jane remover
Some checks failed
Docker image builds / build (push) Waiting to run
Asset Build Verification / asset_verification (push) Has been cancelled
Docs deploy / build (push) Has been cancelled
Go Mod Tidy Check / go_mod_tidy_check (push) Has been cancelled
Go / go_tests (push) Has been cancelled
Package builds (unstable) / package_builds (push) Has been cancelled
Smoke tests / smoke-test (default-config-macro) (push) Has been cancelled
Smoke tests / smoke-test (docker-registry) (push) Has been cancelled
Smoke tests / smoke-test (double_slash) (push) Has been cancelled
Smoke tests / smoke-test (forced-language) (push) Has been cancelled
Smoke tests / smoke-test (git-clone) (push) Has been cancelled
Smoke tests / smoke-test (git-push) (push) Has been cancelled
Smoke tests / smoke-test (healthcheck) (push) Has been cancelled
Smoke tests / smoke-test (i18n) (push) Has been cancelled
Smoke tests / smoke-test (log-file) (push) Has been cancelled
Smoke tests / smoke-test (nginx) (push) Has been cancelled
Smoke tests / smoke-test (palemoon/amd64) (push) Has been cancelled
Smoke tests / smoke-test (robots_txt) (push) Has been cancelled
Check Spelling / Check Spelling (push) Has been cancelled
SSH CI / ssh (aarch64-16k) (push) Has been cancelled
SSH CI / ssh (aarch64-4k) (push) Has been cancelled
SSH CI / ssh (ppc64le) (push) Has been cancelled
SSH CI / ssh (riscv64) (push) Has been cancelled
zizmor / zizmor latest via PyPI (push) Has been cancelled
Some checks failed
Docker image builds / build (push) Waiting to run
Asset Build Verification / asset_verification (push) Has been cancelled
Docs deploy / build (push) Has been cancelled
Go Mod Tidy Check / go_mod_tidy_check (push) Has been cancelled
Go / go_tests (push) Has been cancelled
Package builds (unstable) / package_builds (push) Has been cancelled
Smoke tests / smoke-test (default-config-macro) (push) Has been cancelled
Smoke tests / smoke-test (docker-registry) (push) Has been cancelled
Smoke tests / smoke-test (double_slash) (push) Has been cancelled
Smoke tests / smoke-test (forced-language) (push) Has been cancelled
Smoke tests / smoke-test (git-clone) (push) Has been cancelled
Smoke tests / smoke-test (git-push) (push) Has been cancelled
Smoke tests / smoke-test (healthcheck) (push) Has been cancelled
Smoke tests / smoke-test (i18n) (push) Has been cancelled
Smoke tests / smoke-test (log-file) (push) Has been cancelled
Smoke tests / smoke-test (nginx) (push) Has been cancelled
Smoke tests / smoke-test (palemoon/amd64) (push) Has been cancelled
Smoke tests / smoke-test (robots_txt) (push) Has been cancelled
Check Spelling / Check Spelling (push) Has been cancelled
SSH CI / ssh (aarch64-16k) (push) Has been cancelled
SSH CI / ssh (aarch64-4k) (push) Has been cancelled
SSH CI / ssh (ppc64le) (push) Has been cancelled
SSH CI / ssh (riscv64) (push) Has been cancelled
zizmor / zizmor latest via PyPI (push) Has been cancelled
This commit is contained in:
parent
d2205b11a7
commit
896858e027
332 changed files with 1482 additions and 33742 deletions
|
|
@ -1,14 +1,14 @@
|
|||
:80 {
|
||||
reverse_proxy http://anubis:3000 {
|
||||
reverse_proxy http://nuke:3000 {
|
||||
header_up X-Real-Ip {remote_host}
|
||||
header_up X-Http-Version {http.request.proto}
|
||||
}
|
||||
}
|
||||
|
||||
:443 {
|
||||
tls /etc/techaro/pki/caddy.local.cetacean.club/cert.pem /etc/techaro/pki/caddy.local.cetacean.club/key.pem
|
||||
tls /etc/sad.ovh/pki/caddy.local.cetacean.club/cert.pem /etc/sad.ovh/pki/caddy.local.cetacean.club/key.pem
|
||||
|
||||
reverse_proxy http://anubis:3000 {
|
||||
reverse_proxy http://nuke:3000 {
|
||||
header_up X-Real-Ip {remote_host}
|
||||
header_up X-Http-Version {http.request.proto}
|
||||
header_up X-Tls-Version {http.request.tls.version}
|
||||
|
|
|
|||
|
|
@ -6,16 +6,16 @@ services:
|
|||
- 8080:80
|
||||
- 8443:443
|
||||
volumes:
|
||||
- "../pki/caddy.local.cetacean.club:/etc/techaro/pki/caddy.local.cetacean.club/"
|
||||
- "../pki/caddy.local.cetacean.club:/etc/sad.ovh/pki/caddy.local.cetacean.club/"
|
||||
|
||||
anubis:
|
||||
image: ghcr.io/techarohq/anubis:main
|
||||
nuke:
|
||||
image: git.sad.ovh/sophie/nuke:main
|
||||
environment:
|
||||
BIND: ":3000"
|
||||
TARGET: http://httpdebug:3000
|
||||
POLICY_FNAME: /etc/techaro/anubis/less_paranoid.yaml
|
||||
POLICY_FNAME: /etc/sad.ovh/nuke/less_paranoid.yaml
|
||||
volumes:
|
||||
- ../anubis_configs:/etc/techaro/anubis
|
||||
- ../nuke_configs:/etc/sad.ovh/nuke
|
||||
|
||||
httpdebug:
|
||||
image: ghcr.io/xe/x/httpdebug
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ import (
|
|||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/TecharoHQ/anubis/test/cmd/cipra/internal"
|
||||
"git.sad.ovh/sophie/nuke/test/cmd/cipra/internal"
|
||||
"github.com/facebookgo/flagenv"
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ import (
|
|||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/TecharoHQ/anubis/internal"
|
||||
"git.sad.ovh/sophie/nuke/internal"
|
||||
"github.com/facebookgo/flagenv"
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ import (
|
|||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/TecharoHQ/anubis/internal"
|
||||
"git.sad.ovh/sophie/nuke/internal"
|
||||
"github.com/facebookgo/flagenv"
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -7,24 +7,24 @@ services:
|
|||
image: ghcr.io/xe/x/relayd
|
||||
pull_policy: always
|
||||
environment:
|
||||
CERT_DIR: /etc/techaro/pki/registry.local.cetacean.club
|
||||
CERT_DIR: /etc/sad.ovh/pki/registry.local.cetacean.club
|
||||
CERT_FNAME: cert.pem
|
||||
KEY_FNAME: key.pem
|
||||
PROXY_TO: http://anubis:3000
|
||||
PROXY_TO: http://nuke:3000
|
||||
ports:
|
||||
- 3004:3004
|
||||
volumes:
|
||||
- ./pki/registry.local.cetacean.club:/etc/techaro/pki/registry.local.cetacean.club
|
||||
- ./pki/registry.local.cetacean.club:/etc/sad.ovh/pki/registry.local.cetacean.club
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
restart: always
|
||||
environment:
|
||||
BIND: ":3000"
|
||||
TARGET: http://registry:5000
|
||||
POLICY_FNAME: /etc/techaro/anubis.yaml
|
||||
POLICY_FNAME: /etc/sad.ovh/nuke.yaml
|
||||
USE_REMOTE_ADDRESS: "true"
|
||||
ports:
|
||||
- 3000
|
||||
volumes:
|
||||
- ./anubis.yaml:/etc/techaro/anubis.yaml
|
||||
- ./nuke.yaml:/etc/sad.ovh/nuke.yaml
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ set -u
|
|||
|
||||
source ../lib/lib.sh
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
|
||||
function cleanup() {
|
||||
docker compose down
|
||||
|
|
|
|||
|
|
@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
|
|||
# Build static assets
|
||||
(cd ../.. && npm ci && npm run assets)
|
||||
|
||||
go tool anubis --help 2>/dev/null || :
|
||||
go tool nuke --help 2>/dev/null || :
|
||||
|
||||
go run ../cmd/httpdebug &
|
||||
|
||||
go tool anubis \
|
||||
--policy-fname ./anubis.yaml \
|
||||
go tool nuke \
|
||||
--policy-fname ./nuke.yaml \
|
||||
--use-remote-address \
|
||||
--target=http://localhost:3923 &
|
||||
|
||||
|
|
|
|||
|
|
@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
|
|||
# Build static assets
|
||||
(cd ../.. && npm ci && npm run assets)
|
||||
|
||||
go tool anubis --help 2>/dev/null ||:
|
||||
go tool nuke --help 2>/dev/null ||:
|
||||
|
||||
go run ../cmd/unixhttpd &
|
||||
|
||||
FORCED_LANGUAGE=de go tool anubis \
|
||||
--policy-fname ./anubis.yaml \
|
||||
FORCED_LANGUAGE=de go tool nuke \
|
||||
--policy-fname ./nuke.yaml \
|
||||
--use-remote-address \
|
||||
--target=unix://$(pwd)/unixhttpd.sock &
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ services:
|
|||
volumes:
|
||||
- ./var/repos:/srv/git
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
environment:
|
||||
BIND: ":8005"
|
||||
TARGET: http://cgit:80
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ set -u
|
|||
|
||||
source ../lib/lib.sh
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
|
||||
rm -rf ./var/repos ./var/clones
|
||||
mkdir -p ./var/repos ./var/clones
|
||||
|
|
@ -22,4 +22,4 @@ sleep 2
|
|||
|
||||
(cd ./var/clones && git clone http://localhost:8005/status.git)
|
||||
|
||||
exit 0
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ services:
|
|||
volumes:
|
||||
- ./var/repos:/git
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
environment:
|
||||
BIND: ":3000"
|
||||
TARGET: http://git:80
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ set -u
|
|||
|
||||
source ../lib/lib.sh
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
|
||||
rm -rf ./var/repos ./var/foo
|
||||
mkdir -p ./var/repos
|
||||
|
|
@ -27,8 +27,8 @@ sleep 2
|
|||
git init &&
|
||||
touch README &&
|
||||
git add . &&
|
||||
git config user.name "Anubis CI" &&
|
||||
git config user.email "social+anubis-ci@techaro.lol" &&
|
||||
git config user.name "Nuke CI" &&
|
||||
git config user.email "nuke-ci@sad.ovh" &&
|
||||
git commit -sm "initial commit" &&
|
||||
git push -u http://localhost:3000/git/foo.git master
|
||||
)
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
module github.com/TecharoHQ/anubis/test
|
||||
module git.sad.ovh/sophie/nuke/test
|
||||
|
||||
go 1.24.5
|
||||
|
||||
replace github.com/TecharoHQ/anubis => ..
|
||||
replace git.sad.ovh/sophie/nuke => ..
|
||||
|
||||
require (
|
||||
github.com/TecharoHQ/anubis v1.23.1
|
||||
git.sad.ovh/sophie/nuke v1.23.1
|
||||
github.com/docker/docker v28.5.2+incompatible
|
||||
github.com/facebookgo/flagenv v0.0.0-20160425205200-fcd59fca7456
|
||||
github.com/google/uuid v1.6.0
|
||||
|
|
@ -15,7 +15,6 @@ require (
|
|||
buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.11-20251209175733-2a1774d88802.1 // indirect
|
||||
cel.dev/expr v0.25.1 // indirect
|
||||
github.com/Microsoft/go-winio v0.6.2 // indirect
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0 // indirect
|
||||
github.com/a-h/templ v0.3.960 // indirect
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
||||
github.com/aws/aws-sdk-go-v2 v1.41.0 // indirect
|
||||
|
|
@ -103,6 +102,6 @@ require (
|
|||
)
|
||||
|
||||
tool (
|
||||
github.com/TecharoHQ/anubis/cmd/anubis
|
||||
git.sad.ovh/sophie/nuke/cmd/nuke
|
||||
github.com/jsha/minica
|
||||
)
|
||||
|
|
|
|||
|
|
@ -10,8 +10,6 @@ github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg
|
|||
github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
|
||||
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
|
||||
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0 h1:Fa663s4soYiURSU8MfW9tZ2wF+LsCRSaYmjUSyagfBM=
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0/go.mod h1:C/U7FqTxpVn4V/qebC/GcW32I0h9xzsmWehF27KFOJs=
|
||||
github.com/a-h/templ v0.3.960 h1:trshEpGa8clF5cdI39iY4ZrZG8Z/QixyzEyUnA7feTM=
|
||||
github.com/a-h/templ v0.3.960/go.mod h1:oCZcnKRf5jjsGpf2yELzQfodLphd2mwecwG4Crk5HBo=
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
|
||||
|
|
|
|||
|
|
@ -2,13 +2,13 @@ services:
|
|||
web:
|
||||
image: ghcr.io/xe/nginx-micro:v1.29.0
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
environment:
|
||||
TARGET: http://web:80
|
||||
USE_REMOTE_ADDRESS: "true"
|
||||
healthcheck:
|
||||
test: ["CMD", "anubis", "--healthcheck"]
|
||||
test: ["CMD", "nuke", "--healthcheck"]
|
||||
interval: 5s
|
||||
timeout: 30s
|
||||
retries: 5
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ set -u
|
|||
|
||||
source ../lib/lib.sh
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
docker compose up -d
|
||||
|
||||
attempt=1
|
||||
|
|
@ -27,4 +27,4 @@ while ! docker compose ps | grep healthy; do
|
|||
attempt=$(( attempt + 1 ))
|
||||
done
|
||||
|
||||
exit 0
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -1,12 +1,14 @@
|
|||
async function fetchLanguages() {
|
||||
return fetch("http://localhost:8923/.within.website/x/cmd/anubis/static/locales/manifest.json")
|
||||
.then(resp => {
|
||||
return fetch(
|
||||
"http://localhost:8923/.within.website/x/cmd/nuke/static/locales/manifest.json",
|
||||
)
|
||||
.then((resp) => {
|
||||
if (resp.status !== 200) {
|
||||
throw new Error(`wanted status 200, got status: ${resp.status}`);
|
||||
}
|
||||
return resp;
|
||||
})
|
||||
.then(resp => resp.json());
|
||||
.then((resp) => resp.json());
|
||||
}
|
||||
|
||||
async function getChallengePage(lang) {
|
||||
|
|
@ -14,15 +16,15 @@ async function getChallengePage(lang) {
|
|||
headers: {
|
||||
"Accept-Language": lang,
|
||||
"User-Agent": "CHALLENGE",
|
||||
}
|
||||
},
|
||||
})
|
||||
.then(resp => {
|
||||
.then((resp) => {
|
||||
if (resp.status !== 200) {
|
||||
throw new Error(`wanted status 200, got status: ${resp.status}`);
|
||||
}
|
||||
return resp;
|
||||
})
|
||||
.then(resp => resp.text());
|
||||
.then((resp) => resp.text());
|
||||
}
|
||||
|
||||
(async () => {
|
||||
|
|
@ -42,7 +44,7 @@ async function getChallengePage(lang) {
|
|||
console.log(`getting for ${lang}`);
|
||||
const page = await getChallengePage(lang);
|
||||
|
||||
resultSheet[lang] = page.includes(`<html lang="${lang}">`)
|
||||
resultSheet[lang] = page.includes(`<html lang="${lang}">`);
|
||||
}
|
||||
|
||||
for (const [lang, result] of Object.entries(resultSheet)) {
|
||||
|
|
@ -59,4 +61,4 @@ async function getChallengePage(lang) {
|
|||
}
|
||||
|
||||
process.exit(0);
|
||||
})();
|
||||
})();
|
||||
|
|
|
|||
|
|
@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
|
|||
# Build static assets
|
||||
(cd ../.. && npm ci && npm run assets)
|
||||
|
||||
go tool anubis --help 2>/dev/null ||:
|
||||
go tool nuke --help 2>/dev/null ||:
|
||||
|
||||
go run ../cmd/unixhttpd &
|
||||
|
||||
go tool anubis \
|
||||
--policy-fname ./anubis.yaml \
|
||||
go tool nuke \
|
||||
--policy-fname ./nuke.yaml \
|
||||
--use-remote-address \
|
||||
--target=unix://$(pwd)/unixhttpd.sock &
|
||||
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ function cleanup() {
|
|||
|
||||
trap cleanup EXIT SIGINT
|
||||
|
||||
function build_anubis_ko() {
|
||||
function build_nuke_ko() {
|
||||
(
|
||||
cd $REPO_ROOT && npm ci && npm run assets
|
||||
)
|
||||
|
|
@ -30,7 +30,7 @@ function build_anubis_ko() {
|
|||
--image-user=1000 \
|
||||
--image-annotation="" \
|
||||
--image-label="" \
|
||||
./cmd/anubis \
|
||||
./cmd/nuke \
|
||||
--local
|
||||
)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ status_codes:
|
|||
logging:
|
||||
sink: file
|
||||
parameters:
|
||||
file: "./var/anubis.log"
|
||||
file: "./var/nuke.log"
|
||||
maxBackups: 3 # keep at least 3 old copies
|
||||
maxBytes: 67108864 # each file can have up to 64 Mi of logs
|
||||
maxAge: 7 # rotate files out every n days
|
||||
|
|
|
|||
|
|
@ -3,16 +3,16 @@ import { statSync } from "fs";
|
|||
async function getPage(path) {
|
||||
return fetch(`http://localhost:8923${path}`, {
|
||||
headers: {
|
||||
'User-Agent': 'CHALLENGE'
|
||||
}
|
||||
"User-Agent": "CHALLENGE",
|
||||
},
|
||||
})
|
||||
.then(resp => {
|
||||
.then((resp) => {
|
||||
if (resp.status !== 200) {
|
||||
throw new Error(`wanted status 200, got status: ${resp.status}`);
|
||||
}
|
||||
return resp;
|
||||
})
|
||||
.then(resp => resp.text());
|
||||
.then((resp) => resp.text());
|
||||
}
|
||||
|
||||
async function getFileSize(filePath) {
|
||||
|
|
@ -24,7 +24,7 @@ async function getFileSize(filePath) {
|
|||
}
|
||||
|
||||
(async () => {
|
||||
const logFilePath = "./var/anubis.log";
|
||||
const logFilePath = "./var/nuke.log";
|
||||
|
||||
// Get initial log file size
|
||||
const initialSize = await getFileSize(logFilePath);
|
||||
|
|
@ -63,7 +63,9 @@ async function getFileSize(filePath) {
|
|||
|
||||
// Verify that log file size increased
|
||||
if (finalSize <= initialSize) {
|
||||
console.error("ERROR: Log file size did not increase after making requests!");
|
||||
console.error(
|
||||
"ERROR: Log file size did not increase after making requests!",
|
||||
);
|
||||
failed = true;
|
||||
}
|
||||
|
||||
|
|
@ -79,10 +81,14 @@ async function getFileSize(filePath) {
|
|||
console.log(`Successful requests: ${successCount}/${requests.length}`);
|
||||
|
||||
if (failed) {
|
||||
console.error("Test failed: Some requests failed or log file size did not increase");
|
||||
console.error(
|
||||
"Test failed: Some requests failed or log file size did not increase",
|
||||
);
|
||||
process.exit(1);
|
||||
} else {
|
||||
console.log("Test passed: All requests succeeded and log file size increased");
|
||||
console.log(
|
||||
"Test passed: All requests succeeded and log file size increased",
|
||||
);
|
||||
process.exit(0);
|
||||
}
|
||||
})();
|
||||
})();
|
||||
|
|
|
|||
|
|
@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
|
|||
# Build static assets
|
||||
(cd ../.. && npm ci && npm run assets)
|
||||
|
||||
go tool anubis --help 2>/dev/null || :
|
||||
go tool nuke --help 2>/dev/null || :
|
||||
|
||||
go run ../cmd/httpdebug &
|
||||
|
||||
go tool anubis \
|
||||
--policy-fname ./anubis.yaml \
|
||||
go tool nuke \
|
||||
--policy-fname ./nuke.yaml \
|
||||
--use-remote-address \
|
||||
--target=http://localhost:3923 &
|
||||
|
||||
|
|
|
|||
|
|
@ -11,15 +11,15 @@ server {
|
|||
auth_request off;
|
||||
}
|
||||
|
||||
location @redirectToAnubis {
|
||||
location @redirectToNuke {
|
||||
return 307 /.within.website/?redir=$scheme://$host$request_uri;
|
||||
auth_request off;
|
||||
}
|
||||
|
||||
location / {
|
||||
auth_request /.within.website/x/cmd/anubis/api/check;
|
||||
error_page 401 = @redirectToAnubis;
|
||||
auth_request /.within.website/x/cmd/nuke/api/check;
|
||||
error_page 401 = @redirectToNuke;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html index.htm;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -31,8 +31,8 @@ spec:
|
|||
- name: config
|
||||
mountPath: /etc/nginx/conf.d
|
||||
readOnly: true
|
||||
- name: anubis
|
||||
image: ttl.sh/techaro/anubis:latest
|
||||
- name: nuke
|
||||
image: git.sad.ovh/sophie/nuke:latest
|
||||
imagePullPolicy: Always
|
||||
resources:
|
||||
limits:
|
||||
|
|
|
|||
|
|
@ -7,8 +7,8 @@ set -euo pipefail
|
|||
cd ../.. &&
|
||||
npm ci &&
|
||||
npm run container -- \
|
||||
--docker-repo ttl.sh/techaro/anubis \
|
||||
--docker-tags ttl.sh/techaro/anubis:latest
|
||||
--docker-repo git.sad.ovh/sophie/nuke \
|
||||
--docker-tags git.sad.ovh/sophie/nuke:latest
|
||||
)
|
||||
|
||||
kubectl apply -k .
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
# /etc/nginx/conf-anubis.inc
|
||||
# /etc/nginx/conf-nuke.inc
|
||||
|
||||
# Forward to anubis
|
||||
# Forward to nuke
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_pass http://anubis;
|
||||
}
|
||||
proxy_pass http://nuke;
|
||||
}
|
||||
|
|
@ -6,8 +6,8 @@ server {
|
|||
listen [::]:443 ssl;
|
||||
http2 on;
|
||||
|
||||
# Slipstream via Anubis
|
||||
include "conf-anubis.inc";
|
||||
# Slipstream via Nuke
|
||||
include "conf-nuke.inc";
|
||||
|
||||
server_name mimi.techaro.lol;
|
||||
|
||||
|
|
@ -26,4 +26,4 @@ server {
|
|||
|
||||
# Your normal configuration can go here
|
||||
# location .php { fastcgi...} etc.
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,17 +1,17 @@
|
|||
# /etc/nginx/conf.d/upstream-anubis.conf
|
||||
# /etc/nginx/conf.d/upstream-nuke.conf
|
||||
|
||||
upstream anubis {
|
||||
zone anubis_zone 64k;
|
||||
upstream nuke {
|
||||
zone nuke_zone 64k;
|
||||
# Make sure this matches the values you set for `BIND` and `BIND_NETWORK`.
|
||||
# If this does not match, your services will not be protected by Anubis.
|
||||
# If this does not match, your services will not be protected by Nuke.
|
||||
|
||||
# Try anubis first over a UNIX socket
|
||||
#server unix:/run/anubis/nginx.sock;
|
||||
server anubis:3000 resolve;
|
||||
# Try nuke first over a UNIX socket
|
||||
#server unix:/run/nuke/nginx.sock;
|
||||
server nuke:3000 resolve;
|
||||
|
||||
# Optional: fall back to serving the websites directly. This allows your
|
||||
# websites to be resilient against Anubis failing, at the risk of exposing
|
||||
# websites to be resilient against Nuke failing, at the risk of exposing
|
||||
# them to the raw internet without protection. This is a tradeoff and can
|
||||
# be worth it in some edge cases.
|
||||
#server unix:/run/nginx.sock backup;
|
||||
}
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
# Pale Moon CI tests
|
||||
|
||||
Pale Moon has exposed [some pretty bad bugs](https://anubis.techaro.lol/blog/release/v1.21.1#fix-event-loop-thrashing-when-solving-a-proof-of-work-challenge) in Anubis. As such, we're running Pale Moon against Anubis in CI to ensure that it keeps working.
|
||||
Pale Moon has exposed [some pretty bad bugs](https://nuke.techaro.lol/blog/release/v1.21.1#fix-event-loop-thrashing-when-solving-a-proof-of-work-challenge) in Nuke. As such, we're running Pale Moon against Nuke in CI to ensure that it keeps working.
|
||||
|
||||
This test is a fork of [dtinth/xtigervnc-docker](https://github.com/dtinth/xtigervnc-docker) but focused on Pale Moon.
|
||||
|
|
|
|||
|
|
@ -5,15 +5,15 @@ services:
|
|||
ports:
|
||||
- 5900:5900
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
environment:
|
||||
BIND: ":3000"
|
||||
TARGET: http://$TARGET
|
||||
POLICY_FNAME: /cfg/anubis.yaml
|
||||
POLICY_FNAME: /cfg/nuke.yaml
|
||||
SLOG_LEVEL: DEBUG
|
||||
volumes:
|
||||
- ../anubis:/cfg
|
||||
- ../nuke:/cfg
|
||||
depends_on:
|
||||
- relayd
|
||||
|
||||
|
|
@ -21,12 +21,12 @@ services:
|
|||
image: ghcr.io/xe/x/relayd
|
||||
environment:
|
||||
BIND: :443
|
||||
CERT_DIR: /techaro/pki
|
||||
CERT_DIR: /sad.ovh/pki
|
||||
CERT_FNAME: cert.pem
|
||||
KEY_FNAME: key.pem
|
||||
PROXY_TO: http://anubis:3000
|
||||
PROXY_TO: http://nuke:3000
|
||||
volumes:
|
||||
- ./pki/relayd:/techaro/pki:ro
|
||||
- ./pki/relayd:/sad.ovh/pki:ro
|
||||
|
||||
# novnc:
|
||||
# image: geek1011/easy-novnc
|
||||
|
|
@ -45,6 +45,6 @@ services:
|
|||
- ./pki:/usr/local/share/ca-certificates/minica:ro
|
||||
- ../scripts:/hack/scripts:ro
|
||||
depends_on:
|
||||
- anubis
|
||||
- nuke
|
||||
- relayd
|
||||
- display
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ fi
|
|||
|
||||
set -euo pipefail
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
mint_cert relayd
|
||||
|
||||
timeout &
|
||||
|
|
|
|||
|
|
@ -5,15 +5,15 @@ services:
|
|||
ports:
|
||||
- 5900:5900
|
||||
|
||||
anubis:
|
||||
image: ko.local/anubis
|
||||
nuke:
|
||||
image: ko.local/nuke
|
||||
environment:
|
||||
BIND: ":3000"
|
||||
TARGET: http://$TARGET
|
||||
POLICY_FNAME: /cfg/anubis.yaml
|
||||
POLICY_FNAME: /cfg/nuke.yaml
|
||||
SLOG_LEVEL: DEBUG
|
||||
volumes:
|
||||
- ../anubis:/cfg
|
||||
- ../nuke:/cfg
|
||||
|
||||
relayd:
|
||||
image: ghcr.io/xe/x/relayd
|
||||
|
|
@ -22,7 +22,7 @@ services:
|
|||
CERT_DIR: /techaro/pki
|
||||
CERT_FNAME: cert.pem
|
||||
KEY_FNAME: key.pem
|
||||
PROXY_TO: http://anubis:3000
|
||||
PROXY_TO: http://nuke:3000
|
||||
volumes:
|
||||
- ./pki/relayd:/techaro/pki:ro
|
||||
|
||||
|
|
|
|||
|
|
@ -21,7 +21,7 @@ fi
|
|||
|
||||
set -euo pipefail
|
||||
|
||||
build_anubis_ko
|
||||
build_nuke_ko
|
||||
mint_cert relayd
|
||||
|
||||
go run ../../cmd/cipra/ --compose-name $(basename $(pwd))
|
||||
|
|
|
|||
|
|
@ -11,12 +11,12 @@ trap cleanup EXIT SIGINT
|
|||
# Build static assets
|
||||
(cd ../.. && npm ci && npm run assets)
|
||||
|
||||
go tool anubis --help 2>/dev/null || :
|
||||
go tool nuke --help 2>/dev/null || :
|
||||
|
||||
go run ../cmd/unixhttpd &
|
||||
|
||||
go tool anubis \
|
||||
--policy-fname ./anubis.yaml \
|
||||
go tool nuke \
|
||||
--policy-fname ./nuke.yaml \
|
||||
--use-remote-address \
|
||||
--serve-robots-txt \
|
||||
--target=unix://$(pwd)/unixhttpd.sock &
|
||||
|
|
|
|||
|
|
@ -1,17 +1,20 @@
|
|||
<!DOCTYPE html>
|
||||
<!doctype html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Anubis works!</title>
|
||||
<link rel="stylesheet" href="/.within.website/x/xess/xess.css"/>
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
|
||||
</head>
|
||||
<body id="top">
|
||||
<main>
|
||||
<h1>Anubis works!</h1>
|
||||
<head>
|
||||
<title>Nuke works!</title>
|
||||
<link rel="stylesheet" href="/.within.website/x/xess/xess.css" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
</head>
|
||||
<body id="top">
|
||||
<main>
|
||||
<h1>Nuke works!</h1>
|
||||
|
||||
<p>If you see this, everything has gone according to keikaku.</p>
|
||||
<p>If you see this, everything has gone according to keikaku.</p>
|
||||
|
||||
<img height=128 src="/.within.website/x/cmd/anubis/static/img/happy.webp"/>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
<img
|
||||
height="128"
|
||||
src="/.within.website/x/cmd/nuke/static/img/happy.webp"
|
||||
/>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -2,4 +2,4 @@ ARG ALPINE_VERSION=3.22
|
|||
|
||||
FROM alpine:${ALPINE_VERSION}
|
||||
RUN apk add -U go nodejs git build-base git npm bash zstd brotli gzip
|
||||
LABEL org.opencontainers.image.source="https://github.com/TecharoHQ/anubis"
|
||||
LABEL org.opencontainers.image.source="https://git.sad.ovh/sophie/nuke"
|
||||
|
|
|
|||
|
|
@ -21,6 +21,6 @@ target "ci-runner" {
|
|||
]
|
||||
pull = true
|
||||
tags = [
|
||||
"ghcr.io/techarohq/anubis/ci-runner:latest"
|
||||
"git.sad.ovh/sophie/nuke/ci-runner:latest"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,14 +9,14 @@ fi
|
|||
|
||||
declare -A Hosts
|
||||
|
||||
Hosts["riscv64"]="ubuntu@riscv64.techaro.lol" # GOARCH=riscv64 GOOS=linux
|
||||
Hosts["ppc64le"]="ci@ppc64le.techaro.lol" # GOARCH=ppc64le GOOS=linux
|
||||
Hosts["riscv64"]="ubuntu@riscv64.sad.ovh" # GOARCH=riscv64 GOOS=linux
|
||||
Hosts["ppc64le"]="ci@ppc64le.sad.ovh" # GOARCH=ppc64le GOOS=linux
|
||||
Hosts["aarch64-4k"]="rocky@192.168.2.52" # GOARCH=arm64 GOOS=linux 4k page size
|
||||
Hosts["aarch64-16k"]="ci@192.168.2.28" # GOARCH=arm64 GOOS=linux 16k page size
|
||||
|
||||
CIRunnerImage="ghcr.io/techarohq/anubis/ci-runner:latest"
|
||||
CIRunnerImage="git.sad.ovh/sophie/nuke/ci-runner:latest"
|
||||
RunID=${GITHUB_RUN_ID:-$(uuidgen)}
|
||||
RunFolder="anubis/runs/${RunID}"
|
||||
RunFolder="nuke/runs/${RunID}"
|
||||
Target="${Hosts["$1"]}"
|
||||
|
||||
ssh "${Target}" uname -av >/dev/null
|
||||
|
|
@ -26,15 +26,15 @@ git archive HEAD | ssh "${Target}" tar xC "${RunFolder}"
|
|||
ssh "${Target}" <<EOF
|
||||
set -euo pipefail
|
||||
set -x
|
||||
mkdir -p anubis/cache/{go,go-build,node}
|
||||
mkdir -p nuke/cache/{go,go-build,node}
|
||||
podman pull ${CIRunnerImage}
|
||||
podman run --rm -it \
|
||||
-v "\$HOME/${RunFolder}:/app/anubis:z" \
|
||||
-v "\$HOME/anubis/cache/go:/root/go:z" \
|
||||
-v "\$HOME/anubis/cache/go-build:/root/.cache/go-build:z" \
|
||||
-v "\$HOME/anubis/cache/node:/root/.npm:z" \
|
||||
-w /app/anubis \
|
||||
-v "\$HOME/${RunFolder}:/app/nuke:z" \
|
||||
-v "\$HOME/nuke/cache/go:/root/go:z" \
|
||||
-v "\$HOME/nuke/cache/go-build:/root/.cache/go-build:z" \
|
||||
-v "\$HOME/nuke/cache/node:/root/.npm:z" \
|
||||
-w /app/nuke \
|
||||
${CIRunnerImage} \
|
||||
sh /app/anubis/test/ssh-ci/in-container.sh
|
||||
sh /app/nuke/test/ssh-ci/in-container.sh
|
||||
ssh "${Target}" rm -rf "${RunFolder}"
|
||||
EOF
|
||||
|
|
|
|||
|
|
@ -33,17 +33,17 @@ fi
|
|||
# HTTP daemon that listens over a unix socket (implicitly ./unixhttpd.sock)
|
||||
go run ../cmd/unixhttpd &
|
||||
|
||||
# A copy of Anubis, specifically for the current Git checkout
|
||||
go tool anubis \
|
||||
--bind=./anubis.sock \
|
||||
# A copy of Nuke, specifically for the current Git checkout
|
||||
go tool nuke \
|
||||
--bind=./nuke.sock \
|
||||
--bind-network=unix \
|
||||
--policy-fname=../anubis_configs/aggressive_403.yaml \
|
||||
--policy-fname=../nuke_configs/aggressive_403.yaml \
|
||||
--target=unix://$(pwd)/unixhttpd.sock &
|
||||
|
||||
# A simple TLS terminator that forwards to Anubis, which will forward to
|
||||
# A simple TLS terminator that forwards to Nuke, which will forward to
|
||||
# unixhttpd
|
||||
go run ../cmd/relayd \
|
||||
--proxy-to=unix://./anubis.sock \
|
||||
--proxy-to=unix://./nuke.sock \
|
||||
--cert-dir=../pki/relayd.local.cetacean.club &
|
||||
|
||||
# When you press control c, kill all the child processes to clean things up
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue