PACKIT-5358: internal deployment

.gitignore

@@ -6,6 +6,7 @@ vars/**/*.yml
 
 secrets/packit/prod/*
 secrets/packit/stg/*
+secrets/packit/internal/*
 secrets/stream/prod/*
 secrets/stream/stg/*
 secrets/fedora-source-git/prod/*

devenv.lock

@@ -3,11 +3,11 @@
     "devenv": {
       "locked": {
         "dir": "src/modules",
-        "lastModified": 1777454881,
-        "narHash": "sha256-AkVmSToNoYX/f1U1mHijwv4Kmyh3NRshR6JSjBwHggc=",
+        "lastModified": 1790701375,
+        "narHash": "sha256-0FpLHIRDYiyo3EMTnMQSobZQknZaa3JuWo6vmMCK76o=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "2bc51f06128611db5f778e3c95296399354aed85",
+        "rev": "fe20b5cba7ab5e93ae73f956a8d3efc50e1753f4",
         "type": "github"
       },
       "original": {
@@ -19,11 +19,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1777268161,
-        "narHash": "sha256-bxrdOn8SCOv8tN4JbTF/TXq7kjo9ag4M+C8yzzIRYbE=",
+        "lastModified": 1791048980,
+        "narHash": "sha256-KgItSKML8Xvte0B7/uGnBDsYzSnnKHcOaiUbgWBXLXw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "1c3fe55ad329cbcb28471bb30f05c9827f724c76",
+        "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed",
         "type": "github"
       },
       "original": {

docs/deployment/tls-certs.md

@@ -13,6 +13,8 @@ We are using multi-domain wildcard certificates for the following domains:
 
 - `*.packit.dev`
 - `*.stg.packit.dev`
+- `*.prod.packit.dev`
+- `*.internal.packit.dev`
 
 In case the procedure bellow does not work,
 [previously used http challenge](https://github.com/packit/deployment/blob/008f5eaad69a620c54784f1fc19c7c775af9ec7d/README.md#obtaining-a-lets-encrypt-cert-using-certbot)
@@ -58,7 +60,7 @@ Or use the combo of nixpkg + devenv.sh.
 
 Run certbot:
 
-    $ certbot certonly --config-dir ~/.certbot --work-dir ~/.certbot --logs-dir ~/.certbot --manual --preferred-challenges dns --email hello@packit.dev -d prod.packit.dev -d stg.packit.dev -d dashboard.packit.dev -d dashboard.stg.packit.dev -d workers.packit.dev -d workers.stg.packit.dev
+    $ certbot certonly --config-dir ~/.certbot --work-dir ~/.certbot --logs-dir ~/.certbot --manual --preferred-challenges dns --email hello@packit.dev -d \*.packit.dev -d \*.stg.packit.dev -d \*.prod.packit.dev -d \*.internal.packit.dev
 
 You will be asked to set TXT record for every domain requested:
 
@@ -104,16 +106,16 @@ the last one and once you have the correct answer, hit Enter )
 ## Update secrets in the vault
 
 [Upload](https://bitwarden.com/help/attachments/#upload-a-file)
-`fullchain.pem` and `privkey.pem` from `~/.certbot/live/prod.packit.dev/`
+`fullchain.pem` and `privkey.pem` from `~/.certbot/live/packit.dev/`
 to `secrets-tls-certs` item in our shared `Packit` collection in Bitwarden vault.
 
 ## Re-deploy secrets for all services and environments
 
 `oc login ‹cluster›; oc project ‹project›` and
 
-    for cert in fullchain privkey; do scripts/update_oc_secret.sh packit-secrets ~/.certbot/live/prod.packit.dev/${cert}.pem; done
+    for cert in fullchain privkey; do scripts/update_oc_secret.sh packit-secrets ~/.certbot/live/packit.dev/${cert}.pem; done
 
-or update `api_key` in `vars/{packit|stream|fedora-source-git}/{prod|stg}.yml` and run:
+or update `api_key` in `vars/{packit|stream|fedora-source-git}/{prod|stg|internal}.yml` and run:
 
     `SERVICE=‹service› DEPLOYMENT=‹deployment› make deploy TAGS=secrets`
 

docs/deployment/vars.md

@@ -8,7 +8,7 @@ There are also `{service}/{deployment}_template.yml` files,
 where
 
 - `{service}` is either `packit` or `stream`
-- `{deployment}` is one of `prod`, `stg` or `dev`
+- `{deployment}` is one of `prod`, `stg`, `internal`, or `dev`
 
 You have to copy `{service}/{deployment}_template.yml` to `{service}/{deployment}.yml`
 depending on what service and environment you want to deploy to

openshift/dashboard.yml.j2

@@ -80,10 +80,14 @@ metadata:
 {% if managed_platform %}
   labels:
     paas.redhat.com/appcode: {{ appcode }}
-    shard: external
+    shard: {{ 'internal' if deployment == 'internal' else 'external' }}
 {% endif %}
 spec:
-  host: "{{ 'dashboard.stg.packit.dev' if deployment == 'stg' else 'dashboard.packit.dev' if deployment == 'prod'}}"
+{% if deployment == 'prod' %}
+  host: dashboard.packit.dev
+{% else %}
+  host: "dashboard.{{ deployment }}.packit.dev"
+{% endif %}
   port:
     targetPort: packit-dashboard-https
   to:

openshift/nginx.yml.j2

@@ -133,10 +133,15 @@ metadata:
   labels:
     paas.redhat.com/appcode: {{ appcode }}
     # used by internal Grafana
-    shard: external
+    shard: {{ 'internal' if deployment == 'internal' else 'external' }}
 {% endif %}
+
 spec:
-  host: "{{ 'workers.stg.packit.dev' if deployment == 'stg' else 'workers.packit.dev' if deployment == 'prod'}}"
+{% if deployment == 'prod' %}
+  host: workers.packit.dev
+{% else %}
+  host: "workers.{{ deployment }}.packit.dev"
+{% endif %}
   port:
     targetPort: nginx-https
   to:

openshift/packit-service.yml.j2

@@ -170,7 +170,7 @@ metadata:
 {% if managed_platform %}
   labels:
     paas.redhat.com/appcode: {{ appcode }}
-    shard: external
+    shard: {{ 'internal' if deployment == 'internal' else 'external' }}
 {% endif %}
 spec:
 # for local deployment (dev) creates default route for testing.

playbooks/cleanup.yml

@@ -23,6 +23,6 @@
 
     - name: Delete all
       ansible.builtin.command: oc delete all,cm,pvc --all
-      when: deployment != "prod"
+      when: 'deployment not in ("prod", "internal")'
       # on stage this always changes something
       changed_when: true

playbooks/oc-cluster-run.yml

@@ -26,7 +26,9 @@
     - name: Rebuild pull_secret from its parts
       ansible.builtin.set_fact:
         pull_secret: "{{ pull_secret_part_1 }}{{ pull_secret_part_2 }}{{ pull_secret_part_3 }}{{ pull_secret_part_4 }}{{ pull_secret_part_5 }}{{ pull_secret_part_6 }}{{ pull_secret_part_7 }}"
-      when: pull_secret == "" and pull_secret_part_1 != ""
+      when:
+        - pull_secret == ""
+        - pull_secret_part_1 != ""
 
     - name: Check pull secret is not empty
       ansible.builtin.fail:

playbooks/zuul-deploy.yml

@@ -21,7 +21,9 @@
       ansible.builtin.pip:
         name: Jinja2==2.8.1
       become: true
-      when: (ansible_facts['distribution'] == "CentOS" and ansible_facts['distribution_major_version'] == "7")
+      when:
+        - ansible_facts['distribution'] == "CentOS"
+        - ansible_facts['distribution_major_version'] == "7"
 
     - name: Get token
       ansible.builtin.command: oc whoami -t

roles/deploy/tasks/main.yml

@@ -178,7 +178,10 @@
   loop: "{{ range(0, workers_all_tasks) | list }}"
   tags:
     - packit-worker
-  when: workers_all_tasks > 0 and with_repository_cache
+  when:
+    - workers_all_tasks > 0
+    - with_repository_cache
+    - with_sandbox
 
 - name: Deploy packit-worker to serve all queues
   vars:
@@ -226,7 +229,10 @@
   loop: "{{ range(0, workers_long_running) | list }}"
   tags:
     - packit-worker
-  when: workers_long_running > 0 and with_repository_cache
+  when:
+    - workers_long_running > 0
+    - with_repository_cache
+    - with_sandbox
 
 - name: Deploy packit-worker to serve long-running and rate-limited queue
   vars:
@@ -368,7 +374,9 @@
   tags:
     - pushgateway
   register: nginx
-  when: with_pushgateway and with_flower
+  when:
+    - with_pushgateway
+    - with_flower
 
 - name: Wait for worker-0 to be running
   vars:

secrets/packit/internal/centpkg-sig.conf.j2

@@ -0,0 +1,34 @@
+[centpkg-sig]
+lookaside = https://git.centos.org/sources
+lookasidehash = sha512
+lookaside_cgi = https://git.centos.org/sources/upload_sig.cgi
+# lookaside_cgi = https://git.centos.org/sources/upload.cgi
+distgit_namespaced = True
+distgit_namespaces = rpms
+gitbaseurl = git+ssh://git@gitlab.com/CentOS/%(repo)s.git
+anongiturl = https://gitlab.com/CentOS/%(repo)s.git
+branchre = c\d+s?-sig-.+|master$
+kojiprofile = cbs
+build_client = cbs
+lookaside_namespaced = True
+git_excludes =
+  i386/
+  i686/
+  x86_64/
+  ppc/
+  ppc64/
+  ia64/
+  mips/
+  arm/
+  noarch/
+  /*.src.rpm
+  /build*.log
+  /.build-*.log
+  results_*/
+  clog
+
+[centpkg-sig.distgit]
+apibaseurl = https://gitlab.com
+{% set gitlab_forge = git_forges | selectattr('name', 'equalto', 'gitlab.com') | first %}
+{% set gitlab_fields = gitlab_forge['fields'] | items2dict(key_name='name') %}
+token = {{ gitlab_fields['token:key'] }}

secrets/packit/internal/fedora.toml.j2

@@ -0,0 +1,87 @@
+# A basic configuration for Fedora's message broker, using the example callback
+# which simply prints messages to standard output.
+#
+# This file is in the TOML format.
+amqp_url = "amqps://fedora:@rabbitmq.fedoraproject.org/%2Fpublic_pubsub"
+
+[tls]
+ca_cert = "/etc/fedora-messaging/cacert.pem"
+keyfile = "/etc/fedora-messaging/fedora-key.pem"
+certfile = "/etc/fedora-messaging/fedora-cert.pem"
+
+[client_properties]
+app = "Packit"
+# Some suggested extra fields:
+# URL of the project that provides this consumer
+app_url = "https://github.com/packit/packit-service-fedmsg"
+# Contact emails for the maintainer(s) of the consumer - in case the
+# broker admin needs to contact them, for e.g.
+app_contacts_email = ["hello@packit.dev"]
+
+[exchanges."amq.topic"]
+type = "topic"
+durable = true
+auto_delete = false
+arguments = {}
+
+# Queue names *must* be in the normal UUID format: run "uuidgen" and use the
+# output as your queue name. If you don't define a queue here, the server will
+# generate a queue name for you. This queue will be non-durable, auto-deleted and
+# exclusive.
+# If your queue is not exclusive, anyone can connect and consume from it, causing
+# you to miss messages, so do not share your queue name. Any queues that are not
+# auto-deleted on disconnect are garbage-collected after approximately one hour.
+#
+# If you require a stronger guarantee about delivery, please talk to Fedora's
+# Infrastructure team.
+[queues.{{ vault.fedora_messaging.queue }}]
+# Keep messages on broker restart
+durable = true
+# Delete the queue when the client terminates
+auto_delete = true
+# Refuse multiple simultaneous consumers
+exclusive = true
+arguments = {}
+
+[[bindings]]
+queue = "{{ vault.fedora_messaging.queue }}"
+exchange = "amq.topic"
+routing_keys = []
+
+[log_config]
+version = 1
+disable_existing_loggers = true
+
+[log_config.formatters.simple]
+format = "[%(asctime)s %(levelname)s %(name)s] %(message)s"
+
+[log_config.handlers.console]
+class = "logging.StreamHandler"
+formatter = "simple"
+stream = "ext://sys.stdout"
+
+[log_config.loggers.fedora_messaging]
+level = "INFO"
+propagate = false
+handlers = ["console"]
+
+[log_config.loggers.twisted]
+level = "INFO"
+propagate = false
+handlers = ["console"]
+
+[log_config.loggers.pika]
+level = "WARNING"
+propagate = false
+handlers = ["console"]
+
+# If your consumer sets up a logger, you must add a configuration for it
+# here in order for the messages to show up.
+[log_config.loggers.packit_service_fedmsg]
+level = "DEBUG"
+propagate = false
+handlers = ["console"]
+
+[log_config.root]
+level = "ERROR"
+handlers = ["console"]