Skip to content

Commit 8e4f5f4

Browse files
Jetman80Jetman80
committed
feat: gitlab custom nginx configs
1 parent 3c73ae0 commit 8e4f5f4

3 files changed

Lines changed: 196 additions & 0 deletions

File tree

‎CLAUDE.md‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
# CLAUDE.md
2+
3+
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
4+
5+
## Overview
6+
7+
This is the **microdevops-formula** repository - a comprehensive SaltStack formula collection for managing infrastructure and applications. It's designed to handle everything from basic system configuration to complex application deployments across hundreds of servers.
8+
9+
## Key Architecture Components
10+
11+
### Formula Structure
12+
- **State files (.sls)**: Main configuration and deployment logic
13+
- **Pillar examples**: Configuration templates for each service/component
14+
- **Jinja templates**: Dynamic configuration generation
15+
- **Files directory**: Static configuration files, scripts, and assets
16+
17+
### Core Service Categories
18+
- **Infrastructure**: nginx, php-fpm, docker-ce, ufw_simple (firewall), bootstrap (system setup)
19+
- **Applications**: app (web app deployment), wordpress, gitlab, nextcloud, sentry
20+
- **Monitoring**: netdata, prometheus, grafana, alertmanager, cmd_check_alert
21+
- **Databases**: percona (MySQL), postgresql, mongodb, redis
22+
- **Security**: authentik, keycloak, vault, wazuh
23+
- **Backup**: rsnapshot_backup with sysadmws-utils integration
24+
- **Networking**: keepalived, haproxy, consul
25+
26+
### Application Deployment System
27+
The `app/` formula provides a sophisticated deployment system supporting:
28+
- **PHP-FPM applications** with nginx integration
29+
- **Python applications** with various WSGI servers
30+
- **Static sites** with nginx optimization
31+
- **WordPress** deployments with specialized configurations
32+
- **Docker-based applications**
33+
34+
Key files:
35+
- `app/init.sls`: Main deployment orchestration
36+
- `app/deploy.sls`: Core deployment logic
37+
- `app/_nginx.sls`: Nginx vhost configuration
38+
- `app/_user_and_source.sls`: User setup and source code management
39+
40+
## Common Salt Commands
41+
42+
### Basic Operations
43+
```bash
44+
# Apply a specific state
45+
salt 'minion-id' state.apply nginx
46+
47+
# Apply with specific pillar data
48+
salt 'minion-id' state.apply app.php-fpm pillar='{"nginx_reload": true}'
49+
50+
# Test configuration
51+
salt 'minion-id' state.apply test.git_commit
52+
```
53+
54+
### Application Deployment
55+
```bash
56+
# Deploy PHP-FPM application
57+
salt 'minion-id' state.apply app.php-fpm
58+
59+
# Deploy static application
60+
salt 'minion-id' state.apply app.static
61+
62+
# Deploy Python application
63+
salt 'minion-id' state.apply app.python
64+
```
65+
66+
### System Management
67+
```bash
68+
# Bootstrap system (initial setup)
69+
salt 'minion-id' state.apply bootstrap
70+
71+
# Update firewall rules
72+
salt 'minion-id' state.apply ufw_simple
73+
74+
# Configure monitoring
75+
salt 'minion-id' state.apply netdata
76+
salt 'minion-id' state.apply cmd_check_alert
77+
```
78+
79+
### Backup Operations
80+
```bash
81+
# Update backup configuration
82+
salt 'minion-id' state.apply rsnapshot_backup.update_config
83+
84+
# Check backup coverage
85+
salt 'minion-id' state.apply rsnapshot_backup.check_coverage
86+
87+
# Run backup sync
88+
salt 'minion-id' cmd.run '/opt/sysadmws/rsnapshot_backup/rsnapshot_backup_sync_monthly_weekly_daily_check_backup.sh'
89+
```
90+
91+
## Configuration Management
92+
93+
### Pillar Structure
94+
- Each service has a `pillar.example` file showing configuration options
95+
- Main pillar reference at `/pillar.example` points to individual service examples
96+
- Ready-to-use pillar templates in `pillar/` directory with common configurations
97+
98+
### SSL/TLS with ACME
99+
The formula integrates with acme.sh for automated SSL certificate management:
100+
- Webroot validation for Let's Encrypt certificates
101+
- Automatic nginx configuration for HTTPS redirects
102+
- Integration with various DNS providers (CloudFlare, GoDaddy, etc.)
103+
104+
### UFW Simple Firewall
105+
Advanced firewall management system (`ufw_simple/`) that:
106+
- Extends UFW with NAT and raw iptables rules
107+
- Manages firewall rules across hundreds of servers
108+
- Includes predefined rule sets for common scenarios
109+
- Supports Docker integration and complex networking
110+
111+
### Monitoring Integration
112+
Comprehensive monitoring setup:
113+
- **Netdata**: Real-time system monitoring
114+
- **Prometheus**: Metrics collection and alerting
115+
- **Grafana**: Visualization and dashboards
116+
- **cmd_check_alert**: Custom health checks with alert integration
117+
118+
## Development Workflow
119+
120+
### Making Changes
121+
1. Modify the appropriate `.sls` state file
122+
2. Update corresponding `pillar.example` if configuration changes
123+
3. Test changes on development minions first
124+
4. Use `state.apply` to deploy changes
125+
126+
### Testing
127+
- Use `salt-call --local state.apply` for local testing
128+
- The `test/` directory contains validation states
129+
- Bootstrap testing available via `bootstrap/test.sls`
130+
131+
### Scripts and Automation
132+
- `scripts/ci_sudo/`: Scripts for running Salt states via CI/CD
133+
- `scripts/salt-ssh/`: Salt-SSH specific scripts
134+
- Integration with GitLab CI for automated deployments
135+
136+
## File Organization
137+
138+
- **Top-level directories**: Each represents a service or component
139+
- **init.sls**: Main state file for each service
140+
- **pillar.example**: Configuration template
141+
- **files/**: Static files, templates, and scripts
142+
- **defaults.yaml**: Default variables for complex services
143+
- **map.jinja**: OS-specific variable mapping where needed
144+
145+
## Important Notes
146+
147+
- This formula is designed for production environments managing hundreds of servers
148+
- Many services are configured to work together (nginx + php-fpm + app deployment)
149+
- The backup system (`rsnapshot_backup`) is tightly integrated with `sysadmws-utils`
150+
- Firewall rules (`ufw_simple`) are designed for complex multi-server environments
151+
- SSL certificates are automated via acme.sh integration

‎gitlab/init.sls‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,17 @@ gitlab_nginx_redirect:
106106
107107
{%- endif %}
108108
109+
{%- if "nginx_configs" in pillar["gitlab"] %}
110+
{%- for config_name, config_contents in pillar["gitlab"]["nginx_configs"].items() %}
111+
112+
gitlab_nginx_config_{{ config_name }}:
113+
file.managed:
114+
- name: /etc/gitlab/nginx/conf.d/{{ config_name }}
115+
- contents: {{ config_contents | yaml_encode }}
116+
117+
{%- endfor %}
118+
{%- endif %}
119+
109120
{%- if "mattermost" in pillar["gitlab"] %}
110121
{%- if "acme_account" in pillar["gitlab"]["mattermost"] %}
111122
@@ -347,6 +358,11 @@ gitlab_reconfigure:
347358
- file: /etc/gitlab/gitlab.rb
348359
{%- if "redirect" in pillar["gitlab"] %}
349360
- file: /etc/gitlab/nginx/conf.d/redirect.conf
361+
{%- endif %}
362+
{%- if "nginx_configs" in pillar["gitlab"] %}
363+
{%- for config_name in pillar["gitlab"]["nginx_configs"] %}
364+
- file: gitlab_nginx_config_{{ config_name }}
365+
{%- endfor %}
350366
{%- endif %}
351367
- require:
352368
{%- if "acme_account" in pillar["gitlab"] %}
@@ -361,6 +377,11 @@ gitlab_restart:
361377
- file: /etc/gitlab/gitlab.rb
362378
{%- if "redirect" in pillar["gitlab"] %}
363379
- file: /etc/gitlab/nginx/conf.d/redirect.conf
380+
{%- endif %}
381+
{%- if "nginx_configs" in pillar["gitlab"] %}
382+
{%- for config_name in pillar["gitlab"]["nginx_configs"] %}
383+
- file: gitlab_nginx_config_{{ config_name }}
384+
{%- endfor %}
364385
{%- endif %}
365386
- require:
366387
{%- if "acme_account" in pillar["gitlab"] %}

‎gitlab/pillar.example‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,27 @@ gitlab:
3333
# # -----BEGIN PRIVATE KEY-----
3434
# # ...
3535
# # -----END PRIVATE KEY-----
36+
#nginx_configs: # optional, deploy arbitrary configs to /etc/gitlab/nginx/conf.d/
37+
# custom-redirect.conf: |
38+
# server {
39+
# listen 80;
40+
# listen 443 ssl;
41+
# server_name old.example.com;
42+
# ssl_certificate /etc/ssl/old.example.com/ssl.crt;
43+
# ssl_certificate_key /etc/ssl/old.example.com/ssl.key;
44+
# return 301 https://gitlab.example.com$request_uri;
45+
# }
46+
# # Use together with config_additions: nginx['default_server_enabled'] = false
47+
# # to block direct access via server IP (returns 403 instead of showing GitLab).
48+
# # ssl_reject_handshake drops the TLS handshake for HTTPS without needing a cert.
49+
# default-server.conf: |
50+
# server {
51+
# listen 80 default_server;
52+
# listen 443 ssl default_server;
53+
# ssl_reject_handshake on;
54+
# server_name _;
55+
# return 403;
56+
# }
3657
mattermost: # optional, enable bundled mattermost instance
3758
domain: mattermost.example.com
3859
acme_account: example.com
@@ -109,6 +130,9 @@ gitlab:
109130
#config_additions: |
110131
# sidekiq['queue_groups'] = ['*'] * 8 # https://docs.gitlab.com/ee/administration/sidekiq/extra_sidekiq_processes.html
111132
# sidekiq['max_concurrency'] = 10 # has been deprecated since 16.9 and was removed in 17.0. Starting with GitLab 17.0, `sidekiq['max_concurrency']` will be removed.
133+
# # Disable bundled default_server so a custom one can be defined via nginx_configs.
134+
# # Required when adding your own default_server block (e.g. the 403 catch-all above).
135+
# nginx['default_server_enabled'] = false
112136
post_install: |
113137
#!/bin/bash
114138
echo "run post install script"

0 commit comments

Comments
 (0)