init

2026-09-18 18:46:20 +02:00
commit 5018c2e0df
6 changed files with 98 additions and 0 deletions
@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: secrets\.prod\.env$
+    age: age14r2lmce367dmp4gl9lcf0tkdttc3aaqql4ymphpj5lcqeg9vjpzqz3pqp9
@@ -0,0 +1,60 @@
+steps:
+  - name: build-db
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: registry.ci.poc.mehl.mx/poc/dummy-service-db
+      dockerfile: Dockerfile.db
+      tag: ${CI_COMMIT_SHA:0:8}
+      registry: registry.ci.poc.mehl.mx
+      username:
+        from_secret: zot_username
+      password:
+        from_secret: zot_password
+
+  - name: build-app
+    image: woodpeckerci/plugin-docker-buildx
+    settings:
+      repo: registry.ci.poc.mehl.mx/poc/dummy-service-app
+      dockerfile: Dockerfile.app
+      tag: ${CI_COMMIT_SHA:0:8}
+      registry: registry.ci.poc.mehl.mx
+      username:
+        from_secret: zot_username
+      password:
+        from_secret: zot_password
+
+  - name: publish-deployment-artifact
+    image: alpine:3.20
+    environment:
+      REGISTRY: registry.ci.poc.mehl.mx
+      IMAGE_TAG: ${CI_COMMIT_SHA:0:8}
+      SOURCE_COMMIT: ${CI_COMMIT_SHA}
+      ZOT_USERNAME:
+        from_secret: zot_username
+      ZOT_PASSWORD:
+        from_secret: zot_password
+    commands:
+      - apk add --no-cache oras
+      - mkdir -p /tmp/deploy-bundle
+      - cp compose.yaml secrets.prod.env /tmp/deploy-bundle/
+      - echo "IMAGE_TAG=${IMAGE_TAG}" > /tmp/deploy-bundle/release.env
+      - echo "SOURCE_COMMIT=${SOURCE_COMMIT}" >> /tmp/deploy-bundle/release.env
+      - echo "REGISTRY=${REGISTRY}" >> /tmp/deploy-bundle/release.env
+      - oras login "${REGISTRY}" -u "${ZOT_USERNAME}" -p "${ZOT_PASSWORD}"
+      - cd /tmp/deploy-bundle && oras push "${REGISTRY}/poc/deploy/dummy-service:${IMAGE_TAG}" compose.yaml secrets.prod.env release.env
+
+  - name: trigger-deployment
+    image: woodpeckerci/plugin-trigger
+    settings:
+      repositories:
+        - mxmehl/deployments
+      deploy: production
+      params:
+        - ARTIFACT=registry.ci.poc.mehl.mx/poc/deploy/dummy-service:${CI_COMMIT_SHA:0:8}
+        - TARGET=target1
+      token:
+        from_secret: woodpecker_trigger_token
+
+when:
+  branch: ${CI_REPO_DEFAULT_BRANCH}
+  event: push
@@ -0,0 +1,6 @@
+# Dummy "app" container for the PoC. Not a real application - proves that
+# both the shared DB_PASSWORD and its own APP_PASSWORD secret reach it
+# correctly, by logging (masked) evidence on startup, then staying up.
+FROM alpine:3.20
+
+CMD ["sh", "-c", "for v in DB_PASSWORD APP_PASSWORD; do val=$(eval echo \\$$v); if [ -n \"$val\" ]; then echo \"$v: received (redacted)\"; else echo \"$v: MISSING\"; fi; done; sleep infinity"]
@@ -0,0 +1,5 @@
+# Dummy "database" container for the PoC. Not a real database - just proves
+# that a secret env var (DB_ROOT_PASSWORD) reaches this container correctly.
+FROM alpine:3.20
+
+CMD ["sh", "-c", "if [ -n \"$DB_ROOT_PASSWORD\" ]; then echo 'DB_ROOT_PASSWORD: received (redacted)'; else echo 'DB_ROOT_PASSWORD: MISSING'; fi; sleep infinity"]
@@ -0,0 +1,15 @@
+services:
+  db:
+    image: ${REGISTRY:?err}/poc/dummy-service-db:${IMAGE_TAG:?err}
+    restart: unless-stopped
+    environment:
+      DB_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:?err}
+
+  app:
+    image: ${REGISTRY:?err}/poc/dummy-service-app:${IMAGE_TAG:?err}
+    restart: unless-stopped
+    depends_on:
+      - db
+    environment:
+      DB_PASSWORD: ${DB_PASSWORD:?err}
+      APP_PASSWORD: ${APP_PASSWORD:?err}
@@ -0,0 +1,9 @@
+DB_ROOT_PASSWORD=ENC[AES256_GCM,data:v7SL0WSvL2nRy1JUi0lHnx23V58Mzw==,iv:GnTwZeQA9XL5oAXO0rrSjkQrwsS2ITOZ9BzWKkDEUMI=,tag:DluClErQnXzppkWzUODpBA==,type:str]
+DB_PASSWORD=ENC[AES256_GCM,data:DhvyDY8LuglX2cd2UujygUZXuSw=,iv:qEFuyR4orvPf0HvsGUCiOftyCKGCMXu7I7dFI4SLZaw=,tag:3o/OD4eaj1uDxKv9ORJUFA==,type:str]
+APP_PASSWORD=ENC[AES256_GCM,data:VuGscm+j9ADALZGWp3vO+xnK9S5b,iv:Xk215wjl6KKzs58jR1wj/GNtkreIu2uoVOMXKI2EfFY=,tag:SIabyKRgtYdxXaA95l0bww==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NUsxM3JiTHBkWTdPclYv\nY1FvL0ZBcEIrTlhPb25teTlzdHg1NkY3WlRvCnNFYW8vSGV5Y3I0OGtCai9SREs2\nMGlzMGRxL0Q2YmdIUFJLbTFET2VqbUEKLS0tIEsvMC9WeXBrU3VhemtUMGd0NERo\nZ2VsVmxHUWVXUkJtd3JFUEtzcXkxeXcKBJiGxzToQOlpq/nNt9S4lwvh70SZ5t5f\nPeXW49a4/oXAvLuDcJtN8QmqQgCNbgnqhZZGvMxfuyELHNPolHhhVw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age14r2lmce367dmp4gl9lcf0tkdttc3aaqql4ymphpj5lcqeg9vjpzqz3pqp9
+sops_lastmodified=2026-09-18T15:44:35Z
+sops_mac=ENC[AES256_GCM,data:BWdvcGLzhrFpgs/J41t5NA4SlvxZi75LQ5VWJlkS0hK2LvmO6JV2ojl8mtHkl+8ObR4yBd2PI4Aq4MO6+z4KVNWMQIiKIg/nfjUhFaaeNpt7LBpItX6HzAcfDST4O6Nh0Wcudx46sHwolHM7dy5GlD4Es0dGNWDRnUozPnpNyaM=,iv:V4GNwdu+4PT6yM2FsJfTNqyxKX4E5fb73R+0gMg6kSc=,tag:24hDwSkbBmvO+4wL8dvUPg==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3