Initial Commit

.gitlab/workflows/deploy-k8s.gitlab-ci.yml

@@ -0,0 +1,198 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# K8s stack deploy pipeline — mirrors .gitea/workflows/deploy-k8s.yml
+#
+# Triggered on pushes to main when files under k8s/apps/*.tfvars change.
+# Two jobs run in sequence:
+#   deploy-k8s   — loops over added/modified tfvars and applies each app
+#   destroy-k8s  — loops over deleted tfvars, recovers content from git
+#                  history, destroys each app and removes its workspace
+#
+# gopass paths used:
+#   infra/kubeconfigs/<app-name>       — kubeconfig for the target cluster
+#   apps/<app-name>/rabbitmq_password  — RabbitMQ admin password
+#   apps/<app-name>/loki_token         — optional Loki auth bearer token
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ─── Shared template: OpenTofu + gopass setup ────────────────────────────────
+.deploy_k8s_base:
+  image: ubuntu:22.04
+  variables:
+    GIT_DEPTH: "0"
+    TOFU_WORKING_DIR: "k8s"
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq curl git jq gnupg
+    - |
+      curl -fsSL https://get.opentofu.org/install-opentofu.sh \
+        | sh -s -- --install-method=standalone --opentofu-version=$TOFU_VERSION
+    - |
+      curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz \
+        | tar xz
+      mv gopass /usr/local/bin/
+    - |
+      echo "$GOPASS_GPG_KEY" | gpg --batch --import
+      gopass clone "$GOPASS_STORE_REPO"
+
+# ─── Deploy / Update ─────────────────────────────────────────────────────────
+deploy-k8s:
+  extends: .deploy_k8s_base
+  stage: deploy
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
+      changes:
+        - k8s/apps/*.tfvars
+  script:
+    - |
+      ADDED_MODIFIED=$(git diff --name-only --diff-filter=ACM \
+        "$CI_COMMIT_BEFORE_SHA" "$CI_COMMIT_SHA" -- 'k8s/apps/*.tfvars')
+
+      if [ -z "$ADDED_MODIFIED" ]; then
+        echo "No K8s tfvars files added or modified. Nothing to deploy."
+        exit 0
+      fi
+
+      echo "Files to deploy: $ADDED_MODIFIED"
+      FAILED=0
+
+      for TFVARS in $ADDED_MODIFIED; do
+        APP=$(basename "$TFVARS" .tfvars)
+        echo ""
+        echo "══════════════════════════════════════════"
+        echo "  Deploying K8s app: $APP"
+        echo "══════════════════════════════════════════"
+
+        if ! (
+          set -e
+
+          # ── Fetch kubeconfig from gopass ──
+          gopass show -o "infra/kubeconfigs/$APP" > /tmp/kubeconfig
+          chmod 600 /tmp/kubeconfig
+
+          # ── Fetch app secrets from gopass ──
+          RABBITMQ_PASSWORD=$(gopass show -o "apps/$APP/rabbitmq_password" 2>/dev/null || echo "")
+          LOKI_AUTH_TOKEN=$(gopass show -o "apps/$APP/loki_token" 2>/dev/null || echo "")
+
+          # ── tofu init with SeaweedFS backend ──
+          export AWS_ACCESS_KEY_ID="$SEAWEED_ACCESS_KEY"
+          export AWS_SECRET_ACCESS_KEY="$SEAWEED_SECRET_KEY"
+
+          cd "$TOFU_WORKING_DIR"
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps-k8s/$APP.tfstate" \
+            -backend-config="endpoint=$SEAWEED_S3_ENDPOINT" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true" \
+            -reconfigure
+
+          # ── Workspace ──
+          tofu workspace select "$APP" 2>/dev/null || tofu workspace new "$APP"
+
+          # ── Apply ──
+          tofu apply -auto-approve \
+            -var-file="../$TFVARS" \
+            -var="kubeconfig_path=/tmp/kubeconfig" \
+            -var="rabbitmq_password=$RABBITMQ_PASSWORD" \
+            -var="loki_auth_token=$LOKI_AUTH_TOKEN"
+
+          rm -f /tmp/kubeconfig
+          echo "  Deployed K8s app: $APP"
+        ); then
+          echo "ERROR: Deployment of K8s app $APP failed — continuing with remaining apps"
+          FAILED=1
+          rm -f /tmp/kubeconfig
+        fi
+      done
+
+      if [ $FAILED -ne 0 ]; then
+        echo ""
+        echo "One or more K8s deployments failed. See logs above for details."
+        exit 1
+      fi
+  after_script:
+    - rm -f /tmp/kubeconfig
+
+# ─── Destroy (tfvars file deleted) ───────────────────────────────────────────
+destroy-k8s:
+  extends: .deploy_k8s_base
+  stage: destroy
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
+      changes:
+        - k8s/apps/*.tfvars
+  script:
+    - |
+      DELETED=$(git diff --name-only --diff-filter=D \
+        "$CI_COMMIT_BEFORE_SHA" "$CI_COMMIT_SHA" -- 'k8s/apps/*.tfvars')
+
+      if [ -z "$DELETED" ]; then
+        echo "No K8s tfvars files deleted. Nothing to destroy."
+        exit 0
+      fi
+
+      echo "Files to destroy: $DELETED"
+      FAILED=0
+
+      for TFVARS in $DELETED; do
+        APP=$(basename "$TFVARS" .tfvars)
+        echo ""
+        echo "══════════════════════════════════════════"
+        echo "  Destroying K8s app: $APP"
+        echo "══════════════════════════════════════════"
+
+        if ! (
+          set -e
+
+          # ── Recover deleted tfvars from git history ──
+          git show "$CI_COMMIT_BEFORE_SHA:$TFVARS" > /tmp/${APP}.tfvars
+
+          # ── Fetch kubeconfig from gopass ──
+          gopass show -o "infra/kubeconfigs/$APP" > /tmp/kubeconfig
+          chmod 600 /tmp/kubeconfig
+
+          # ── Fetch app secrets from gopass ──
+          RABBITMQ_PASSWORD=$(gopass show -o "apps/$APP/rabbitmq_password" 2>/dev/null || echo "")
+          LOKI_AUTH_TOKEN=$(gopass show -o "apps/$APP/loki_token" 2>/dev/null || echo "")
+
+          # ── tofu init ──
+          export AWS_ACCESS_KEY_ID="$SEAWEED_ACCESS_KEY"
+          export AWS_SECRET_ACCESS_KEY="$SEAWEED_SECRET_KEY"
+
+          cd "$TOFU_WORKING_DIR"
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps-k8s/$APP.tfstate" \
+            -backend-config="endpoint=$SEAWEED_S3_ENDPOINT" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true" \
+            -reconfigure
+
+          # ── Select existing workspace ──
+          tofu workspace select "$APP"
+
+          # ── Destroy ──
+          tofu destroy -auto-approve \
+            -var-file="/tmp/${APP}.tfvars" \
+            -var="kubeconfig_path=/tmp/kubeconfig" \
+            -var="rabbitmq_password=$RABBITMQ_PASSWORD" \
+            -var="loki_auth_token=$LOKI_AUTH_TOKEN"
+
+          # ── Remove workspace ──
+          tofu workspace select default
+          tofu workspace delete "$APP"
+
+          rm -f /tmp/${APP}.tfvars /tmp/kubeconfig
+          echo "  Destroyed K8s app: $APP"
+        ); then
+          echo "ERROR: Destroy of K8s app $APP failed — continuing with remaining apps"
+          FAILED=1
+          rm -f /tmp/${APP}.tfvars /tmp/kubeconfig
+        fi
+      done
+
+      if [ $FAILED -ne 0 ]; then
+        echo ""
+        echo "One or more K8s destroy operations failed. See logs above for details."
+        exit 1
+      fi
+  after_script:
+    - rm -f /tmp/kubeconfig /tmp/*.tfvars

.gitlab/workflows/deploy.gitlab-ci.yml

@@ -0,0 +1,202 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Docker stack deploy pipeline — mirrors .gitea/workflows/deploy.yml
+#
+# Triggered on pushes to main when files under apps/*.tfvars change.
+# Two jobs run in sequence:
+#   deploy-docker   — loops over added/modified tfvars and applies each app
+#   destroy-docker  — loops over deleted tfvars, recovers content from git
+#                     history, destroys each app and removes its workspace
+#
+# Both jobs process all changed files sequentially (GitLab CI does not support
+# dynamic matrix jobs natively). A failure in one app is recorded but processing
+# continues for the remaining apps (fail-fast: false equivalent).
+#
+# Key difference from Gitea: deleted tfvars content is recovered via
+#   git show $CI_COMMIT_BEFORE_SHA:$TFVARS
+# instead of checking out the previous commit.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ─── Shared template: OpenTofu + gopass setup ────────────────────────────────
+.deploy_base:
+  image: ubuntu:22.04
+  variables:
+    # Full clone so git show $CI_COMMIT_BEFORE_SHA works for deleted files
+    GIT_DEPTH: "0"
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq curl git jq gnupg
+    - |
+      curl -fsSL https://get.opentofu.org/install-opentofu.sh \
+        | sh -s -- --install-method=standalone --opentofu-version=$TOFU_VERSION
+    - |
+      curl -fsSL https://github.com/gopasspw/gopass/releases/latest/download/gopass-linux-amd64.tar.gz \
+        | tar xz
+      mv gopass /usr/local/bin/
+    - |
+      echo "$GOPASS_GPG_KEY" | gpg --batch --import
+      gopass clone "$GOPASS_STORE_REPO"
+
+# ─── Deploy / Update ─────────────────────────────────────────────────────────
+deploy-docker:
+  extends: .deploy_base
+  stage: deploy
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
+      changes:
+        - apps/*.tfvars
+  script:
+    - |
+      ADDED_MODIFIED=$(git diff --name-only --diff-filter=ACM \
+        "$CI_COMMIT_BEFORE_SHA" "$CI_COMMIT_SHA" -- 'apps/*.tfvars')
+
+      if [ -z "$ADDED_MODIFIED" ]; then
+        echo "No Docker tfvars files added or modified. Nothing to deploy."
+        exit 0
+      fi
+
+      echo "Files to deploy: $ADDED_MODIFIED"
+      FAILED=0
+
+      for TFVARS in $ADDED_MODIFIED; do
+        APP=$(basename "$TFVARS" .tfvars)
+        echo ""
+        echo "══════════════════════════════════════════"
+        echo "  Deploying: $APP"
+        echo "══════════════════════════════════════════"
+
+        if ! (
+          set -e
+
+          # ── Fetch SSH key from gopass ──
+          gopass show -o "infra/ssh-keys/$APP" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+
+          # ── Fetch app secrets from gopass ──
+          DB_PASSWORD=$(gopass show -o "apps/$APP/db_password")
+          GIT_TOKEN=$(gopass show -o "apps/$APP/git_token" 2>/dev/null || echo "")
+
+          # ── tofu init with SeaweedFS backend ──
+          export AWS_ACCESS_KEY_ID="$SEAWEED_ACCESS_KEY"
+          export AWS_SECRET_ACCESS_KEY="$SEAWEED_SECRET_KEY"
+
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps/$APP.tfstate" \
+            -backend-config="endpoint=$SEAWEED_S3_ENDPOINT" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true" \
+            -reconfigure
+
+          # ── Workspace ──
+          tofu workspace select "$APP" 2>/dev/null || tofu workspace new "$APP"
+
+          # ── Apply ──
+          tofu apply -auto-approve \
+            -var-file="$TFVARS" \
+            -var="ssh_key_path=/tmp/deploy_key" \
+            -var="db_password=$DB_PASSWORD" \
+            -var="openresty_git_token=$GIT_TOKEN"
+
+          rm -f /tmp/deploy_key
+          echo "  Deployed: $APP"
+        ); then
+          echo "ERROR: Deployment of $APP failed — continuing with remaining apps"
+          FAILED=1
+          rm -f /tmp/deploy_key
+        fi
+      done
+
+      if [ $FAILED -ne 0 ]; then
+        echo ""
+        echo "One or more deployments failed. See logs above for details."
+        exit 1
+      fi
+  after_script:
+    # Safety cleanup in case the job was interrupted
+    - rm -f /tmp/deploy_key
+
+# ─── Destroy (tfvars file deleted) ───────────────────────────────────────────
+destroy-docker:
+  extends: .deploy_base
+  stage: destroy
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
+      changes:
+        - apps/*.tfvars
+  script:
+    - |
+      DELETED=$(git diff --name-only --diff-filter=D \
+        "$CI_COMMIT_BEFORE_SHA" "$CI_COMMIT_SHA" -- 'apps/*.tfvars')
+
+      if [ -z "$DELETED" ]; then
+        echo "No Docker tfvars files deleted. Nothing to destroy."
+        exit 0
+      fi
+
+      echo "Files to destroy: $DELETED"
+      FAILED=0
+
+      for TFVARS in $DELETED; do
+        APP=$(basename "$TFVARS" .tfvars)
+        echo ""
+        echo "══════════════════════════════════════════"
+        echo "  Destroying: $APP"
+        echo "══════════════════════════════════════════"
+
+        if ! (
+          set -e
+
+          # ── Recover deleted tfvars from git history ──
+          # No need to check out the previous commit — git show reads it directly.
+          git show "$CI_COMMIT_BEFORE_SHA:$TFVARS" > /tmp/${APP}.tfvars
+
+          # ── Fetch SSH key from gopass ──
+          gopass show -o "infra/ssh-keys/$APP" > /tmp/deploy_key
+          chmod 600 /tmp/deploy_key
+
+          # ── Fetch app secrets from gopass ──
+          DB_PASSWORD=$(gopass show -o "apps/$APP/db_password")
+          GIT_TOKEN=$(gopass show -o "apps/$APP/git_token" 2>/dev/null || echo "")
+
+          # ── tofu init ──
+          export AWS_ACCESS_KEY_ID="$SEAWEED_ACCESS_KEY"
+          export AWS_SECRET_ACCESS_KEY="$SEAWEED_SECRET_KEY"
+
+          tofu init \
+            -backend-config="bucket=tofu-state" \
+            -backend-config="key=apps/$APP.tfstate" \
+            -backend-config="endpoint=$SEAWEED_S3_ENDPOINT" \
+            -backend-config="region=us-east-1" \
+            -backend-config="force_path_style=true" \
+            -reconfigure
+
+          # ── Select existing workspace ──
+          tofu workspace select "$APP"
+
+          # ── Destroy ──
+          tofu destroy -auto-approve \
+            -var-file="/tmp/${APP}.tfvars" \
+            -var="ssh_key_path=/tmp/deploy_key" \
+            -var="db_password=$DB_PASSWORD" \
+            -var="openresty_git_token=$GIT_TOKEN"
+
+          # ── Remove workspace ──
+          tofu workspace select default
+          tofu workspace delete "$APP"
+
+          rm -f /tmp/${APP}.tfvars /tmp/deploy_key
+          echo "  Destroyed: $APP"
+        ); then
+          echo "ERROR: Destroy of $APP failed — continuing with remaining apps"
+          FAILED=1
+          rm -f /tmp/${APP}.tfvars /tmp/deploy_key
+        fi
+      done
+
+      if [ $FAILED -ne 0 ]; then
+        echo ""
+        echo "One or more destroy operations failed. See logs above for details."
+        exit 1
+      fi
+  after_script:
+    # Safety cleanup in case the job was interrupted
+    - rm -f /tmp/deploy_key /tmp/*.tfvars

.gitlab/workflows/test.gitlab-ci.yml

@@ -0,0 +1,144 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Test pipeline — mirrors .gitea/workflows/test.yml
+#
+# Level 1 (static)      — fmt check + validate, all MRs and feature branches
+# Level 2 (unit)        — tofu test with mock_provider, all MRs and branches
+# Level 3 (integration) — real k3d cluster apply/destroy, main branch only
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ─── Shared template: installs OpenTofu and common tools ─────────────────────
+.tofu_setup:
+  image: ubuntu:22.04
+  before_script:
+    - apt-get update -qq && apt-get install -y -qq curl git jq
+    - |
+      curl -fsSL https://get.opentofu.org/install-opentofu.sh \
+        | sh -s -- --install-method=standalone --opentofu-version=$TOFU_VERSION
+
+# ─── Level 1: Static Analysis ────────────────────────────────────────────────
+static-analysis:
+  extends: .tofu_setup
+  stage: static
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
+  script:
+    - tofu fmt -check -recursive
+    - |
+      echo "── Validating Docker stack ──"
+      tofu init -backend=false -input=false
+      tofu validate
+    - |
+      echo "── Validating K8s stack ──"
+      cd k8s
+      tofu init -backend=false -input=false
+      tofu validate
+
+# ─── Level 2: Unit Tests (mocked providers) ──────────────────────────────────
+unit-tests-docker:
+  extends: .tofu_setup
+  stage: unit
+  needs: [static-analysis]
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
+  script:
+    - echo "── Docker stack unit tests ──"
+    - tofu init -backend=false -input=false
+    - tofu test
+
+unit-tests-k8s:
+  extends: .tofu_setup
+  stage: unit
+  needs: [static-analysis]
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+    - if: '$CI_COMMIT_BRANCH == "main"'
+    - if: '$CI_COMMIT_BRANCH =~ /^feature\//'
+  script:
+    - echo "── K8s stack unit tests ──"
+    - cd k8s
+    - tofu init -backend=false -input=false
+    - tofu test
+
+# ─── Level 3: Integration Test — K8s (k3d) ───────────────────────────────────
+# Runs only on push to main. Creates a real k3d cluster, applies the example
+# app, verifies resources exist, then destroys. Skipped on MRs for fast feedback.
+integration-k8s:
+  extends: .tofu_setup
+  stage: integration
+  needs: [unit-tests-docker, unit-tests-k8s]
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "main" && $CI_PIPELINE_SOURCE == "push"'
+  # Full clone needed so git show works for the integration workspace
+  variables:
+    GIT_DEPTH: "0"
+  script:
+    - |
+      echo "── Installing k3d ──"
+      curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+    - |
+      echo "── Installing kubectl ──"
+      curl -fsSL \
+        "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+        -o /usr/local/bin/kubectl
+      chmod +x /usr/local/bin/kubectl
+    - |
+      echo "── Creating k3d cluster (Traefik disabled — CRDs installed manually) ──"
+      k3d cluster create tofu-test \
+        --agents 1 \
+        --k3s-arg "--disable=traefik@server:0" \
+        --wait
+      k3d kubeconfig get tofu-test > /tmp/test-kubeconfig
+      chmod 600 /tmp/test-kubeconfig
+    - |
+      echo "── Installing Traefik CRDs ──"
+      kubectl --kubeconfig /tmp/test-kubeconfig apply \
+        -f https://raw.githubusercontent.com/traefik/traefik/v2.11/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
+      kubectl --kubeconfig /tmp/test-kubeconfig wait \
+        --for=condition=established --timeout=60s \
+        crd/ingressroutes.traefik.io crd/middlewares.traefik.io
+    - |
+      echo "── tofu init + workspace ──"
+      cd k8s
+      tofu init -backend=false -input=false
+      tofu workspace select integration-test 2>/dev/null \
+        || tofu workspace new integration-test
+    - |
+      echo "── tofu apply ──"
+      cd k8s
+      tofu apply -auto-approve \
+        -var-file="apps/example-nodered.tfvars" \
+        -var="kubeconfig_path=/tmp/test-kubeconfig" \
+        -var="app_name=integration-test" \
+        -var="rabbitmq_password=testpass-ci" \
+        -var="loki_auth_token="
+    - |
+      echo "── Verify K8s resources ──"
+      NS="integration-test"
+      KC=/tmp/test-kubeconfig
+      echo "── Namespace ──"
+      kubectl --kubeconfig $KC get namespace $NS
+      echo "── Deployment ──"
+      kubectl --kubeconfig $KC get deployment -n $NS
+      echo "── Services ──"
+      kubectl --kubeconfig $KC get service -n $NS
+      echo "── PVCs ──"
+      kubectl --kubeconfig $KC get pvc -n $NS
+      echo "── IngressRoutes ──"
+      kubectl --kubeconfig $KC get ingressroute.traefik.io -n $NS 2>/dev/null || \
+        kubectl --kubeconfig $KC get ingressroute.traefik.containo.us -n $NS
+    - |
+      echo "── tofu destroy ──"
+      cd k8s
+      tofu destroy -auto-approve \
+        -var-file="apps/example-nodered.tfvars" \
+        -var="kubeconfig_path=/tmp/test-kubeconfig" \
+        -var="app_name=integration-test" \
+        -var="rabbitmq_password=testpass-ci" \
+        -var="loki_auth_token="
+  after_script:
+    - k3d cluster delete tofu-test 2>/dev/null || true
+    - rm -f /tmp/test-kubeconfig