mirror of
https://github.com/ansible/awx.git
synced 2026-05-19 23:07:42 -02:30
Consolidate the Local Docker installer and the dev env
- removes local_docker installer and points community users to our development environment (make docker-compose) - provides a migration path from Local Docker Compose installations --> the dev environment - the dev env can now be configured to use an external database - consolidated the Local Docker and dev env docker-compose.yml files into one template file, used by the dockerfile role - added a 'sources' role to template out config files - the postgres data dir is no longer a bind-mount, it is a docker volume - the redis socket is not longer a bind-mount, it is a docker volume - the local_settings.py.docker-compose file no longer needs to be copied over in the dev env - Create tmp rsyslog.conf in rsyslog volume to avoid cross-linking. Previously, the tmp code-generated rsyslog.conf was being written to /tmp (by default). As a result, we were attempting to shutil.move() across volumes. - move k8s image build and push roles under tools/ansible - See tools/docker-compose/README.md for usage of these changes
This commit is contained in:
Christian M. Adams
@@ -0,0 +1,11 @@
|
||||
DATABASES = {
|
||||
'default': {
|
||||
'ATOMIC_REQUESTS': True,
|
||||
'ENGINE': 'awx.main.db.profiled_pg',
|
||||
'NAME': "{{ pg_database }}",
|
||||
'USER': "{{ pg_username }}",
|
||||
'PASSWORD': "{{ pg_password }}",
|
||||
'HOST': "{{ pg_hostname | default('postgres') }}",
|
||||
'PORT': "{{ pg_port }}",
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
---
|
||||
version: '2'
|
||||
services:
|
||||
# Primary AWX Development Container
|
||||
awx:
|
||||
user: "{{ ansible_user_uid }}"
|
||||
image: "{{ awx_image }}:{{ awx_image_tag }}"
|
||||
container_name: tools_awx_1
|
||||
hostname: awx
|
||||
command: launch_awx.sh
|
||||
environment:
|
||||
OS: "{{ os_info.stdout }}"
|
||||
SDB_HOST: 0.0.0.0
|
||||
SDB_PORT: 7899
|
||||
AWX_GROUP_QUEUES: tower
|
||||
ports:
|
||||
- "8888:8888"
|
||||
- "8080:8080"
|
||||
- "8013:8013"
|
||||
- "8043:8043"
|
||||
- "6899:6899" # default port range for sdb-listen
|
||||
- "7899-7999:7899-7999" # default port range for sdb-listen
|
||||
links:
|
||||
- postgres
|
||||
- redis
|
||||
working_dir: "/awx_devel"
|
||||
volumes:
|
||||
- "../../../:/awx_devel"
|
||||
- "../../docker-compose/supervisor.conf:/etc/supervisord.conf"
|
||||
- "../../docker-compose/_sources/database.py:/etc/tower/conf.d/database.py"
|
||||
- "../../docker-compose/_sources/websocket_secret.py:/etc/tower/conf.d/websocket_secret.py"
|
||||
- "../../docker-compose/_sources/local_settings.py:/etc/tower/conf.d/local_settings.py"
|
||||
- "redis_socket:/var/run/redis/:rw"
|
||||
privileged: true
|
||||
tty: true
|
||||
# A useful container that simply passes through log messages to the console
|
||||
# helpful for testing awx/tower logging
|
||||
# logstash:
|
||||
# build:
|
||||
# context: ./docker-compose
|
||||
# dockerfile: Dockerfile-logstash
|
||||
|
||||
# Postgres Database Container
|
||||
postgres:
|
||||
image: postgres:12
|
||||
container_name: tools_postgres_1
|
||||
environment:
|
||||
POSTGRES_HOST_AUTH_METHOD: trust
|
||||
POSTGRES_USER: {{ pg_username }}
|
||||
POSTGRES_DB: {{ pg_database }}
|
||||
POSTGRES_PASSWORD: {{ pg_password }}
|
||||
volumes:
|
||||
- "awx_db:/var/lib/postgresql/data"
|
||||
redis:
|
||||
image: redis:latest
|
||||
container_name: tools_redis_1
|
||||
volumes:
|
||||
- "../../redis/redis.conf:/usr/local/etc/redis/redis.conf"
|
||||
- "redis_socket:/var/run/redis/:rw"
|
||||
entrypoint: ["redis-server"]
|
||||
command: ["/usr/local/etc/redis/redis.conf"]
|
||||
|
||||
volumes:
|
||||
awx_db:
|
||||
redis_socket:
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
version: '2'
|
||||
services:
|
||||
# Primary Tower Development Container link
|
||||
awx:
|
||||
links:
|
||||
- hashivault
|
||||
- conjur
|
||||
hashivault:
|
||||
image: vault
|
||||
container_name: tools_hashivault_1
|
||||
ports:
|
||||
- '8200:8200'
|
||||
cap_add:
|
||||
- IPC_LOCK
|
||||
environment:
|
||||
VAULT_DEV_ROOT_TOKEN_ID: 'vaultdev'
|
||||
|
||||
conjur:
|
||||
image: cyberark/conjur
|
||||
container_name: tools_conjur_1
|
||||
command: server -p 8300
|
||||
environment:
|
||||
DATABASE_URL: postgres://awx@postgres/postgres
|
||||
CONJUR_DATA_KEY: 'dveUwOI/71x9BPJkIgvQRRBF3SdASc+HP4CUGL7TKvM='
|
||||
depends_on:
|
||||
- postgres
|
||||
links:
|
||||
- postgres
|
||||
ports:
|
||||
- "8300:8300"
|
||||
@@ -0,0 +1,10 @@
|
||||
DATABASE_USER={{ pg_username|quote }}
|
||||
DATABASE_NAME={{ pg_database|quote }}
|
||||
DATABASE_HOST={{ pg_hostname|default('postgres')|quote }}
|
||||
DATABASE_PORT={{ pg_port|default('5432')|quote }}
|
||||
DATABASE_PASSWORD={{ pg_password|default('awxpass')|quote }}
|
||||
{% if pg_admin_password is defined %}
|
||||
DATABASE_ADMIN_PASSWORD={{ pg_admin_password|quote }}
|
||||
{% endif %}
|
||||
AWX_ADMIN_USER={{ admin_user|quote }}
|
||||
AWX_ADMIN_PASSWORD={{ admin_password|quote }}
|
||||
@@ -0,0 +1,122 @@
|
||||
#user awx;
|
||||
|
||||
worker_processes 1;
|
||||
|
||||
pid /tmp/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
include /etc/nginx/mime.types;
|
||||
default_type application/octet-stream;
|
||||
server_tokens off;
|
||||
|
||||
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||
'$status $body_bytes_sent "$http_referer" '
|
||||
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||
|
||||
access_log /dev/stdout main;
|
||||
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
sendfile on;
|
||||
#tcp_nopush on;
|
||||
#gzip on;
|
||||
|
||||
upstream uwsgi {
|
||||
server 127.0.0.1:8050;
|
||||
}
|
||||
|
||||
upstream daphne {
|
||||
server 127.0.0.1:8051;
|
||||
}
|
||||
|
||||
{% if ssl_certificate is defined %}
|
||||
server {
|
||||
listen 8052 default_server;
|
||||
server_name _;
|
||||
|
||||
# Redirect all HTTP links to the matching HTTPS page
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
{%endif %}
|
||||
|
||||
server {
|
||||
{% if (ssl_certificate is defined) and (ssl_certificate_key is defined) %}
|
||||
listen 8053 ssl;
|
||||
|
||||
ssl_certificate /etc/nginx/awxweb.pem;
|
||||
ssl_certificate_key /etc/nginx/awxweb_key.pem;
|
||||
{% elif (ssl_certificate is defined) and (ssl_certificate_key is not defined) %}
|
||||
listen 8053 ssl;
|
||||
|
||||
ssl_certificate /etc/nginx/awxweb.pem;
|
||||
ssl_certificate_key /etc/nginx/awxweb.pem;
|
||||
{% else %}
|
||||
listen 8052 default_server;
|
||||
{% endif %}
|
||||
|
||||
# If you have a domain name, this is where to add it
|
||||
server_name _;
|
||||
keepalive_timeout 65;
|
||||
|
||||
# HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
|
||||
add_header Strict-Transport-Security max-age=15768000;
|
||||
|
||||
# Protect against click-jacking https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)
|
||||
add_header X-Frame-Options "DENY";
|
||||
|
||||
location /nginx_status {
|
||||
stub_status on;
|
||||
access_log off;
|
||||
allow 127.0.0.1;
|
||||
deny all;
|
||||
}
|
||||
|
||||
location /static/ {
|
||||
alias /var/lib/awx/public/static/;
|
||||
}
|
||||
|
||||
location /favicon.ico { alias /var/lib/awx/public/static/favicon.ico; }
|
||||
|
||||
location /websocket {
|
||||
# Pass request to the upstream alias
|
||||
proxy_pass http://daphne;
|
||||
# Require http version 1.1 to allow for upgrade requests
|
||||
proxy_http_version 1.1;
|
||||
# We want proxy_buffering off for proxying to websockets.
|
||||
proxy_buffering off;
|
||||
# http://en.wikipedia.org/wiki/X-Forwarded-For
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
# enable this if you use HTTPS:
|
||||
proxy_set_header X-Forwarded-Proto https;
|
||||
# pass the Host: header from the client for the sake of redirects
|
||||
proxy_set_header Host $http_host;
|
||||
# We've set the Host header, so we don't need Nginx to muddle
|
||||
# about with redirects
|
||||
proxy_redirect off;
|
||||
# Depending on the request value, set the Upgrade and
|
||||
# connection headers
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
}
|
||||
|
||||
location / {
|
||||
# Add trailing / if missing
|
||||
rewrite ^(.*)$http_host(.*[^/])$ $1$http_host$2/ permanent;
|
||||
uwsgi_read_timeout 120s;
|
||||
uwsgi_pass uwsgi;
|
||||
include /etc/nginx/uwsgi_params;
|
||||
{%- if extra_nginx_include is defined %}
|
||||
include {{ extra_nginx_include }};
|
||||
{%- endif %}
|
||||
proxy_set_header X-Forwarded-Port 443;
|
||||
uwsgi_param HTTP_X_FORWARDED_PORT 443;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
{{ item.item }}: '{{ lookup('vars', item.item, default='') or lookup('password', '/dev/null chars=ascii_letters') }}'
|
||||
@@ -0,0 +1 @@
|
||||
BROADCAST_WEBSOCKET_SECRET = "{{ broadcast_websocket_secret | b64encode }}"
|
||||
Reference in New Issue
Block a user