534 lines
No EOL
22 KiB
YAML
534 lines
No EOL
22 KiB
YAML
---
|
||
name: "RepKo"
|
||
version: 1.0
|
||
description: "Сервер для управления собственным Debian репозиторием.
|
||
Позволяет работать с дистрибутивами и его компонентами, загружать пакеты, автоматически подписывать файлы Release для доступа apt."
|
||
icon: "_public/icons/repository.png"
|
||
type: "other"
|
||
conf-files:
|
||
- file: "_public/files/config.ini"
|
||
type: "ini"
|
||
name: "ini config"
|
||
- file: "_public/files/.env"
|
||
type: "env"
|
||
name: "env config"
|
||
- file: "_public/files/repko.service"
|
||
type: "service"
|
||
name: "app service"
|
||
- file: "_public/files/separated.repko.conf"
|
||
type: "nginx"
|
||
name: "nginx separated config"
|
||
- file: "_public/files/united.repko.conf"
|
||
type: "nginx"
|
||
name: "nginx united config"
|
||
variables:
|
||
- name: "user_type"
|
||
type: "string"
|
||
default: "Create"
|
||
- name: "repko_user"
|
||
type: "string"
|
||
default: "repko-user"
|
||
- name: "api_domain"
|
||
type: "string"
|
||
default: "api.repko.com"
|
||
- name: "panel_domain"
|
||
type: "string"
|
||
default: "panel.repko.com"
|
||
- name: "cookie_domain"
|
||
type: "string"
|
||
default: "repko.com"
|
||
- name: "is_secure"
|
||
type: "bool"
|
||
default: false
|
||
- name: "server_address"
|
||
type: "string"
|
||
default: "127.0.0.1:9988"
|
||
- name: "trusted_proxy"
|
||
type: "string"
|
||
default: "127.0.0.1,::1"
|
||
- name: "nginx_port"
|
||
type: "string"
|
||
default: "80"
|
||
- name: "ssl_type"
|
||
type: "string"
|
||
default: "path now"
|
||
- name: "ssl_cert_path"
|
||
type: "string"
|
||
default: "/usr/share/ca-certificates/repko/repko.crt"
|
||
- name: "ssl_key_path"
|
||
type: "string"
|
||
#default: "/usr/share/ca-certificates/repko/repko.key"
|
||
default: "/etc/repko/ssl/repko.key"
|
||
- name: "database_type"
|
||
type: "string"
|
||
default: "sqlite"
|
||
- name: "database_host"
|
||
type: "string"
|
||
default: "localhost"
|
||
- name: "database_port"
|
||
type: "string"
|
||
default: "5435"
|
||
- name: "database_name"
|
||
type: "string"
|
||
default: "repkoDB"
|
||
- name: "database_user"
|
||
type: "string"
|
||
default: "root"
|
||
- name: "database_password"
|
||
type: "string"
|
||
default: "admin"
|
||
- name: "gpg_full_name"
|
||
type: "string"
|
||
default: "Repko Reposiory"
|
||
- name: "gpg_note"
|
||
type: "string"
|
||
default: "notee"
|
||
- name: "gpg_mail"
|
||
type: "string"
|
||
default: "admin@repko.com"
|
||
- name: "gpg_key_id"
|
||
type: "string"
|
||
default: "123ABCD"
|
||
- name: "repko_login"
|
||
type: "string"
|
||
default: "admin_repko"
|
||
- name: "repko_pass"
|
||
type: "string"
|
||
default: "admin_repko"
|
||
- name: "debian_root"
|
||
type: "string"
|
||
default: "/var/www/repko/debian"
|
||
- name: "archive_root"
|
||
type: "string"
|
||
default: "/var/www/repko/archive"
|
||
sections:
|
||
- name: "Repko about"
|
||
type: "about"
|
||
description: "Описание приложения"
|
||
paragraphs:
|
||
- "# Repko - собственный сервер репозитория для debian систем. "
|
||
- "## Возможности: \n - Встроенная система аутентификации (локальные пользователи или LDAP).\n - Подпись gpg ключом.\n - Удобный веб интерфейс"
|
||
- "## Бла бла бла. \n lorem ipsum прочее прочее прочее прочее"
|
||
- "### Бла бла бла бла. \n lorem ipsum прочее прочее прочее прочее"
|
||
- "## Бла бла бла бла. \n lorem ipsum прочее прочее прочее прочее"
|
||
actions:
|
||
- name: "Create directories"
|
||
type: "command"
|
||
command: "mkdir -p \
|
||
/etc/repko \
|
||
/var/log/repko \
|
||
/var/lib/repko \
|
||
/var/lib/repko/uploads \
|
||
/var/lib/repko/gnupg \
|
||
/var/www/repko \
|
||
/usr/share/keyrings \
|
||
/usr/share/ca-certificates/repko"
|
||
error: "не удалось создать необходимые директории"
|
||
- name: "Sleep 1"
|
||
type: "command"
|
||
#command: "touch /etc/repko/{{.api_domain}}.txt"
|
||
command: "sleep 1"
|
||
error: "ошибка создания файла"
|
||
- name: "user"
|
||
description: "Настройка данных пользователя"
|
||
fields:
|
||
- name: "choose_user"
|
||
variable-name: "user_type"
|
||
field-type: "select"
|
||
options:
|
||
- "Create"
|
||
- "Existing"
|
||
- name: "select_user"
|
||
variable-name: "repko_user"
|
||
field-type: "select"
|
||
special-value: "code:users"
|
||
description: "Выберите существующего пользователя"
|
||
condition: "user_type=='Existing'"
|
||
parent:
|
||
- "user_type"
|
||
- name: "new_user"
|
||
variable-name: "repko_user"
|
||
field-type: "input"
|
||
description: "Пользователь от которого будет запускаться программа"
|
||
condition: "user_type=='Create'"
|
||
parent:
|
||
- "user_type"
|
||
validate:
|
||
- rule: "regex_match(repko_user, `^[a-z][a-z0-9_-]*$`)"
|
||
message: "Только строчные латинские буквы, цифры, _, -"
|
||
- rule: "not user_exists(repko_user)"
|
||
message: "Пользователь существует"
|
||
actions:
|
||
- name: "create_user"
|
||
type: "command"
|
||
command: "echo 'adduser --system --group --no-create-home --disabled-password --shell /bin/false {{.repko_user}}'"
|
||
condition: "user_type=='Create'"
|
||
run-as: "root"
|
||
require-packages:
|
||
- "adduser"
|
||
error: "Ошибка при создании пользователя"
|
||
- name: "Set directories ownership"
|
||
type: "command"
|
||
command: "chown -R {{.repko_user}}:{{.repko_user}} /var/log/repko /var/lib/repko /var/www/repko /etc/repko /var/lib/gnupg"
|
||
error: "Ошибка установка владельца для директорий"
|
||
- name: "Set rights 755"
|
||
type: "command"
|
||
command: "chmod -R 755 /var/www/repko /usr/share/keyrings"
|
||
error: "Ошибка установки прав 755"
|
||
- name: "Set rights 750"
|
||
type: "command"
|
||
command: "chmod -R 750 /var/log/repko /var/lib/repko /etc/repko"
|
||
error: "ошибка установки прав 750"
|
||
- name: "Set rights 700"
|
||
type: "command"
|
||
command: "chmod -R 700 /var/lib/repko/gnupg"
|
||
error: "Ошибка установки прав 700"
|
||
- name: "Set files ownership"
|
||
type: "command"
|
||
command: "chown {{.repko_user}}:{{.repko_user}} /opt/repko/repko /opt/repko/.env /etc/repko/config.ini"
|
||
error: "Ошибка установка владельца для файлов"
|
||
- name: "Set rights 750"
|
||
type: "command"
|
||
command: "chmod 750 /opt/repko/repko"
|
||
error: "Ошибка установки прав 750"
|
||
- name: "Set rights 640"
|
||
type: "command"
|
||
command: "chmod 640 /opt/repko/.env /etc/repko/config.ini"
|
||
error: "Ошибка установки прав 640"
|
||
- name: "domain"
|
||
description: "Настройка используемых доменов"
|
||
fields:
|
||
- name: "api_domain"
|
||
variable-name: "api_domain"
|
||
field-type: "input"
|
||
description: "Домен на котором будет работать api"
|
||
validate:
|
||
- rule: "regex_match(api_domain,`^[a-zA-Z0-9.-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, '.'"
|
||
- name: "panel_domain"
|
||
variable-name: "panel_domain"
|
||
field-type: "input"
|
||
description: "Домен на котором будет работать сайт"
|
||
validate:
|
||
- rule: "regex_match(api_domain,`^[a-zA-Z0-9.-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, '.'"
|
||
- name: "cookie_domain"
|
||
variable-name: "cookie_domain"
|
||
description: "Домен для куки"
|
||
field-type: "compute"
|
||
parent:
|
||
- "panel_domain"
|
||
- "api_domain"
|
||
compute: |
|
||
api_domain == panel_domain ? api_domain :
|
||
regex(api_domain, `^.*\.([a-zA-Z0-9-]+\.[a-zA-Z]{2,})$`, '$1') !=
|
||
regex(panel_domain, `^.*\.([a-zA-Z0-9-]+\.[a-zA-Z]{2,})$`, '$1') ?
|
||
error("Разные корневые домены") :
|
||
regex(api_domain, `^.*\.([a-zA-Z0-9-]+\.[a-zA-Z]{2,})$`, '$1')
|
||
- name: "is_secure"
|
||
variable-name: "is_secure"
|
||
field-type: "check"
|
||
description: "Использовать SSL"
|
||
- name: "server_address"
|
||
variable-name: "server_address"
|
||
field-type: "input"
|
||
description: "Адрес сервера"
|
||
validate:
|
||
- rule: "regex_match(server_address,`^[a-zA-Z.-]+:[0-9]+$`)"
|
||
message: "Неверный формат, host:port, host только латиница,цифры, тире, '.', port только цифры"
|
||
- rule: "port_free( regex(server_address, `^.*:([0-9]+)$`, `$1`) )"
|
||
message: "Порт занят"
|
||
- name: "trusted_proxy"
|
||
variable-name: "trusted_proxy"
|
||
description: "Доверенные прокси"
|
||
field-type: "compute"
|
||
parent:
|
||
- "server_address"
|
||
compute: split(server_address,":")[0]
|
||
- name: "ssl"
|
||
description: "Настройка ssl"
|
||
condition: "is_secure == true"
|
||
parent:
|
||
- "is_secure"
|
||
fields:
|
||
- name: "ssl_type"
|
||
variable-name: "ssl_type"
|
||
field-type: "select"
|
||
options:
|
||
- "path later"
|
||
- "path now"
|
||
- "self-signed"
|
||
- "lets encrypt"
|
||
- name: "ssl_cert_path"
|
||
variable-name: "ssl_cert_path"
|
||
field-type: "file"
|
||
file-field-extensions:
|
||
- ".crt"
|
||
- ".cer"
|
||
- ".pem"
|
||
description: "Путь к ssl сертификату"
|
||
condition: "ssl_type=='path now'"
|
||
parent:
|
||
- "ssl_type"
|
||
validate:
|
||
- rule: "file_exists(ssl_cert_path)"
|
||
message: "Файл не существует"
|
||
- name: "ssl_key_path"
|
||
variable-name: "ssl_key_path"
|
||
field-type: "file"
|
||
file-field-extensions:
|
||
- ".key"
|
||
description: "Путь к ssl ключу"
|
||
condition: "ssl_type=='path now'"
|
||
parent:
|
||
- "ssl_type"
|
||
validate:
|
||
- rule: "file_exists(ssl_key_path)"
|
||
message: "Файл не существует"
|
||
actions:
|
||
- name: "create_ssl_repko_dir"
|
||
type: "command"
|
||
command: "mkdir -p /usr/share/ca-certificates/repko"
|
||
condition: "ssl_type == 'self-signed'"
|
||
run-as: "root"
|
||
error: "Ошибка при создании директории для сертификатов"
|
||
- name: "generate_self_signed" #тут
|
||
type: "command"
|
||
command: |
|
||
openssl req -x509 -nodes -days 365 \
|
||
-newkey rsa:2048 \
|
||
-keyout {{ssl_key_path}} \
|
||
-out {{ssl_cert_path}} \
|
||
-subj "/CN={{api_domain}}"
|
||
condition: "ssl_type == 'self-signed'"
|
||
run-as: "root"
|
||
error: "Не удалось сгенерировать сертификат через openssl"
|
||
- name: "Set owner for key"
|
||
type: "command"
|
||
command: "chown root:root {{.ssl_key_path}}"
|
||
condition: "ssl_type == 'self-signed'"
|
||
error: "Ошибка установки владельца ключа"
|
||
- name: "Set rights 600 for key"
|
||
type: "command"
|
||
command: "chmod 600 {{.ssl_key_path}}"
|
||
condition: "ssl_type == 'self-signed'"
|
||
error: "Ошибка установки прав ключа"
|
||
- name: "run_certbot"
|
||
type: "command"
|
||
command: "certbot --nginx -d {{api_domain}} -d {{panel_domain}} --non-interactive --agree-tos -m admin@{{api_domain}}"
|
||
condition: "ssl_type == 'lets encrypt'"
|
||
require-packages:
|
||
- "nginx"
|
||
- "certbot"
|
||
run-as: "root"
|
||
error: "Ошибка при генерации сертификата через lets encrypt"
|
||
- name: "update_ca_certificates"
|
||
type: "command"
|
||
command: "update_ca_certificates"
|
||
run-as: "root"
|
||
error: "Не удалось обновить сертификаты"
|
||
condition: "ssl_type != 'path later'"
|
||
- name: "database"
|
||
description: "Настройка используемой базы данных"
|
||
fields:
|
||
- name: "database_type"
|
||
variable-name: "database_type"
|
||
field-type: "select"
|
||
options:
|
||
- "sqlite"
|
||
- "postgres"
|
||
description: "Используемая база данных"
|
||
- name: "database_host"
|
||
variable-name: "database_host"
|
||
field-type: "input"
|
||
description: "Адрес база данных"
|
||
condition: "database_type=='postgres'"
|
||
parent:
|
||
- "database_type"
|
||
validate:
|
||
- rule: "regex_match(database_host,`^[a-zA-Z0-9.-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, '.'"
|
||
- name: "database_port"
|
||
variable-name: "database_port"
|
||
field-type: "input"
|
||
description: "Порт база данных"
|
||
condition: "database_type=='postgres'"
|
||
parent:
|
||
- "database_type"
|
||
validate:
|
||
- rule: "regex_match(database_host,`^[0-9]+$`)"
|
||
message: "Только цифры"
|
||
- name: "database_name"
|
||
variable-name: "database_name"
|
||
field-type: "input"
|
||
description: "Имя базы данных"
|
||
condition: "database_type=='postgres'"
|
||
parent:
|
||
- "database_type"
|
||
validate:
|
||
- rule: "regex_match(database_name,`^[a-zA-Z0-9_-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, _"
|
||
- name: "database_user"
|
||
variable-name: "database_user"
|
||
field-type: "input"
|
||
description: "Имя пользователя база данных"
|
||
condition: "database_type=='postgres'"
|
||
parent:
|
||
- "database_type"
|
||
validate:
|
||
- rule: "regex_match(database_user,`^[a-zA-Z0-9_-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, _"
|
||
- name: "database_password"
|
||
variable-name: "database_password"
|
||
field-type: "input"
|
||
description: "Пароль база данных"
|
||
condition: "database_type=='postgres'"
|
||
parent:
|
||
- "database_type"
|
||
validate:
|
||
- rule: "database_password!=''"
|
||
message: "Поле не может быть пустым"
|
||
- name: "gpg"
|
||
description: "Настройка gpg"
|
||
condition: "not file_exists('/var/lib/repko/gnupg/pubring.kbx')"
|
||
fields:
|
||
- name: "gpg name"
|
||
variable-name: "gpg_full_name"
|
||
field-type: "input"
|
||
description: "Полное имя для gpg ключа"
|
||
validate:
|
||
- rule: "gpg_full_name!=''"
|
||
message: "Поле не может быть пустым"
|
||
- rule: "regex_match(gpg_full_name,`^[a-zA-z0-9 .-]+$`)"
|
||
message: "Только латинские буквы, цифры, -, _, ' '"
|
||
- name: "gpg note"
|
||
variable-name: "gpg_note"
|
||
field-type: "input"
|
||
description: "Описание для gpg ключа"
|
||
validate:
|
||
- rule: "regex_match(gpg_note,`^[a-zA-Z0-9 .-]*$`)"
|
||
message: "Только латинские буквы, цифры, -, _, ' ' либо пустое"
|
||
- name: "gpg mail"
|
||
variable-name: "gpg_mail"
|
||
field-type: "input"
|
||
description: "Почта для gpg ключа"
|
||
validate:
|
||
- rule: "gpg_mail!=''"
|
||
message: "Поле не может быть пустым"
|
||
- rule: "regex_match(gpg_mail,`^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}$`)"
|
||
message: "Не соответствует формату почты"
|
||
actions:
|
||
- name: "generate gpg key"
|
||
type: "command"
|
||
command: "sudo -u {{.repko_user}} gpg --homedir /var/lib/repko/gnupg --batch --passphrase '' --quick-generate-key '{.gpg_full_name} ({.gpg_note}) <{.gpg_mail}>' rsa4096"
|
||
error: "Не удалось создать ключ"
|
||
- name: "get gpg key id"
|
||
type: "command"
|
||
command: "sudo -u {{.repko_user}} gpg --homedir /var/lib/repko/gnupg --list-keys --with-colons | grep pub | cut -d: -f5"
|
||
error: "Не удалось получить и сохранить id gpg ключа"
|
||
assign-to: "gpg_key_id"
|
||
- name: "export gpg key"
|
||
type: "command"
|
||
command: "sudo -u {{.repko_user}} gpg --homedir /var/lib/repko/gnupg --armor --export {{.gpg_key_id}} > /usr/share/keyrings/repko.asc"
|
||
error: "Не удалось экспортировать gpg ключ"
|
||
- name: "write gpg key id"
|
||
type: "command"
|
||
command: "echo {{.gpg_key_id}} > /etc/repko/keyid"
|
||
error: "не удалось записать gpg key id в файл keyid"
|
||
- name: "set owner for exported key"
|
||
type: "command"
|
||
command: "chown -R root:root /usr/share/keyrings/repko.asc"
|
||
error: "Ошибка установки владельца файла экспортированного ключа"
|
||
- name: "set owner for keyid file"
|
||
type: "command"
|
||
command: "chown -R {{.repko_user}}:{{.repko_user}} /etc/repko/keyid"
|
||
error: "Ошибка установки владельца файла id ключа"
|
||
- name: "set rights for keys"
|
||
type: "command"
|
||
command: "chmod 644 /usr/share/keyrings/repko.asc /etc/repko/keyid"
|
||
error: "Ошибка установки прав для ключей"
|
||
- name: "basic auth"
|
||
description: "Настройка базовой аутентификации"
|
||
fields:
|
||
- name: "repko login"
|
||
variable-name: "repko_login"
|
||
field-type: "input"
|
||
description: "Логин для входа на сайт"
|
||
validate:
|
||
- rule: "regex_match(repko_login,`^[a-zA-Z0-9_-]+$`)"
|
||
message: "Только строчные латинские буквы, цифры, _, -"
|
||
- name: "repko pass"
|
||
variable-name: "repko_pass"
|
||
field-type: "input"
|
||
description: "Пароль для входа на сайт"
|
||
validate:
|
||
- rule: "repko_pass!=''"
|
||
message: "Пароль не должен быть пустым"
|
||
actions:
|
||
- name: "generate htpasswd"
|
||
type: "command"
|
||
command: "htpasswd -c -b /etc/repko/.htpasswd {{.repko_login}} {{.repko_pass}}"
|
||
error: "Не удалось создать файл htpasswd"
|
||
- name: "set htpasswd owner"
|
||
type: "command"
|
||
command: "chown {{.repko_user}}:{{.repko_user}} /etc/repko/.htpasswd"
|
||
error: "Ошибка установки владельца файла "
|
||
- name: "set rights for htpasswd "
|
||
type: "command"
|
||
command: "chmod 640 /etc/repko/.htpasswd"
|
||
error: "Ошибку установки прав для файла"
|
||
- name: "paths"
|
||
description: "Настройка директорий"
|
||
fields:
|
||
- name: "debian_root"
|
||
variable-name: "debian_root"
|
||
field-type: "directory"
|
||
description: "Директория debian"
|
||
validate:
|
||
- rule: "dir_exists(debian_root)"
|
||
message: "Папка не существует"
|
||
- name: "archive_root"
|
||
variable-name: "archive_root"
|
||
field-type: "directory"
|
||
description: "Директория архива debian"
|
||
validate:
|
||
- rule: "dir_exists(archive_root)"
|
||
message: "Папка не существует"
|
||
actions:
|
||
- name: "create debian dir"
|
||
type: "command"
|
||
command: "mkdir -p {{.debian_root}}"
|
||
error: "Ошибка создания папки debian"
|
||
- name: "create archive dir"
|
||
type: "command"
|
||
command: "mkdir -p {{.archive_root}}"
|
||
error: "Ошибка создания папки archive"
|
||
- name: "finale"
|
||
description: "Последний этап, проверьте правильность введенных данных"
|
||
type: "final"
|
||
actions:
|
||
- name: "update_united_nginx_conf"
|
||
type: "file_template"
|
||
condition: "api_domain==panel_domain"
|
||
file-source: "/home/test/Projects/Personal/GoSetup/_public/files/donor/united.repko.donor.conf"
|
||
file-target: "/home/test/Projects/Personal/GoSetup/_public/files/target/united.repko.needy.conf"
|
||
error: "Ошибка при создании файла united.repko.needy.conf"
|
||
- name: "update_separated_nginx_conf"
|
||
type: "file_template"
|
||
condition: "api_domain !=panel_domain"
|
||
file-source: "/home/test/Projects/Personal/GoSetup/_public/files/donor/separated.repko.donor.conf"
|
||
file-target: "/home/test/Projects/Personal/GoSetup/_public/files/target/separated.repko.needy.conf"
|
||
error: "Ошибка при создании файла separated.repko.needy.conf"
|
||
- name: "update_repko_service"
|
||
type: "file_template"
|
||
file-source: "/home/test/Projects/Personal/GoSetup/_public/files/donor/repko.donor.service"
|
||
file-target: "/home/test/Projects/Personal/GoSetup/_public/files/target/repko.target.service"
|
||
error: "Ошибка при создании файла repko.target.service"
|
||
- name: "update_repko_ini"
|
||
type: "file_template"
|
||
# file-source: "/home/test/Projects/Personal/GoSetup/_public/files/donor/config.donor.ini"
|
||
# file-target: "/home/test/Projects/Personal/GoSetup/_public/files/target/config.target.ini"
|
||
file-source: "http://gsg.site/_public/config.donor.ini"
|
||
file-target: "/home/test/Projects/Personal/GoSetup/_public/files/target/http.config.ini"
|
||
error: "Ошибка при создании файла repko.target.service"
|
||
root: true |