services/cojedzie/stack.yml

@@ -1,19 +1,8 @@
 version: "{{ compose_version }}"
 
-x-defaults: 
-  worker: &worker
-    image: {{ cojedzie_image_base }}/worker:{{ cojedzie_worker_version }}
-    env_file:
-      - ./api.env
-      - ./sentry.env
-    volumes:
-      - db_data:/var/db
-    depends_on:
-      - api
-
 services:
   api:
-    image: {{ cojedzie_image_base }}/api:{{ cojedzie_api_version }}
+    image: {{ cojedzie_image_base }}/api:{{ cojedzie_version }}
     networks:
       - "{{ ingress_network }}"
       - default
@@ -38,14 +27,25 @@ services:
         - traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
         - traefik.http.services.{{ service }}-api.loadbalancer.server.port=8080
 
-  schedule:
+  cron:
-    <<: *worker
+    image: {{ cojedzie_image_base }}/cron:{{ cojedzie_version }}
-    environment:
+    env_file:
-      COJEDZIE_WORKER_OPTS: '-vv'
+      - ./api.env
-      COJEDZIE_WORKER_QUEUES: 'scheduler_default scheduler_hub'
+      - ./sentry.env
+    volumes:
+      - db_data:/var/db
+    depends_on:
+      - api
 
   worker:
-    <<: *worker
+    image: {{ cojedzie_image_base }}/worker:{{ cojedzie_version }}
+    env_file:
+      - ./api.env
+      - ./sentry.env
+    volumes:
+      - db_data:/var/db
+    depends_on:
+      - api
 
   mercure:
     image: dunglas/mercure:{{ cojedzie_mercure_version|default('latest') }}
@@ -71,7 +71,7 @@ services:
         - traefik.http.services.{{ service }}-mercure.loadbalancer.server.port=80
 
   front:
-    image: {{ cojedzie_image_base }}/front:{{ cojedzie_front_version }}
+    image: {{ cojedzie_image_base }}/front:{{ cojedzie_version }}
     networks:
       - "{{ ingress_network }}"
       - default

services/cojedzie/tasks/pre-deploy.yaml

@@ -6,9 +6,10 @@
     source: pull
     force_source: yes
   with_items:
-    - "{{ cojedzie_image_base }}/front:{{ cojedzie_front_version }}"
+    - "{{ cojedzie_image_base }}/front:{{ cojedzie_version }}"
-    - "{{ cojedzie_image_base }}/api:{{ cojedzie_api_version }}"
+    - "{{ cojedzie_image_base }}/api:{{ cojedzie_version }}"
-    - "{{ cojedzie_image_base }}/worker:{{ cojedzie_worker_version }}"
+    - "{{ cojedzie_image_base }}/worker:{{ cojedzie_version }}"
+    - "{{ cojedzie_image_base }}/cron:{{ cojedzie_version }}"
   loop_control:
     loop_var: image
   notify:

services/cojedzie/templates/api.env

@@ -2,7 +2,7 @@ MERCURE_URL=http://mercure/.well-known/mercure
 MERCURE_PUBLIC_URL=https://{{ cojedzie_domain }}/.well-known/mercure
 MERCURE_JWT_SECRET={{ cojedzie_mercure_jwt_key }}
 
-DATABASE_URL=mysql://{{ cojedzie_database.user }}:{{ cojedzie_database.password }}@{{ database_mysql_host }}/{{ cojedzie_database.name }}
+DATABASE_URL=mysql://{{ cojedzie_database.user }}:{{ cojedzie_database.password }}@{{ database_mysql_host }}/{{ cojedzie_database.name }}?serverVersion=mariadb-10.7.1
 
 SENTRY_DSN={{ sentry_dsn_api }}
 SENTRY_SAMPLE_RATE={{ sentry_sample_rate_api }}

services/cojedzie/vars/main.yml

@@ -13,9 +13,6 @@ cojedzie_mercure_jwt_key: !vault |
 cojedzie_maptiler: 8GX5FRUNgk4lB83GZT8Q
 cojedzie_image_base: docker.io/cojedzie
 cojedzie_version: latest
-cojedzie_front_version: "{{ cojedzie_version }}"
-cojedzie_api_version: "{{ cojedzie_version }}"
-cojedzie_worker_version: "{{ cojedzie_version }}"
 sentry_dsn_api: https://fd114053dd724e0eb16011ac0da16ba1@o4505224124891136.ingest.sentry.io/4505224126332928
 sentry_dsn_front: https://2815d4e0251240fcb9cd8c81c31e86fe@o4505224124891136.ingest.sentry.io/4505224128233472
 sentry_sample_rate_api: 0.05

services/registry/config/config.yml

@@ -11,7 +11,7 @@ storage:
   {{ registry_storage|to_nice_yaml(indent=2, width=140)|indent(2) }}
 
 redis:
-  addrs: [redis:6379]
+  addr: redis:6379
 
 http:
   addr: :5000

services/registry/stack.yml

@@ -9,28 +9,20 @@ services:
           memory: 256M
 
   registry:
-    image: registry:3.0.0
+    image: registry:2
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/distribution/config.yml
+        target: /etc/docker/registry/config.yml
     environment:
       - REGISTRY_STORAGE_DELETE_ENABLED=true
     deploy:
       placement:
         constraints:
           - node.role == manager
-      labels:
+    networks: ['default']
-        - traefik.enable=true
-        - traefik.http.routers.{{ service }}-api.rule=Host(`{{ service }}.{{ main_domain }}`) && PathPrefix(`/v2`)
-        - traefik.http.routers.{{ service }}-api.priority=100
-        - traefik.http.routers.{{ service }}-api.tls=true
-        - traefik.http.routers.{{ service }}-api.tls.certresolver=lets-encrypt
-        - traefik.http.routers.{{ service }}-api.service={{ service }}-api
-        - traefik.http.services.{{ service }}-api.loadbalancer.server.port=5000
-    networks: ['{{ ingress_network }}', 'default']
 
   ui:
     image: joxit/docker-registry-ui:2.5.6
@@ -50,14 +42,14 @@ services:
     networks: ['{{ ingress_network }}', 'default']
 
   image-cleanup-job:
-    image: registry:3.0.0
+    image: registry:2
-    command: ["registry", "garbage-collect", "/etc/distribution/config.yml", "-m"]
+    command: ["registry", "garbage-collect", "/etc/docker/registry/config.yml", "-m"]
     secrets:
       - source: htpasswd_{{ registry_htpasswd.stat.checksum }}
         target: /etc/docker/registry/htpasswd
     configs:
       - source: registry_{{ registry_config.checksum }}
-        target: /etc/distribution/config.yml
+        target: /etc/docker/registry/config.yml
     deploy:
       placement:
         constraints:

services/registry/tasks/config.yml

@@ -7,17 +7,16 @@
   tags:
     - config
 
-# Registry checks the bcrypt hash on every request, so a low cost keeps it fast.
-# Salt is derived from the user name to keep the file stable between runs.
 - name: 'Generate passwords file for "{{ service }}"'
-  ansible.builtin.copy:
+  community.general.htpasswd:
-    dest: "{{ remote_service_path }}/config/htpasswd"
+    path: "{{ remote_service_path }}/config/htpasswd"
-    content: |
+    name: "{{ registry_user.name }}"
-      {% for registry_user in registry_users %}
+    crypt_scheme: bcrypt
-      {{ registry_user.name }}:{{ registry_user.password | password_hash('bcrypt', salt=((service ~ ':' ~ registry_user.name) | hash('sha256'))[:22], rounds=registry_bcrypt_rounds) }}
+    password: "{{ registry_user.password }}"
-      {% endfor %}
+  loop: "{{ registry_users }}"
-    mode: "0600"
+  loop_control:
-  no_log: true
+    loop_var: registry_user
+    label: "{{ registry_user.name }}"
   tags:
     - config
 

services/registry/vars/main.yml

@@ -1,2 +0,0 @@
----
-registry_bcrypt_rounds: 5

vars/services.yml

@@ -180,10 +180,7 @@ service_config:
       62643132313336356365313465353263626565616434633963343764653330316566613633633638
       623838613832393239343036396439383561
   cojedzie:
-    # releases are deployed by CI pinned by digest, see the Release workflow in cojedzie/cojedzie;
+    cojedzie_version: "2023.1.5"
-    # full playbook runs fall back to the latest release
-    cojedzie_version: latest
-    cojedzie_image_base: registry.kadet.net/cojedzie
     cojedzie_gtm: GTM-TQNX386
 
     cojedzie_database: