From cf8d1c702e63626f58b13e0c2086c267eddffea0 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Fri, 7 Aug 2026 18:57:51 +0200 Subject: [PATCH] chore: update --- .gitignore | 1 + monitoring/ota/.env | 32 +++++ monitoring/ota/docker-compose.yml | 212 ++++++++++++++++++++++++++++++ monitoring/ota/init-multi-db.sh | 11 ++ monitoring/ota/nginx.conf | 168 +++++++++++++++++++++++ monitoring/ota/renew-certs.sh | 22 ++++ 6 files changed, 446 insertions(+) create mode 100644 monitoring/ota/.env create mode 100644 monitoring/ota/docker-compose.yml create mode 100644 monitoring/ota/init-multi-db.sh create mode 100644 monitoring/ota/nginx.conf create mode 100644 monitoring/ota/renew-certs.sh diff --git a/.gitignore b/.gitignore index ac3dd9ab..ce19b908 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ dist/ docker-prod/ .ssh mc_utilisation +monitoring/*/certs diff --git a/monitoring/ota/.env b/monitoring/ota/.env new file mode 100644 index 00000000..cb9c0b10 --- /dev/null +++ b/monitoring/ota/.env @@ -0,0 +1,32 @@ +POSTGRES_USER=xaviaota +POSTGRES_ROOT_PASS=Ipv0ph9tqVew5zuHdHZAVef + +PRIVATE_KEY_PROD=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQy9rRXNwd0lGT1pzTi8KbVNId2pDdTI2RnVHTE8yUWNYVUt4SHdKR0hoMks2aGRQeDkyWENaRHJGL3kxZ1V5UVhoRFhLMGRjZG5WVjh1eQpWVGg5WlZNU3NsYjM5N1RKUEhXdy9pd2hQT202T1E1Tko0V1c4M0VuWmpvd29XaXJERlViLzMzMmhLMTQxTXNCCkI0RTF1ZkNBZWpIc0c3VllrWlhkOENPL3ZMcFcyMGYrNzFsUzBDZnAzQ3NkeXdZVm5tK3F2alBaa3d6NTFUVXYKK3lNWGpYQkFCb0l0S2xqbXVOeUhZVjRQV0NOVVdsVXlZeXJFbHAyanNIaFE5eGhsL1ZnSisyT21uYzZOdlJrTApMWFc1ZWp1c2c1aEhrUUdEVzlNU0NRd2luc0t3TGdWUjFrbzJXMGNPUTJLYVh1RVF1bmIwTDVxNE9Od2RHUmhtCjlKazA5cnE5QWdNQkFBRUNnZ0VBS2ZIZ1kxNEJjamRTSzBoT2hDdE5EeG5Gb0pXSjF3emd3ZURQLy9YWnVwWkkKb1ZKSEExV2VFMGRWSXdqMXpsRkRrZ3hpNDRXZ1d2U0VaNkg5WW9lakx2N1p5Q1gyOGZGSkc5NHJyNE4wOGcrNApML0N0Y2FZUWFyNFprN2hrQU1BTWlycmd5KysxUkRYajFXL2RQUFJmMHVIdXVISkF2UW56dE1yMktPK2NKWlF3CllMby9aMmJ5QnBEY3ErWlgzbXFldGE5MVpRWmdIM3B3KzYyL2FrRC9LM3lOMXJoQ1plWENCMU9HbjdLVlgrNVcKUVlmRWV5ZzE5QlhxSVQ1VkE2Rm1zci9BdGdUZXphd0dYeUV5clMwdUxSeUV5UmFUbW5EaENJeWdmMCtMOWlLbwpvSFZWKy9JVllpcGJkcTh6ZnhhTXFvclNXNStmM3hyMDBCcXFONlhDU1FLQmdRRDc0a3lQNm03RGVzZGJPMVNICmhtUE0xdVRINUhKQ0o2UmkvRkpzWk4xRXA3Wm1keERqeWx0T0diRmtJMkpxL1d4ZllaVFk4ajNKenhKWjJ5TDkKUk9XQkNYcjVBeVZoeEtSY09RK2ZrZy92M2RFTmdYMWdwQnNDWk1xSzY1bm91b3lwSExIWUlOQnhiRTNHc2twYwpkQnVMOHRDbUl6REtsL0srTEtSVEUxVHNid0tCZ1FEQ3NhaGkxZWo4QWtkaUtDQndqMEdKcXdkdHplS0MyN1VCClZRcTl3ek5OY2paUzlNQTBCMWowZk80enZId1IyYURqcUR6cytaNGgvN2lFbHdDTzFwOXFkbURpdERZblR0Z1YKN1d0RHJ1U0NmN0RVME1xNUZJeTI5a2s1d0FiNEw0Ym9lcTZvNzY5cSszdlhlUCtKQitoMUxCL0FSS1ZqV3hHbwo2dStsOWZYNWt3S0JnUURBWkdmcWZUeEJYNlNxVUxVT0YxNWZkYnlsMmg1VDNZZTRlOVpSS1BIQm9RQzNYemF0ClowRTZkSEdFZFdxVklpRUc4YmdKeFczZ21hUUFzbHNWYk95SUZUK3l0KzV6c1FtQno2dlpURzJUMzYvd1N2b0QKT1JYUVRFQlF3QWg5TlJCL2s0VmIraVI4bmljQ0graWdtYWI0ekcwR21WYUpTR3FIUy8zdjNwSTlUUUtCZ0dkMAowajZhM3JBelljMUY5MTc0c09HLzBUWEhCc3QwaG0yTHpDWmtPTG01ckNaT3ltZWJVK2l2RGtETnNyd2xnZm9YClp6Q2h3Q2JlNVNVSHZKTXFkeEd5ais5SHhkTURjWTNOV0lkaHd5bVpRdFVEa2dYaFpwaStyTkNVT3QvZEdYb2wKM3ZRRVVabXV3dk1QNS9IZ0V1VllxaEtZSjY1eE1TUXFtMmY4R0ZZakFvR0JBS1F5Q3Z6YStXY2RlS2xQSDhTagp4QzE0bUgvZFpBVzRweStSMlZPTHlrQUlqVEVCcUllSFVHVkowaGwxZ3E5WExCY2t2TXlOMXdpTFJZSlF1WVl6CjN6L3Rwd1F1UEtGZVZYL1ltRXd6N1ZqWW5mVUt3YjB4RU53SDdkMUNFVjNyakpMMFp6VTE5OFZnZHFqdXhBNXcKRkdWTHdWYllNWm9BSFdQM2kwZmZPeHV1Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_PROD=7jgEeJsRTwLkOXsisb6pODHN +UPLOAD_KEY_PROD=9b5b36eec185ba242ce5afcc6e344dce03a4c855 +POSTGRES_PASS_PROD=5AiArInxJTbXVlhmpr9g2rQ + +PRIVATE_KEY_PREPROD=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRRE9lZjV6dmd3ekNLZ0gKS0drVEh2eUJidWhrei9vbC9qT0ZLYnlWekdCL1orS0FxZTNCM29NYTZ1U3BGdVVQQjROVUluUDlqZUZ1T3h2Uwo2Qk1vNE9mSlRtU0VuZ2J1clpiWjM0aFNER3FzcnNReWI2dk9kWXhYOW9PTGwwZGc2UnVKMXVPbmMzZCtqRmdHCnlObE1oSVZDajFSQ1JvV1hPYlBYai9naEFtSmtnNDlLTWptN0hqSElucUphZ2xlNHJVczhKbkpObmxWcTJ6aVIKZVU0RU51aHZHN2dQSUYxR3lWRlJ6TW1wL0N3MWc1Zi9pVTNKQ2RSRFhYS3dUOG93UDNIdDhHMVFWWnQ5MDN1KwpmQ1ZtK2NNUUQ5cHpJdHE2c3Z4bmI0RUF4K3B2TnJ2d1FSQmJKcFBqWit6eVFXSlJGSGxEOUszWCtVYWp5UjlHCjg3ajFNOG9KQWdNQkFBRUNnZ0VBSjI5clp1WEVaTGJoaU1SeUZTSFU3aytsZVNPenppL1gzVFlVZTdQV05sODgKQm9EdUZSb1Boa09ZdXFiUnh1WVRjaTFHWkFZR0tVeUd5dWhpU0d0ME9hR01WenZyYlFpZ2lDcEdXZzFmRG00dQpzTWRkVkFobGJxTjVpbDZ4VmxRUFcyczhmYzN5NDZ1Z1lHTmFCV0JHSjJsQ21Zbm9sL0tBWThwdWhMZDAzV2RmClViMzF0S1pOOXkyVkFnSUZIUnh0Z3NBY1ljem5HOXBEQ0JhTUlxcjhkZXc2THArQWFVbVptbXM4TklZNkQ1dlkKbHBBSmhVejdnMXVMcXJyTnV3T2J3aG9kanZHVURuSG9VWHlaL3dyeEJXb3F0YTNibnBTNkt1NHRoeTdZajV5Rwp6RytVWVgwL0lCeFNrOHQvS2dXU2MyclExVUhUaXlHMlM2YzlZNFdONVFLQmdRRG9na3Q5bFpNMEFqRzl4dHcyCi8wVE1hUHJWTWt3ejVQd004NEU3U2krV0pYeC9UNzIzQ2xER3lkMGVKU0JJMENBUDZHbnU2a1ozRWk4Vy9QamUKK2NXSXB3dWJSSTBvb2hKbG45VEV0OW9jTytyTitYUHcvbnFRNFk0bnVGSEJaTUxRa1RvbEhIZzNqRVA5YlYwNApaY1B0UkFJSngxbjFibXlmak1ESlBZOE85d0tCZ1FEalZtTFBKNXUvNEgyZWRHQ0JrQXIwY1Jia2xzT3U3ekZqCitlUEhydVp1ZzNKWThVRVdMT0xWV0Q2NXNuL1hhaGcrT3FmWXAvRGs5NXRqWjhlUFhhS2RvVllDaERrZXFBTE4KMnFibHU1bktjdmo0d3plN1p1MTlCRDlMOWhmTWxtei9pYTY3bkR5c3hZTDd1Z1pIWVZSQ2J2b3V2K3pMVHhDQwpwUC9qQ3JpdS93S0JnQnFLYlFXYjRsN0lkVmNkY1J2U0RjOXJtRjVuekcwTUVYMkUrbGFEUkdWV1NCemNSR0sxCmliejNaQWRCNDZxTUgyelJjZTQwemZCZm9nSjB4QS9uNFJXVlErem9hVmlmRDR5TUx5UjVmQ3RHNTZtMWRQZW8KaE9NdTdDUTZsUktIWnZtWjZsSThLcmpraVFwUHhwbGVmSHdFREZ1RFp4QnVGM1lyQWdLMnhUTEhBb0dBSWVodApublpLN2NpZkUvWkp1cWx3YU50QlRlRUsyTm5HWlNJTmptZ1E2S1RrZGsydHBwQVZXVHJyU0NsT2xpTzE3L294CnRNZi96emI3VDAxWVg1TFl3V2doK3dnYnVPM1lWVG5xc05OVmNmUEtITmlKUklOcW9yM3lidk1LdzdJZ0dkRkEKWmEwOUE0d0dLR09yc2hQYlRIbGZDWUFJNHA0dFdUOGhCNDArMUtNQ2dZQWY5RkVVTDBZRDZKblNiK2R0YjRQMQpnVVUwNDZnc0Ira3l5anNmb3hXMEVQM3hQZmVCMCtmc0kzeUhuOHZHQWRNMFdFVW9FeENqZzVaY0Y4bXUrcUpVCnpSQTB5ajM1SnkvU0sxY2FBVjZiMDRiUFBLRmYxT3pWV3laR3NzMVlVVy9xVlJsRlQ4RXFDYTc5NGlaMHA0NVgKR2ZPUEkvbzMydzhKUEY2WUdrUXEzZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_PREPROD=kc2To8hAm1AN00umhtfZ91rt +UPLOAD_KEY_PREPROD=133a37f8498e9a828a8050e7e7e60b3553fef2d2 +POSTGRES_PASS_PREPROD=uc1zmnNPWu9WWA6eCAxAiJ + +PRIVATE_KEY_OMNEX_CLI=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ1l4L1Z2c3pxb1BtaHUKUjRWVnZEY2drVE81TDRwZ2VwdHR4ODZCT045ZDBaZ01HNmFpWFFJZXZhT1hLUjlIMW1qeURyRk95NDB2VlNiKwpoK1JwRDJ2Z2JCTmdaTFJmeVE0V0E1U3g0QXk1UVU2V0Y0UGpQdC8wK3pQcjIrcXBDMDVrZGJSSXhMVjdXSnkrCnl4cCtFTjAxbFlXOU5FdWxqWEJyN2ZNRldKYmlXTmRWQjYzY3N5d2YzWVd0WXlvNHdCZkFTT3cxemVacWdCclMKYStsT0FOOWthYjBsWnpqcXVZbDFEbEE3bzJnZVlZcDNOelNpTU1GbXpGUm1NNmhDRzM1VzE1azlaS0E5dmZ6TQpGSE9kaEZZQXRFR0RnUDhveU56SCtrOFdkd3NCM1MzRnhtK3V3aTA5OFV4dDd5UEQ1LzNGb2lIYytWejR1N2FCCmszYlZDZ0w1QWdNQkFBRUNnZ0VBQk5NdmQ3NGxsSXNOcmRUb1VRbGdoWHRuSFNVelFJSFlGSVJEd1Q0NjcwOHkKRng0aVJJZFMxMXZHYXdkNkQzWmJTbHRjZzJMbmlWYXVEeDlheWV3YUlhOFJhMnV4YkJoN3IzRGdiUlVvc0dBNgpVNEJpM1REVVE3djhCZW41aHFvK3lQLyt5QnV6NlFxRzFHVGM2QjFrejdTZEJ5NkdmZVZzMGJCdmlvd2pqZy96CkZicy83LzJpbVRtVUN6V29KOW5za1BLOUdmaU5ONWxiYU5NSnpJVGRYQVkvVC9uM0N2WXBLRTlMMlZJbVMzNWgKNkh5LzgzdE5GWWhvYk5xVmtlRjFFc1R1OURqVVhRUzl0MVFCZVd0a0IvbkRWQS9uLzFiQU56UE5SdEFNZUpTQgpQNkZLTkRwSzJ1cWJpT3dQQnZMaDdtQ0I0VVI1elpSUzFJN0RHRjBjc1FLQmdRRFdZeG55NUEzeS9oUFl5MFNmCllYSzBXaTlsbGc4dTgvYjBGUFJoTytQcHoxYVFLdGJVYThWL0FCRXdHd3FXVS9naGs1L21LNkJsYWg3VWRBVEEKdDVEM1AvTU1hS3JZNHZ6NlV2NUVadG1zWU5mTjBFLzNPTWtHZ3pzWEIrR2ZnaHdjNlcwbnFpcVcwK0tMYmJYZgpDemM0c25nWW1YZE1ESE1QNUZXUm9VRVNLUUtCZ1FDMmI2Y3lTOUtIVmc0dnRlYkdlb3ZkMWZMdHhTV294WlJKCmxSMWVIM0RrWWZaMEk2UU5NNE9STHdNb0JNUmlpUTVwbnhyQ1plV0VJN1BjQis1QmFTR21lOGs1TEJqenMwZ2MKWEo3K1RIVXUvT3FIeFA2TVdpMGNWc1cvQkxIWDlWTE8zY2JZQnBlYnRRTTRoWjJrcEN0WVRnTDhWeDE2U0o0TQpjTHUyNVdta1VRS0JnSHdQeTBOZ3I2WFBYR0xYZGpXWktjeXVaOEVzcmtxb2lWOUVCUXVEb2VkNndZZ2FFa25JCnQvZy9iTExlNHlpTkhRa3BLWjREM3dUdy9UaEtqem1Ld013ajZKMWtzSUZrRWFzMmZjZk5rT2VNL3pVdCtDaUQKWnVscTViWDFMSjZtcDJnZnVMZjhaRHIyRUtKSThiZEtBVUhCSFhoMnpxOW1nT3RRWWlndEhiL0pBb0dBR2JpMApRZ3NlcTZZZWFldWpsZWhCUUEyaUtwUFpNMnBuOWRmb1JCVDZ2Ymh5SHYzSGEzVVAzN0JaS1pOQ2ZRSUYzaTVvCmYzQU9aQXNFbU1rbGRtTjBNeHpReWhiRmpkYUJIRDZTekJmTGpjeHE1S21KbWhBOHUvb2Y5MGFhTEhDU05FaGcKZUtTMVMyYkNCWDRSTTkxUm55bWdraU5XTEorQWFSQ2I1cldCcDRFQ2dZQklDeVBkeTVCNCswaVFhVnVkdG1wcgpPenR3R2VxaGI4WHNLcU5iNjRUQW52TWZNWnE3Y3lWYTNYZ0EvcVZtZVBhQmg5Z3JWeWxlUG94V3RIN09xL05MCllnakxmQnUvVk5LQWlIaXJkTVAwTEhQYzFaUVNYS09EYU5RdmdXazBTYnMwN1d1SGN5RG5oM0E3UzFlMmdvTXYKRW94NkdPVlRhRnB0cDYxYVdHN3dWdz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_OMNEX_CLI=XamoflYJO76jU3WkX074EMfe +UPLOAD_KEY_OMNEX_CLI=653f61211812ea0c4ce7b763db4821a417549e91 +POSTGRES_PASS_OMNEX_CLI=h7z47IGFzsNhXWJtvwOXxWjD + +PRIVATE_KEY_OMNEX_ADMIN=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2xBd1laeWtVSXRSNFYKQllQN1MyM2VXNFk1L3UxdFlpa3l0b2xZaithd3FUUlBCK09mS2EzV2xCRkJyS1I0VWNYUkRTR1VrQk9HT3g2UgphWklyd1o4eVhCbG1OeEl1TlIvVDE1cW9DMzI3Uy9jUmcyL0grQjJVOWtqTFhSQUM1WVVscnZ4cXhBUFFRdytOCjFYNW8wUWhSVi83Nlc3T2lhaURocktjRWNWUjJldkU3Q3BMblRTbU8zS1FQSDM4NEg3alYxN0o4YVRKczR5QnEKVUtPSGpGT05rUWNMbHFLOHE5YWdLQTl6c2RKVTFCTWNCK2oyVXVBcGtEc0pRWG9nVFRaV1poQzhqTnlCVFhINQpiZWxpVlN0M1FPdm5zTDFnRFd2R3ZyTXRiUzQyRDNGMEwzNWNoM0I0VG5ZaDJ5Y3VsSXFtZnlMVXRBanc5dENjCkpESk1LK1dCQWdNQkFBRUNnZ0VBR0lqOUVMdWZEUjdsQktvbnlDY2NoSG5tV053N1VFN09vbUE2eHNUS3Y4ekEKM3RsazhtYi9sbzY0akNQUDVxWDkvRW53Q3Nkclo4T0ZsWWgxZC9VWHB5VERrQXV6TTlTcFVWWFhCSktFMU9NRQpMd0gwam02cGMxczFVcXVaTkYwTk1aKzFuMmhheXM0VjAzaUJqYk03QWVGTUk4eWJ4cFB5Skt3SHYyVGNjcXN5CjY3QXNZazU2cm1PQjhsbGV0Ni9kOHp6cXFPbHZBV0xxWmZHSnViM3hRbCs2U3ZoNkM3SDhlTW9XdnhpaVZIdDMKUTkxamF4L0xUYzU2WkFBd3IzczMrRGp1Rit1cEs3NVRML2hyeWlYN0g0cHRFblE0UllIWFVVNHhZR3lnQzFkWQowZUllcVZCcmFlSFNzTjR0QURHc0FXaHpkajZ2SmtJOVpYcWhaUHFqbVFLQmdRRFRGcGFaMUcyRVMzUVpReUVaCm9DUVJCQTQxNy9sVCtWVENuZ0x2V1Q0V2pRM1BWUDZNWVFaQXZIOSswVEEwaDFKUzFFTDk0cVR3aVFrR1VnZXEKRXBKTG40aTFxTkpWNHkxU1U3VENpL1N5OWVYL3E4RVFMZDBNUFl1eGpvRTFHdGgwODRCTEFBUkd2bWVGclB4MgpwdmpvSDJjWENhb2NoOHlsWHRHYjl6azZUUUtCZ1FESUhzYWxpQ0F1WUZkV3ZvSWVlZGtEYVU5VDlzc3A1TnBWCjEzRzNuWFJzYWN0OFEwaFhNTjBBRWdNdngvSXFEOUlmRmFQQnJFOUlYbDZxQ3lrSW5IQWZ1ekJkVThJUU05OGgKWXZwMGhRVlhnaEF0blB6VkgxTEE4aUJTbktZMTdOS1ppR3cvU2sza1lCWnk2aGg2QWRmc0R3eDJ3RlJUalpzWAplbExkek1IS0JRS0JnQUw5THVTK3ZVNUNRMEtZVUwrc0pOYVkyQnFyYXp4bEsyNFdEclNVN3V3aTB5ODhaTjVZCkFWNnBUS1RmRVcrcyt0MXhaQUYwVkNHVHp5em52SFFNRDBaQzNBeTJkMFFBRTRRMjZ6aFdBd0VGdWx3RWNwZG8KRHRrOWhkemR4N2FZeXJmZE90UFZERHAwTjhNTTBBWmVGdWd5aWFNcDM5N0hqWDVKK1czYjhsT0JBb0dBZU5hRQprcTJvNlBnSnBQcHlMWjdiMklCOWd6RFJxcUZpNlZTbmVQMGRzTjBOSHlLdGl1Q1pnaEplVkRyQzBuMHRIdEg5ClNOUVlKNVc4U2FkbGhxcVgxY0U5U2cxcWNFZ3lJc0hXaEFkU20yMlJBVW43TFdHMW9ZWlMyQzk0K2JUZjBnK2IKZFhnVG9xUVd5aHJxM3JsQVBXMDAxSHY4TDF1aFc4TGtTTVA3L0ZVQ2dZRUFxRFo5eEI3d3h5Nzc2VWs2SUFBdgpEVkV4TTZhQjYwMVJkd09pUlk4VTFkU3ZoRko5TFJHM3g5VVl2NHdKa1IvZFZMTGJlVnVvTHJJMEUvWERqQmhMClp6dzZOWTYydUY4K2tmTUFqOEpSNkx1azF0WWtYM1lIN2tvM0loMDFSVWMyYXNpU1dkbHAyUk1BbnNodGk2MHYKWC9OdmU0ZFhOOHZDbC9maE5kbEJuVFE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_OMNEX_ADMIN=v8dkMb6uAeiGMHEczI3IFphl +UPLOAD_KEY_OMNEX_ADMIN=144225999c44d936caf42adeecb74a419b7d91c8 +POSTGRES_PASS_OMNEX_ADMIN=We9ji9I75kIfZJy4QjTqJ4Rp + +PRIVATE_KEY_MOBILE_PROD=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQzJmb0IrVzA0TWtYSXkKQU5yVWVmZkR5MVZvc29aNlVnRC9GV3Z2ellZMFBmMjlrV3NhdEJUZnV3Zk1RUGc0VlZsMk9YY2k3b0wwMVN0ZQptbDJaT01iK2tGMGZuM2RhNWRSRkZQVkVwN0tJK3kxYlJTQmN5M003OVk4b29uMlExVGNvb0NlYUtWWFZ4N1lrCmc2L0dQRExMLyt0STBIVlhkdFF4TURyMUVjQ1p1VG8yZys5MW84NE1MWEpYaXBIa3VTNjRVWUFqbFBySkZjcTkKalI0VEo3ellzTDAxUDlmUG1va0FtMlZjMkI5ZEcrQmpsU0JYcDdveUxJT3RNd0MxekFDa1dpVSs4MWQ1OU5NWgpBdjA0RkpFTkIvUDZ4ZUczV3FNL24vOUlOR3kyWHZkOXdrVXVaRU9iWkppTmg0Q0w2Wld6aEpQQ1BxMmNIY3FyCmNIeFhlUnR4QWdNQkFBRUNnZ0VBQmRYS3B2K2xZYnArMDhGNlBjUCttNWlUVFFzMFNKSDVyUzVTcXJMQUlVaUEKSmdFUjB5TkI3WnR0MXVhVzZUbzFaNVhUek42aWVsQ2NsK1JJck44SFlkbGMyT2VBNmZ1aVMya3RwSG5XT0JJTAo4N2lrbmNMMWxzdTF2WjlnYzNLVjFtczBpUFhjWkQ4RUFHdmpnV3VvVmlTRE1ldFViUzBFQU9TaFpmZWcyR2xwCmJhbllxa3h4U1RVbUpocmYyc1dETDRRRUtMb3NxU1BqWWxRSmFMdFYwR3ZSckFwTzFNbGxyWFB6V05SUGRrUHEKSWdjQWxGU3drZzZ3OUNHSmowSG1YQm1DcUFMM0dlczRTWVBrakkvSThESEFxRHZIUGpuRVdtTGYxeXVySVFHawo2aGYySUgwK2xTcDVYd29wZ1hnQlYvRUVxN3VRM0xuNkIrcUF2MTVCU1FLQmdRRGxqQmR1bTd4VXdweVFRSmkrCkFzb0daZHk5UW5xaHltV3VBWUw3Rlh5SXlER0UyWkZ6djc5Q2RVV0t0Z1VmNWxtL0htNDN1T0xxWjBQYWRnT2MKUENFTFowOGdRSmFJTXBLc0ZMeXdycmpaQUJGZzZRRGlwTllpN1AvSmRJaldWaTcwQWNoekJkNjVWd1hzSWlKNApBdGNJRmxuYUNXeDVwb3VNR0MwR0EyWHM5UUtCZ1FETGhrcEJyR0pOU2dCZ3J5bEwxUS9Yb0szYVRqZk5yOE1xCjBYMVBqSU0vMG5zdFlWMUp1VFpxaW1kSmkzQ09va1BDMTZ5YlhzZ2ZTdmZ1TTBiaTRiS1VQUDl4aVRDaCtCNkMKRUNueXo1QXdnbWNyU21iUEQzWlNBTDhYTi9mSVlhNW5raHBwbHZuVmVMWVVRbWRaVlNaOVFBZ2pmTTcwTnJTcAorUVlzKzYvbkRRS0JnQmdmUTZzYzlJcVh0T28zejVWUUo3aktaWXNCL0c4YUhOdFBUMXRoWTZmZ0djd1RMUVRUCjVwNXVRbk9VTXkrcC9rNW1QVURmemdEQi8xQnF6SEJUcFVsVWZ1MHR2R1B0cEpvdXg3RnRld0ZhejNpMm82QXQKb0U4bFJxLzk3ZzlRR1RrTkl1cHJlSDlUbE15K3ZZNk5CZG5VdDNhQlBRUC9xM1I2YWVqUzNKZ3RBb0dBREJJdgo3MHM1SFZwcFFWTENRVVFteDJRNVMzeGVKTzNxeG14Y1lVNTFMbURlZTJlTjcrUnpUTWhlcmViK1N3ZG11M1N0ClFSM1RBc0FnaWxreU9CeW95ZEFBV295SGZPUEpjMjlmL1kzQUFKQ0xhKzdpd0I4cnBsdHkrZjZRektxMmZHQVcKL3ZJOGFTUGFzTUxyZkVubm1ZQWx1MjBZblRWdGE3TmdZV1NnSHpVQ2dZQXNiT3JPbHhEbWpjZER4N3l1YmNSOApTMTBTalJzNkhMQ2ttV3djV2lpbGpXelpaT2pyVytmcThyTzE2cEp0K2IrVjZtVVRScXplTG5xTVVvb3pjQXAvClJSS0xEVC94aFVZeHM1TWhGUlBTa3E3YXdLV3NpdFVheVEvaW4xaEtkUDhlZzJ6Qzg2eE5zNzhERE1MWUxsdWEKbm9NMm0yL0NxcEZySHN6cFhnQmgrZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_MOBILE_PROD=zjRFjKEnu3dTB4Re2BUEWj0p +UPLOAD_KEY_MOBILE_PROD=f7213601d353955c65eb2790fecadc4a41d3e9f9 +POSTGRES_PASS_MOBILE_PROD=LbYA14vuUG937x9wvOKErN + +PRIVATE_KEY_MOBILE_PREPROD=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzl6OCtueTRLM1JJZHYKNjBKb3o4K0x2Q2J4QUVwL3FxZEtjV3Y2bDRlWXpmRlptUklTVHUvZzE2Vk9YQnduOEQ0RE4rL1EvTHQ2NGdaMAo1VFhkdGRsRklNL25CdGRVNGttM1Y1KzBteUphVTVQcDZFYXVkazRkMzYxNldkT2VYOTladU1tcTBPbUdtM2R1CmJRTi9GVEtscTBiODBDZERWSVNJc3pKVENJRk9zaGFnc1ZENWRzTHBRdWVncCtGRTZwZVBXSHQ1SDdFSW5ieEgKNHU0SDZRbVR3U0VQd3ZnSm1xVTcvRldUM2Q0M2VnbTVNY2xoUHVOWjkvYTVQN1ZKek5GVysvaG1hZk9kVCtCUQo5Y2x4Q1VoS2VhOW9iLzd3MkR4bjFPRU1vT2VlZDRta1ZjQ0VXcFRyWmFOdjlqMnROdjBWWm1leG9GQzROa2FuCjZjRlVkeFBsQWdNQkFBRUNnZ0VBQkdSRmdyVmVZemZPVzc3a0VpRnFHai9uNEJXZCtQdzRLS3h5ZWlGOWFBSUQKMCtDTEh0U29ENFM0ZE1BRUtzRzZrdXA5YUZGMS9sbUh4V0ZKbTIvMHIwNXd0bFlJaEw5RG1MUUorWmR6OWx1NQpXcnAwRlluejNyOFR6WGFSN2VKNy9DQjBFZzYwQ0lMdnJYb1BrRkRXUGllMkJHMXdnSFNqMHd5S1hUVEtLOG1WCmFrVGl4VWFkNGNMV2NoOUhZeXNEM1MweGRtRnNaZi9tQ2VWb2JpMWlVSlJnZDFSeVRCcmFlaEZSc2RHMlRBN3cKVTdYaVlDSlgrbG52SEhGR0xwS2pUcGtydUhpU3ViaGE0MXhMWU8xR2xzMzAvb2dYbTZtZHR1b2xvQ1lOM2RGWQpBS3UweFJkQ3Z2SThNYVFjaWtjVWdNQ2N1L1BObE5TaHNyOWxoZHA1OVFLQmdRRC90UTZ0WTFqczJ5dXU4UUZUCm5zaWlNamhFajhHSHBwZEtyNTNpYWdpdkdreWhSOTBoK0pZUlR4RG1KZnk3Mjl5VWorTDhsWlJ3dVBJczlNYWMKUXFzeTBDZ2JId25SK1NEdFhSUkVxTkZKdHg2SkxCNGw4THZMa1lhZFBaQnN5SGZUa3RBcXJjZjFMM0Z1WmFnTwpoa1hORW44c2VGWGh5MnMxdE1XdlVNY2tNd0tCZ1FDK0IzRHd4UmtWRTZjeWNqNWJRejV0d3lVUEZYT0hFVVpzClZ1bjk1aXFPQjR4TDFNeStaTW1kWktkRXpncjc1MTEyZzlJRmRtWU5xalhoNXhMMnVhdG5SNmxTY3lvOTlIbk8KWFd5UWtBNm9MYUVVQ0QvdG80NHEya1M0STA2MytURTFUbWZNRVB0d0NJeUYzNmNnU1NwMUZ5U29zck05NmYvdQp5RXg4dWx3UGh3S0JnRXVvaDdvM3ZmVCsrRkxmemxPdWxKQ2hLVkxuOGd3djkyM0t2bjFpZ0VWSEU4dFlsdzVaCkhoWHEvZ1lLMFZmSU91RGVIZnc4U2RwOGJuTnN6V01vdXJ6aktDcTJLVkt1VXRiSWhwbTJGWTZwRnVqaFc5NC8KOTJESkl6cGRIK0dBQXl4ZnNTWWZteDFwdHpkQjd0SzFXZXZPZ0VCcExvZ0xoeUl4NVpmMDM2ZFBBb0dCQUxnRQpyTEg3cTlabE9idjROYnBhMjlHZTcvd3pZYlNpWGZmOEVvdjBuN0Q2VGpvQTBHUnZaVzR0VW0ybXVheEcySk0wCkErV1dTaTFoYnR4YjBGbHNZemVZaGJkNkhxWHdZU1FlQkV2WnROZlhsK3kyTUhJSHVGeDNFYVRmVEJPTUZNTHkKTWtIREVEbmxqVzcycmZqdDRWZVNHY1hqaHYrbDRsbHhUZUJhOTF0eEFvR0JBS3k5WGxUUXFqTW1MRjB3cGpVMApxS1pLRmdFRHJUNUI3b05MaXlzNWlWK2dGbEVaeWV0N3VGVVBWdHV0TDMzTWttSkFIMkxXRjRVMTBTc1ZIWUE0ClQvUEtEMzhNZGhRR0U0RytIL1psSkpXWjhLdkM1MFZBWTEwanBKTnlXa0JicjlBU0lYSVhTUlp2Zi9IYnNraUIKTElHSUJ3WVF1ZjI3RHprRk9WMmRMRFgyCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K +ADMIN_PASSWORD_MOBILE_PREPROD=thxz419zFmNdh547A3vrQE1v +UPLOAD_KEY_MOBILE_PREPROD=8f65a01120509b149f3a781b139391272519041b +POSTGRES_PASS_MOBILE_PREPROD=uS6K8V54JeUHOYsbEDdbIt diff --git a/monitoring/ota/docker-compose.yml b/monitoring/ota/docker-compose.yml new file mode 100644 index 00000000..0108b1f5 --- /dev/null +++ b/monitoring/ota/docker-compose.yml @@ -0,0 +1,212 @@ +services: + postgres: + image: postgres:16-alpine + container_name: ota-postgres + restart: unless-stopped + environment: + - POSTGRES_USER=${POSTGRES_USER} + - POSTGRES_PASSWORD=${POSTGRES_ROOT_PASS} + - POSTGRES_DB=postgres + - POSTGRES_PASS_PROD=${POSTGRES_PASS_PROD} + - POSTGRES_PASS_PREPROD=${POSTGRES_PASS_PREPROD} + - POSTGRES_PASS_OMNEX_CLI=${POSTGRES_PASS_OMNEX_CLI} + - POSTGRES_PASS_OMNEX_ADMIN=${POSTGRES_PASS_OMNEX_ADMIN} + - POSTGRES_PASS_MOBILE_PROD=${POSTGRES_PASS_MOBILE_PROD} + - POSTGRES_PASS_MOBILE_PREPROD=${POSTGRES_PASS_MOBILE_PREPROD} + volumes: + - postgres_data:/var/lib/postgresql/data + - ./init-multi-db.sh:/docker-entrypoint-initdb.d/init-multi-db.sh:ro + networks: + - ota-net + healthcheck: + test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"] + interval: 10s + timeout: 5s + retries: 5 + + ota-prod: + image: xaviaio/xavia-ota:latest + container_name: ota-prod + restart: unless-stopped + environment: + - HOST=https://ota-prod.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_prod + - POSTGRES_PASSWORD=${POSTGRES_PASS_PROD} + - POSTGRES_DB=ota_prod + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_PROD} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_PROD} + - UPLOAD_KEY=${UPLOAD_KEY_PROD} + volumes: + - ota_prod_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + ota-preprod: + image: xaviaio/xavia-ota:latest + container_name: ota-preprod + restart: unless-stopped + environment: + - HOST=https://ota-preprod.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_preprod + - POSTGRES_PASSWORD=${POSTGRES_PASS_PREPROD} + - POSTGRES_DB=ota_preprod + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_PREPROD} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_PREPROD} + - UPLOAD_KEY=${UPLOAD_KEY_PREPROD} + volumes: + - ota_preprod_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + ota-omnex-cli: + image: xaviaio/xavia-ota:latest + container_name: ota-omnex-cli + restart: unless-stopped + environment: + - HOST=https://ota-omnex-cli.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_omnex_cli + - POSTGRES_PASSWORD=${POSTGRES_PASS_OMNEX_CLI} + - POSTGRES_DB=ota_omnex_cli + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_OMNEX_CLI} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_OMNEX_CLI} + - UPLOAD_KEY=${UPLOAD_KEY_OMNEX_CLI} + volumes: + - ota_omnex_cli_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + ota-omnex-admin: + image: xaviaio/xavia-ota:latest + container_name: ota-omnex-admin + restart: unless-stopped + environment: + - HOST=https://ota-omnex-admin.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_omnex_admin + - POSTGRES_PASSWORD=${POSTGRES_PASS_OMNEX_ADMIN} + - POSTGRES_DB=ota_omnex_admin + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_OMNEX_ADMIN} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_OMNEX_ADMIN} + - UPLOAD_KEY=${UPLOAD_KEY_OMNEX_ADMIN} + volumes: + - ota_omnex_admin_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + ota-mobile-prod: + image: xaviaio/xavia-ota:latest + container_name: ota-mobile-prod + restart: unless-stopped + environment: + - HOST=https://ota-mobile-prod.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_mobile_prod + - POSTGRES_PASSWORD=${POSTGRES_PASS_MOBILE_PROD} + - POSTGRES_DB=ota_mobile_prod + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_MOBILE_PROD} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_MOBILE_PROD} + - UPLOAD_KEY=${UPLOAD_KEY_MOBILE_PROD} + volumes: + - ota_mobile_prod_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + ota-mobile-preprod: + image: xaviaio/xavia-ota:latest + container_name: ota-mobile-preprod + restart: unless-stopped + environment: + - HOST=https://ota-mobile-preprod.uber-stup.club + - BLOB_STORAGE_TYPE=local + - DB_TYPE=postgres + - POSTGRES_USER=ota_mobile_preprod + - POSTGRES_PASSWORD=${POSTGRES_PASS_MOBILE_PREPROD} + - POSTGRES_DB=ota_mobile_preprod + - POSTGRES_HOST=postgres + - POSTGRES_PORT=5432 + - PRIVATE_KEY_BASE_64=${PRIVATE_KEY_MOBILE_PREPROD} + - ADMIN_PASSWORD=${ADMIN_PASSWORD_MOBILE_PREPROD} + - UPLOAD_KEY=${UPLOAD_KEY_MOBILE_PREPROD} + volumes: + - ota_mobile_preprod_releases:/app/local-releases + networks: + - ota-net + depends_on: + postgres: + condition: service_healthy + + nginx: + image: nginx:alpine + container_name: ota-nginx + restart: unless-stopped + ports: + - "80:80" + - "443:443" + volumes: + - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro + - ./certs:/etc/nginx/certs:ro + - certbot_www:/var/www/certbot:ro + networks: + - ota-net + depends_on: + - ota-prod + - ota-preprod + - ota-omnex-cli + - ota-omnex-admin + - ota-mobile-prod + - ota-mobile-preprod + + dozzle-agent: + image: amir20/dozzle:latest + command: agent + volumes: + - /var/run/docker.sock:/var/run/docker.sock:ro + ports: + - "0.0.0.0:7007:7007" + restart: unless-stopped + +networks: + ota-net: + +volumes: + postgres_data: + ota_prod_releases: + ota_preprod_releases: + ota_omnex_cli_releases: + ota_omnex_admin_releases: + ota_mobile_prod_releases: + ota_mobile_preprod_releases: + certbot_www: diff --git a/monitoring/ota/init-multi-db.sh b/monitoring/ota/init-multi-db.sh new file mode 100644 index 00000000..4bffb6f8 --- /dev/null +++ b/monitoring/ota/init-multi-db.sh @@ -0,0 +1,11 @@ +#!/bin/bash +set -e + +for pair in "ota_prod:${POSTGRES_PASS_PROD}" "ota_preprod:${POSTGRES_PASS_PREPROD}" "ota_omnex_cli:${POSTGRES_PASS_OMNEX_CLI}" "ota_omnex_admin:${POSTGRES_PASS_OMNEX_ADMIN}" "ota_mobile_prod:${POSTGRES_PASS_MOBILE_PROD}" "ota_mobile_preprod:${POSTGRES_PASS_MOBILE_PREPROD}"; do + db="${pair%%:*}" + pass="${pair##*:}" + psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" <<-EOSQL + CREATE USER ${db} WITH PASSWORD '${pass}'; + CREATE DATABASE ${db} OWNER ${db}; +EOSQL +done diff --git a/monitoring/ota/nginx.conf b/monitoring/ota/nginx.conf new file mode 100644 index 00000000..cbf525b4 --- /dev/null +++ b/monitoring/ota/nginx.conf @@ -0,0 +1,168 @@ +# ========================================================= +# Redirection HTTP -> HTTPS pour les 4 sous-domaines +# (garde /.well-known/acme-challenge/ en clair pour certbot) +# ========================================================= +server { + listen 80; + listen [::]:80; + server_name ota-prod.uber-stup.club ota-preprod.uber-stup.club ota-omnex-cli.uber-stup.club ota-omnex-admin.uber-stup.club ota-mobile-prod.uber-stup.club ota-mobile-preprod.uber-stup.club; + + location /.well-known/acme-challenge/ { + root /var/www/certbot; + allow all; + } + + location / { + return 301 https://$host$request_uri; + } +} + +# ========================================================= +# ota-prod.uber-stup.club -> conteneur ota-prod:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-prod.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-prod.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-prod.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-prod:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + +# ========================================================= +# ota-preprod.uber-stup.club -> conteneur ota-preprod:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-preprod.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-preprod.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-preprod.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-preprod:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + +# ========================================================= +# ota-omnex-cli.uber-stup.club -> conteneur ota-omnex-cli:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-omnex-cli.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-omnex-cli.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-omnex-cli.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-omnex-cli:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + +# ========================================================= +# ota-omnex-admin.uber-stup.club -> conteneur ota-omnex-admin:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-omnex-admin.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-omnex-admin.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-omnex-admin.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-omnex-admin:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + +# ========================================================= +# ota-mobile-prod.uber-stup.club -> conteneur ota-mobile-prod:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-mobile-prod.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-mobile-prod.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-mobile-prod.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-mobile-prod:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} + +# ========================================================= +# ota-mobile-preprod.uber-stup.club -> conteneur ota-mobile-preprod:3000 +# ========================================================= +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name ota-mobile-preprod.uber-stup.club; + + ssl_certificate /etc/nginx/certs/ota-mobile-preprod.uber-stup.club.crt; + ssl_certificate_key /etc/nginx/certs/ota-mobile-preprod.uber-stup.club.key; + ssl_protocols TLSv1.2 TLSv1.3; + + client_max_body_size 500m; + + location / { + proxy_pass http://ota-mobile-preprod:3000; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/monitoring/ota/renew-certs.sh b/monitoring/ota/renew-certs.sh new file mode 100644 index 00000000..92542e02 --- /dev/null +++ b/monitoring/ota/renew-certs.sh @@ -0,0 +1,22 @@ +#!/bin/bash +set -e + +docker run --rm \ + -v ota_certbot_letsencrypt:/etc/letsencrypt \ + -v ota_certbot_www:/var/www/certbot \ + certbot/certbot renew --webroot -w /var/www/certbot --quiet + +changed=0 +for sub in ota-prod ota-preprod ota-omnex-cli ota-omnex-admin ota-mobile-prod ota-mobile-preprod; do + domain="${sub}.uber-stup.club" + if ! docker run --rm -v ota_certbot_letsencrypt:/etc/letsencrypt -v /opt/ota/certs:/out alpine \ + sh -c "cmp -s /etc/letsencrypt/live/${domain}/fullchain.pem /out/${domain}.crt"; then + docker run --rm -v ota_certbot_letsencrypt:/etc/letsencrypt -v /opt/ota/certs:/out alpine sh -c \ + "cp /etc/letsencrypt/live/${domain}/fullchain.pem /out/${domain}.crt && cp /etc/letsencrypt/live/${domain}/privkey.pem /out/${domain}.key" + changed=1 + fi +done + +if [ "$changed" = "1" ]; then + cd /opt/ota && docker compose up -d --force-recreate nginx +fi