diff --git a/provisioning/roles/deploy_all/files/bin/omarustwebsite-dev b/provisioning/roles/deploy_all/files/bin/omarustwebsite-dev new file mode 100755 index 0000000..42dc461 Binary files /dev/null and b/provisioning/roles/deploy_all/files/bin/omarustwebsite-dev differ diff --git a/services/radiodemo.oma-radio.fr/.env b/services/radiodemo.oma-radio.fr/.env index 7a79b0c..c25c4ab 100644 --- a/services/radiodemo.oma-radio.fr/.env +++ b/services/radiodemo.oma-radio.fr/.env @@ -1,5 +1,15 @@ -GIT_SOURCE_REPO="git@gitlab.com:omaradio/website.git" -RADIO_HOST=mux.radiodemo.oma-radio.fr -USE_SSL=true WEBSOCKET_PORT=2004 -VUE_APP_PUBLIC_WEBSITE=radiodemo.oma-radio.fr +WEBSERVER=.105 +MUX=.100 +TELECOM=.101 +SWEBSOCKET_PORT=2004 +WEBSOCKET_PORT=2204 +MUX_SERVER_PORT=9004 +TELECOM_SERVER_PORT=3494 +OMA_DOCKER_VERSION=dev +ICECAST=.110 +SOUNDBASE_HOST=soundbase.radiodemo.oma-radio.fr +COMPOSE_NAME=muxradiodemooma-radiofr +DOCKER_INSTANCES_PREFIX=muxradiodemooma-radiofr- +DOCKER_INSTANCES_SUFIX=-1 +OMA_CONFIG_LogLevel=8 diff --git a/services/radiodemo.oma-radio.fr/deploy_user.sh b/services/radiodemo.oma-radio.fr/deploy_user.sh index 1ad3676..a94a997 100755 --- a/services/radiodemo.oma-radio.fr/deploy_user.sh +++ b/services/radiodemo.oma-radio.fr/deploy_user.sh @@ -1,16 +1,21 @@ #!/bin/bash + set -euo pipefail -# Si le site a déjà été build par le passé, curl termine l’exécution du script en cas d’absence sur serveur corps. -[ -f "$HTTP_DIR/public/index.html" ] && { curl -iI https://$RADIO_HOST/fic/_series-_index.fic >/dev/null || exit 0 ; } -# Update git repo -git_update.sh -d "$HTTP_DIR" -o "-i $SECRET_DIR/gitlab-deploy.sshprivkey" -r "${GIT_SOURCE_BRANCH:-main}" "$GIT_SOURCE_REPO" +if [ ! -e "$DATA_DIR/.env" ] ; then + source_pass="$(LC_ALL=C tr -dc A-Za-z0-9 "$DATA_DIR/.env" < ~/.ssh/authorized_keys <&1 | grep '200 OK' && wget http://127.0.0.1:8000/direct.mp3 -O - -t 1 -T 3 -S --spider 2>&1 | grep '200 OK'" + interval: 1h0m0s + timeout: 10s + retries: 3 + start_period: 1m0s + networks: + default: + ipv4_address: $NET$ICECAST + + system_api: + image: jeancloud/system-api:$OMA_DOCKER_VERSION + env_file: .env + environment: + UID: 33 + SOUNDBASE_PATH: /soundbase + MOUNT: /muxapi + CONFIG_PATH: /config + restart: unless-stopped + volumes: + - /tmp/uwsgi/$JC_SERVICE:/tmp/uwsgi + - /var/run/docker.sock:/var/run/docker.sock + - $DATA_DIR/soundbase:/soundbase + networks: + default: + ipv4_address: $NET.107 + deploy: + resources: + limits: + cpus: '0.50' + memory: 500M + +networks: + default: + ipam: + config: + - subnet: $NET.0/24 diff --git a/services/radiodemo.oma-radio.fr/nginx_server.conf b/services/radiodemo.oma-radio.fr/nginx_server.conf index 032bdd5..fac639b 100755 --- a/services/radiodemo.oma-radio.fr/nginx_server.conf +++ b/services/radiodemo.oma-radio.fr/nginx_server.conf @@ -1,26 +1,69 @@ -server { - listen 443 ssl http2; - listen [::]:443 ssl http2; - ssl_certificate $JC_CERT/fullchain.pem; - ssl_certificate_key $JC_CERT/privkey.pem; - server_name $JC_SERVICE www.$JC_SERVICE; - root $HTTP_DIR/public/; - - # Security headers - add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; - #add_header Content-Security-Policy "default-src 'none';frame-ancestors 'none'; script-src 'self' 'https://static.jean-cloud.net/player-interface/*' ; img-src 'self'; font-src 'self'; object-src 'none'; style-src 'self' 'https://static.jean-cloud.net/player-interface/*' 'https://cdn.jsdelivr.net/npm/*'; base-uri 'self'; form-action 'self';" always; - add_header X-Content-Type-Options "nosniff"; - add_header X-Frame-Options SAMEORIGIN always; - add_header X-XSS-Protection "1; mode=block" always; - add_header Referrer-Policy "strict-origin-when-cross-origin"; - add_header Permissions-Policy "geolocation='none';midi='none';notifications='none';push='none';microphone='none';camera='none';magnetometer='none';gyroscope='none';speaker='self';vibrate='none';fullscreen='self';payment='none';"; - - location / { - index index.html; - try_files $uri $uri/ =404; - } - - location /manager { - return 301 $scheme://mux.$JC_SERVICE/manager; - } +map $http_upgrade $connection_upgrade { + default upgrade; + '' close; +} + +server{ + listen $SWEBSOCKET_PORT ssl; + ssl_certificate $JC_CERT/fullchain.pem; + ssl_certificate_key $JC_CERT/privkey.pem; + + location / { + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_pass http://$NET$WEBSERVER:9000; + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_read_timeout 120s; + } +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name $JC_SERVICE mux.$JC_SERVICE; + ssl_certificate $JC_CERT/fullchain.pem; + ssl_certificate_key $JC_CERT/privkey.pem; + + location /soundbase { + alias "$DATA_DIR/soundbase"; + try_files $uri $uri/ =404; + } + + location / { + root "$DATA_DIR/soundbase/website"; + try_files $uri $uri/ =404; + } + + + location /direct.ogg { + client_max_body_size 0; + proxy_pass http://$NET$ICECAST:8000/direct.ogg; + # kill cache + add_header Last-Modified $date_gmt; + add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0'; + if_modified_since off; + expires off; + etag off; + } + location /direct.mp3 { + client_max_body_size 0; + proxy_pass http://$NET$ICECAST:8000/direct.mp3; + add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0'; + } + location /icecast/style.css { + client_max_body_size 0; + proxy_pass http://$NET$ICECAST:8000/style.css; + } + location /icecast/status.xsl { + client_max_body_size 0; + proxy_pass http://$NET$ICECAST:8000/status.xsl; + # kill cache + add_header Last-Modified $date_gmt; + add_header Cache-Control 'private no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0'; + if_modified_since off; + expires off; + etag off; + } } diff --git a/services/soundbase.radiodemo.oma-radio.fr/deploy_user.sh b/services/soundbase.radiodemo.oma-radio.fr/deploy_user.sh index 6b583b8..6ab7041 100755 --- a/services/soundbase.radiodemo.oma-radio.fr/deploy_user.sh +++ b/services/soundbase.radiodemo.oma-radio.fr/deploy_user.sh @@ -1,11 +1,43 @@ #!/bin/bash +set -euo pipefail + + + +# Add ssh fingerprint +mkdir -p ~/.ssh +cat > ~/.ssh/known_hosts <&1 >>/tmp/jc_log/$JC_SERVICE.lsyncd.log & diff --git a/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml b/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml index 9980ea6..e49840a 100644 --- a/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml +++ b/services/soundbase.radiodemo.oma-radio.fr/docker-compose.yml @@ -1,14 +1,13 @@ version: '3' services: - anthracite_jukebox: + jukebox: image: registry.gitlab.com/omaradio/core/oma-jukebox:$OMA_DOCKER_VERSION env_file: .env environment: - OMA_CONFIG_Client1Host: mux.radiodemo.oma-radio.fr + OMA_CONFIG_TelecommandeHost: $RADIO_HOST + OMA_CONFIG_TelecommandePort: $TELECOM_SERVER_PORT + OMA_CONFIG_Client1Host: $RADIO_HOST OMA_CONFIG_Client1Port: $MUX_SERVER_PORT - OMA_CONFIG_Client2: off - OMA_CONFIG_Client2Host: radionimaitre.oma-radio.fr - OMA_CONFIG_Client2Port: 9003 volumes: - $SOUNDBASE_DIR:/app/soundBase - $SOUNDBASE_DIR/secours/JingleDemo-Secours.wavM:/app/secours/secours-jingle.wavM @@ -23,30 +22,12 @@ services: cpus: '1' memory: 100M - azurite_jukebox_simulator: - image: registry.gitlab.com/omaradio/core/oma-jukebox-simulator:$OMA_DOCKER_VERSION - env_file: .env - volumes: - - $SOUNDBASE_DIR:/app/soundBase - restart: unless-stopped - networks: - default: - ipv4_address: $NET.103 - deploy: - resources: - limits: - cpus: '0.50' - memory: 100M - - # aventurine_transcode: - # image: jeancloud/transcode:$OMA_DOCKER_VERSION - # env_file: .env - # restart: unless-stopped - - - agate_importer: - image: registry.gitlab.com/omaradio/core/oma-baseimport:$OMA_DOCKER_VERSION + + importer: + image: registry.gitlab.com/omaradio/core/oma-base-import:$OMA_DOCKER_VERSION env_file: .env + environment: + OMA_CONFIG_TelecommandeHost: $RADIO_HOST volumes: - $SOUNDBASE_DIR:/app/soundBase stop_grace_period: 1m30s @@ -58,12 +39,14 @@ services: resources: limits: cpus: '0.50' - memory: 500M + memory: 1000M - rubis_base_mg: + basemg: image: registry.gitlab.com/omaradio/core/oma-base-mg:$OMA_DOCKER_VERSION env_file: .env + environment: + OMA_CONFIG_TelecommandeHost: $RADIO_HOST restart: unless-stopped volumes: - $SOUNDBASE_DIR:/soundbase @@ -78,9 +61,10 @@ services: system_api: - image: jeancloud/system-api:dev + image: jeancloud/system-api:$OMA_DOCKER_VERSION env_file: .env environment: + OMA_CONFIG_TelecommandeHost: $RADIO_HOST UID: 33 SOUNDBASE_PATH: /soundbase MOUNT: /api @@ -99,32 +83,6 @@ services: cpus: '0.50' memory: 500M - - #ammolite_mp3_addon: - # image: jeancloud/mp3addon:$OMA_DOCKER_VERSION - # env_file: .env - # environment: - # OMA_CONFIG_PigePrefix: /opt - # restart: unless-stopped - # volumes: - # - $SOUNDBASE_DIR:/app/soundbase - # networks: - # default: - # ipv4_address: $NET.109 - # deploy: - # resources: - # limits: - # cpus: '0.05' - - # doxy: - # image: qnib/doxy - # volumes: - # - /tmp/radiodemo.oma-radio.fr/doxy:/tmp/doxy - # - /data/radiodemo.oma-radio.fr/doxy.pattern:/etc/doxy.pattern - # - /var/run/docker.sock:/var/run/docker.sock - # environment: - # DOXY_PROXY_SOCKET: /tmp/doxy/doxy.sock - networks: default: ipam: diff --git a/services/soundbase.radiodemo.oma-radio.fr/lsyncd.conf b/services/soundbase.radiodemo.oma-radio.fr/lsyncd.conf new file mode 100644 index 0000000..b7d334c --- /dev/null +++ b/services/soundbase.radiodemo.oma-radio.fr/lsyncd.conf @@ -0,0 +1,21 @@ +settings { + logfile = "/tmp/lsyncd.log", + statusFile = "/tmp/lsyncd.status", + nodaemon = true, +} + +sync { + default.rsyncssh, + source = "/data/soundbase.radiodemo.oma-radio.fr/soundbase", + host = "radiodemo.oma-radio.fr@radiodemo.oma-radio.fr", + targetdir = "/data/radiodemo.oma-radio.fr/soundbase", + exclude = {'/wav*', '/png/', '/jpg*', '/png*', '/txt/', '/webpH/', '/import*', '/fic', '/bonus*', '/prg/', '/secours/', '/statique/', '/tmp/', '/cart/', 'cfg_*', '/readme.md', '/mp3/', '/lst/', '/groups.json', '/users.htpasswd'}, + ssh = { + identityFile = "~/.ssh/synchro_tete.sshkey", + port = 45985, + }, + -- need 2.3.0 -- daily sync + --crontab = { + -- "11 11 4 * * *", + --}, +} diff --git a/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf b/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf index 6a687f7..1133752 100644 --- a/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf +++ b/services/soundbase.radiodemo.oma-radio.fr/nginx_server.conf @@ -16,16 +16,29 @@ server { - listen 80; - listen [::]:80; + listen 443 ssl; + listen [::]:443 ssl; server_name $JC_SERVICE; - root $SOUNDBASE_DIR/website; - index index.html; + ssl_certificate $JC_CERT/fullchain.pem; + ssl_certificate_key $JC_CERT/privkey.pem; - location ~ /api(/.*) { + root $SOUNDBASE_DIR; + index index.html; auth_basic "Entrez votre identifiant et mot de passe"; auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; + + location /soundbase { + alias "$DATA_DIR/soundbase"; + try_files $uri $uri/ =404; + } + + location / { + root "$DATA_DIR/soundbase/website"; + try_files $uri $uri/ =404; + } + + location ~ /api(/.*) { include uwsgi_params; uwsgi_param PATH_INFO "$1"; uwsgi_param SCRIPT_NAME /api; @@ -43,77 +56,5 @@ server { etag off; } - location /pige{ - alias $SOUNDBASE_DIR/pige; - try_files $uri $uri/ =404; - } - location /png { - alias $SOUNDBASE_DIR/png; - try_files $uri $uri/ =404; - } - location /webpL { - alias $SOUNDBASE_DIR/webpL; - try_files $uri $uri/ =404; - } - location /webpH { - alias $SOUNDBASE_DIR/webpH; - try_files $uri $uri/ =404; - } - location /ogg { - alias $SOUNDBASE_DIR/ogg; - try_files $uri $uri/ =404; - } - location /txt { - alias $SOUNDBASE_DIR/txt; - try_files $uri $uri/ =404; - } - location /wavM { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/wavM; - try_files $uri $uri/ =404; - } - location /import { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/import; - try_files $uri $uri/ =404; - } - location /export { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/export; - try_files $uri $uri/ =404; - } - location /wav { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/wav; - try_files $uri $uri/ =404; - } - location /fic { - add_header Cache-Control 'must-revalidate, proxy-revalidate'; - alias $SOUNDBASE_DIR/fic; - try_files $uri $uri/ =404; - } - location /prg { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/prg; - try_files $uri $uri/ =404; - } - location /lst { - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - alias $SOUNDBASE_DIR/lst; - try_files $uri $uri/ =404; - } - # Admin interface - location /manager { - alias $HTTP_DIR/manager/dist; - auth_basic "Entrez votre identifiant et mot de passe"; - auth_basic_user_file $SOUNDBASE_DIR/users.htpasswd; - try_files $uri $uri/ =404; - } }