419 lines
17 KiB
HCL
419 lines
17 KiB
HCL
resource "kubectl_manifest" "cm_env_back" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: "${var.instance}-${var.component}-back"
|
|
labels: ${jsonencode(local.common_labels)}
|
|
namespace: ${var.namespace}
|
|
data:
|
|
POSTGRES_DB: ${var.component}
|
|
POSTGRES_USER: ${var.component}
|
|
POSTGRES_HOST: ${var.instance}-${var.component}-pg-rw.${var.namespace}.svc
|
|
TAIGA_URL: https://${local.dns_name}
|
|
TAIGA_SITES_DOMAIN: ${local.dns_name}
|
|
TAIGA_SITES_SCHEME: https
|
|
TAIGA_ASYNC_RABBITMQ_HOST: ${kubectl_manifest.rabbit.name}
|
|
TAIGA_EVENTS_RABBITMQ_HOST: ${kubectl_manifest.rabbit.name}
|
|
SESSION_COOKIE_SECURE: "True"
|
|
CSRF_COOKIE_SECURE: "True"
|
|
ENABLE_TELEMETRY: "False"
|
|
PUBLIC_REGISTER_ENABLED: "True"
|
|
ENABLE_GITHUB_AUTH: "False"
|
|
ENABLE_GITLAB_AUTH: "False"
|
|
ENABLE_SLACK: "False"
|
|
ENABLE_GITHUB_IMPORTER: "False"
|
|
ENABLE_JIRA_IMPORTER: "False"
|
|
ENABLE_TRELLO_IMPORTER: "False"
|
|
ENABLE_OIDC_AUTH: "True"
|
|
OIDC_RP_SCOPES: "openid email profile"
|
|
OIDC_BASE_URL: "${module.oauth2.sso_configuration_url}"
|
|
OIDC_OP_JWKS_ENDPOINT: "${module.oauth2.sso_configuration_url}jwks/"
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT: "${module.oauth2.sso_authorize_url}"
|
|
OIDC_OP_TOKEN_ENDPOINT: "${module.oauth2.sso_token_url}"
|
|
OIDC_OP_USER_ENDPOINT: "${module.oauth2.sso_userinfo_url}"
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "cm_env_front" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: "${var.instance}-${var.component}-front"
|
|
labels: ${jsonencode(local.common_labels)}
|
|
namespace: ${var.namespace}
|
|
data:
|
|
TAIGA_URL: https://${local.dns_name}
|
|
TAIGA_SITES_DOMAIN: ${local.dns_name}
|
|
TAIGA_SITES_SCHEME: https
|
|
SESSION_COOKIE_SECURE: "false"
|
|
CSRF_COOKIE_SECURE: "false"
|
|
ENABLE_TELEMETRY: "false"
|
|
PUBLIC_REGISTER_ENABLED: "true"
|
|
ENABLE_GITHUB_AUTH: "false"
|
|
ENABLE_GITLAB_AUTH: "false"
|
|
ENABLE_SLACK: "false"
|
|
ENABLE_GITHUB_IMPORTER: "false"
|
|
ENABLE_JIRA_IMPORTER: "false"
|
|
ENABLE_TRELLO_IMPORTER: "false"
|
|
ENABLE_OIDC_AUTH: "true"
|
|
OIDC_BUTTON_TEXT: "${var.domain}"
|
|
OIDC_MOUNT_POINT: "/api/oidc"
|
|
EOF
|
|
}
|
|
|
|
# awk '/taiga-events-rabbitmq/||/taiga-async-rabbitmq/' < /taiga-back/settings/config.py
|
|
# EVENTS_PUSH_BACKEND_URL = f"amqp://{ os.getenv('RABBITMQ_USER') }:{ os.getenv('RABBITMQ_PASS') }@taiga-events-rabbitmq:5672/taiga"
|
|
# CELERY_BROKER_URL = f"amqp://{ os.getenv('RABBITMQ_USER') }:{ os.getenv('RABBITMQ_PASS') }@taiga-async-rabbitmq:5672/taiga"
|
|
|
|
|
|
resource "kubectl_manifest" "cm_scripts" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: "${var.instance}-${var.component}-scripts"
|
|
labels: ${jsonencode(local.postcfg_all_labels)}
|
|
namespace: ${var.namespace}
|
|
data:
|
|
certs.sh: |-
|
|
#!/usr/bin/env bash
|
|
if [ -f /etc/local-ca/ca.crt ];then
|
|
export REQUESTS_CA_BUNDLE=/etc/local-ca/ca.crt
|
|
else
|
|
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
|
fi
|
|
postconfig.py: |-
|
|
#!/usr/bin/env python
|
|
import time
|
|
import requests
|
|
import subprocess
|
|
|
|
print('Waiting for backend ...')
|
|
while requests.get('http://${kubectl_manifest.svc_back.name}/api/v1/').status_code != 200:
|
|
print('...')
|
|
time.sleep(2)
|
|
|
|
if len(str(subprocess.check_output(['python', 'manage.py', 'dumpdata', 'projects.projecttemplate']))) < 5:
|
|
print(subprocess.check_output(['python', 'manage.py', 'loaddata', 'initial_project_templates']))
|
|
|
|
if str(subprocess.check_output(['python', 'manage.py', 'dumpdata', 'users.user'], cwd='/taiga-back')).find('\"is_superuser\": true') == -1:
|
|
print(subprocess.check_output(['python', 'manage.py', 'loaddata', 'initial_user'], cwd='/taiga-back'))
|
|
config.py: |-
|
|
# -*- coding: utf-8 -*-
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
#
|
|
# Copyright (c) 2021-present Kaleidos INC
|
|
|
|
from .common import *
|
|
import os
|
|
|
|
|
|
#########################################
|
|
## GENERIC
|
|
#########################################
|
|
|
|
DEBUG = os.getenv('DEBUG', 'False') == 'True'
|
|
|
|
DATABASES = {
|
|
'default': {
|
|
'ENGINE': 'django.db.backends.postgresql',
|
|
'NAME': os.getenv('POSTGRES_DB'),
|
|
'USER': os.getenv('POSTGRES_USER'),
|
|
'PASSWORD': os.getenv('POSTGRES_PASSWORD'),
|
|
'HOST': os.getenv('POSTGRES_HOST'),
|
|
'PORT': os.getenv('POSTGRES_PORT','5432'),
|
|
'OPTIONS': {'sslmode': os.getenv('POSTGRES_SSLMODE','disable')},
|
|
'DISABLE_SERVER_SIDE_CURSORS': os.getenv('POSTGRES_DISABLE_SERVER_SIDE_CURSORS', 'False') == 'True',
|
|
}
|
|
}
|
|
SECRET_KEY = os.getenv('TAIGA_SECRET_KEY')
|
|
|
|
TAIGA_SITES_SCHEME = os.getenv('TAIGA_SITES_SCHEME', "http")
|
|
TAIGA_SITES_DOMAIN = os.getenv('TAIGA_SITES_DOMAIN', "localhost")
|
|
FORCE_SCRIPT_NAME = os.getenv('TAIGA_SUBPATH', '')
|
|
|
|
TAIGA_URL = f"{ TAIGA_SITES_SCHEME }://{ TAIGA_SITES_DOMAIN }{ FORCE_SCRIPT_NAME }"
|
|
SITES = {
|
|
"api": { "name": "api", "scheme": TAIGA_SITES_SCHEME, "domain": TAIGA_SITES_DOMAIN },
|
|
"front": { "name": "front", "scheme": TAIGA_SITES_SCHEME, "domain": f"{ TAIGA_SITES_DOMAIN }{ FORCE_SCRIPT_NAME }" }
|
|
}
|
|
|
|
LANGUAGE_CODE = os.getenv("LANGUAGE_CODE", "en-us")
|
|
|
|
INSTANCE_TYPE = "D"
|
|
|
|
WEBHOOKS_ENABLED = os.getenv('WEBHOOKS_ENABLED', 'True') == 'True'
|
|
WEBHOOKS_ALLOW_PRIVATE_ADDRESS = os.getenv('WEBHOOKS_ALLOW_PRIVATE_ADDRESS', 'False') == 'True'
|
|
WEBHOOKS_ALLOW_REDIRECTS = os.getenv('WEBHOOKS_ALLOW_REDIRECTS', 'False') == 'True'
|
|
|
|
# Setting DEFAULT_PROJECT_SLUG_PREFIX to false
|
|
# removes the username from project slug
|
|
DEFAULT_PROJECT_SLUG_PREFIX = os.getenv('DEFAULT_PROJECT_SLUG_PREFIX', 'False') == 'True'
|
|
|
|
#########################################
|
|
## MEDIA
|
|
#########################################
|
|
MEDIA_URL = f"{ TAIGA_URL }/media/"
|
|
DEFAULT_FILE_STORAGE = "taiga_contrib_protected.storage.ProtectedFileSystemStorage"
|
|
THUMBNAIL_DEFAULT_STORAGE = DEFAULT_FILE_STORAGE
|
|
|
|
STATIC_URL = f"{ TAIGA_URL }/static/"
|
|
|
|
|
|
#########################################
|
|
## EMAIL
|
|
#########################################
|
|
# https://docs.djangoproject.com/en/3.1/topics/email/
|
|
EMAIL_BACKEND = os.getenv('EMAIL_BACKEND', 'django.core.mail.backends.console.EmailBackend')
|
|
CHANGE_NOTIFICATIONS_MIN_INTERVAL = 120 # seconds
|
|
|
|
DEFAULT_FROM_EMAIL = os.getenv('DEFAULT_FROM_EMAIL', 'system@taiga.io')
|
|
EMAIL_USE_TLS = os.getenv('EMAIL_USE_TLS', 'False') == 'True'
|
|
EMAIL_USE_SSL = os.getenv('EMAIL_USE_SSL', 'False') == 'True'
|
|
EMAIL_HOST = os.getenv('EMAIL_HOST', 'localhost')
|
|
EMAIL_PORT = os.getenv('EMAIL_PORT', 587)
|
|
EMAIL_HOST_USER = os.getenv('EMAIL_HOST_USER', 'user')
|
|
EMAIL_HOST_PASSWORD = os.getenv('EMAIL_HOST_PASSWORD', 'password')
|
|
|
|
|
|
#########################################
|
|
## SESSION
|
|
#########################################
|
|
SESSION_COOKIE_SECURE = os.getenv('SESSION_COOKIE_SECURE', 'True') == 'True'
|
|
CSRF_COOKIE_SECURE = os.getenv('CSRF_COOKIE_SECURE', 'True') == 'True'
|
|
|
|
|
|
#########################################
|
|
## EVENTS
|
|
#########################################
|
|
EVENTS_PUSH_BACKEND = "taiga.events.backends.rabbitmq.EventsPushBackend"
|
|
|
|
EVENTS_PUSH_BACKEND_URL = os.getenv('EVENTS_PUSH_BACKEND_URL')
|
|
if not EVENTS_PUSH_BACKEND_URL:
|
|
EVENTS_PUSH_BACKEND_URL = f"amqp://{ os.getenv('RABBITMQ_USER') }:{ os.getenv('RABBITMQ_PASS') }@{ os.getenv('TAIGA_EVENTS_RABBITMQ_HOST', 'taiga-events-rabbitmq') }:5672/taiga"
|
|
|
|
EVENTS_PUSH_BACKEND_OPTIONS = {
|
|
"url": EVENTS_PUSH_BACKEND_URL
|
|
}
|
|
|
|
|
|
#########################################
|
|
## TAIGA ASYNC
|
|
#########################################
|
|
CELERY_ENABLED = os.getenv('CELERY_ENABLED', 'True') == 'True'
|
|
from kombu import Queue # noqa
|
|
|
|
CELERY_BROKER_URL = os.getenv('CELERY_BROKER_URL')
|
|
if not CELERY_BROKER_URL:
|
|
CELERY_BROKER_URL = f"amqp://{ os.getenv('RABBITMQ_USER') }:{ os.getenv('RABBITMQ_PASS') }@{ os.getenv('TAIGA_ASYNC_RABBITMQ_HOST', 'taiga-async-rabbitmq') }:5672/taiga"
|
|
|
|
CELERY_RESULT_BACKEND = None # for a general installation, we don't need to store the results
|
|
CELERY_ACCEPT_CONTENT = ['pickle', ] # Values are 'pickle', 'json', 'msgpack' and 'yaml'
|
|
CELERY_TASK_SERIALIZER = "pickle"
|
|
CELERY_RESULT_SERIALIZER = "pickle"
|
|
CELERY_TIMEZONE = os.getenv('CELERY_TIMEZONE', 'Europe/Madrid')
|
|
CELERY_TASK_DEFAULT_QUEUE = 'tasks'
|
|
CELERY_QUEUES = (
|
|
Queue('tasks', routing_key='task.#'),
|
|
Queue('transient', routing_key='transient.#', delivery_mode=1)
|
|
)
|
|
CELERY_TASK_DEFAULT_EXCHANGE = 'tasks'
|
|
CELERY_TASK_DEFAULT_EXCHANGE_TYPE = 'topic'
|
|
CELERY_TASK_DEFAULT_ROUTING_KEY = 'task.default'
|
|
|
|
|
|
#########################################
|
|
## REGISTRATION
|
|
#########################################
|
|
PUBLIC_REGISTER_ENABLED = os.getenv('PUBLIC_REGISTER_ENABLED', 'False') == 'True'
|
|
|
|
|
|
#########################################
|
|
## CONTRIBS
|
|
#########################################
|
|
|
|
# SLACK
|
|
ENABLE_SLACK = os.getenv('ENABLE_SLACK', 'False') == 'True'
|
|
if ENABLE_SLACK:
|
|
INSTALLED_APPS += [
|
|
"taiga_contrib_slack"
|
|
]
|
|
|
|
# GITHUB AUTH
|
|
# WARNING: If PUBLIC_REGISTER_ENABLED == False, currently Taiga by default prevents the OAuth
|
|
# buttons to appear for both login and register
|
|
ENABLE_GITHUB_AUTH = os.getenv('ENABLE_GITHUB_AUTH', 'False') == 'True'
|
|
if PUBLIC_REGISTER_ENABLED and ENABLE_GITHUB_AUTH:
|
|
INSTALLED_APPS += [
|
|
"taiga_contrib_github_auth"
|
|
]
|
|
GITHUB_API_CLIENT_ID = os.getenv('GITHUB_API_CLIENT_ID')
|
|
GITHUB_API_CLIENT_SECRET = os.getenv('GITHUB_API_CLIENT_SECRET')
|
|
|
|
# GITLAB AUTH
|
|
# WARNING: If PUBLIC_REGISTER_ENABLED == False, currently Taiga by default prevents the OAuth
|
|
# buttons to appear for both login and register
|
|
ENABLE_GITLAB_AUTH = os.getenv('ENABLE_GITLAB_AUTH', 'False') == 'True'
|
|
if PUBLIC_REGISTER_ENABLED and ENABLE_GITLAB_AUTH:
|
|
INSTALLED_APPS += [
|
|
"taiga_contrib_gitlab_auth"
|
|
]
|
|
GITLAB_API_CLIENT_ID = os.getenv('GITLAB_API_CLIENT_ID')
|
|
GITLAB_API_CLIENT_SECRET = os.getenv('GITLAB_API_CLIENT_SECRET')
|
|
GITLAB_URL = os.getenv('GITLAB_URL')
|
|
|
|
# OIDC AUTH
|
|
ENABLE_OIDC_AUTH = os.getenv('ENABLE_OIDC_AUTH', 'False') == 'True'
|
|
if ENABLE_OIDC_AUTH:
|
|
INSTALLED_APPS += [
|
|
"mozilla_django_oidc",
|
|
"taiga_contrib_oidc_auth",
|
|
]
|
|
AUTHENTICATION_BACKENDS = list(AUTHENTICATION_BACKENDS) + [
|
|
"taiga_contrib_oidc_auth.oidc.TaigaOIDCAuthenticationBackend",
|
|
]
|
|
ROOT_URLCONF = "settings.urls"
|
|
OIDC_CALLBACK_CLASS = "taiga_contrib_oidc_auth.views.TaigaOIDCAuthenticationCallbackView"
|
|
OIDC_BASE_URL = os.getenv("OIDC_BASE_URL", "https://id.fedoraproject.org/openidc")
|
|
OIDC_RP_SCOPES = os.getenv("OIDC_RP_SCOPES", "openid profile email")
|
|
OIDC_RP_SIGN_ALGO = os.getenv("OIDC_RP_SIGN_ALGO", "RS256")
|
|
OIDC_OP_JWKS_ENDPOINT = os.getenv("OIDC_OP_JWKS_ENDPOINT", OIDC_BASE_URL + "/Jwks")
|
|
OIDC_OP_AUTHORIZATION_ENDPOINT = os.getenv("OIDC_OP_AUTHORIZATION_ENDPOINT", OIDC_BASE_URL + "/Authorization")
|
|
OIDC_OP_TOKEN_ENDPOINT = os.getenv("OIDC_OP_TOKEN_ENDPOINT", OIDC_BASE_URL + "/Token")
|
|
OIDC_OP_USER_ENDPOINT = os.getenv("OIDC_OP_USER_ENDPOINT", OIDC_BASE_URL + "/UserInfo")
|
|
OIDC_RP_CLIENT_ID = os.getenv("OIDC_RP_CLIENT_ID")
|
|
OIDC_RP_CLIENT_SECRET = os.getenv("OIDC_RP_CLIENT_SECRET")
|
|
print("ENABLE_OIDC_AUTH:", OIDC_BASE_URL, OIDC_BASE_URL)
|
|
print("INSTALLED_APPS:", INSTALLED_APPS)
|
|
print("AUTHENTICATION_BACKENDS:", AUTHENTICATION_BACKENDS)
|
|
|
|
|
|
#########################################
|
|
## TELEMETRY
|
|
#########################################
|
|
ENABLE_TELEMETRY = os.getenv('ENABLE_TELEMETRY', 'True') == 'True'
|
|
|
|
|
|
#########################################
|
|
## IMPORTERS
|
|
#########################################
|
|
ENABLE_GITHUB_IMPORTER = os.getenv('ENABLE_GITHUB_IMPORTER', 'False') == 'True'
|
|
if ENABLE_GITHUB_IMPORTER:
|
|
IMPORTERS["github"] = {
|
|
"active": True,
|
|
"client_id": os.getenv('GITHUB_IMPORTER_CLIENT_ID'),
|
|
"client_secret": os.getenv('GITHUB_IMPORTER_CLIENT_SECRET')
|
|
}
|
|
|
|
ENABLE_JIRA_IMPORTER = os.getenv('ENABLE_JIRA_IMPORTER', 'False') == 'True'
|
|
if ENABLE_JIRA_IMPORTER:
|
|
IMPORTERS["jira"] = {
|
|
"active": True,
|
|
"consumer_key": os.getenv('JIRA_IMPORTER_CONSUMER_KEY'),
|
|
"cert": os.getenv('JIRA_IMPORTER_CERT'),
|
|
"pub_cert": os.getenv('JIRA_IMPORTER_PUB_CERT')
|
|
}
|
|
|
|
ENABLE_TRELLO_IMPORTER = os.getenv('ENABLE_TRELLO_IMPORTER', 'False') == 'True'
|
|
if ENABLE_TRELLO_IMPORTER:
|
|
IMPORTERS["trello"] = {
|
|
"active": True,
|
|
"api_key": os.getenv('TRELLO_IMPORTER_API_KEY'),
|
|
"secret_key": os.getenv('TRELLO_IMPORTER_SECRET_KEY')
|
|
}
|
|
EOF
|
|
}
|
|
|
|
resource "kubectl_manifest" "cm_nginx" {
|
|
yaml_body = <<-EOF
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: "${var.instance}-${var.component}-nginx"
|
|
namespace: ${var.namespace}
|
|
labels: ${jsonencode(local.common_labels)}
|
|
data:
|
|
default.conf: |-
|
|
server {
|
|
listen 8080 default_server;
|
|
|
|
client_max_body_size 100M;
|
|
charset utf-8;
|
|
|
|
# Frontend
|
|
location / {
|
|
proxy_pass http://${kubectl_manifest.svc_front.name}/;
|
|
proxy_pass_header Server;
|
|
proxy_set_header Host $http_host;
|
|
proxy_redirect off;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Scheme $scheme;
|
|
}
|
|
|
|
# Api
|
|
location /api {
|
|
proxy_pass http://${kubectl_manifest.svc_back.name}:8000/api;
|
|
proxy_pass_header Server;
|
|
proxy_set_header Host $http_host;
|
|
proxy_redirect off;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Scheme $scheme;
|
|
}
|
|
|
|
# Admin
|
|
location /admin {
|
|
proxy_pass http://${kubectl_manifest.svc_back.name}:8000/admin;
|
|
proxy_pass_header Server;
|
|
proxy_set_header Host $http_host;
|
|
proxy_redirect off;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Scheme $scheme;
|
|
}
|
|
|
|
# Static
|
|
location /static {
|
|
root /taiga;
|
|
}
|
|
|
|
# Media
|
|
location /_protected {
|
|
internal;
|
|
alias /taiga/media/;
|
|
add_header Content-disposition "attachment";
|
|
}
|
|
|
|
# Unprotected section
|
|
location /media/exports {
|
|
alias /taiga/media/exports/;
|
|
add_header Content-disposition "attachment";
|
|
}
|
|
|
|
location /media {
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Scheme $scheme;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_pass http://${kubectl_manifest.svc_protected.name}:8003/;
|
|
proxy_redirect off;
|
|
}
|
|
|
|
# Events
|
|
location /events {
|
|
proxy_pass http://${kubectl_manifest.svc_events.name}:8888/events;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_connect_timeout 7d;
|
|
proxy_send_timeout 7d;
|
|
proxy_read_timeout 7d;
|
|
}
|
|
}
|
|
EOF
|
|
}
|
|
|