps: https://github.com/jelastic-jps/lets-encrypt/blob/master/manifest.jps
            settings:
              nodeGroup: bl
              customDomains: ${env.envName}.hidora.com

success: |
  **Your environment Jenkins has been installed successfully.**