CD Setup via GitLab

I once thought about automating the deployment of my project. gitlab.com kindly provides all the tools for this, so I decided to take advantage of it by figuring out and writing a small deployment script. In this article, I share my experience with the community.

TL;DR

1. Configure VPS: disable root, password login, install dockerd, configure ufw
2. Generate certificates for the server and client docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl Enable dockerd management through TCP socket: remove the -H fd:// option from the Docker config.
3. Прописать пути до сертификатов в docker.json
4. Add the contents of the certificates to the GitLab CI/CD settings as variables. Write a .gitlab-ci.yml script for deployment.

I will demonstrate all examples using the Debian distribution.

Initial VPS Setup

So you've purchased an instance on DO, the first thing you need to do is secure your server from the aggressive outside world. I won't argue or assert anything, just look at the log /var/log/messages of my virtual server:

Screenshot

First, let's install the ufw firewall:

apt-get update && apt-get install ufw

Let's set the default policy: block all incoming connections, allow all outgoing connections:

ufw default deny incoming
ufw default allow outgoing

Important: don't forget to allow SSH connections:

ufw allow OpenSSH

The general syntax is: Allow connection on port: ufw allow 12345, where 12345 is the port number or the service name. Deny: ufw deny 12345

Enable the firewall:

ufw enable

Log out of the session and log back in via SSH.

Add a user, assign a password, and add them to the sudo group.

apt-get install sudo
adduser scoty
usermod -aG sudo scoty

Next, we need to disable password login. To do this, copy your SSH key to the server:

ssh-copy-id root@10.101.10.28

The IP of the server should be yours. Now try logging in with the previously created user, you no longer need to enter a password. Next, in the configuration settings, change the following:

sudo nano /etc/ssh/sshd_config

disable password login:

PasswordAuthentication no

Restart the sshd daemon:

sudo systemctl reload sshd

Now, if you or anyone else tries to enter with the root user, nothing will happen.

Next, install dockerd; I won't describe the process here, as everything may already have changed; go to the official website and follow the Docker installation steps for your virtual machine: https://docs.docker.com/install/linux/docker-ce/debian/

Certificate Generation

To manage the Docker daemon remotely, an encrypted TLS connection is required. You need to have a certificate and key, which must be generated and transferred to your remote machine. Follow the steps provided in the instructions on the official Docker website: https://docs.docker.com/engine/security/https/#create-a-ca-server-and-client-keys-with-openssl All generated *.pem files for the server, namely ca.pem, server.pem, key.pem, should be placed in the directory /etc/docker on the server.

Configuring dockerd

In the Docker daemon startup script, remove the -H df:// option, which specifies on which host you can manage the Docker daemon.

# At /lib/systemd/system/docker.service
[Service]
Type=notify
ExecStart=/usr/bin/dockerd

Next, create a configuration file if it does not exist and specify the options:

/etc/docker/docker.json

{
  "hosts": [
    "unix://var/run/docker.sock",
    "tcp://0.0.0.0:2376"
  ],
  "labels": [
    "is-our-remote-engine=true"
  ],
  "tls": true,
  "tlscacert": "/etc/docker/ca.pem",
  "tlscert": "/etc/docker/server.pem",
  "tlskey": "/etc/docker/key.pem",
  "tlsverify": true
}

Allow connections on port 2376:

sudo ufw allow 2376

Restart dockerd with the new settings:

sudo systemctl daemon-reload && sudo systemctl restart docker

Let's check:

sudo systemctl status docker

If everything is "green", then we can assume that we have successfully configured Docker on the server.

Setting up continuous delivery on GitLab

For the GitLab worker to execute commands on the remote Docker host, you need to determine how and where to store the certificates and key for an encrypted connection to dockerd. I solved this issue by simply defining variables in the GitLab settings:

Spoiler Title

Just output the contents of the certificates and key using cat: cat ca.pem. Copy and paste into the values of the variables.

Let's write a script for deployment via GitLab. We will use the Docker-in-Docker (dind) image.

.gitlab-ci.yml

image:
  name: docker/compose:1.23.2
  # rewrite entrypoint to work in dind
  entrypoint: ["/bin/sh", "-c"]

variables:
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2

services:
  - docker:dind

stages:
  - deploy

deploy:
  stage: deploy
  script:
    - bin/deploy.sh # deployment script here

Contents of the deployment script with comments:

bin/deploy.sh

#!/usr/bin/env sh
# Падаем сразу, если возникли какие-то ошибки
set -e
# Выводим, то , что делаем
set -v

# 
DOCKER_COMPOSE_FILE=docker-compose.yml
# Куда деплоим
DEPLOY_HOST=185.241.52.28
# Путь для сертификатов клиента, то есть в нашем случае - gitlab-воркера
DOCKER_CERT_PATH=/root/.docker

# проверим, что в контейнере все имеется
docker info
docker-compose version

# создаем путь (сейчас работаем в клиенте - воркере gitlab'а)
mkdir $DOCKER_CERT_PATH
# изымаем содержимое переменных, при этом удаляем лишние символы добавленные при сохранении переменных.
echo "$CA_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/ca.pem
echo "$CERT_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/cert.pem
echo "$KEY_PEM" | tr -d 'r' > $DOCKER_CERT_PATH/key.pem
# на всякий случай даем только читать
chmod 400 $DOCKER_CERT_PATH/ca.pem
chmod 400 $DOCKER_CERT_PATH/cert.pem
chmod 400 $DOCKER_CERT_PATH/key.pem

# далее начинаем уже работать с удаленным docker-демоном. Собственно, сам деплой
export DOCKER_TLS_VERIFY=1
export DOCKER_HOST=tcp://$DEPLOY_HOST:2376

# проверим, что коннектится все успешно
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  ps

# логинимся в docker-регистри, тут можете указать свой "местный" регистри
docker login -u $DOCKER_USER -p $DOCKER_PASSWORD

docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  pull app
# поднимаем приложение
docker-compose 
  -f $DOCKER_COMPOSE_FILE 
  up -d app

The main issue was to "extract" the contents of the certificates from the GitLab CI/CD variables in a normal form. I couldn't understand why the connection to the remote host was not working. I checked the log on the host with sudo journalctl -u docker, and there was an error during the handshake. I decided to see what was actually stored in the variables, so I checked with cat -A $DOCKER_CERT_PATH/key.pem. I resolved the error by removing the carriage return character with tr -d 'r'.

You can add post-release tasks to the script at your discretion. You can familiarize yourself with the working version in my repository. https://gitlab.com/isqad/gitlab-ci-cd

Source: habr.com