.gitlab-ci.yml

stages:
  - build
  - scan
  - package
  - deploy
  - manual-deploy

variables:
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"

workflow:
  rules:
    - if: $CI_COMMIT_REF_NAME == "master"
      when: always
    - if: $CI_COMMIT_REF_NAME == "staging"
      when: always
    - if: '$CI_PIPELINE_SOURCE == "web"'
      when: always

set-vars:
  stage: .pre
  image: docker.io/alpine:3.15
  before_script:
    - >
      apk add jq yq --no-cache
      --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
  script:
    - cat .env >> build.env
    - source build.env
    - echo CHART_VERSION=$(yq '.version' chart/Chart.yaml) >> build.env
    - "echo MONITORING_API_IMAGE=${INTERNAL_REG}/${APP_NAME}:\
      ${APP_VERSION}-${CI_COMMIT_REF_NAME} >> build.env"
    - "echo PROXY_IMAGE=${INTERNAL_REG}/${APP_NAME}/proxy:\
      ${NGINX_VERSION}-${CI_COMMIT_REF_NAME} >> build.env"
    - cat build.env
  artifacts:
    reports:
      dotenv: build.env

.build:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:v1.8.1-debug
    entrypoint: [""]
  before_script:
    - mkdir -p /kaniko/.docker
    - >
      echo "{\"auths\":{\"${INTERNAL_REG}\":{\"auth\":\"$(printf
      "%s:%s" "${IMAGE_REGISTRY_USER}" "${IMAGE_REGISTRY_PASS}"
      | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
  script:
    - echo "Going to build image ${IMAGE_NAME}-unverified"
    - >
      /kaniko/executor
      --force
      --context "${CONTEXT_DIR}"
      --dockerfile "${CONTEXT_DIR}/Dockerfile"
      --cache=true
      --destination "${IMAGE_NAME}-unverified"
      --build-arg APP_MAINTAINER="${APP_MAINTAINER}"
      --build-arg DEVOPS_MAINTAINER="${DEVOPS_MAINTAINER}"
      --build-arg EXTERNAL_REG="${EXTERNAL_REG}"
      --build-arg INTERNAL_REG="${INTERNAL_REG}"
      --build-arg PYTHON_IMG_TAG="${PYTHON_IMG_TAG}"
      --build-arg APP_VERSION="${APP_VERSION}"
      --build-arg NGINX_VERSION="${NGINX_VERSION}"

api-build:
  extends:
    - .build
  needs:
    - set-vars
  variables:
    IMAGE_NAME: $MONITORING_API_IMAGE
    CONTEXT_DIR: "${CI_PROJECT_DIR}"

proxy-build:
  extends:
    - .build
  needs:
    - set-vars
  variables:
    IMAGE_NAME: $PROXY_IMAGE
    CONTEXT_DIR: "${CI_PROJECT_DIR}/nginx"

.scan:
  stage: scan
  image:
    name: docker.io/aquasec/trivy:0.23.0
    entrypoint: [""]
  variables:
    GIT_STRATEGY: none
  before_script:
    - >
      echo "${IMAGE_REGISTRY_CA_CERT}"
      | base64 -d >> /etc/ssl/certs/ca-certificates.crt
  script:
    - echo "Going to scan image ${IMAGE_NAME}-unverified"
    - trivy --version
    - time trivy image --clear-cache
    - time trivy --cache-dir .trivycache/ image --download-db-only --no-progress
    # Create report artifact
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 0 --ignore-unfixed
      --no-progress --format template --template "@/contrib/gitlab.tpl"
      --output "$CI_PROJECT_DIR/$SHORT_NAME-imgscan.json"
      "${IMAGE_NAME}-unverified"
    # Print full report
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 0 --ignore-unfixed
      --no-progress "${IMAGE_NAME}-unverified"
    # Fail on critical vulnerabilities
    - >
      time trivy --cache-dir .trivycache/ image --exit-code 1 --ignore-unfixed
      --severity CRITICAL --no-progress "${IMAGE_NAME}-unverified"
  cache:
    key: trivy-cache
    paths:
      - .trivycache/
    policy: pull-push
  artifacts:
    when: always
    reports:
      container_scanning: $SHORT_NAME-imgscan.json

api-scan:
  extends:
    - .scan
  needs:
    - set-vars
    - api-build
  variables:
    IMAGE_NAME: $MONITORING_API_IMAGE
    SHORT_NAME: "monitoring-api"

proxy-scan:
  extends:
    - .scan
  needs:
    - set-vars
    - proxy-build
  variables:
    IMAGE_NAME: $PROXY_IMAGE
    SHORT_NAME: "proxy"

.retag:
  stage: package
  image: docker.io/regclient/regctl:v0.3-alpine
  variables:
    GIT_STRATEGY: none
  before_script:
    - export REG_HOST=${INTERNAL_REG%/*}
    - >
      echo "{\"hosts\":{\"${REG_HOST}\":{\"tls\":\"enabled\",\"regcert\":
      \"$(printf "%s" "${IMAGE_REGISTRY_CERT}" | base64 -d
      | awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}')\",\"hostname\":
      \"${REG_HOST}\",\"user\":\"${IMAGE_REGISTRY_USER}\",\"pass\":
      \"${IMAGE_REGISTRY_PASS}\"}}}" >> /home/appuser/.regctl/config.json
  script:
    - echo "Going to retag image ${IMAGE_NAME}-unverified to ${IMAGE_NAME}"
    - >
      regctl --verbosity debug image copy
      "${IMAGE_NAME}-unverified" "${IMAGE_NAME}"
    - regctl --verbosity debug tag delete "${IMAGE_NAME}-unverified"

api-retag:
  extends:
    - .retag
  needs:
    - set-vars
    - api-scan
  variables:
    IMAGE_NAME: $MONITORING_API_IMAGE

proxy-retag:
  extends:
    - .retag
  needs:
    - set-vars
    - proxy-scan
  variables:
    IMAGE_NAME: $PROXY_IMAGE

remote-docker:
  stage: deploy
  environment: $CI_COMMIT_REF_NAME
  image: docker.io/docker:24.0
  needs:
    - set-vars
    - api-retag
    - proxy-retag
  only:
    - branches
  variables:
    DOCKER_HOST: "ssh://$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME"
  before_script:
    - apk update
    - apk add openssh
    - echo "$RUNTIME_ENV" > monitoring-api/project/.env
    - echo "Adding SSH Key"
    - mkdir -p ~/.ssh
    - echo "$DEPLOY_SSH_KEY" > ~/.ssh/gitlab
    - chmod 400 ~/.ssh/gitlab
    - echo 'IdentityFile ~/.ssh/gitlab' > ~/.ssh/config
    - echo "going to keyscan on HOST ${DEPLOY_HOSTNAME}"
    - ssh-keyscan -v -H $DEPLOY_HOSTNAME >> ~/.ssh/known_hosts
  script:
    - USER_DIR=$(echo "/home/$DEPLOY_SSH_USER")
    - echo "Defined USER_DIR ${USER_DIR}"
    - HOME=$USER_DIR
    - echo "Going to remotely start the docker-compose.${CI_COMMIT_REF_NAME}.yml on ${DEPLOY_SSH_USER}@${DEPLOY_HOSTNAME}"
    # use docker compose create to recreate the container and force pulling the latest image
    # to avoid using the local cache
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        create --force-recreate --pull="always"
    # use docker compose up to start the service on the remote machine
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        up --detach

manual-remote-docker:
  stage: manual-deploy
  environment: $CI_COMMIT_REF_NAME
  image: docker.io/docker:24.0
  needs:
    - set-vars
  when: manual
  variables:
    DOCKER_HOST: "ssh://$DEPLOY_SSH_USER@$DEPLOY_HOSTNAME"
  before_script:
    - apk update
    - apk add openssh
    - echo "$RUNTIME_ENV" > monitoring-api/project/.env
    - echo "Adding SSH Key"
    - mkdir -p ~/.ssh
    - echo "$DEPLOY_SSH_KEY" > ~/.ssh/gitlab
    - chmod 400 ~/.ssh/gitlab
    - echo 'IdentityFile ~/.ssh/gitlab' > ~/.ssh/config
    - echo "going to keyscan on HOST ${DEPLOY_HOSTNAME}"
    - ssh-keyscan -v -H $DEPLOY_HOSTNAME >> ~/.ssh/known_hosts
  script:
    - USER_DIR=$(echo "/home/$DEPLOY_SSH_USER")
    - echo "Defined USER_DIR ${USER_DIR}"
    - HOME=$USER_DIR
    - echo "Going to remotely start the docker-compose.${CI_COMMIT_REF_NAME}.yml on ${DEPLOY_SSH_USER}@${DEPLOY_HOSTNAME}"
    # use docker compose create to recreate the container and force pulling the latest image
    # to avoid using the local cache
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        create --force-recreate --pull="always"
    # use docker compose up to start the service on the remote machine
    - |
      docker compose --project-name="$APP_NAME" \
        --file "docker-compose.$CI_COMMIT_REF_NAME.yml" \
        up --detach

# .helm:
#   stage: deploy
#   image:
#     name: docker.io/alpine/helm:3.8.0
#     entrypoint: [""]
#   before_script:
#     - >
#       echo "${IMAGE_REGISTRY_CA_CERT}"
#       | base64 -d >> /etc/ssl/certs/ca-certificates.crt
#     - mkdir -p /root/.config/helm/registry
#     - >
#       echo "{\"auths\":{\"${INTERNAL_REG}\":{\"auth\":\"$(printf "%s:%s"
#       "${IMAGE_REGISTRY_USER}" "${IMAGE_REGISTRY_PASS}" | base64
#       | tr -d '\n')\"}}}" > /root/.config/helm/registry/config.json

# create-helm-chart:
#   extends:
#     - .helm
#   stage: package
#   rules:
#     - if: $CI_COMMIT_REF_NAME == "master"
#       when: always
#   script:
#     - >
#       apk add yq --no-cache
#       --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
#     - helm package chart
#     - CHART_VER=$(yq '.version' chart/Chart.yaml)
#     - helm push "monitoring-api-${CHART_VER}.tgz" oci://registry.envidat.ch/envidat

# helm-deploy:
#   extends:
#     - .helm
#   rules:
#     - if: $CI_COMMIT_REF_NAME == "master"
#       when: always
#   variables:
#     GIT_STRATEGY: none
#   script:
#     - >
#       helm upgrade --install "${APP_NAME}"
#       oci://registry.envidat.ch/envidat/monitoring-api
#       --namespace envidat --create-namespace
#       --version "${CHART_VERSION}"
#       --set image.tag="${APP_VERSION}-${CI_COMMIT_REF_NAME}"
#       --set proxy.image.tag="${NGINX_VERSION}-${CI_COMMIT_REF_NAME}"