From 27417f6806d70c39eeacdbf90cfb1be00e4bbe5f Mon Sep 17 00:00:00 2001 From: badbl0cks <4161747+badbl0cks@users.noreply.github.com> Date: Thu, 2 Jul 2026 11:47:26 -0700 Subject: [PATCH] Remove CI/CD stuffs from being directly in project (migrated to separate CI/CD infrastructure) --- .forgejo/workflows/build-and-deploy.yml | 72 ----------- cicd/scripts/build.sh | 30 ----- cicd/scripts/deploy.sh | 47 ------- deploy/certs/renewal-hooks/deploy/merge.sh | 4 - deploy/docker-compose.yml | 39 +----- deploy/haproxy/challenge.html | 143 --------------------- deploy/haproxy/haproxy.cfg | 85 ------------ 7 files changed, 2 insertions(+), 418 deletions(-) delete mode 100644 .forgejo/workflows/build-and-deploy.yml delete mode 100755 cicd/scripts/build.sh delete mode 100755 cicd/scripts/deploy.sh delete mode 100644 deploy/certs/renewal-hooks/deploy/merge.sh delete mode 100644 deploy/haproxy/challenge.html delete mode 100644 deploy/haproxy/haproxy.cfg diff --git a/.forgejo/workflows/build-and-deploy.yml b/.forgejo/workflows/build-and-deploy.yml deleted file mode 100644 index 274e94a..0000000 --- a/.forgejo/workflows/build-and-deploy.yml +++ /dev/null @@ -1,72 +0,0 @@ -name: Build And Deploy -on: - push: - branches: - - main - -jobs: - build-and-deploy: - runs-on: ubuntu-latest - steps: - - name: Install dependencies - run: | - apt-get update && apt-get install gettext dnsutils iputils-ping -y - - name: Check out repository - uses: actions/checkout@v4 - - name: Substitute environment variables in .env.example and write to .env - env: - CERTBOT_EMAIL: ${{secrets.CERTBOT_EMAIL}} - CLOUDFLARE_API_TOKEN: ${{secrets.CLOUDFLARE_API_TOKEN}} - ANDROID_SMS_GATEWAY_LOGIN: ${{secrets.ANDROID_SMS_GATEWAY_LOGIN}} - ANDROID_SMS_GATEWAY_PASSWORD: ${{secrets.ANDROID_SMS_GATEWAY_PASSWORD}} - ANDROID_SMS_GATEWAY_RECIPIENT_PHONE: ${{secrets.ANDROID_SMS_GATEWAY_RECIPIENT_PHONE}} - OTP_SUPER_SECRET_SALT: ${{secrets.OTP_SUPER_SECRET_SALT}} - SSH_USER: ${{secrets.SSH_USER}} - SSH_KNOWN_HOST: ${{secrets.SSH_KNOWN_HOST}} - ASTRO_DB_REMOTE_URL: ${{secrets.ASTRO_DB_REMOTE_URL}} - SSH_KEY: ${{secrets.SSH_KEY}} - WIREGUARD_PRIVATE_KEY: ${{secrets.WIREGUARD_PRIVATE_KEY}} - WIREGUARD_PUBLIC_KEY: ${{secrets.WIREGUARD_PUBLIC_KEY}} - DNS_SERVER: ${{vars.DNS_SERVER}} - DNS_ADDRESS: ${{vars.DNS_ADDRESS}} - DOMAIN: ${{vars.DOMAIN}} - PUBLIC_IP: ${{vars.PUBLIC_IP}} - ANDROID_SMS_GATEWAY_IP: ${{vars.ANDROID_SMS_GATEWAY_IP}} - ANDROID_SMS_GATEWAY_URL: ${{vars.ANDROID_SMS_GATEWAY_URL}} - IMAGE_FILENAME: ${{vars.IMAGE_FILENAME}} - IMAGE_NAME: ${{vars.IMAGE_NAME}} - SSH_PORT: ${{vars.SSH_PORT}} - SSH_HOST: ${{vars.SSH_HOST}} - WIREGUARD_ALLOWED_IPS: ${{vars.WIREGUARD_ALLOWED_IPS}} - WIREGUARD_ADDRESSES: ${{vars.WIREGUARD_ADDRESSES}} - WIREGUARD_ENDPOINT_HOST: ${{vars.WIREGUARD_ENDPOINT_HOST}} - WIREGUARD_ENDPOINT_PORT: ${{vars.WIREGUARD_ENDPOINT_PORT}} - HEALTH_TARGET_ADDRESSES: ${{vars.HEALTH_TARGET_ADDRESSES}} - HEALTH_ICMP_TARGET_IPS: ${{vars.HEALTH_ICMP_TARGET_IPS}} - VERSION_INFORMATION: ${{vars.VERSION_INFORMATION}} - PUBLICIP_ENABLED: ${{vars.PUBLICIP_ENABLED}} - run: | - envsubst < .env.example > .env - # - name: Export secrets and variables to $GITHUB_ENV - # env: - # SECRETS_CONTEXT: ${{ toJSON(secrets) }} - # VARS_CONTEXT: ${{ toJSON(vars) }} - # run: | - # EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) - # to_envs() { jq -r "to_entries[] | \"\(.key)<<$EOF\n\(.value)\n$EOF\n\""; } - # echo "$VARS_CONTEXT" | to_envs >> $GITHUB_ENV - # echo "$SECRETS_CONTEXT" | to_envs >> $GITHUB_ENV - # - name: Update .env with secrets and variables - # run: | - # envsubst < .env.example > .env - # cat .env - - name: Run build script - run: | - cd cicd/scripts - chmod +x ./build.sh - ./build.sh - - name: Run deploy script - run: | - cd cicd/scripts - chmod +x ./deploy.sh - ./deploy.sh diff --git a/cicd/scripts/build.sh b/cicd/scripts/build.sh deleted file mode 100755 index 8c105a4..0000000 --- a/cicd/scripts/build.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash -set -eu - -####################### -# VARIABLES # -####################### -ROOT_DIR=$(dirname $(dirname $(dirname $(realpath $0)))) -GIT_REF=${GIT_REF:-main} - -### NO EDITS BELOW THIS LINE ### -cd ${ROOT_DIR} -source .env -git checkout ${GIT_REF} -GIT_SHA=$(git rev-parse --short HEAD) - -if [[ "${GIT_REF}" =~ ^refs/tags/v([0-9]+\.[0-9]+\.[0-9]+)(-.*)?$ ]]; then - VERSION="${BASH_REMATCH[1]}" - if [[ -n "${BASH_REMATCH[2]}" ]]; then - VERSION="${VERSION}${BASH_REMATCH[2]}" - fi - echo "Using git tag version: ${VERSION}" -else - VERSION=$(node -p "require('./package.json').version || '0.0.0'") - GIT_SHA_SHORT="${GIT_SHA:0:7}" - VERSION="${VERSION}-${GIT_SHA_SHORT}" - echo "Using package.json + SHA version: ${VERSION}" -fi - -docker build -t ${IMAGE_NAME}:latest -t ${IMAGE_NAME}:v${VERSION} --build-arg VERSION=${VERSION} . -docker save -o ${IMAGE_FILENAME} ${IMAGE_NAME}:latest diff --git a/cicd/scripts/deploy.sh b/cicd/scripts/deploy.sh deleted file mode 100755 index 2dec7ad..0000000 --- a/cicd/scripts/deploy.sh +++ /dev/null @@ -1,47 +0,0 @@ -#!/bin/bash -set -eu - -####################### -# VARIABLES # -####################### -ROOT_DIR=$(dirname $(dirname $(dirname $(realpath $0)))) - -### NO EDITS BELOW THIS LINE ### -cd ${ROOT_DIR} -source .env - -mkdir -p ${HOME}/.ssh -chmod 700 ${HOME}/.ssh -echo "${SSH_KEY}" > ${HOME}/.ssh/id_ed25519-${SSH_HOST//./_} -echo "${SSH_KNOWN_HOST}" > ${HOME}/.ssh/known_hosts-${SSH_HOST//./_} -chmod -R 600 ${HOME}/.ssh/ -chmod 700 ${HOME}/.ssh - -grep -q "Host ${SSH_HOST}" ${HOME}/.ssh/config 2>&1 1>/dev/null || cat >> ${HOME}/.ssh/config <&2 && exit 1 -echo "WIREGUARD_ENDPOINT_IP=${WIREGUARD_ENDPOINT_IP}" >> .env - -DOCKER_HOST=ssh://${SSH_HOST} docker load -i ${IMAGE_FILENAME} - -ssh ${SSH_HOST} "mkdir -p /srv/${IMAGE_NAME#*/}/" -ssh ${SSH_HOST} "cd /srv/${IMAGE_NAME#*/}/ && docker compose down" -scp .env ${SSH_HOST}:/srv/${IMAGE_NAME#*/}/.env -cd deploy -scp -r . ${SSH_HOST}:/srv/${IMAGE_NAME#*/}/ -ssh ${SSH_HOST} "cd /srv/${IMAGE_NAME#*/}/ && docker compose up -d" diff --git a/deploy/certs/renewal-hooks/deploy/merge.sh b/deploy/certs/renewal-hooks/deploy/merge.sh deleted file mode 100644 index c71d27b..0000000 --- a/deploy/certs/renewal-hooks/deploy/merge.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/bash -cat /etc/letsencrypt/live/badblocks.dev/fullchain.pem /etc/letsencrypt/live/badblocks.dev/privkey.pem > /etc/letsencrypt/fullcert.pem -chmod 755 /etc/letsencrypt/ -chmod 644 /etc/letsencrypt/fullcert.pem diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index f752649..a4cbf23 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -5,8 +5,6 @@ services: container_name: badblocks-personal-site volumes: - ./db:/db - networks: - - proxynet env_file: - .env # healthcheck: @@ -41,46 +39,13 @@ services: devices: - /dev/net/tun:/dev/net/tun restart: unless-stopped - networks: - - proxynet # healthcheck: # test: ["CMD", "ping", "-c", "1", "-W", "3", "$$ANDROID_SMS_GATEWAY_IP"] # interval: 30s # timeout: 15s # retries: 3 # start_period: 60s - certbot: - image: serversideup/certbot-dns-cloudflare - container_name: certbot - volumes: - - ./certs:/etc/letsencrypt - environment: - CLOUDFLARE_API_TOKEN: "${CLOUDFLARE_API_TOKEN}" - CERTBOT_EMAIL: "${CERTBOT_EMAIL}" - CERTBOT_DOMAINS: "${DOMAIN}" - haproxy: - image: haproxy:3.2 - stop_signal: SIGTERM - container_name: haproxy - env_file: - - .env - command: ["haproxy", "-f", "/usr/local/etc/haproxy"] - ports: - - "${PUBLIC_IP}:80:80" - - "${PUBLIC_IP}:443:443" - - "${PUBLIC_IP}:8404:8404" - volumes: - - ./haproxy:/usr/local/etc/haproxy:ro - - ./certs:/certs:ro - restart: always - networks: - - proxynet - # healthcheck: - # test: ["CMD", "haproxy", "-c", "-f", "/usr/local/etc/haproxy"] - # interval: 30s - # timeout: 10s - # retries: 3 networks: - proxynet: + default: name: proxynet - driver: bridge + external: true diff --git a/deploy/haproxy/challenge.html b/deploy/haproxy/challenge.html deleted file mode 100644 index 73eeca0..0000000 --- a/deploy/haproxy/challenge.html +++ /dev/null @@ -1,143 +0,0 @@ - - -Challenge Accepted! - -
- - - - -
-
- -
-
- - - diff --git a/deploy/haproxy/haproxy.cfg b/deploy/haproxy/haproxy.cfg deleted file mode 100644 index c3a6d7b..0000000 --- a/deploy/haproxy/haproxy.cfg +++ /dev/null @@ -1,85 +0,0 @@ -global - daemon - log stdout format raw local0 info - maxconn 2000 - # For normalize-uri - expose-experimental-directives - -defaults - mode http - log global - timeout connect 5s - timeout client 30s - timeout server 30s - timeout check 5s - retries 3 - option httplog - option dontlognull - option redispatch - -frontend http - bind :80 - mode http - - http-request redirect scheme https unless { ssl_fc } - -frontend www - bind :443 ssl crt /certs/fullcert.pem - - # 2 general purpose tags in this stick-table (name defaults to frontend name, i.e. www) - stick-table type ipv6 size 1m expire 2d store gpt(2) - http-request track-sc0 src - http-request normalize-uri path-merge-slashes - http-request normalize-uri path-strip-dot - http-request normalize-uri path-strip-dotdot - - # Drop the connection immediately if the requester previously requested the honeypot path) - http-request silent-drop if { sc_get_gpt(0,0) gt 0 } - - # Protect all paths except /robots.txt, /.well-known/*, and /favicon.ico - acl unprotected_path path -m reg ^/(robots.txt|\.well-known/.*|favicon\.ico|_challenge)$ - # Matches the default config of anubis of triggering on "Mozilla" - acl protected_ua hdr(User-Agent) -m beg Mozilla/ - # Set stick table index 0 to 1 if request is for honeypot path - http-request sc-set-gpt(0,0) 1 if { path -m beg /blokmeplz/ } - http-request silent-drop if { path -m beg /blokmeplz/ } - - acl accepted sc_get_gpt(1,0) gt 0 - http-request return status 200 content-type "text/html; charset=UTF-8" hdr "Cache-control" "max-age=0, no-cache" lf-file /usr/local/etc/haproxy/challenge.html if !unprotected_path protected_ua !accepted - use_backend challenge if { path -m beg /_challenge } - - http-response set-header Strict-Transport-Security "max-age=16000000; includeSubDomains; preload;" - default_backend main - -backend challenge - mode http - option http-buffer-request - # The parameter to table must match the stick table used in the frontend. - http-request track-sc0 src table www - acl challenge_req method POST - http-request set-var(txn.tries) req.body_param(tries) - http-request set-var(txn.ts) req.body_param(ts) - http-request set-var(txn.host) hdr(Host),host_only - http-request set-var(txn.hash) src,concat(;,txn.host,),concat(;,txn.ts,),concat(;,txn.tries),sha2,hex - acl ts_recent date,neg,add(txn.ts) ge -60 - # 4 is the difficulty, should match "diff" in challenge.html. - acl hash_good var(txn.hash) -m reg 0{4}.* - http-request sc-set-gpt(1,0) 1 if challenge_req ts_recent hash_good - http-request return status 200 if challenge_req hash_good - http-request return status 400 content-type "text/html; charset=UTF-8" hdr "Cache-control" "max-age=0" string "Bad request" if !challenge_req OR !hash_good - -backend main - mode http - balance leastconn - option httpchk GET /health - http-check expect status 200 - - server badblocks-personal-site badblocks-personal-site:4321 check resolvers docker resolve-prefer ipv4 init-addr none - -resolvers docker - nameserver dns1 127.0.0.11:53 - resolve_retries 3 - timeout resolve 1s - timeout retry 1s - hold valid 10s - hold obsolete 30s