Lab 9: Trivy scans, ZAP, security middleware

.github/workflows/ci.yml

@@ -0,0 +1,98 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'app/**'
+      - '.github/workflows/ci.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'app/**'
+      - '.github/workflows/ci.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  vet:
+    name: vet (${{ matrix.go-version }})
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        go-version: [ '1.23', '1.24' ]
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go ${{ matrix.go-version }}
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: go vet
+        working-directory: app
+        run: go vet ./...
+
+  test:
+    name: test (${{ matrix.go-version }})
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        go-version: [ '1.23', '1.24' ]
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go ${{ matrix.go-version }}
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: go test -race
+        working-directory: app
+        run: go test -race -count=1 ./...
+
+  lint:
+    name: lint
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: '1.24'
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: Install golangci-lint v2.5.0
+        working-directory: app
+        run: |
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+
+      - name: Run golangci-lint
+        working-directory: app
+        run: golangci-lint run
+
+  ci-ok:
+    name: ci-ok
+    if: always()
+    needs: [ vet, test, lint ]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check results
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "Some jobs failed or were cancelled"
+            exit 1
+          fi
+          echo "All jobs passed"

.github/workflows/ci.yml.backup

@@ -0,0 +1,98 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'app/**'
+      - '.github/workflows/ci.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'app/**'
+      - '.github/workflows/ci.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  vet:
+    name: vet (${{ matrix.go-version }})
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        go-version: [ '1.23', '1.24' ]
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go ${{ matrix.go-version }}
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: go vet
+        working-directory: app
+        run: go vet ./...
+
+  test:
+    name: test (${{ matrix.go-version }})
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        go-version: [ '1.23', '1.24' ]
+      fail-fast: false
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go ${{ matrix.go-version }}
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: go test -race
+        working-directory: app
+        run: go test -race -count=1 ./...
+
+  lint:
+    name: lint
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b  # v5.3.0
+        with:
+          go-version: '1.24'
+          cache: true
+          cache-dependency-path: app/go.sum
+
+      - name: Install golangci-lint v2.5.0
+        working-directory: app
+        run: |
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0
+
+      - name: Run golangci-lint
+        working-directory: app
+        run: golangci-lint run
+
+  ci-ok:
+    name: ci-ok
+    if: always()
+    needs: [ vet, test, lint ]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check results
+        run: |
+          if [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "true" ]; then
+            echo "Some jobs failed or were cancelled"
+            exit 1
+          fi
+          echo "All jobs passed"

Vagrantfile

@@ -0,0 +1,25 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "ubuntu/jammy64"
+  config.vm.hostname = "quicknotes-vm"
+  config.vm.network "forwarded_port", guest: 8080, host: 18080, host_ip: "127.0.0.1"
+  config.vm.synced_folder "./app", "/home/vagrant/app"
+
+  config.vm.provider "virtualbox" do |vb|
+    vb.memory = "1024"
+    vb.cpus = 2
+  end
+
+  config.vm.provision "shell", inline: <<-SHELL
+    apt-get update
+    apt-get install -y wget git
+    wget -q https://go.dev/dl/go1.24.5.linux-amd64.tar.gz
+    tar -C /usr/local -xzf go1.24.5.linux-amd64.tar.gz
+    echo 'export PATH=$PATH:/usr/local/go/bin' >> /home/vagrant/.bashrc
+    echo 'export PATH=$PATH:/usr/local/go/bin' >> /root/.bashrc
+    export PATH=$PATH:/usr/local/go/bin
+    go version
+  SHELL
+end

Vagrantfile.txt

@@ -0,0 +1,35 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure("2") do |config|
+  # 1. Базовый образ Ubuntu 22.04 (работает быстрее, чем 24.04)
+  config.vm.box = "ubuntu/jammy64"
+
+  # 2. Хостнейм
+  config.vm.hostname = "quicknotes-vm"
+
+  # 3. Проброс порта 18080 хост → 8080 гость
+  config.vm.network "forwarded_port", guest: 8080, host: 18080, host_ip: "127.0.0.1"
+
+  # 4. Синхронизация папки ./app → /home/vagrant/app
+  config.vm.synced_folder "./app", "/home/vagrant/app"
+
+  # 5. Ресурсы: 2 vCPU, 1024 MB RAM
+  config.vm.provider "virtualbox" do |vb|
+    vb.memory = "1024"
+    vb.cpus = 2
+  end
+
+  # 6. Provisioning: установка Go 1.24.5
+  config.vm.provision "shell", inline: <<-SHELL
+    apt-get update
+    apt-get install -y wget git
+    wget -q https://go.dev/dl/go1.24.5.linux-amd64.tar.gz
+    tar -C /usr/local -xzf go1.24.5.linux-amd64.tar.gz
+    echo 'export PATH=$PATH:/usr/local/go/bin' >> /home/vagrant/.bashrc
+    echo 'export PATH=$PATH:/usr/local/go/bin' >> /root/.bashrc
+    # для текущей сессии
+    export PATH=$PATH:/usr/local/go/bin
+    go version
+  SHELL
+end

ansible.cfg

@@ -0,0 +1,4 @@
+[ssh_connection]
+control_path = /dev/null
+control_master = false
+scp_if_ssh = True

ansible/inventory.ini

@@ -0,0 +1,2 @@
+[quicknotes-vm]
+quicknotes-vm ansible_host=127.0.0.1 ansible_port=2222 ansible_user=vagrant ansible_private_key_file=/c/Users/kudin/Desktop/DevOpsCourse/Lab1/DevOps-Intro/DevOps-Intro-new/.vagrant/machines/default/virtualbox/private_key ansible_ssh_extra_args="-o StrictHostKeyChecking=no -o ControlMaster=no -o ControlPersist=no"

ansible/playbook.yaml

@@ -0,0 +1,63 @@
+---
+- name: Deploy QuickNotes to Lab 5 VM
+  hosts: quicknotes-vm
+  become: true
+  gather_facts: false
+
+  vars:
+    listen_addr: ":9090"
+    data_path: "/var/lib/quicknotes/data.json"
+    seed_path: "/var/lib/quicknotes/seed.json"
+    binary_path: "/usr/local/bin/quicknotes"
+    data_dir: "/var/lib/quicknotes"
+    user: "quicknotes"
+    group: "quicknotes"
+
+  tasks:
+    - name: Create system user quicknotes
+      ansible.builtin.user:
+        name: "{{ user }}"
+        system: true
+        shell: /usr/sbin/nologin
+        create_home: false
+        state: present
+
+    - name: Ensure data directory exists
+      ansible.builtin.file:
+        path: "{{ data_dir }}"
+        state: directory
+        owner: "{{ user }}"
+        group: "{{ group }}"
+        mode: '0750'
+
+    - name: Copy QuickNotes binary
+      ansible.builtin.copy:
+        src: files/quicknotes
+        dest: "{{ binary_path }}"
+        mode: '0755'
+        owner: root
+        group: root
+      notify: restart quicknotes
+
+    - name: Render systemd unit file
+      ansible.builtin.template:
+        src: templates/quicknotes.service.j2
+        dest: /etc/systemd/system/quicknotes.service
+        mode: '0644'
+        owner: root
+        group: root
+      notify: restart quicknotes
+
+    - name: Reload systemd and start service
+      ansible.builtin.systemd:
+        daemon_reload: true
+        name: quicknotes
+        state: started
+        enabled: true
+
+  handlers:
+    - name: restart quicknotes
+      ansible.builtin.systemd:
+        name: quicknotes
+        state: restarted
+        daemon_reload: true

ansible/templates/quicknotes.service.j2

@@ -0,0 +1,18 @@
+[Unit]
+Description=QuickNotes Service
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+User=quicknotes
+Group=quicknotes
+WorkingDirectory=/var/lib/quicknotes
+ExecStart=/usr/local/bin/quicknotes
+Restart=on-failure
+RestartSec=5
+Environment=ADDR={{ listen_addr }}
+Environment=DATA_PATH={{ data_path }}
+Environment=SEED_PATH={{ seed_path }}
+
+[Install]
+WantedBy=multi-user.target

app/Dockerfile

@@ -0,0 +1,36 @@
+# ===== СТЕЙДЖ 1: СБОРКА =====
+FROM golang:1.24-alpine AS builder
+
+WORKDIR /build
+
+# Кешируем зависимости
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Копируем исходники
+COPY . .
+
+# Собираем статический бинарник
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -ldflags='-s -w' \
+    -trimpath \
+    -o quicknotes .
+
+# ===== СТЕЙДЖ 2: РАНТАЙМ =====
+FROM gcr.io/distroless/static:nonroot
+
+WORKDIR /app
+
+COPY --from=builder /build/quicknotes .
+
+COPY --from=busybox:stable-musl /bin/busybox /bin/busybox
+
+# Создаём каталог /data и даём права пользователю 65532
+USER root
+RUN ["/bin/busybox", "mkdir", "-p", "/data"]
+RUN ["/bin/busybox", "chown", "65532:65532", "/data"]
+USER 65532
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/quicknotes"]