部署

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

version: '3.6'
services:
  gocd:
    image: gocd/gocd-server:v21.3.0
    ports:
      - 8153:8153
#    environment:
#      - GOCD_SERVER_JVM_OPTS=-Dplugin.cd.go.authentication.passwordfile.log.level=debug
    volumes:
      - /git1/gocd/data:/godata
      - /git1/gocd/home:/home/go
      # to save data about pipelines as code
      - /git1/gocd/go-working-dir/pipelines:/go-working-dir/pipelines
      - /etc/localtime:/etc/localtime:ro
    networks:
      - core-infra
    deploy:
      labels:
        - traefik.http.routers.gocdWeb-https.tls.certresolver=le
        - traefik.docker.network=core-infra
        - traefik.constraint-label=core-infra

        - traefik.enable=true
        - traefik.http.middlewares.redirect-http-to-https.redirectScheme.scheme=https
        - traefik.http.middlewares.redirect-http-to-https.redirectScheme.permanent=true
        - traefik.http.routers.gocdWeb-https.rule=Host(`ci.youdomain.com`)
        - traefik.http.routers.gocdWeb-https.entrypoints=https
        - traefik.http.routers.gocdWeb-https.tls=true
        - traefik.http.routers.gocdWeb-https.service=gocdWeb
        - traefik.http.routers.gocdWeb-http.rule=Host(`ci.youdomain.com`)
        - traefik.http.routers.gocdWeb-http.entrypoints=http
        - traefik.http.routers.gocdWeb-http.middlewares=redirect-http-to-https
        - traefik.http.routers.gocdWeb-http.service=gocdWeb
        - traefik.http.services.gocdWeb.loadbalancer.server.scheme=http
        - traefik.http.services.gocdWeb.loadbalancer.server.port=8153

  gocd-anent:
    image: gocd/gocd-agent-ubuntu-20.04:v21.3.0
    volumes:
      - /git1/gocda/data:/godata
      # save ssh key and ssh-keyscan host > .ssh/known_hosts here.
      - /git1/gocda/home:/home/go
      - /etc/localtime:/etc/localtime:ro
    environment:
      - GO_SERVER_URL=https://ci.youdomain.com:4430/go
      - AGENT_AUTO_REGISTER_KEY=8240fa7f-xxxx-xxxx-xxxx-ba62c640dxxx
    networks:
      - core-infra    

networks:
  core-infra:
    external: true

一些小的问题:

  • Webhook 强制签名，密钥在config.xml里面，如果签名不通过会404。
  • GoCD的webhook代码应该是很久没有更新了， Github的钩子需要添加ref字段。而且签名字段使用的是SHA1算法的的X-Hub-Signature，而不是基于SHA256的X-Hub-Signature-256。
  • Webhook没有适配 Gogs/Gitea 这样的程序，本来想改改GoCD，后来还是写了个小的 Gitea Payload 转 Github Payload 的程序。