add app ufw-docker

2022-12-05 19:29:00 +00:00
parent b938dd0ffd
commit b8fe9d893c
26 changed files with 95 additions and 61 deletions
@@ -34,9 +34,9 @@ ANSIBLE_SSH_USERNAME            ?= $(firstword $(SSH_USER))
 ANSIBLE_SERVER_NAME             ?= $(SERVER_NAME)
 ANSIBLE_USERNAME                ?= $(USER)
 ANSIBLE_VERBOSE                 ?= $(if $(DEBUG),-vvvv,$(if $(VERBOSE),-v))
-CMDARGS                         += ansible ansible-playbook
 DOCKER_RUN_OPTIONS_ANSIBLE      ?= -it $(if $(DOCKER_INTERNAL_DOCKER_HOST),--add-host=host.docker.internal:$(DOCKER_INTERNAL_DOCKER_HOST))
 ENV_VARS                        += ANSIBLE_APP_LOAD ANSIBLE_APP_NAME ANSIBLE_AWS_ACCESS_KEY_ID ANSIBLE_AWS_DEFAULT_OUTPUT ANSIBLE_AWS_DEFAULT_REGION ANSIBLE_AWS_SECRET_ACCESS_KEY ANSIBLE_CONFIG ANSIBLE_DISKS_NFS_DISK ANSIBLE_DISKS_NFS_OPTIONS ANSIBLE_DISKS_NFS_PATH ANSIBLE_DOCKER_IMAGE_TAG ANSIBLE_DOCKER_REGISTRY ANSIBLE_EXTRA_VARS ANSIBLE_GIT_DIRECTORY ANSIBLE_GIT_KEY_FILE ANSIBLE_GIT_REPOSITORY ANSIBLE_GIT_VERSION ANSIBLE_INVENTORY ANSIBLE_MYOS ANSIBLE_PLAYBOOK ANSIBLE_SSH_AUTHORIZED_KEYS ANSIBLE_SSH_BASTION_HOSTNAME ANSIBLE_SSH_BASTION_USERNAME ANSIBLE_SSH_PRIVATE_IP_RANGE ANSIBLE_SSH_PRIVATE_KEYS ANSIBLE_SSH_PUBLIC_HOSTS ANSIBLE_SSH_USERNAME ANSIBLE_USERNAME ANSIBLE_VERBOSE
+MAKECMDARGS                     += ansible ansible-playbook

 # function ansible: Call run ansible ANSIBLE_ARGS with arg 1
 define ansible
@@ -13,9 +13,9 @@ AWS_SECRET_ACCESS_KEY           := $(if $(AWS_CREDENTIALS),$(shell $(call conf,$
 AWS_SERVICE_NAME                ?= $(COMPOSE_SERVICE_NAME)
 AWS_SERVICE_VERSION             ?= $(BUILD_DATE)-$(VERSION)
 AWS_SNAP_DESCRIPTION            ?= $(AWS_SERVICE_NAME)-$(AWS_SERVICE_VERSION)-$(AWS_S3_FILENAME)
-CMDARGS                         += aws
 DOCKER_RUN_VOLUME               += -v $(HOME)/.aws:/home/$(USER)/.aws
 ENV_VARS                        += AWS_ACCESS_KEY_ID AWS_AMI_DESCRIPTION AWS_AMI_NAME AWS_DEFAULT_OUTPUT AWS_DEFAULT_REGION AWS_INSTANCE_ID AWS_PROFILE AWS_S3_BUCKET AWS_S3_KEY AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SNAP_DESCRIPTION AWS_SNAP_ID
+MAKECMDARGS                     += aws

 # function aws: Call run aws with arg 1
 define aws
@@ -156,7 +156,7 @@ restart: docker-compose-restart app-start ## Restart application
 # target run: Run command ARGS in a new docker SERVICE
 # on local host
 .PHONY: run
-run: SERVICE ?= $(DOCKER_SERVICE)
+run: SERVICE ?= $(or $(DOCKER_COMPOSE_SERVICE),$(DOCKER_SERVICE))
 run: ## Run a command in a new docker
 #ifneq (,$(filter $(ENV),$(ENV_DEPLOY)))
 #	$(call run,$(ARGS))
@@ -1,5 +1,3 @@
-CMDARGS                         += docker-run docker-run-%
-COMPOSE_ARGS                    ?= --ansi auto
 COMPOSE_FILE                    ?= $(wildcard docker-compose.yml docker/docker-compose.yml $(foreach file,$(patsubst docker/docker-compose.%,%,$(basename $(wildcard docker/docker-compose.*.yml))),$(if $(filter true,$(COMPOSE_FILE_$(file)) $(COMPOSE_FILE_$(call UPPERCASE,$(file)))),docker/docker-compose.$(file).yml)))
 COMPOSE_FILE_$(ENV)             ?= true
 COMPOSE_FILE_DEBUG              ?= $(if $(DEBUG),true)
@@ -28,10 +26,13 @@ DOCKER_BUILD_TARGET             ?= $(if $(filter $(ENV),$(DOCKER_BUILD_TARGETS))
 DOCKER_BUILD_TARGET_DEFAULT     ?= master
 DOCKER_BUILD_TARGETS            ?= $(ENV_DEPLOY)
 DOCKER_BUILD_VARS               ?= APP BRANCH COMPOSE_VERSION DOCKER_GID DOCKER_MACHINE DOCKER_REPOSITORY DOCKER_SYSTEM GIT_AUTHOR_EMAIL GIT_AUTHOR_NAME SSH_REMOTE_HOSTS USER VERSION
-DOCKER_COMPOSE                  ?= $(if $(DOCKER_RUN),docker/compose:$(COMPOSE_VERSION),$(or $(shell docker compose >/dev/null 2>&1 && printf 'docker compose\n'),docker-compose)) $(COMPOSE_ARGS)
+DOCKER_COMPOSE                  ?= $(or $(shell docker-compose --version 2>/dev/null |awk '$$4 != "v'"$(COMPOSE_VERSION)"'" {exit 1;}' && printf 'docker-compose\n'),$(shell docker compose >/dev/null 2>&1 && printf 'docker compose\n'))
+DOCKER_COMPOSE_ARGS             ?= --ansi=auto
 DOCKER_COMPOSE_DOWN_OPTIONS     ?=
 DOCKER_COMPOSE_PROJECT_NAME     ?= $(if $(filter host,$(firstword $(subst /, ,$(STACK)))),$(HOST_COMPOSE_PROJECT_NAME),$(if $(filter User,$(firstword $(subst /, ,$(STACK)))),$(USER_COMPOSE_PROJECT_NAME)))
-DOCKER_COMPOSE_RUN_OPTIONS      ?= --rm
+DOCKER_COMPOSE_RUN_ENTRYPOINT   ?= $(patsubst %,--entrypoint=%,$(DOCKER_COMPOSE_ENTRYPOINT))
+DOCKER_COMPOSE_RUN_OPTIONS      ?= --rm $(DOCKER_COMPOSE_RUN_ENTRYPOINT) $(DOCKER_COMPOSE_RUN_WORKDIR)
+DOCKER_COMPOSE_RUN_WORKDIR      ?= $(if $(DOCKER_COMPOSE_WORKDIR),-w $(DOCKER_COMPOSE_WORKDIR))
 DOCKER_COMPOSE_SERVICE_NAME     ?= $(subst _,-,$(DOCKER_COMPOSE_PROJECT_NAME))
 DOCKER_COMPOSE_UP_OPTIONS       ?= -d
 DOCKER_IMAGE_TAG                ?= $(if $(filter true,$(DEPLOY)),$(if $(filter $(ENV),$(ENV_DEPLOY)),$(VERSION)),$(if $(DRONE_BUILD_NUMBER),$(DRONE_BUILD_NUMBER),latest))
@@ -52,6 +53,7 @@ DOCKER_SERVICE                  ?= $(lastword $(DOCKER_SERVICES))
 DOCKER_SERVICES                 ?= $(eval IGNORE_DRYRUN := true)$(eval IGNORE_VERBOSE := true)$(shell $(call docker-compose,config --services) 2>/dev/null)$(eval IGNORE_DRYRUN := false)$(eval IGNORE_VERBOSE := false)
 DOCKER_SHELL                    ?= /bin/sh
 ENV_VARS                        += COMPOSE_PROJECT_NAME COMPOSE_SERVICE_NAME DOCKER_BUILD_TARGET DOCKER_IMAGE_TAG DOCKER_REGISTRY DOCKER_REPOSITORY DOCKER_SHELL
+MAKECMDARGS                     += docker-run docker-run-%

 ifeq ($(DRONE), true)
 APP_PATH_PREFIX                 := $(DRONE_BUILD_NUMBER)
@@ -83,14 +85,21 @@ endef
 # function docker-compose: Run docker-compose with arg 1
 define docker-compose
 	$(call INFO,docker-compose,$(1))
-	$(if $(DOCKER_RUN),$(call docker-build,$(MYOS)/docker/compose,docker/compose:$(COMPOSE_VERSION)))
-	$(if $(COMPOSE_FILE),$(call run,$(DOCKER_COMPOSE) $(patsubst %,-f %,$(COMPOSE_FILE)) -p $(COMPOSE_PROJECT_NAME) $(1)))
+	$(if $(COMPOSE_FILE),
+	  $(if $(DOCKER_COMPOSE),
+	    $(call env-exec,$(RUN) $(DOCKER_COMPOSE) $(DOCKER_COMPOSE_ARGS) $(patsubst %,-f %,$(COMPOSE_FILE)) -p $(COMPOSE_PROJECT_NAME) $(1))
+	  , $(if $(DOCKER_RUN),
+	      $(call docker-build,$(MYOS)/docker/compose,docker/compose:$(COMPOSE_VERSION))
+	      $(call docker-run,docker/compose:$(COMPOSE_VERSION) $(DOCKER_COMPOSE_ARGS),$(patsubst %,-f %,$(COMPOSE_FILE)) -p $(COMPOSE_PROJECT_NAME) $(1))
+	    , $(call env-exec,$(RUN) docker-compose $(DOCKER_COMPOSE_ARGS) $(patsubst %,-f %,$(COMPOSE_FILE)) -p $(COMPOSE_PROJECT_NAME) $(1))
+	    )
+	  )
+	)
 endef
 # function docker-compose-exec-sh: Run docker-compose-exec sh -c 'arg 2' in service 1
 define docker-compose-exec-sh
 	$(call INFO,docker-compose-exec-sh,$(1)$(comma) $(2))
-	$(if $(DOCKER_RUN),$(call docker-build,$(MYOS)/docker/compose,docker/compose:$(COMPOSE_VERSION)))
-	$(if $(COMPOSE_FILE),$(call run,$(DOCKER_COMPOSE) $(patsubst %,-f %,$(COMPOSE_FILE)) -p $(COMPOSE_PROJECT_NAME) exec -T $(1) sh -c '$(2)'))
+	$(call docker-compose,exec -T $(1) sh -c '$(2)')
 endef
 # function docker-push: Push docker image
 define docker-push
@@ -17,11 +17,11 @@ APP_UPSTREAM_REPOSITORY         ?= $(or $(shell git config --get remote.upstream
 APP_URI                         ?= $(APP_HOST)/$(APP_PATH)
 APP_URIS                        ?= $(APP_URI)
 APP_URL                         ?= $(APP_SCHEME)://$(APP_URI)
-CMDARGS                         += exec exec:% exec@% run run:% run@%
 CONTEXT                         += APP APPS BRANCH DOMAIN VERSION RELEASE
 CONTEXT_DEBUG                   += APP_DIR APP_URL APP_REPOSITORY APP_UPSTREAM_REPOSITORY ENV_DEPLOY
 ENV_DEPLOY                      ?= $(patsubst origin/%,%,$(shell git rev-parse --symbolic --remotes=origin |sed '/origin\/HEAD/d' 2>/dev/null))
 ENV_VARS                        += APP_DIR APP_DOMAIN APP_HOST APP_PATH APP_URL CONSUL_HTTP_TOKEN $(if $(filter true,$(MOUNT_NFS)),NFS_CONFIG)
+MAKECMDARGS                     += exec exec:% exec@% run run:% run@%
 MOUNT_NFS                       ?= false
 NFS_CONFIG                      ?= addr=$(NFS_HOST),actimeo=3,intr,noacl,noatime,nocto,nodiratime,nolock,soft,rsize=32768,wsize=32768,tcp,rw,vers=3
 NFS_HOST                        ?= host.docker.internal
@@ -1,4 +1,4 @@
-CMDARGS                         += ufw ufw-docker
+MAKECMDARGS                     += ufw ufw-docker
 UFW_UPDATE                      ?= $(or $(SERVICE),$(DOCKER_SERVICES))

 ifeq ($(SETUP_UFW),true)
@@ -118,10 +118,10 @@ docker-images-myos: MAKE_VARS += DOCKER_REPOSITORY STACK
 docker-images-myos:
 	$(foreach image,$(subst $(quote),,$(DOCKER_IMAGES_MYOS)),$(call make,docker-build-$(image),$(MYOS)))

-# target docker-images-rm: Call docker-image-rm-% target for DOCKER_REPOSITORY
+# target docker-images-rm: Remove docker images matching DOCKER_REPOSITORY
 .PHONY: docker-images-rm
 docker-images-rm:
-	$(call make,docker-images-rm-$(DOCKER_REPOSITORY)/)
+	docker images |awk '$$1 ~ /^$(subst /,\/,$(DOCKER_REPOSITORY)/)/ {print $$3}' |sort -u |while read image; do $(RUN) docker rmi -f $$image; done

 # target docker-images-rm-%: Remove docker images matching %
 .PHONY: docker-images-rm-%
@@ -226,7 +226,7 @@ docker-run-%: docker-build-%
 	$(eval path            := $(patsubst %/,%,$*))
 	$(eval image           := $(DOCKER_REPOSITORY)/$(lastword $(subst /, ,$(path)))$(if $(findstring :,$*),,:$(DOCKER_IMAGE_TAG)))
 	$(eval image_id        := $(shell docker images -q $(image) 2>/dev/null))
-	$(call docker-run,$(command),$(if $(image_id),$(image),$(path)))
+	$(call docker-run,$(if $(image_id),$(image),$(path)),$(command))

 # target docker-tag: Call docker-tag for each SERVICES
 .PHONY: docker-tag
@@ -1,7 +1,7 @@
-CMDARGS                         += ssh-run
 COMPOSE_IGNORE_ORPHANS          := true
 ENV_VARS                        += COMPOSE_IGNORE_ORPHANS MYOS_TAGS_JSON
 HOME                            ?= /home/$(USER)
+MAKECMDARGS                     += ssh-run
 MYOS_TAGS_VARS                  ?= env user
 MYOS_TAGS_ARGS                  ?= $(foreach var,$(filter $(MYOS_TAGS_VARS),$(MAKE_FILE_VARS)),$(if $($(var)),$(var)='$($(var))'))
 MYOS_TAGS_JSON                  ?= "{$(foreach var,$(filter $(MYOS_TAGS_VARS),$(MAKE_FILE_VARS)),$(if $($(var)), '$(var)': '$($(var))'$(comma))) }"
@@ -5,7 +5,7 @@
 .PHONY: setup-binfmt
 setup-binfmt:
 ifeq ($(SETUP_BINFMT),true)
-	$(call docker-run,--install $(SETUP_BINFMT_ARCH),--privileged tonistiigi/binfmt)
+	$(call docker-run,--privileged tonistiigi/binfmt,--install $(SETUP_BINFMT_ARCH))
 endif

 # target setup-docker-group: Call ansible to add user in docker group if needed
@@ -39,13 +39,13 @@ endif

 # target setup-ufw: Install ufw-docker
 .PHONY: setup-ufw
+setup-ufw: COMPOSE_PROJECT_NAME := $(HOST_COMPOSE_PROJECT_NAME)
+setup-ufw: DOCKER_RUN_OPTIONS := --rm -d --cap-add NET_ADMIN -v /etc/ufw:/etc/ufw $(if wildcard /etc/default/ufw,-v /etc/default/ufw:/etc/default/ufw) --network host
 setup-ufw:
 ifeq ($(SETUP_UFW),true)
 	$(call app-install,$(SETUP_UFW_REPOSITORY))
 	$(call app-bootstrap,$(lastword $(subst /, ,$(SETUP_UFW_REPOSITORY))))
-	$(eval COMPOSE_PROJECT_NAME := $(HOST_COMPOSE_PROJECT_NAME))
 	$(call app-build)
-	$(eval DOCKER_RUN_OPTIONS := --rm --cap-add NET_ADMIN -v /etc/ufw:/etc/ufw --network host)
 	$(call app-up)
 	$(call ufw-docker,install)
 endif
@@ -1,5 +1,6 @@
-CMDARGS                         += openstack
 ENV_VARS                        += OS_AUTH_URL OS_TENANT_ID OS_TENANT_NAME OS_USERNAME OS_PASSWORD OS_REGION_NAME OS_USER_DOMAIN_NAME OS_PROJECT_DOMAIN_NAME
+MAKECMDARGS                     += openstack
+
 ifneq ($(DEBUG),)
 OPENSTACK_ARGS                  += --debug
 endif
@@ -1,7 +1,7 @@
-CMDARGS                         += packer
 DOCKER_RUN_OPTIONS_PACKER       ?= -it -p $(PACKER_SSH_PORT):$(PACKER_SSH_PORT) -p $(PACKER_VNC_PORT):$(PACKER_VNC_PORT) -v $(SSH_DIR):$(SSH_DIR)
 ENV_VARS                        += PACKER_CACHE_DIR PACKER_KEY_INTERVAL PACKER_LOG
 KVM_GID                         ?= $(call gid,kvm)
+MAKECMDARGS                     += packer
 PACKER_ARCH                     ?= $(PACKER_ALPINE_ARCH)
 PACKER_BOOT_WAIT                ?= 24s
 PACKER_BUILD_ARGS               ?= -on-error=cleanup $(foreach var,$(PACKER_BUILD_VARS),$(if $($(var)),-var $(var)='$($(var))'))
@@ -1,4 +1,4 @@
-CMDARGS                         += terraform
+MAKECMDARGS                     += terraform

 define terraform
 	$(RUN) $(call run,terraform $(1),hashicorp/)
@@ -16,12 +16,14 @@ ufw-docker:
 # target ufw-docker: Call ufw and ufw-docker foreach service UFW_UPDATE
 .PHONY: ufw-update
 ufw-update: debug-UFW_UPDATE
-	$(eval name := $(DOCKER_COMPOSE_PROJECT_NAME))
-	$(foreach update,$(UFW_UPDATE), \
-	  $(foreach port,$(UFW_DOCKER_$(update)) $(UFW_DOCKER_$(name)-$(update)), \
-		  $(call ufw-docker,$(if $(UFW_DELETE),delete) allow $(name)-$(update) $(port) ||:) \
+	$(eval name := $(COMPOSE_PROJECT_NAME))
+	$(foreach UPDATE,$(call UPPERCASE,$(UFW_UPDATE)), \
+	  $(eval ufw_update := $($(if $(filter host,$(firstword $(subst /, ,$(STACK)))),HOST_)$(UPDATE)_UFW_UPDATE)) \
+	  $(eval ufw_docker := $($(if $(filter host,$(firstword $(subst /, ,$(STACK)))),HOST_)$(UPDATE)_UFW_DOCKER)) \
+	  $(foreach port,$(ufw_docker), \
+	    $(call ufw-docker,$(if $(UFW_DELETE),delete) allow $(name)-$(call LOWERCASE,$(UPDATE)) $(port) ||:) \
 	  ) \
-	  $(foreach port,$(UFW_UPDATE_$(update)) $(UFW_UPDATE_$(name)-$(update)), \
+	  $(foreach port,$(ufw_update), \
 	    $(call ufw,$(if $(UFW_DELETE),delete) allow $(port)) \
 	  ) \
 	)