publish -> link -> read testattu "e2e"

port forward, local publish ja luettu tämän repon linkin luomisen mallisella url julkaistu raportti
2026-06-28 05:27:42 +03:00
parent 5e2c50d67e
commit 179f6a1b43
41 changed files with 638 additions and 1829 deletions
@@ -0,0 +1,19 @@
+Nginx + upload-sidecar installed.
+
+See docs/secrets.md for secret prerequisites (K8s + Gitea Actions).
+
+Install:
+  helm upgrade --install git-pages ./git-pages -n {{ .Release.Namespace }} --create-namespace -f dev-values.yaml
+
+Host:     https://{{ .Values.ingress.host }}
+Reports:  https://{{ .Values.ingress.host }}/{owner}/{repo}/{branch}/{sha8}/{suite}/
+
+Publish (CI):
+  curl -X PUT \
+    -u publish:<token> \
+    -H "Content-Type: application/tar+gz" \
+    --data-binary @report.tar.gz \
+    https://{{ .Values.ingress.host }}/{owner}/{repo}/{branch}/{sha8}/{suite}/
+
+Upgrade:   helm upgrade {{ .Release.Name }} ./git-pages -n {{ .Release.Namespace }} -f dev-values.yaml
+Uninstall: helm uninstall {{ .Release.Name }} -n {{ .Release.Namespace }}
@@ -0,0 +1,39 @@
+{{- define "git-pages.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "git-pages.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "git-pages.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "git-pages.labels" -}}
+helm.sh/chart: {{ include "git-pages.chart" . }}
+{{ include "git-pages.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "git-pages.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "git-pages.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{- define "git-pages.componentLabels" -}}
+{{ include "git-pages.labels" . }}
+app.kubernetes.io/component: pages-server
+{{- end }}
@@ -0,0 +1,15 @@
+{{- if and .Values.ingress.enabled .Values.certificate.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "git-pages.fullname" . }}-tls
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  secretName: git-pages-tls
+  dnsNames:
+    - {{ .Values.ingress.host | quote }}
+  issuerRef:
+    name: {{ .Values.certificate.issuerRef.name }}
+    kind: {{ .Values.certificate.issuerRef.kind }}
+{{- end }}
@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "git-pages.fullname" . }}-config
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+data:
+  default.conf: |
+    client_max_body_size {{ .Values.nginx.bodySize }};
+
+    server {
+        listen {{ .Values.nginx.port }};
+        root /app/data;
+        autoindex on;
+        client_max_body_size {{ .Values.nginx.bodySize }};
+
+        location / {
+            try_files $uri $uri/ $uri/index.html =404;
+        }
+    }
+  upload-server.py: |
+    #!/usr/bin/env python3
+    import http.server, os, sys, tarfile, io
+
+    PORT = int(os.environ.get("UPLOAD_PORT", "8081"))
+    DATA_ROOT = "/app/data"
+
+    class Handler(http.server.BaseHTTPRequestHandler):
+        def do_PUT(self):
+            dest = DATA_ROOT + self.path.rstrip("/")
+            os.makedirs(dest, exist_ok=True)
+            length = int(self.headers.get("Content-Length", 0))
+            body = self.rfile.read(length)
+            with tarfile.open(fileobj=io.BytesIO(body), mode="r:gz") as tar:
+                tar.extractall(dest)
+            self.send_response(201)
+            self.end_headers()
+
+        def log_message(self, fmt, *args):
+            sys.stderr.write("%s - %s\n" % (self.client_address[0], fmt % args))
+
+    http.server.HTTPServer(("", PORT), Handler).serve_forever()
@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "git-pages.fullname" . }}
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "git-pages.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "git-pages.componentLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        fsGroup: 1000
+      containers:
+        - name: nginx
+          image: "{{ .Values.nginx.image }}:{{ .Values.nginx.tag }}"
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http-read
+              containerPort: {{ .Values.nginx.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/conf.d
+              readOnly: true
+            {{- if .Values.persistence.enabled }}
+            - name: data
+              mountPath: /app/data
+            {{- end }}
+          resources:
+            {{- toYaml .Values.nginx.resources | nindent 12 }}
+        - name: upload
+          image: "{{ .Values.upload.image }}:{{ .Values.upload.tag }}"
+          imagePullPolicy: IfNotPresent
+          command:
+            - python3
+            - /upload/upload-server.py
+          ports:
+            - name: http-write
+              containerPort: {{ .Values.upload.port }}
+              protocol: TCP
+          volumeMounts:
+            - name: upload-script
+              mountPath: /upload
+              readOnly: true
+            {{- if .Values.persistence.enabled }}
+            - name: data
+              mountPath: /app/data
+            {{- end }}
+          resources:
+            {{- toYaml .Values.upload.resources | nindent 12 }}
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: {{ include "git-pages.fullname" . }}-config
+            items:
+              - key: default.conf
+                path: default.conf
+        - name: upload-script
+          configMap:
+            name: {{ include "git-pages.fullname" . }}-config
+            defaultMode: 0755
+            items:
+              - key: upload-server.py
+                path: upload-server.py
+        {{- if .Values.persistence.enabled }}
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ include "git-pages.fullname" . }}-data
+        {{- end }}
@@ -0,0 +1,48 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ include "git-pages.fullname" . }}
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - {{ .Values.ingress.entryPoints.websecure }}
+  routes:
+    - match: >-
+        Host(`{{ .Values.ingress.host }}`) &&
+        (Method(`PATCH`) || Method(`PUT`))
+      kind: Rule
+      middlewares:
+        - name: {{ include "git-pages.fullname" . }}-publish-auth
+      services:
+        - name: {{ include "git-pages.fullname" . }}
+          port: {{ .Values.upload.port }}
+    - match: Host(`{{ .Values.ingress.host }}`) && (Method(`GET`) || Method(`HEAD`))
+      kind: Rule
+      services:
+        - name: {{ include "git-pages.fullname" . }}
+          port: {{ .Values.nginx.port }}
+  tls:
+    secretName: git-pages-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ include "git-pages.fullname" . }}-http
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  entryPoints:
+    - {{ .Values.ingress.entryPoints.web }}
+  routes:
+    - match: >-
+        Host(`{{ .Values.ingress.host }}`) &&
+        !PathPrefix(`/.well-known/acme-challenge/`)
+      kind: Rule
+      middlewares:
+        - name: {{ include "git-pages.fullname" . }}-https-redirect
+      services:
+        - name: {{ include "git-pages.fullname" . }}
+          port: {{ .Values.nginx.port }}
+{{- end }}
@@ -0,0 +1,22 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ include "git-pages.fullname" . }}-publish-auth
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  basicAuth:
+    secret: git-pages-publish-auth
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ include "git-pages.fullname" . }}-https-redirect
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+{{- end }}
@@ -0,0 +1,12 @@
+{{- if and .Values.publishAuth.create .Values.publishAuth.htpasswdUsers }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: git-pages-publish-auth
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+type: Opaque
+stringData:
+  users: |
+    {{ .Values.publishAuth.htpasswdUsers }}
+{{- end }}
@@ -0,0 +1,17 @@
+{{- if .Values.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "git-pages.fullname" . }}-data
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode }}
+  {{- if .Values.persistence.storageClass }}
+  storageClassName: {{ .Values.persistence.storageClass | quote }}
+  {{- end }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size }}
+{{- end }}
@@ -0,0 +1,17 @@
+{{- if and .Values.persistence.enabled .Values.retention.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: git-pages-retention
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+data:
+  retention.json: |
+    {{- .Values.retention.rules | toJson | nindent 4 }}
+  retention-lib.sh: |
+    {{- .Files.Get "files/retention-lib.sh" | nindent 4 }}
+  retention-cleanup.sh: |
+    {{- .Files.Get "files/retention-cleanup.sh" | nindent 4 }}
+  retention-run.sh: |
+    {{- .Files.Get "files/retention-run.sh" | nindent 4 }}
+{{- end }}
@@ -0,0 +1,72 @@
+{{- if and .Values.persistence.enabled .Values.retention.enabled (eq .Values.retention.mode "cronjob") }}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: git-pages-retention
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  schedule: {{ .Values.retention.schedule | quote }}
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: git-pages-retention
+            app.kubernetes.io/instance: {{ .Release.Name }}
+        spec:
+          serviceAccountName: git-pages-retention
+          restartPolicy: OnFailure
+          containers:
+            - name: retention
+              image: "{{ .Values.retention.image.repository }}:{{ .Values.retention.image.tag }}"
+              imagePullPolicy: {{ .Values.retention.image.pullPolicy }}
+              securityContext:
+                runAsUser: 0
+              command:
+                - bash
+                - -c
+                - |
+                  set -euo pipefail
+                  apt-get update -qq
+                  apt-get install -y --no-install-recommends curl jq >/dev/null
+                  chmod +x /scripts/retention-run.sh
+                  /scripts/retention-run.sh
+              env:
+                - name: DATA_ROOT
+                  value: /app/data
+                - name: RETENTION_CONFIG
+                  value: /etc/retention/retention.json
+                - name: GITEA_API_URL
+                  value: {{ required "retention.giteaApiUrl is required" .Values.retention.giteaApiUrl | quote }}
+                - name: GITEA_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: git-pages-retention-gitea
+                      key: token
+              volumeMounts:
+                - name: data
+                  mountPath: /app/data
+                - name: scripts
+                  mountPath: /scripts
+                - name: config
+                  mountPath: /etc/retention
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: {{ include "git-pages.fullname" . }}-data
+            - name: scripts
+              configMap:
+                name: git-pages-retention
+                defaultMode: 0755
+            - name: config
+              configMap:
+                name: git-pages-retention
+                items:
+                  - key: retention.json
+                    path: retention.json
+{{- end }}
@@ -0,0 +1,37 @@
+{{- if and .Values.persistence.enabled .Values.retention.enabled (eq .Values.retention.mode "cronjob") }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: git-pages-retention
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: git-pages-retention
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments", "deployments/scale"]
+    verbs: ["get", "patch", "update"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: git-pages-retention
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: git-pages-retention
+subjects:
+  - kind: ServiceAccount
+    name: git-pages-retention
+    namespace: {{ .Release.Namespace }}
+{{- end }}
@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "git-pages.fullname" . }}
+  labels:
+    {{- include "git-pages.componentLabels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  selector:
+    {{- include "git-pages.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http-read
+      port: {{ .Values.nginx.port }}
+      targetPort: http-read
+      protocol: TCP
+    - name: http-write
+      port: {{ .Values.upload.port }}
+      targetPort: http-write
+      protocol: TCP