Initial commit: Infrastructure Git CI/CD avec Gitea, Woodpecker, PostgreSQL, Consul et Registrator
This commit is contained in:
399
docs/08-deploiement-consul-registrator.md
Normal file
399
docs/08-deploiement-consul-registrator.md
Normal file
@ -0,0 +1,399 @@
|
||||
# Deploiement de Consul et Registrator (mode production)
|
||||
|
||||
Ce guide explique comment deployer Consul et Registrator avec ACL sur l'infrastructure existante **sans perturber les services en production**.
|
||||
|
||||
## Prerequis
|
||||
|
||||
- Infrastructure existante fonctionnelle (Gitea, Woodpecker, PostgreSQL)
|
||||
- Acces SSH au serveur
|
||||
- Reseau Docker `gitgit_syoul_fr_gitea_net` existant
|
||||
|
||||
## Vue d'ensemble
|
||||
|
||||
```
|
||||
AVANT (actuel) APRES (avec Consul + ACL)
|
||||
---------------- -------------------------
|
||||
|
||||
[Gitea] [Gitea] <-+
|
||||
| | |
|
||||
v v |
|
||||
[gitea:3000] [gitea:3000]
|
||||
^ ^ |
|
||||
| | |
|
||||
[Woodpecker] [Woodpecker]
|
||||
| |
|
||||
v v
|
||||
[Consul + ACL] <-- [Registrator + Token]
|
||||
```
|
||||
|
||||
## Etape 1 : Copier les fichiers sur le serveur
|
||||
|
||||
```bash
|
||||
# Depuis votre machine locale
|
||||
scp -r consul/ portainer2:/opt/
|
||||
scp -r registrator/ portainer2:/opt/
|
||||
```
|
||||
|
||||
## Etape 2 : Deployer Consul
|
||||
|
||||
### Demarrer Consul
|
||||
|
||||
```bash
|
||||
ssh portainer2
|
||||
cd /opt/consul
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
### Verifier le demarrage
|
||||
|
||||
```bash
|
||||
# Attendre quelques secondes
|
||||
sleep 10
|
||||
|
||||
# Verifier que le conteneur est lance
|
||||
docker ps | grep consul
|
||||
|
||||
# Verifier les logs
|
||||
docker logs consul
|
||||
|
||||
# Tester l'API (sans token, certaines routes sont accessibles)
|
||||
curl -s http://localhost:8500/v1/status/leader
|
||||
```
|
||||
|
||||
### Verifier l'interface web
|
||||
|
||||
Acceder a : `http://[IP-serveur]:8500`
|
||||
|
||||
**Note** : Avec les ACL activees, vous verrez un message demandant un token pour acceder aux services.
|
||||
|
||||
## Etape 3 : Initialiser les ACL
|
||||
|
||||
### Bootstrap des ACL
|
||||
|
||||
```bash
|
||||
# Generer le token administrateur
|
||||
docker exec consul consul acl bootstrap
|
||||
```
|
||||
|
||||
**IMPORTANT** : Notez le `SecretID` retourne. C'est votre token administrateur.
|
||||
|
||||
Exemple de sortie :
|
||||
```
|
||||
AccessorID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
|
||||
SecretID: abcdef12-3456-7890-abcd-ef1234567890 <-- NOTEZ CE TOKEN !
|
||||
Description: Bootstrap Token (Global Management)
|
||||
Local: false
|
||||
Create Time: 2025-01-01 00:00:00.000000000 +0000 UTC
|
||||
Policies:
|
||||
00000000-0000-0000-0000-000000000001 - global-management
|
||||
```
|
||||
|
||||
### Stocker le token admin
|
||||
|
||||
```bash
|
||||
# Sur le serveur, creer le fichier .env pour Consul
|
||||
cd /opt/consul
|
||||
echo "CONSUL_HTTP_TOKEN=abcdef12-3456-7890-abcd-ef1234567890" > .env
|
||||
chmod 600 .env
|
||||
|
||||
# Exporter pour les commandes suivantes
|
||||
export CONSUL_TOKEN="abcdef12-3456-7890-abcd-ef1234567890"
|
||||
```
|
||||
|
||||
### Creer la policy pour Registrator
|
||||
|
||||
```bash
|
||||
docker exec consul consul acl policy create \
|
||||
-name "registrator" \
|
||||
-description "Policy pour Registrator - enregistrement des services" \
|
||||
-rules '
|
||||
service_prefix "" {
|
||||
policy = "write"
|
||||
}
|
||||
node_prefix "" {
|
||||
policy = "read"
|
||||
}
|
||||
agent_prefix "" {
|
||||
policy = "read"
|
||||
}
|
||||
' \
|
||||
-token "$CONSUL_TOKEN"
|
||||
```
|
||||
|
||||
### Creer le token Registrator
|
||||
|
||||
```bash
|
||||
docker exec consul consul acl token create \
|
||||
-description "Token Registrator" \
|
||||
-policy-name "registrator" \
|
||||
-token "$CONSUL_TOKEN"
|
||||
```
|
||||
|
||||
Notez le `SecretID` du token Registrator.
|
||||
|
||||
Exemple :
|
||||
```
|
||||
AccessorID: yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy
|
||||
SecretID: registr8-or12-3456-7890-tokenexample <-- TOKEN REGISTRATOR
|
||||
Description: Token Registrator
|
||||
...
|
||||
```
|
||||
|
||||
## Etape 4 : Deployer Registrator
|
||||
|
||||
### Configurer le token
|
||||
|
||||
```bash
|
||||
cd /opt/registrator
|
||||
|
||||
# Creer le fichier .env avec le token Registrator
|
||||
echo "CONSUL_HTTP_TOKEN=registr8-or12-3456-7890-tokenexample" > .env
|
||||
chmod 600 .env
|
||||
```
|
||||
|
||||
### Demarrer Registrator
|
||||
|
||||
```bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
### Verifier le demarrage
|
||||
|
||||
```bash
|
||||
# Verifier que le conteneur est lance
|
||||
docker ps | grep registrator
|
||||
|
||||
# Verifier les logs (pas d'erreur ACL)
|
||||
docker logs registrator
|
||||
```
|
||||
|
||||
## Etape 5 : Verifier les services enregistres
|
||||
|
||||
```bash
|
||||
# Via l'API (avec token admin)
|
||||
curl -s -H "X-Consul-Token: $CONSUL_TOKEN" \
|
||||
http://localhost:8500/v1/catalog/services | python3 -m json.tool
|
||||
```
|
||||
|
||||
Vous devriez voir les services existants :
|
||||
```json
|
||||
{
|
||||
"consul": [],
|
||||
"gitea-3000": [],
|
||||
"woodpecker-server-8000": [],
|
||||
"gitea_db-5432": []
|
||||
}
|
||||
```
|
||||
|
||||
**Note** : Les noms de services sont automatiques. Pour des noms propres, ajoutez des labels (etape suivante).
|
||||
|
||||
## Etape 6 : Ajouter les labels aux services (optionnel mais recommande)
|
||||
|
||||
Pour avoir des noms de services propres et des health checks, modifier les docker-compose existants.
|
||||
|
||||
### Gitea
|
||||
|
||||
Modifier `/opt/gitea/docker-compose.yml` :
|
||||
|
||||
```yaml
|
||||
services:
|
||||
gitea:
|
||||
container_name: gitea
|
||||
image: gitea/gitea:latest
|
||||
restart: always
|
||||
|
||||
# Ajouter ces labels
|
||||
labels:
|
||||
- "SERVICE_NAME=gitea"
|
||||
- "SERVICE_TAGS=web,git"
|
||||
- "SERVICE_3000_CHECK_HTTP=/api/v1/version"
|
||||
- "SERVICE_3000_CHECK_INTERVAL=15s"
|
||||
|
||||
# ... reste de la configuration inchangee ...
|
||||
```
|
||||
|
||||
### PostgreSQL
|
||||
|
||||
Modifier `/opt/postgres/docker-compose.yml` :
|
||||
|
||||
```yaml
|
||||
services:
|
||||
gitea_db:
|
||||
container_name: gitea_db
|
||||
image: postgres:14
|
||||
restart: always
|
||||
|
||||
# Ajouter ces labels
|
||||
labels:
|
||||
- "SERVICE_NAME=gitea-db"
|
||||
- "SERVICE_TAGS=postgres,database"
|
||||
- "SERVICE_5432_CHECK_TCP=true"
|
||||
- "SERVICE_5432_CHECK_INTERVAL=10s"
|
||||
|
||||
# ... reste de la configuration inchangee ...
|
||||
```
|
||||
|
||||
### Woodpecker
|
||||
|
||||
Modifier `/opt/woodpecker/docker-compose.yml` :
|
||||
|
||||
```yaml
|
||||
services:
|
||||
woodpecker-server:
|
||||
# ...
|
||||
labels:
|
||||
- "SERVICE_NAME=woodpecker"
|
||||
- "SERVICE_TAGS=ci,web"
|
||||
- "SERVICE_8000_CHECK_HTTP=/healthz"
|
||||
- "SERVICE_8000_CHECK_INTERVAL=15s"
|
||||
|
||||
woodpecker-agent:
|
||||
# ...
|
||||
labels:
|
||||
- "SERVICE_NAME=woodpecker-agent"
|
||||
- "SERVICE_TAGS=ci,agent"
|
||||
```
|
||||
|
||||
### Appliquer les changements
|
||||
|
||||
```bash
|
||||
# Pour chaque service modifie
|
||||
cd /opt/[service]
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
**Note** : Cette operation redemarrera les conteneurs. Effectuer pendant une periode de faible activite.
|
||||
|
||||
## Etape 7 : Tester la resolution DNS (optionnel)
|
||||
|
||||
### Depuis le serveur
|
||||
|
||||
```bash
|
||||
dig @localhost -p 8600 gitea.service.consul
|
||||
dig @localhost -p 8600 woodpecker.service.consul
|
||||
dig @localhost -p 8600 gitea-db.service.consul
|
||||
```
|
||||
|
||||
### Depuis un conteneur
|
||||
|
||||
```bash
|
||||
docker exec consul dig @127.0.0.1 -p 8600 gitea.service.consul
|
||||
```
|
||||
|
||||
## Verification finale
|
||||
|
||||
### Tous les services sont enregistres
|
||||
|
||||
```bash
|
||||
curl -s -H "X-Consul-Token: $CONSUL_TOKEN" \
|
||||
http://localhost:8500/v1/catalog/services | python3 -m json.tool
|
||||
```
|
||||
|
||||
Resultat attendu (avec labels) :
|
||||
|
||||
```json
|
||||
{
|
||||
"consul": [],
|
||||
"gitea": ["web", "git"],
|
||||
"gitea-db": ["postgres", "database"],
|
||||
"woodpecker": ["ci", "web"],
|
||||
"woodpecker-agent": ["ci", "agent"]
|
||||
}
|
||||
```
|
||||
|
||||
### Health checks sont verts
|
||||
|
||||
Dans l'interface Consul : `http://[IP-serveur]:8500/ui/dc1/services`
|
||||
|
||||
Utilisez le token admin pour voir les services. Tous devraient avoir un statut "passing" (vert).
|
||||
|
||||
### Resolution DNS fonctionne
|
||||
|
||||
```bash
|
||||
dig @localhost -p 8600 gitea.service.consul +short
|
||||
# Devrait retourner l'IP du conteneur gitea
|
||||
```
|
||||
|
||||
### Tokens fonctionnels
|
||||
|
||||
```bash
|
||||
# Test token admin
|
||||
curl -s -H "X-Consul-Token: $CONSUL_TOKEN" \
|
||||
http://localhost:8500/v1/acl/tokens | head -20
|
||||
|
||||
# Test token Registrator (via logs)
|
||||
docker logs registrator 2>&1 | grep -i error
|
||||
# Pas d'erreur = token OK
|
||||
```
|
||||
|
||||
## Resume des tokens
|
||||
|
||||
| Token | Fichier | Usage |
|
||||
|-------|---------|-------|
|
||||
| Admin (bootstrap) | `/opt/consul/.env` | Administration Consul |
|
||||
| Registrator | `/opt/registrator/.env` | Enregistrement des services |
|
||||
|
||||
## Rollback
|
||||
|
||||
Si vous rencontrez des problemes et souhaitez desactiver Consul/Registrator :
|
||||
|
||||
```bash
|
||||
# Arreter Registrator et Consul
|
||||
cd /opt/registrator && docker compose down
|
||||
cd /opt/consul && docker compose down
|
||||
|
||||
# Les services existants continueront de fonctionner normalement
|
||||
# via le reseau Docker classique
|
||||
```
|
||||
|
||||
Pour repartir de zero (supprimer les donnees Consul) :
|
||||
|
||||
```bash
|
||||
docker volume rm consul_consul-data
|
||||
```
|
||||
|
||||
## Securite - Bonnes pratiques
|
||||
|
||||
### 1. Proteger les fichiers .env
|
||||
|
||||
```bash
|
||||
chmod 600 /opt/consul/.env
|
||||
chmod 600 /opt/registrator/.env
|
||||
```
|
||||
|
||||
### 2. Ne pas exposer le port 8500 sur Internet
|
||||
|
||||
Utiliser un firewall ou n'exposer que sur localhost :
|
||||
|
||||
```yaml
|
||||
ports:
|
||||
- "127.0.0.1:8500:8500"
|
||||
```
|
||||
|
||||
### 3. Rotation des tokens
|
||||
|
||||
Periodiquement (ex: tous les 3 mois) :
|
||||
|
||||
1. Creer un nouveau token Registrator
|
||||
2. Mettre a jour `/opt/registrator/.env`
|
||||
3. Redemarrer Registrator
|
||||
4. Revoquer l'ancien token
|
||||
|
||||
### 4. Sauvegardes
|
||||
|
||||
```bash
|
||||
# Sauvegarder Consul
|
||||
docker exec consul consul snapshot save /consul/data/backup.snap -token "$CONSUL_TOKEN"
|
||||
docker cp consul:/consul/data/backup.snap ./consul_backup_$(date +%Y%m%d).snap
|
||||
|
||||
# Sauvegarder les tokens (fichiers .env)
|
||||
cp /opt/consul/.env ./consul_env_backup_$(date +%Y%m%d)
|
||||
cp /opt/registrator/.env ./registrator_env_backup_$(date +%Y%m%d)
|
||||
```
|
||||
|
||||
## Prochaines etapes
|
||||
|
||||
1. **Surveillance** : Ajouter des alertes basees sur les health checks Consul
|
||||
2. **Configuration distribuee** : Utiliser le Key/Value store de Consul
|
||||
3. **Haute disponibilite** : Deployer plusieurs noeuds Consul
|
||||
4. **TLS** : Activer le chiffrement des communications
|
||||
Reference in New Issue
Block a user