OpenHub: новый хаб пакетов на hub-new.oscript.io #37
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,3 +29,31 @@ | |
| * Публикация в основном канале хаба, если это ветка master. | ||
|
|
||
| Этот документ можно обсуждать и предлагать к нему правки. | ||
|
|
||
| ## OpenHub — hub-new.oscript.io | ||
|
|
||
| Новый хаб пакетов ([OpenHub](https://github.com/Segate-ekb/openhub)) живёт в том же `docker-compose.yml`: | ||
|
|
||
| | Сервис | Что это | | ||
| | --- | --- | | ||
| | `openhub` | сам хаб, образ `segateekb/openhub`; | | ||
| | `openhub_db` | PostgreSQL хаба;| | ||
| | `lgtm` | мониторинг хаба одним контейнером (`grafana/otel-lgtm`), Grafana — grafana.oscript.io; дашборд хаба — в `monitoring/` | | ||
|
|
||
| Файлы пакетов хаб хранит в общем MinIO | ||
|
|
||
| ### Первый запуск на работающем сервере | ||
|
|
||
| 1. Добавить в `.env` переменные из [`openhub.env.example`](openhub.env.example). | ||
| 2. Завести DNS-записи `hub-new.oscript.io` и `grafana.oscript.io` на сервер. | ||
| 3. Выпустить сертификаты и пересобрать nginx с новыми сайтами: | ||
|
|
||
| ```bash | ||
| ./add-letsencrypt-domain.sh hub-new.oscript.io | ||
| ./add-letsencrypt-domain.sh grafana.oscript.io | ||
| ``` | ||
| 4. Завести в MinIO бакет `openhub` и учётку хаба с ключами `OPENHUB_S3_ACCESS_KEY` / | ||
| `OPENHUB_S3_SECRET_KEY` из `.env` — руками, один раз. | ||
| 5. Поднять хаб — база и мониторинг поднимутся сами: | ||
|
|
||
| 6. Сразу открыть <https://hub-new.oscript.io/setup> и завести первого администратора. | ||
|
Comment on lines
+50
to
+59
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: sed -n '1,60p' web/nginx/sites-enabled/hub-new.oscript.io
sed -n '25,65p' README.mdRepository: EvilBeaver/oscript-infrastructure Length of output: 3188 🏁 Script executed: printf '%s\n' '--- compose references ---'
rg -n -C 5 'openhub:|openhub_db|3333|OPENHUB|OSHUB|image:' docker-compose.yml openhub.env.example README.md
printf '%s\n' '--- local OpenHub references ---'
rg -n -i -C 3 '0\.7\.23|/setup|first administrator|first admin|setup' . -g '!*.json' -g '!*.log' | head -240Repository: EvilBeaver/oscript-infrastructure Length of output: 12656 🌐 Web query:
💡 Result: <search_synthesis> <source_evidence> Citations:
🌐 Web query:
💡 Result: For OpenHub 0.7.23, start the service and open: Create the first login and password there. The first account automatically becomes the administrator, and For unattended setup: OSHUB_ADMIN_LOGIN=admin \
OSHUB_ADMIN_PASSWORD='your-password' \
openhubUsing Citations: 🏁 Script executed: set -eu
for url in \
https://api.github.com/repos/Segate-ekb/openhub \
https://api.github.com/repos/Segate-ekb/openhub/releases/tags/0.7.23 \
https://api.github.com/repos/Segate-ekb/openhub/git/ref/tags/0.7.23
do
echo "--- $url"
curl -L --fail --silent --show-error "$url" | head -c 12000
printf '\n'
doneRepository: EvilBeaver/oscript-infrastructure Length of output: 6230 🏁 Script executed: set -eu
url='https://raw.githubusercontent.com/Segate-ekb/openhub/main/docs/%D1%80%D0%B0%D0%B7%D0%B2%D1%91%D1%80%D1%82%D1%8B%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5.md'
curl -L --fail --silent --show-error "$url" | sed -n '1,240p'Repository: EvilBeaver/oscript-infrastructure Length of output: 8555 Initialize the first administrator before exposing OpenHub. Nginx proxies every path on An internet user can therefore claim the first administrator before the operator reaches step 6. Pass 🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Сертификат для одного нового домена, остальные не трогает: | ||
| # ./add-letsencrypt-domain.sh hub-new.oscript.io | ||
|
|
||
| set -e | ||
|
|
||
| domain="$1" | ||
| if [ -z "$domain" ]; then | ||
| echo "Usage: $0 <domain>" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if ! [ -x "$(command -v docker-compose)" ]; then | ||
| echo 'Error: docker-compose is not installed.' >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| rsa_key_size=4096 | ||
| data_path="./web/certbot" | ||
| email="ovsiankin.aa@gmail.com" | ||
| staging=0 | ||
|
|
||
| if [ -d "$data_path/conf/live/$domain" ]; then | ||
| echo "Certificate for $domain already exists, nothing to do." >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "### Creating dummy certificate for $domain ..." | ||
| path="/etc/letsencrypt/live/$domain" | ||
| mkdir -p "$data_path/conf/live/$domain" | ||
| docker-compose run --rm --no-deps --entrypoint "\ | ||
| openssl req -x509 -nodes -newkey rsa:2048 -days 1 \ | ||
| -keyout '$path/privkey.pem' \ | ||
| -out '$path/fullchain.pem' \ | ||
| -subj '/CN=localhost'" certbot | ||
|
|
||
| echo "### Rebuilding nginx with the new site ..." | ||
| docker-compose build nginx | ||
| docker-compose up --force-recreate --no-deps -d nginx | ||
|
|
||
| echo "### Deleting dummy certificate for $domain ..." | ||
| docker-compose run --rm --no-deps --entrypoint "\ | ||
| rm -Rf /etc/letsencrypt/live/$domain && \ | ||
| rm -Rf /etc/letsencrypt/archive/$domain && \ | ||
| rm -Rf /etc/letsencrypt/renewal/$domain.conf" certbot | ||
|
|
||
| echo "### Requesting Let's Encrypt certificate for $domain ..." | ||
| if [ $staging != "0" ]; then staging_arg="--staging"; fi | ||
|
|
||
| docker-compose run --rm --no-deps --entrypoint "\ | ||
| certbot certonly --webroot -w /var/www/certbot \ | ||
| $staging_arg \ | ||
| --email $email \ | ||
| -d $domain \ | ||
| --rsa-key-size $rsa_key_size \ | ||
| --agree-tos \ | ||
| --non-interactive" certbot | ||
|
|
||
| echo "### Reloading nginx ..." | ||
| docker-compose exec nginx nginx -s reload |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -109,8 +109,77 @@ services: | |||||||||
| volumes: | ||||||||||
| - minio_data:/data | ||||||||||
|
|
||||||||||
| # OpenHub — hub-new.oscript.io. Секреты — в .env, см. openhub.env.example | ||||||||||
| openhub: | ||||||||||
| image: segateekb/openhub:0.7.24 | ||||||||||
| restart: unless-stopped | ||||||||||
| environment: | ||||||||||
| - TZ=UTC | ||||||||||
| - OSHUB_INSTANCE_URL=https://hub-new.oscript.io | ||||||||||
| - OSHUB_INSTANCE_TRUSTED_PROXIES=10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | ||||||||||
| - data_ИсточникиДанных_ТипКоннектора=КоннекторPostgreSQL | ||||||||||
| - data_ИсточникиДанных_СтрокаСоединения=Host=openhub_db;Username=openhub;Password=${OPENHUB_DB_PASSWORD};Database=openhub | ||||||||||
|
Comment on lines
+120
to
+121
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Use the OpenHub database environment variables. OpenHub reads Proposed fix- - data_ИсточникиДанных_ТипКоннектора=КоннекторPostgreSQL
- - data_ИсточникиДанных_СтрокаСоединения=Host=openhub_db;Username=openhub;Password=${OPENHUB_DB_PASSWORD};Database=openhub
+ - OSHUB_DB_CONNECTOR=КоннекторPostgreSQL
+ - OSHUB_DB_CONNECTION=Host=openhub_db;Username=openhub;Password=${OPENHUB_DB_PASSWORD};Database=openhub📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||
| - OSHUB_STORAGE_BACKEND=s3 | ||||||||||
| - OSHUB_STORAGE_S3_ENDPOINT=http://minio:9000 | ||||||||||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- compose context ---'
sed -n '95,140p' docker-compose.yml
printf '%s\n' '--- relevant files ---'
git ls-files | rg -i '(^|/)(docker-compose|readme|openhub|storage|s3|minio|docker)' | head -200
printf '%s\n' '--- local references ---'
rg -n -i --glob '!*.lock' 'OSHUB_STORAGE_S3_ENDPOINT|openhub:0\.7\.23|SignatureDoesNotMatch|S3.*(port|endpoint)|minio:9000' . | head -200Repository: EvilBeaver/oscript-infrastructure Length of output: 2804 🌐 Web query:
💡 Result: <search_synthesis> <source_evidence> Citations:
🏁 Script executed: #!/bin/bash
set -eu
url='https://raw.githubusercontent.com/Segate-ekb/openhub/main/docker/README.md'
printf '%s\n' "--- $url ---"
curl -L --fail --silent --show-error "$url" | rg -n -C 5 -i 's3|storage|port|80|443|9000|signature' | head -200Repository: EvilBeaver/oscript-infrastructure Length of output: 3304 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- MinIO image ---'
cat -n minio/Dockerfile
printf '%s\n' '--- MinIO entrypoint ---'
cat -n minio/entrypoint.sh
printf '%s\n' '--- MinIO healthcheck ---'
cat -n minio/healthcheck.sh
printf '%s\n' '--- Compose MinIO and dependent endpoint references ---'
sed -n '100,135p' docker-compose.yml
rg -n -C 3 'minio:9000|MINIO_SERVER_URL|MINIO_ADDRESS|--address|healthcheck|mc .*minio|MC_HOST_minio' minio docker-compose.yml web/nginx/sites-enabled/s3.oscript.ioRepository: EvilBeaver/oscript-infrastructure Length of output: 6165 Configure MinIO on a standard S3 port.
🤖 Prompt for AI Agents |
||||||||||
| - OSHUB_STORAGE_S3_BUCKET=openhub | ||||||||||
| - OSHUB_STORAGE_S3_REGION=us-east-1 | ||||||||||
| - OSHUB_STORAGE_S3_FORCE__PATH__STYLE=true | ||||||||||
| - OSHUB_STORAGE_S3_ACCESS_KEY=${OPENHUB_S3_ACCESS_KEY} | ||||||||||
| - OSHUB_STORAGE_S3_SECRET_KEY=${OPENHUB_S3_SECRET_KEY} | ||||||||||
| - Kestrel__Limits__MaxRequestBodySize=134217728 | ||||||||||
| - OSHUB_PUBLISH_MAX__UPLOAD__BYTES=134217728 | ||||||||||
| - OSHUB_PUBLISH_MAX__UNPACKED__BYTES=268435456 | ||||||||||
| - OSHUB_PUBLISH_MAX__FILES=20000 | ||||||||||
| - OTEL_ENABLED=true | ||||||||||
| - OTEL_SERVICE_NAME=openhub | ||||||||||
| - OTEL_EXPORTER_OTLP_ENDPOINT=http://lgtm:4318 | ||||||||||
| - OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf | ||||||||||
| - OTEL_ENTITY_QUERY_TEXT=true | ||||||||||
| volumes: | ||||||||||
| - openhub_data:/var/lib/openhub | ||||||||||
| depends_on: | ||||||||||
| - openhub_db | ||||||||||
| - minio | ||||||||||
| - lgtm | ||||||||||
| networks: | ||||||||||
| - default | ||||||||||
| - openhub | ||||||||||
|
|
||||||||||
| openhub_db: | ||||||||||
| image: postgres:17-alpine | ||||||||||
| restart: unless-stopped | ||||||||||
| environment: | ||||||||||
| - POSTGRES_USER=openhub | ||||||||||
| - POSTGRES_DB=openhub | ||||||||||
| - POSTGRES_PASSWORD=${OPENHUB_DB_PASSWORD} | ||||||||||
| volumes: | ||||||||||
| - openhub_postgres_data:/var/lib/postgresql/data | ||||||||||
| networks: | ||||||||||
| - openhub | ||||||||||
|
|
||||||||||
| # Мониторинг OpenHub одним контейнером: коллектор OTLP, Prometheus, Tempo, Loki и Grafana. | ||||||||||
| # Наружу смотрит только Grafana: grafana.oscript.io | ||||||||||
| lgtm: | ||||||||||
| image: grafana/otel-lgtm:0.33.1 | ||||||||||
| restart: unless-stopped | ||||||||||
| environment: | ||||||||||
| - GF_SERVER_ROOT_URL=https://grafana.oscript.io | ||||||||||
| - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?задайте GRAFANA_ADMIN_PASSWORD в .env} | ||||||||||
| # В образе анонимный вход по умолчанию открыт с ролью Admin | ||||||||||
| - GF_AUTH_ANONYMOUS_ENABLED=false | ||||||||||
| volumes: | ||||||||||
| - lgtm_data:/data | ||||||||||
| - ./monitoring/grafana-dashboards.yaml:/otel-lgtm/grafana/conf/provisioning/dashboards/openhub.yaml:ro | ||||||||||
| - ./monitoring/openhub-dashboard.json:/otel-lgtm/openhub/openhub-dashboard.json:ro | ||||||||||
|
|
||||||||||
| networks: | ||||||||||
| openhub: | ||||||||||
|
|
||||||||||
| volumes: | ||||||||||
| web_content: | ||||||||||
| jenkins_home: | ||||||||||
| postgres_data: | ||||||||||
| minio_data: | ||||||||||
| openhub_data: | ||||||||||
| openhub_postgres_data: | ||||||||||
| lgtm_data: | ||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: 1 | ||
|
|
||
| providers: | ||
| - name: OpenHub | ||
| orgId: 1 | ||
| folder: OpenHub | ||
| type: file | ||
| disableDeletion: false | ||
| allowUiUpdates: false | ||
| updateIntervalSeconds: 30 | ||
| options: | ||
| path: /otel-lgtm/openhub | ||
| foldersFromFilesStructure: false |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
sed -n '25,65p' README.mdRepository: EvilBeaver/oscript-infrastructure
Length of output: 1641
Add the startup command.
Step 5 ends after the colon, and step 6 immediately instructs the operator to open
/setup. The first-run section does not state how to start the hub.Proposed fix
🤖 Prompt for AI Agents