From c689fb6a02122f8154e36778070a88ba349f76ab Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Wed, 24 Apr 2024 00:23:29 +0200 Subject: [PATCH 01/23] Initial db migrator --- molecule/nexus_postgres_test_vars.yml | 12 +++-- tasks/main.yml | 5 ++ tasks/migrate_database.yml | 70 +++++++++++++++++++++++++++ tasks/nexus_install.yml | 1 + 4 files changed, 85 insertions(+), 3 deletions(-) create mode 100644 tasks/migrate_database.yml diff --git a/molecule/nexus_postgres_test_vars.yml b/molecule/nexus_postgres_test_vars.yml index b1403318..8c2b30b2 100644 --- a/molecule/nexus_postgres_test_vars.yml +++ b/molecule/nexus_postgres_test_vars.yml @@ -1,13 +1,19 @@ -nexus_purge: true +nexus_purge: false nexus_run_provisionning: true +nexus_db_migrator_version: 3.67.0-04 +nexus_db_migrator_download_url: https://download.sonatype.com/nexus/nxrm3-migrator + # Enable Pro features nexus_enable_pro_version: true nexus_pro_license_file: files/license.lic # Postgres settings -#nexus_migrate_orientdb_to_postgres: true -nexus_use_postgres: true +nexus_migrate_database: true +nexus_migrate_tmp_dir: /tmp +nexus_migrate_content_migration: true +nexus_migrate_force: true + # Using Postgres as the initial database? Set nexus_use_postgres to true nexus_use_postgres: false diff --git a/tasks/main.yml b/tasks/main.yml index d745c595..913bd1dc 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -296,3 +296,8 @@ ansible.builtin.include_tasks: create_task_each.yml with_items: "{{ nexus_scheduled_tasks + _nexus_backup_task | default([]) }}" when: nexus_run_provisionning | default(true) | bool + +- name: Migrate OrientDB to Postgres + ansible.builtin.include_tasks: migrate_database.yml + tags: nexus-migrate, nexus-healthcheck + when: nexus_migrate_database | default(false) | bool diff --git a/tasks/migrate_database.yml b/tasks/migrate_database.yml new file mode 100644 index 00000000..7231b033 --- /dev/null +++ b/tasks/migrate_database.yml @@ -0,0 +1,70 @@ +--- + # TODO: Skip this task if the migration is already done or postgres is already used + +- name: Download the Nexus database migration tool + get_url: + url: "{{ nexus_db_migrator_download_url }}/nexus-db-migrator-{{ nexus_db_migrator_version }}.jar" + dest: "{{ nexus_data_dir }}/db/nexus-db-migrator-{{ nexus_db_migrator_version }}.jar" + mode: "0644" + owner: "{{ nexus_os_user }}" + group: "{{ nexus_os_group }}" + tags: nexus-migrate, nexus-healthcheck + +- name: Enable Pro version + ansible.builtin.include_tasks: enable_pro_version.yml + tags: nexus-migrate, nexus-healthcheck + +- name: Stop Nexus service + ansible.builtin.systemd: + name: nexus.service + state: stopped + tags: nexus-migrate, nexus-healthcheck + when: nexus_migrate_database | default(false) | bool + +- name: Healthcheck + ansible.builtin.command: + cmd: 'java -Xmx16G -Xms16G -XX:+UseG1GC -XX:MaxDirectMemorySize=28672M -jar nexus-db-migrator-{{ nexus_db_migrator_version }}.jar --healthcheck --yes' + chdir: "{{ nexus_data_dir }}/db" + become: true + become_user: "{{ nexus_os_user }}" + register: migration_healthcheck + tags: nexus-migrate, nexus-healthcheck + when: nexus_migrate_database | default(false) | bool + +- debug: + var: migration_healthcheck.stdout_lines + tags: nexus-migrate, nexus-healthcheck + when: nexus_migrate_database | default(false) | bool + +- name: Run migration + ansible.builtin.command: + cmd: > + java -Xmx16G -Xms16G -XX:+UseG1GC -XX:MaxDirectMemorySize=28672M + -jar nexus-db-migrator-{{ nexus_db_migrator_version }}.jar --yes --tmpdir="{{ nexus_migrate_tmp_dir }}" + --migration_type=postgres + --db_url="jdbc:postgresql://{{ nexus_postgres_db_host }}:{{ nexus_postgres_db_port }}/{{ nexus_postgres_db_name }}?user={{ nexus_postgres_db_username }}&password={{ nexus_postgres_db_password }}" + --content_migration="{{ nexus_migrate_content_migration }}" + --logging.level.com.sonatype=TRACE + --force="{{ nexus_migrate_force | bool }}" + chdir: "{{ nexus_data_dir }}/db" + become: true + become_user: "{{ nexus_os_user }}" + register: migration_result + tags: nexus-migrate + when: nexus_migrate_database | default(false) | bool + +- debug: + var: migration_result.stdout_lines + tags: nexus-migrate + when: nexus_migrate_database | default(false) | bool + +- name: Set fact to enable Postgres + set_fact: + nexus_database_migration_done: true + tags: nexus-migrate + when: nexus_migrate_database | default(false) | bool + +- name: Enable Postgres as datastore + ansible.builtin.include_tasks: enable_postgres.yml + tags: nexus-migrate + when: nexus_migrate_database | default(false) | bool diff --git a/tasks/nexus_install.yml b/tasks/nexus_install.yml index 32b892aa..999d70b9 100644 --- a/tasks/nexus_install.yml +++ b/tasks/nexus_install.yml @@ -429,6 +429,7 @@ - name: Enable Postgres ansible.builtin.include_tasks: enable_postgres.yml when: nexus_use_postgres | default(false) | bool + tags: nexus-postgres - name: Enable nexus systemd service and make sure it is started ansible.builtin.systemd: From 43021dbf413fe9f8bfdc4086bc827952ebdc9144 Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 25 Apr 2024 10:10:53 +0200 Subject: [PATCH 02/23] Include java version in download url --- defaults/main.yml | 1 + tasks/nexus_install.yml | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/defaults/main.yml b/defaults/main.yml index cc44a72a..41e99ca8 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -22,6 +22,7 @@ nexus_tmp_dir: "{{ (ansible_os_family == 'RedHat') | ternary('/var/nexus-tmp', ' nexus_script_dir: "{{ nexus_installation_dir }}/nexus-{{ nexus_version }}/etc/scripts" nexus_plugin_urls: [] nexus_onboarding_wizard: false +nexus_java_version: 8 # Enable Pro features nexus_enable_pro_version: false diff --git a/tasks/nexus_install.yml b/tasks/nexus_install.yml index 999d70b9..6883a7dc 100644 --- a/tasks/nexus_install.yml +++ b/tasks/nexus_install.yml @@ -56,6 +56,7 @@ vars: version_info: |- Used version: {{ nexus_version }} + Java version: {{ nexus_java_version | default(8) }} Version detected from: {{ nexus_version_detected_from }} Upgrade allowed: {{ nexus_upgrade | default(false) | bool }} Current running version: {{ nexus_version_running | default('none') }} @@ -64,7 +65,7 @@ - name: Register nexus package name ansible.builtin.set_fact: - nexus_package: nexus-{{ nexus_version }}-unix.tar.gz + nexus_package: nexus-{{ nexus_version }}{{ (nexus_java_version > 8) | ternary('-java11', '-java8') }}-unix.tar.gz - name: Download nexus_package ansible.builtin.get_url: From dd876c9ba7b4915edac49f44445fa54030287f23 Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 2 May 2024 14:07:06 +0200 Subject: [PATCH 03/23] Initial data structure for easier repo management --- molecule/nexus_postgres_test_vars.yml | 361 ++++++++++++++++- nexus.drawio | 551 ++++++++++++++++++++++++++ repos.yml | 394 ++++++++++++++++++ tasks/create_proxy_defaults.yml | 7 + tasks/enable_postgres.yml | 2 + tasks/main.yml | 6 + tasks/nexus_install.yml | 7 + teams.yml | 16 + templates/proxies.yml.j2 | 31 ++ 9 files changed, 1374 insertions(+), 1 deletion(-) create mode 100644 nexus.drawio create mode 100644 repos.yml create mode 100644 tasks/create_proxy_defaults.yml create mode 100644 teams.yml create mode 100644 templates/proxies.yml.j2 diff --git a/molecule/nexus_postgres_test_vars.yml b/molecule/nexus_postgres_test_vars.yml index 8c2b30b2..9386bc11 100644 --- a/molecule/nexus_postgres_test_vars.yml +++ b/molecule/nexus_postgres_test_vars.yml @@ -9,7 +9,7 @@ nexus_enable_pro_version: true nexus_pro_license_file: files/license.lic # Postgres settings -nexus_migrate_database: true +nexus_migrate_database: false nexus_migrate_tmp_dir: /tmp nexus_migrate_content_migration: true nexus_migrate_force: true @@ -24,3 +24,362 @@ nexus_postgres_db_username: nexus nexus_postgres_db_password: nexus nexus_postgres_max_lifetime: 840000 nexus_postgres_max_pool_size: 85 + +nexus_transform: true + +proxy_defaults: + - maven: + - name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + - name: maven-central-02 + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + # - python: + # - name: pypi-central + # format: pypi + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://pypi.org/simple + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - npm: + # - name: npm-registry + # format: npm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://registry.npmjs.org/ + # username: + # password: + # bearerToken: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - nuget: + # - name: nuget-gallery + # format: nuget + # online: true + # blocked: false + # auto_block: true + # nuget_version: v3 + # remote: + # url: https://api.nuget.org/v3/index.json + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - apt: + # - name: ubuntu-apt + # format: apt + # online: true + # blocked: false + # auto_block: true + # distribution: bionic + # flat: false + # remote: + # url: http://archive.ubuntu.com/ubuntu/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - helm: + # - name: helm-proxy + # format: helm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://kubernetes-charts.storage.googleapis.com + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - r: + # - name: r-proxy + # format: r + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://cran.r-project.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - raw: + # - name: raw-proxy + # format: raw + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://www.jfrog.com/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # contentDisposition: + # - conda: + # - name: conda-proxy + # format: conda + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://repo.anaconda.com/pkgs/main + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - go: + # - name: go-proxy + # format: go + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://proxy.golang.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + - yum: + - name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + +nexus_repos_maven_proxy: + - name: maven-central + format: maven2 + online: True + blocked: False + auto_block: True + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + - name: maven-central-02 + format: maven2 + online: True + blocked: False + auto_block: True + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 +nexus_repos_yum_proxy: + - name: yum-proxy + format: yum + online: True + blocked: False + auto_block: True + remote: + url: http://mirror.centos.org/centos/ + username: username + password: password + connection: + useTrustStore: False + retries: 2 + user_agent_suffix: agent + enable_cookies: True + enable_circular_redirects: True + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 diff --git a/nexus.drawio b/nexus.drawio new file mode 100644 index 00000000..4ab47695 --- /dev/null +++ b/nexus.drawio @@ -0,0 +1,551 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/repos.yml b/repos.yml new file mode 100644 index 00000000..15d5c234 --- /dev/null +++ b/repos.yml @@ -0,0 +1,394 @@ +teams: + - ID: 1 + name: Team 1 + repos: + requestedBy: + hosted: + - name: maven-repo1 + format: maven2 + - name: python-repo1 + format: pypi + - name: npm-repo1 + format: npm + proxy: + - name: proxy-repo1 + format: maven2 + group: + - name: group-repo-1 + members: + - maven-repo2 + - npm-repo1 + - name: group-repo-2 + members: + - maven-repo2 + - npm-repo1 + sharedAccessTo: + hosted: + - name: maven-repo1 + proxy: + - name: proxy_defaults.maven_defaults + group: [] + +hosted_default: + apt: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + distribution: dist + aptSigning: + keypair: null + passphrase: null + docker: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + latestPolicy: null + cleanup: cleanup + forceBasicAuth: "" + v1Enabled: true + httpPort: null + subdomain: null + gitlfs: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + helm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + maven: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + versionPolicy: release # release, snapshot or mixed + layoutPolicy: strict # strict or permissive + npm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + nuget: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + python: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + raw: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + contentDisposition: INLINE + yum: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup: cleanup + repodataDepth: 1 + deployPolicy: strict # strict or permissive + +proxy_defaults: + maven: + - name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + version_policy: + layout_policy: + content_disposition: + python: + - name: pypi-central + format: pypi + online: true + blocked: false + auto_block: true + remote: + url: https://pypi.org/simple + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + npm: + - name: npm-registry + format: npm + online: true + blocked: false + auto_block: true + remote: + url: https://registry.npmjs.org/ + username: + password: + bearerToken: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + nuget: + - name: nuget-gallery + format: nuget + online: true + blocked: false + auto_block: true + nuget_version: v3 + remote: + url: https://api.nuget.org/v3/index.json + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + apt: + - name: ubuntu-apt + format: apt + online: true + blocked: false + auto_block: true + distribution: bionic + flat: false + remote: + url: http://archive.ubuntu.com/ubuntu/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + helm: + - name: helm-proxy + format: helm + online: true + blocked: false + auto_block: true + remote: + url: https://kubernetes-charts.storage.googleapis.com + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + r: + - name: r-proxy + format: r + online: true + blocked: false + auto_block: true + remote: + url: https://cran.r-project.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + raw: + - name: raw-proxy + format: raw + online: true + blocked: false + auto_block: true + remote: + url: https://www.jfrog.com/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + contentDisposition: + conda: + - name: conda-proxy + format: conda + online: true + blocked: false + auto_block: true + remote: + url: https://repo.anaconda.com/pkgs/main + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + go: + - name: go-proxy + format: go + online: true + blocked: false + auto_block: true + remote: + url: https://proxy.golang.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + yum: + - name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 +group_defaults: + maven: + python: + +proxy_repos: diff --git a/tasks/create_proxy_defaults.yml b/tasks/create_proxy_defaults.yml new file mode 100644 index 00000000..c9401086 --- /dev/null +++ b/tasks/create_proxy_defaults.yml @@ -0,0 +1,7 @@ +--- +- name: Transform proxy_defaults into nexus_repos + ansible.builtin.template: + src: "/workspaces/nexus3-pro/templates/proxies.yml.j2" + dest: "/nexus-downloads/proxies-result.yml" + #remote_src: true + tags: transform diff --git a/tasks/enable_postgres.yml b/tasks/enable_postgres.yml index 7102680a..45275ce0 100644 --- a/tasks/enable_postgres.yml +++ b/tasks/enable_postgres.yml @@ -46,3 +46,5 @@ name: nexus.service state: started tags: nexus-postgres,nexus-migrate + + # wait for nexus to be started succesfully \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index 913bd1dc..4124fe72 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -29,6 +29,7 @@ - name: Run installation tasks ansible.builtin.import_tasks: nexus_install.yml + tags: nexus-install - name: Configure apache reverse proxy ansible.builtin.include_tasks: httpd_reverse_proxy_config.yml @@ -301,3 +302,8 @@ ansible.builtin.include_tasks: migrate_database.yml tags: nexus-migrate, nexus-healthcheck when: nexus_migrate_database | default(false) | bool + +- name: Transform default proxies to yml + ansible.builtin.include_tasks: create_proxy_defaults.yml + tags: transform + when: nexus_transform | default(false) | bool diff --git a/tasks/nexus_install.yml b/tasks/nexus_install.yml index 6883a7dc..6aa9bcc6 100644 --- a/tasks/nexus_install.yml +++ b/tasks/nexus_install.yml @@ -3,12 +3,14 @@ ansible.builtin.set_fact: nexus_version_detected_from: fixed when: nexus_version | length > 0 + tags: nexus-install - name: Check nexus-latest link stat in {{ nexus_installation_dir }} ansible.builtin.stat: path: "{{ nexus_installation_dir }}/nexus-latest" register: nexus_latest_link check_mode: false + tags: nexus-install - name: Register current running version if any ansible.builtin.set_fact: @@ -20,9 +22,11 @@ when: - nexus_latest_link.stat.exists | default(false) - nexus_latest_link.stat.islnk | default(false) + tags: nexus-install - name: No version given => Version detection when: nexus_version | length == 0 + tags: nexus-install block: - name: Register nexus_version from currently installed # Note: setting nexus_version here skips the next block task. @@ -62,10 +66,12 @@ Current running version: {{ nexus_version_running | default('none') }} ansible.builtin.debug: msg: "{{ version_info.split('\n') }}" + tags: nexus-install - name: Register nexus package name ansible.builtin.set_fact: nexus_package: nexus-{{ nexus_version }}{{ (nexus_java_version > 8) | ternary('-java11', '-java8') }}-unix.tar.gz + tags: nexus-install - name: Download nexus_package ansible.builtin.get_url: @@ -81,6 +87,7 @@ until: download_status.status_code == 200 retries: "{{ nexus_download_retries }}" delay: "{{ nexus_download_delay }}" + tags: nexus-install notify: - nexus-service-stop diff --git a/teams.yml b/teams.yml new file mode 100644 index 00000000..c6c02bb8 --- /dev/null +++ b/teams.yml @@ -0,0 +1,16 @@ +# +teams: + - ID: 1 + name: Team 1 + hosted_repo: [ + repo1 + repo2 + ] + proxy_repo: [ + proxy-repo1 + proxy-repo2 + ] + group_repo: [ + group-repo-1 + group-repo-2 + ] diff --git a/templates/proxies.yml.j2 b/templates/proxies.yml.j2 new file mode 100644 index 00000000..f86ea39d --- /dev/null +++ b/templates/proxies.yml.j2 @@ -0,0 +1,31 @@ +{% for proxy_default in proxy_defaults %} +{% for key, value in proxy_default.items() %} +nexus_repos_{{ key }}_proxy: +{% for repo in value %} + - name: {{ repo.name }} + format: {{ repo.format }} + online: {{ repo.online }} + blocked: {{ repo.blocked }} + auto_block: {{ repo.auto_block }} + remote: + username: {{ repo.remote.username }} + password: {{ repo.remote.password }} + remoteUrl: {{ repo.remote.url }} + connection: + useTrustStore: {{ repo.connection.useTrustStore }} + retries: {{ repo.connection.retries }} + user_agent_suffix: {{ repo.connection.user_agent_suffix }} + enable_cookies: {{ repo.connection.enable_cookies }} + enable_circular_redirects: {{ repo.connection.enable_circular_redirects }} + timeout: {{ repo.connection.timeout }} + maximum_component_age: {{ repo.maximum_component_age }} + maximum_metadata_age: {{ repo.maximum_metadata_age }} + negative_cache_enabled: {{ repo.negative_cache_enabled }} + negative_cache_ttl: {{ repo.negative_cache_ttl }} + cleanup_policies: +{% for policy in repo.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% endfor %} +{% endfor %} +{% endfor %} \ No newline at end of file From 4b8e34a2edce6bc6d9b5e8108ac6e8832dd6d5fc Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Tue, 7 May 2024 13:34:06 +0000 Subject: [PATCH 04/23] Split up team list and default list into seperate yml files. initial hosted.yml.j2 structure --- repo-defaults.yml | 371 ++++++++++++++++++++++++++++++++++++++++ repos.yml | 362 --------------------------------------- teams.yml | 16 -- templates/hosted.yml.j2 | 41 +++++ 4 files changed, 412 insertions(+), 378 deletions(-) create mode 100644 repo-defaults.yml delete mode 100644 teams.yml create mode 100644 templates/hosted.yml.j2 diff --git a/repo-defaults.yml b/repo-defaults.yml new file mode 100644 index 00000000..d9a40c5a --- /dev/null +++ b/repo-defaults.yml @@ -0,0 +1,371 @@ +hosted_default: + apt: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + distribution: dist + aptSigning: + keypair: null + passphrase: null + docker: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + latestPolicy: null + cleanup_policies: + - policy-1 + forceBasicAuth: "" + v1Enabled: true + httpPort: null + subdomain: null + gitlfs: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + helm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + maven: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + versionPolicy: release # release, snapshot or mixed + layoutPolicy: strict # strict or permissive + npm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + nuget: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + python: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + raw: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + contentDisposition: INLINE + yum: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + repodataDepth: 1 + deployPolicy: strict # strict or permissive + +proxy_defaults: + maven: + - name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + version_policy: + layout_policy: + content_disposition: + python: + - name: pypi-central + format: pypi + online: true + blocked: false + auto_block: true + remote: + url: https://pypi.org/simple + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + npm: + - name: npm-registry + format: npm + online: true + blocked: false + auto_block: true + remote: + url: https://registry.npmjs.org/ + username: + password: + bearerToken: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + nuget: + - name: nuget-gallery + format: nuget + online: true + blocked: false + auto_block: true + nuget_version: v3 + remote: + url: https://api.nuget.org/v3/index.json + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + apt: + - name: ubuntu-apt + format: apt + online: true + blocked: false + auto_block: true + distribution: bionic + flat: false + remote: + url: http://archive.ubuntu.com/ubuntu/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + helm: + - name: helm-proxy + format: helm + online: true + blocked: false + auto_block: true + remote: + url: https://kubernetes-charts.storage.googleapis.com + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + r: + - name: r-proxy + format: r + online: true + blocked: false + auto_block: true + remote: + url: https://cran.r-project.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + raw: + - name: raw-proxy + format: raw + online: true + blocked: false + auto_block: true + remote: + url: https://www.jfrog.com/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + contentDisposition: + conda: + - name: conda-proxy + format: conda + online: true + blocked: false + auto_block: true + remote: + url: https://repo.anaconda.com/pkgs/main + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + go: + - name: go-proxy + format: go + online: true + blocked: false + auto_block: true + remote: + url: https://proxy.golang.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + yum: + - name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 +group_defaults: + maven: + python: diff --git a/repos.yml b/repos.yml index 15d5c234..03f51246 100644 --- a/repos.yml +++ b/repos.yml @@ -29,366 +29,4 @@ teams: - name: proxy_defaults.maven_defaults group: [] -hosted_default: - apt: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - distribution: dist - aptSigning: - keypair: null - passphrase: null - docker: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - latestPolicy: null - cleanup: cleanup - forceBasicAuth: "" - v1Enabled: true - httpPort: null - subdomain: null - gitlfs: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - helm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - maven: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - versionPolicy: release # release, snapshot or mixed - layoutPolicy: strict # strict or permissive - npm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - nuget: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - python: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - raw: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - contentDisposition: INLINE - yum: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup: cleanup - repodataDepth: 1 - deployPolicy: strict # strict or permissive - -proxy_defaults: - maven: - - name: maven-central - format: maven2 - online: true - blocked: false - auto_block: true - remote: - url: https://repo.maven.apache.org/maven2 - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - version_policy: - layout_policy: - content_disposition: - python: - - name: pypi-central - format: pypi - online: true - blocked: false - auto_block: true - remote: - url: https://pypi.org/simple - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - npm: - - name: npm-registry - format: npm - online: true - blocked: false - auto_block: true - remote: - url: https://registry.npmjs.org/ - username: - password: - bearerToken: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - nuget: - - name: nuget-gallery - format: nuget - online: true - blocked: false - auto_block: true - nuget_version: v3 - remote: - url: https://api.nuget.org/v3/index.json - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - apt: - - name: ubuntu-apt - format: apt - online: true - blocked: false - auto_block: true - distribution: bionic - flat: false - remote: - url: http://archive.ubuntu.com/ubuntu/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - helm: - - name: helm-proxy - format: helm - online: true - blocked: false - auto_block: true - remote: - url: https://kubernetes-charts.storage.googleapis.com - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - r: - - name: r-proxy - format: r - online: true - blocked: false - auto_block: true - remote: - url: https://cran.r-project.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - raw: - - name: raw-proxy - format: raw - online: true - blocked: false - auto_block: true - remote: - url: https://www.jfrog.com/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - contentDisposition: - conda: - - name: conda-proxy - format: conda - online: true - blocked: false - auto_block: true - remote: - url: https://repo.anaconda.com/pkgs/main - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - go: - - name: go-proxy - format: go - online: true - blocked: false - auto_block: true - remote: - url: https://proxy.golang.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - yum: - - name: yum-proxy - format: yum - online: true - blocked: false - auto_block: true - remote: - url: http://mirror.centos.org/centos/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 -group_defaults: - maven: - python: - proxy_repos: diff --git a/teams.yml b/teams.yml deleted file mode 100644 index c6c02bb8..00000000 --- a/teams.yml +++ /dev/null @@ -1,16 +0,0 @@ -# -teams: - - ID: 1 - name: Team 1 - hosted_repo: [ - repo1 - repo2 - ] - proxy_repo: [ - proxy-repo1 - proxy-repo2 - ] - group_repo: [ - group-repo-1 - group-repo-2 - ] diff --git a/templates/hosted.yml.j2 b/templates/hosted.yml.j2 new file mode 100644 index 00000000..4616659d --- /dev/null +++ b/templates/hosted.yml.j2 @@ -0,0 +1,41 @@ +{% for hosted_default in hosted_defaults %} +{% for key, value in hosted_default.items() %} +nexus_repos_{{ key }}_hosted: +{% for team in teams %} +{% for default in value %} + - repositoryName: {{ team.name }} + recipeName: {{ key }} + online: {{ team.online if team.name is defined else default.online }} + storage: + blobStoreName: {{ team.blob if team.blob is defined else default.blob }} + writePolicy: {{ team.writePolicy if team.writePolicy is defined else default.writePolicy }} + cleanup: +{% if team.policy is defined %} +{% for policy in team.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% else %} +{% for policy in default.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% endif %} +### Repo type specific parameters +{% if key == 'apt' %} + distribution: {{ team.distribution if team.distribution is defined else default.distribution }} + aptSigning: + keypair: {{ team.keypair if team.keypair is defined else default.keypair }} + passphrase: {{ team.passphrase if team.passphrase is defined else default.passphrase }} +{% endif %} +{% if key == 'docker' %} + forceBasicAuth: {{ team.forceBasicAuth if team.forceBasicAuth is defined else default.forceBasicAuth }} + v1Enabled: {{ team.v1Enabled if team.v1Enabled is defined else default.v1Enabled }} + httpPort: {{ team.httpPort if team.httpPort is defined else default.httpPort }} + subdomain: {{ team.subdomain if team.subdomain is defined else default.subdomain }} +{% endif %} +{% if key == 'raw' %} + contentDisposition: {{ team.contentDisposition if team.contentDisposition is defined else default.contentDisposition }} +{% endif %} +{% endfor %} +{% endfor %} +{% endfor %} +{% endfor %} \ No newline at end of file From abbe96e2437a657343c654d16888e4c7d64a17c7 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Wed, 8 May 2024 12:57:57 +0000 Subject: [PATCH 05/23] Added team hosted repo list filtering --- molecule/default-converge.yml | 2 +- nexus.drawio | 80 +++++++++++++++++------------------ repos.yml => teams.yml | 4 ++ templates/hosted.yml.j2 | 3 ++ templates/proxies.yml.j2 | 41 +++++++++--------- 5 files changed, 69 insertions(+), 61 deletions(-) rename repos.yml => teams.yml (86%) diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index 04ae647f..9b39dc4f 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -2,7 +2,7 @@ - name: Converge hosts: nexus roles: - - role: nexus3-oss + - role: nexus3-pro vars_files: - ssl-{{ ansible_os_family }}.yml - nexus_common_test_vars.yml diff --git a/nexus.drawio b/nexus.drawio index 4ab47695..31db1089 100644 --- a/nexus.drawio +++ b/nexus.drawio @@ -1,6 +1,6 @@ - + @@ -160,9 +160,9 @@ - - - + + + @@ -183,9 +183,9 @@ - - - + + + @@ -286,9 +286,9 @@ - - - + + + @@ -309,9 +309,9 @@ - - - + + + @@ -355,9 +355,9 @@ - - - + + + @@ -387,9 +387,9 @@ - - - + + + @@ -507,40 +507,40 @@ - + - + - + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + diff --git a/repos.yml b/teams.yml similarity index 86% rename from repos.yml rename to teams.yml index 03f51246..8ce8867a 100644 --- a/repos.yml +++ b/teams.yml @@ -10,6 +10,10 @@ teams: format: pypi - name: npm-repo1 format: npm + - name: apt-repo1 + format: apt + cleanup_policies: + - my_cleanup proxy: - name: proxy-repo1 format: maven2 diff --git a/templates/hosted.yml.j2 b/templates/hosted.yml.j2 index 4616659d..c25a5deb 100644 --- a/templates/hosted.yml.j2 +++ b/templates/hosted.yml.j2 @@ -1,7 +1,9 @@ {% for hosted_default in hosted_defaults %} {% for key, value in hosted_default.items() %} nexus_repos_{{ key }}_hosted: +# Repo default parameters {% for team in teams %} +{% for hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} {% for default in value %} - repositoryName: {{ team.name }} recipeName: {{ key }} @@ -38,4 +40,5 @@ nexus_repos_{{ key }}_hosted: {% endfor %} {% endfor %} {% endfor %} +{% endfor %} {% endfor %} \ No newline at end of file diff --git a/templates/proxies.yml.j2 b/templates/proxies.yml.j2 index f86ea39d..0e24b91a 100644 --- a/templates/proxies.yml.j2 +++ b/templates/proxies.yml.j2 @@ -1,29 +1,30 @@ {% for proxy_default in proxy_defaults %} {% for key, value in proxy_default.items() %} nexus_repos_{{ key }}_proxy: -{% for repo in value %} - - name: {{ repo.name }} - format: {{ repo.format }} - online: {{ repo.online }} - blocked: {{ repo.blocked }} - auto_block: {{ repo.auto_block }} +{% for team in teams %} +{% for default in value %} + - name: {{ team.name }} + format: {{ team.format }} + online: {{ default.online }} + blocked: {{ default.blocked }} + auto_block: {{ default.auto_block }} remote: - username: {{ repo.remote.username }} - password: {{ repo.remote.password }} - remoteUrl: {{ repo.remote.url }} + username: {{ default.remote.username }} + password: {{ default.remote.password }} + remoteUrl: {{ default.remote.url }} connection: - useTrustStore: {{ repo.connection.useTrustStore }} - retries: {{ repo.connection.retries }} - user_agent_suffix: {{ repo.connection.user_agent_suffix }} - enable_cookies: {{ repo.connection.enable_cookies }} - enable_circular_redirects: {{ repo.connection.enable_circular_redirects }} - timeout: {{ repo.connection.timeout }} - maximum_component_age: {{ repo.maximum_component_age }} - maximum_metadata_age: {{ repo.maximum_metadata_age }} - negative_cache_enabled: {{ repo.negative_cache_enabled }} - negative_cache_ttl: {{ repo.negative_cache_ttl }} + useTrustStore: {{ default.connection.useTrustStore }} + retries: {{ default.connection.retries }} + user_agent_suffix: {{ default.connection.user_agent_suffix }} + enable_cookies: {{ default.connection.enable_cookies }} + enable_circular_redirects: {{ default.connection.enable_circular_redirects }} + timeout: {{ default.connection.timeout }} + maximum_component_age: {{ default.maximum_component_age }} + maximum_metadata_age: {{ default.maximum_metadata_age }} + negative_cache_enabled: {{ default.negative_cache_enabled }} + negative_cache_ttl: {{ default.negative_cache_ttl }} cleanup_policies: -{% for policy in repo.cleanup_policies %} +{% for policy in default.cleanup_policies %} - {{ policy }} {% endfor %} {% endfor %} From cbad770b9ba75c9e08adb877174130f6d8e2f7e9 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Wed, 8 May 2024 13:45:01 +0000 Subject: [PATCH 06/23] TODO: testing hosted.yml.j2 --- molecule/nexus_common_test_vars.yml | 400 ++++++++++++++++++++++++++++ repo-defaults.yml | 2 +- tasks/create_proxy_defaults.yml | 6 + templates/proxies.yml.j2 | 4 +- 4 files changed, 409 insertions(+), 3 deletions(-) diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index a3acc6f0..ba11490d 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -6,6 +6,8 @@ httpd_ssl_cert_key_location: "{{ default_key }}" nexus_public_hostname: localhost nexus_api_timeout: 45 +nexus_transform: true + nexus_custom_jvm_settings: - XX:+UseG1GC - XX:+PrintGCDetails @@ -651,3 +653,401 @@ nexus_proxy_exclude_hosts: # no_proxy env for shell does not obey java style - localhost - 127.* - "[::1]" + + + +hosted_defaults: + apt: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + distribution: dist + aptSigning: + keypair: null + passphrase: null + docker: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + latestPolicy: null + cleanup_policies: + - policy-1 + forceBasicAuth: "" + v1Enabled: true + httpPort: null + subdomain: null + gitlfs: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + helm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + maven: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + versionPolicy: release # release, snapshot or mixed + layoutPolicy: strict # strict or permissive + npm: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + nuget: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + python: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + raw: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + contentDisposition: INLINE + yum: + - repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + repodataDepth: 1 + deployPolicy: strict # strict or permissive + + +proxy_defaults: + - maven: + - name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + - name: maven-central-02 + format: maven2 + online: true + blocked: false + auto_block: true + remote: + url: https://repo.maven.apache.org/maven2 + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + version_policy: RELEASE + layout_policy: PERMISSIVE + content_disposition: INLINE + # - python: + # - name: pypi-central + # format: pypi + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://pypi.org/simple + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - npm: + # - name: npm-registry + # format: npm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://registry.npmjs.org/ + # username: + # password: + # bearerToken: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - nuget: + # - name: nuget-gallery + # format: nuget + # online: true + # blocked: false + # auto_block: true + # nuget_version: v3 + # remote: + # url: https://api.nuget.org/v3/index.json + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - apt: + # - name: ubuntu-apt + # format: apt + # online: true + # blocked: false + # auto_block: true + # distribution: bionic + # flat: false + # remote: + # url: http://archive.ubuntu.com/ubuntu/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - helm: + # - name: helm-proxy + # format: helm + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://kubernetes-charts.storage.googleapis.com + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - r: + # - name: r-proxy + # format: r + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://cran.r-project.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - raw: + # - name: raw-proxy + # format: raw + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://www.jfrog.com/ + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # contentDisposition: + # - conda: + # - name: conda-proxy + # format: conda + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://repo.anaconda.com/pkgs/main + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + # - go: + # - name: go-proxy + # format: go + # online: true + # blocked: false + # auto_block: true + # remote: + # url: https://proxy.golang.org + # username: + # password: + # connection: + # useTrustStore: false + # retries: + # user_agent_suffix: + # enable_cookies: + # enable_circular_redirects: + # timeout: + # maximum_component_age: + # maximum_metadata_age: + # negative_cache_enabled: + # negative_cache_ttl: + # cleanup_policies: + # - policy-1 + - yum: + - name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: username + password: password + connection: + useTrustStore: false + retries: 2 + user_agent_suffix: agent + enable_cookies: true + enable_circular_redirects: true + timeout: 1440 + maximum_component_age: 1440 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + cleanup_policies: + - policy-1 + diff --git a/repo-defaults.yml b/repo-defaults.yml index d9a40c5a..cfc69c55 100644 --- a/repo-defaults.yml +++ b/repo-defaults.yml @@ -1,4 +1,4 @@ -hosted_default: +hosted_defaults: apt: - repositoryName: -repo recipeName: recipeName, diff --git a/tasks/create_proxy_defaults.yml b/tasks/create_proxy_defaults.yml index c9401086..b0f4db9e 100644 --- a/tasks/create_proxy_defaults.yml +++ b/tasks/create_proxy_defaults.yml @@ -5,3 +5,9 @@ dest: "/nexus-downloads/proxies-result.yml" #remote_src: true tags: transform +- name: Transform hosted_defaults into nexus_repos + ansible.builtin.template: + src: "/workspaces/nexus3-pro/templates/hosted.yml.j2" + dest: "/nexus-downloads/hosted-result.yml" + #remote_src: true + tags: transform diff --git a/templates/proxies.yml.j2 b/templates/proxies.yml.j2 index 0e24b91a..5e18d36f 100644 --- a/templates/proxies.yml.j2 +++ b/templates/proxies.yml.j2 @@ -1,4 +1,4 @@ -{% for proxy_default in proxy_defaults %} +{# {% for proxy_default in proxy_defaults %} {% for key, value in proxy_default.items() %} nexus_repos_{{ key }}_proxy: {% for team in teams %} @@ -29,4 +29,4 @@ nexus_repos_{{ key }}_proxy: {% endfor %} {% endfor %} {% endfor %} -{% endfor %} \ No newline at end of file +{% endfor %} #} \ No newline at end of file From 0e9b11225a7341462b337f5223e90cd4ca9f50b9 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Tue, 14 May 2024 14:22:22 +0000 Subject: [PATCH 07/23] hosted file jinja2 completed --- molecule/nexus_common_test_vars.yml | 224 ++++++++++++++++------------ templates/hosted.yml.j2 | 36 ++--- 2 files changed, 145 insertions(+), 115 deletions(-) diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index ba11490d..caf6d168 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -658,109 +658,109 @@ nexus_proxy_exclude_hosts: # no_proxy env for shell does not obey java style hosted_defaults: apt: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - distribution: dist - aptSigning: - keypair: null - passphrase: null + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + distribution: dist + aptSigning: + keypair: null + passphrase: null docker: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - latestPolicy: null - cleanup_policies: - - policy-1 - forceBasicAuth: "" - v1Enabled: true - httpPort: null - subdomain: null + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + latestPolicy: null + cleanup_policies: + - policy-1 + forceBasicAuth: "" + v1Enabled: true + httpPort: null + subdomain: null gitlfs: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 helm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 maven: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - versionPolicy: release # release, snapshot or mixed - layoutPolicy: strict # strict or permissive + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + versionPolicy: release # release, snapshot or mixed + layoutPolicy: strict # strict or permissive npm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 nuget: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 python: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 raw: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - contentDisposition: INLINE + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + contentDisposition: INLINE yum: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - repodataDepth: 1 - deployPolicy: strict # strict or permissive + repositoryName: -repo + recipeName: recipeName, + online: true + storage: + blobStoreName: blob + writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW + cleanup_policies: + - policy-1 + repodataDepth: 1 + deployPolicy: strict # strict or permissive proxy_defaults: @@ -1051,3 +1051,39 @@ proxy_defaults: cleanup_policies: - policy-1 +teams: + - ID: 1 + name: Team 1 + repos: + requestedBy: + hosted: + - name: maven-repo1 + format: maven2 + - name: python-repo1 + format: pypi + - name: npm-repo1 + format: npm + - name: apt-repo1 + format: apt + cleanup_policies: + - my_cleanup + proxy: + - name: proxy-repo1 + format: maven2 + group: + - name: group-repo-1 + members: + - maven-repo2 + - npm-repo1 + - name: group-repo-2 + members: + - maven-repo2 + - npm-repo1 + sharedAccessTo: + hosted: + - name: maven-repo1 + proxy: + - name: proxy_defaults.maven_defaults + group: [] + +proxy_repos: diff --git a/templates/hosted.yml.j2 b/templates/hosted.yml.j2 index c25a5deb..8b0f2ebd 100644 --- a/templates/hosted.yml.j2 +++ b/templates/hosted.yml.j2 @@ -1,44 +1,38 @@ -{% for hosted_default in hosted_defaults %} -{% for key, value in hosted_default.items() %} +{% for key, value in hosted_defaults.items() %} nexus_repos_{{ key }}_hosted: -# Repo default parameters {% for team in teams %} -{% for hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} -{% for default in value %} - - repositoryName: {{ team.name }} +{% for team_hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} + - repositoryName: {{ team_hosted_repo.name }} recipeName: {{ key }} - online: {{ team.online if team.name is defined else default.online }} + online: {{ team_hosted_repo.online if team_hosted_repo.online is defined else value.online }} storage: - blobStoreName: {{ team.blob if team.blob is defined else default.blob }} - writePolicy: {{ team.writePolicy if team.writePolicy is defined else default.writePolicy }} + blobStoreName: {{ team_hosted_repo.blob if team_hosted_repo.blob is defined else value.storage.blobStoreName }} + writePolicy: {{ team_hosted_repo.writePolicy if team_hosted_repo.writePolicy is defined else value.storage.writePolicy }} cleanup: {% if team.policy is defined %} {% for policy in team.cleanup_policies %} - {{ policy }} {% endfor %} {% else %} -{% for policy in default.cleanup_policies %} +{% for policy in value.cleanup_policies %} - {{ policy }} {% endfor %} {% endif %} -### Repo type specific parameters {% if key == 'apt' %} - distribution: {{ team.distribution if team.distribution is defined else default.distribution }} + distribution: {{ team_hosted_repo.distribution if team_hosted_repo.distribution is defined else value.distribution }} aptSigning: - keypair: {{ team.keypair if team.keypair is defined else default.keypair }} - passphrase: {{ team.passphrase if team.passphrase is defined else default.passphrase }} + keypair: {{ team_hosted_repo.keypair if team_hosted_repo.keypair is defined else value.aptSigning.keypair }} + passphrase: {{ team_hosted_repo.passphrase if team_hosted_repo.passphrase is defined else value.aptSigning.passphrase }} {% endif %} {% if key == 'docker' %} - forceBasicAuth: {{ team.forceBasicAuth if team.forceBasicAuth is defined else default.forceBasicAuth }} - v1Enabled: {{ team.v1Enabled if team.v1Enabled is defined else default.v1Enabled }} - httpPort: {{ team.httpPort if team.httpPort is defined else default.httpPort }} - subdomain: {{ team.subdomain if team.subdomain is defined else default.subdomain }} + forceBasicAuth: {{ team_hosted_repo.forceBasicAuth if team_hosted_repo.forceBasicAuth is defined else value.forceBasicAuth }} + v1Enabled: {{ team_hosted_repo.v1Enabled if team_hosted_repo.v1Enabled is defined else value.v1Enabled }} + httpPort: {{ team_hosted_repo.httpPort if team_hosted_repo.httpPort is defined else value.httpPort }} + subdomain: {{ team_hosted_repo.subdomain if team_hosted_repo.subdomain is defined else value.subdomain }} {% endif %} {% if key == 'raw' %} - contentDisposition: {{ team.contentDisposition if team.contentDisposition is defined else default.contentDisposition }} + contentDisposition: {{ team_hosted_repo.contentDisposition if team_hosted_repo.contentDisposition is defined else value.contentDisposition }} {% endif %} {% endfor %} {% endfor %} -{% endfor %} -{% endfor %} {% endfor %} \ No newline at end of file From 747854ac78b7c9fd2900f6f39b27bf3ebc83b9a3 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Tue, 21 May 2024 14:34:23 +0000 Subject: [PATCH 08/23] hosted_repos most used types checked. Split up defaults properties in seperate files. --- defaults/main.yml | 2 +- molecule/default-converge.yml | 4 + molecule/nexus_common_test_vars.yml | 435 +----------------- .../repo-defaults.yml | 196 ++++---- teams.yml => molecule/teams.yml | 6 +- templates/hosted.yml.j2 | 35 +- 6 files changed, 131 insertions(+), 547 deletions(-) rename repo-defaults.yml => molecule/repo-defaults.yml (66%) rename teams.yml => molecule/teams.yml (87%) diff --git a/defaults/main.yml b/defaults/main.yml index 41e99ca8..7567f89a 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -513,7 +513,7 @@ nexus_repos_docker_proxy: # maximum_component_age: 1440 # maximum_metadata_age: 1440 # negative_cache_enabled: true - # negative_cache_ttl: 1440 + # negative_cache_ttl: 1440x nexus_repos_docker_group: - name: docker-group diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index 9b39dc4f..beb1ba6d 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -7,6 +7,10 @@ - ssl-{{ ansible_os_family }}.yml - nexus_common_test_vars.yml - nexus_ldap_test_vars.yml + - teams.yml + - repo-defaults.yml + - .nexus-downloads/hosted-result.yml + # - .nexus-downloads/proxies-result.yml environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index caf6d168..4a27a530 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -653,437 +653,4 @@ nexus_proxy_exclude_hosts: # no_proxy env for shell does not obey java style - localhost - 127.* - "[::1]" - - - -hosted_defaults: - apt: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - distribution: dist - aptSigning: - keypair: null - passphrase: null - docker: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - latestPolicy: null - cleanup_policies: - - policy-1 - forceBasicAuth: "" - v1Enabled: true - httpPort: null - subdomain: null - gitlfs: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - helm: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - maven: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - versionPolicy: release # release, snapshot or mixed - layoutPolicy: strict # strict or permissive - npm: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - nuget: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - python: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - raw: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - contentDisposition: INLINE - yum: - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - repodataDepth: 1 - deployPolicy: strict # strict or permissive - - -proxy_defaults: - - maven: - - name: maven-central - format: maven2 - online: true - blocked: false - auto_block: true - remote: - url: https://repo.maven.apache.org/maven2 - username: username - password: password - connection: - useTrustStore: false - retries: 2 - user_agent_suffix: agent - enable_cookies: true - enable_circular_redirects: true - timeout: 1440 - maximum_component_age: 1440 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - cleanup_policies: - - policy-1 - version_policy: RELEASE - layout_policy: PERMISSIVE - content_disposition: INLINE - - name: maven-central-02 - format: maven2 - online: true - blocked: false - auto_block: true - remote: - url: https://repo.maven.apache.org/maven2 - username: username - password: password - connection: - useTrustStore: false - retries: 2 - user_agent_suffix: agent - enable_cookies: true - enable_circular_redirects: true - timeout: 1440 - maximum_component_age: 1440 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - cleanup_policies: - - policy-1 - version_policy: RELEASE - layout_policy: PERMISSIVE - content_disposition: INLINE - # - python: - # - name: pypi-central - # format: pypi - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://pypi.org/simple - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - npm: - # - name: npm-registry - # format: npm - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://registry.npmjs.org/ - # username: - # password: - # bearerToken: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - nuget: - # - name: nuget-gallery - # format: nuget - # online: true - # blocked: false - # auto_block: true - # nuget_version: v3 - # remote: - # url: https://api.nuget.org/v3/index.json - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - apt: - # - name: ubuntu-apt - # format: apt - # online: true - # blocked: false - # auto_block: true - # distribution: bionic - # flat: false - # remote: - # url: http://archive.ubuntu.com/ubuntu/ - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - helm: - # - name: helm-proxy - # format: helm - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://kubernetes-charts.storage.googleapis.com - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - r: - # - name: r-proxy - # format: r - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://cran.r-project.org - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - raw: - # - name: raw-proxy - # format: raw - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://www.jfrog.com/ - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # contentDisposition: - # - conda: - # - name: conda-proxy - # format: conda - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://repo.anaconda.com/pkgs/main - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - # - go: - # - name: go-proxy - # format: go - # online: true - # blocked: false - # auto_block: true - # remote: - # url: https://proxy.golang.org - # username: - # password: - # connection: - # useTrustStore: false - # retries: - # user_agent_suffix: - # enable_cookies: - # enable_circular_redirects: - # timeout: - # maximum_component_age: - # maximum_metadata_age: - # negative_cache_enabled: - # negative_cache_ttl: - # cleanup_policies: - # - policy-1 - - yum: - - name: yum-proxy - format: yum - online: true - blocked: false - auto_block: true - remote: - url: http://mirror.centos.org/centos/ - username: username - password: password - connection: - useTrustStore: false - retries: 2 - user_agent_suffix: agent - enable_cookies: true - enable_circular_redirects: true - timeout: 1440 - maximum_component_age: 1440 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - cleanup_policies: - - policy-1 - -teams: - - ID: 1 - name: Team 1 - repos: - requestedBy: - hosted: - - name: maven-repo1 - format: maven2 - - name: python-repo1 - format: pypi - - name: npm-repo1 - format: npm - - name: apt-repo1 - format: apt - cleanup_policies: - - my_cleanup - proxy: - - name: proxy-repo1 - format: maven2 - group: - - name: group-repo-1 - members: - - maven-repo2 - - npm-repo1 - - name: group-repo-2 - members: - - maven-repo2 - - npm-repo1 - sharedAccessTo: - hosted: - - name: maven-repo1 - proxy: - - name: proxy_defaults.maven_defaults - group: [] - -proxy_repos: + \ No newline at end of file diff --git a/repo-defaults.yml b/molecule/repo-defaults.yml similarity index 66% rename from repo-defaults.yml rename to molecule/repo-defaults.yml index cfc69c55..8f30816b 100644 --- a/repo-defaults.yml +++ b/molecule/repo-defaults.yml @@ -1,108 +1,112 @@ hosted_defaults: apt: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - distribution: dist - aptSigning: - keypair: null - passphrase: null + blob_store: blob-apt + online: true + distribution: dist + keypair: 'none' + passphrase: 'none' + strict_content_validation: true + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - apt_cleanup docker: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - latestPolicy: null - cleanup_policies: - - policy-1 - forceBasicAuth: "" - v1Enabled: true - httpPort: null - subdomain: null + online: true + blob_store: blob-docker + force_basic_auth: true + strict_content_validation: true + allow_redeploy_latest: false + version_policy: release # release, snapshot or mixed + write_policy: allow_once + layout_policy: strict # strict or permissive + http_port: null + https_port: null + sub_domain: '' + v1_enabled: false + cleanup_policies: + - docker_cleanup gitlfs: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-gitlfs + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - gitlfs_cleanup helm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - maven: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - versionPolicy: release # release, snapshot or mixed - layoutPolicy: strict # strict or permissive + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-helm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - helm_cleanup + maven2: + online: true + blob_store: blob-mvn + strict_content_validation: true + version_policy: release # release, snapshot or mixed + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - mvn_cleanup npm: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-npm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - npm_cleanup nuget: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - python: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-nuget + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - nuget_cleanup + pypi: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-pypi + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - python_cleanup raw: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - contentDisposition: INLINE + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-raw + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - raw_cleanup + contentDisposition: INLINE yum: - - repositoryName: -repo - recipeName: recipeName, - online: true - storage: - blobStoreName: blob - writePolicy: ALLOW_ONCE # ALLOW_ONCE or ALLOW - cleanup_policies: - - policy-1 - repodataDepth: 1 - deployPolicy: strict # strict or permissive + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-yum + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - yum_cleanup + repodataDepth: 1 + deployPolicy: strict # strict or permissive proxy_defaults: maven: diff --git a/teams.yml b/molecule/teams.yml similarity index 87% rename from teams.yml rename to molecule/teams.yml index 8ce8867a..9f656af6 100644 --- a/teams.yml +++ b/molecule/teams.yml @@ -12,8 +12,10 @@ teams: format: npm - name: apt-repo1 format: apt - cleanup_policies: - - my_cleanup + - name: docker-repo1 + format: docker + - name: helm-repo1 + format: helm proxy: - name: proxy-repo1 format: maven2 diff --git a/templates/hosted.yml.j2 b/templates/hosted.yml.j2 index 8b0f2ebd..44db59d1 100644 --- a/templates/hosted.yml.j2 +++ b/templates/hosted.yml.j2 @@ -1,34 +1,41 @@ {% for key, value in hosted_defaults.items() %} -nexus_repos_{{ key }}_hosted: +{% set hadData = false %} {% for team in teams %} {% for team_hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} - - repositoryName: {{ team_hosted_repo.name }} +{% if team_hosted_repo|length > 0 and hadData == false %} +{% if key == 'maven2' %} +nexus_repos_{{ key[:-1] }}_hosted: +{% else %} +nexus_repos_{{ key }}_hosted: +{% endif %} +{% set hadData = true %} +{% endif %} + - name: {{ team_hosted_repo.name }} recipeName: {{ key }} online: {{ team_hosted_repo.online if team_hosted_repo.online is defined else value.online }} - storage: - blobStoreName: {{ team_hosted_repo.blob if team_hosted_repo.blob is defined else value.storage.blobStoreName }} - writePolicy: {{ team_hosted_repo.writePolicy if team_hosted_repo.writePolicy is defined else value.storage.writePolicy }} - cleanup: + blob_store: {{ team_hosted_repo.blob_store if team_hosted_repo.blob_store is defined else value.blob_store }} + layout_policy: {{ team_hosted_repo.layout_policy if team_hosted_repo.layout_policy is defined else value.layout_policy }} + write_policy: {{ team_hosted_repo.write_policy if team_hosted_repo.write_policy is defined else value.write_policy }} + cleanup_policies: {% if team.policy is defined %} {% for policy in team.cleanup_policies %} - {{ policy }} {% endfor %} {% else %} {% for policy in value.cleanup_policies %} - - {{ policy }} + - {{ policy }} {% endfor %} {% endif %} {% if key == 'apt' %} distribution: {{ team_hosted_repo.distribution if team_hosted_repo.distribution is defined else value.distribution }} - aptSigning: - keypair: {{ team_hosted_repo.keypair if team_hosted_repo.keypair is defined else value.aptSigning.keypair }} - passphrase: {{ team_hosted_repo.passphrase if team_hosted_repo.passphrase is defined else value.aptSigning.passphrase }} + keypair: {{ team_hosted_repo.keypair if team_hosted_repo.keypair is defined else value.keypair }} + passphrase: {{ team_hosted_repo.passphrase if team_hosted_repo.passphrase is defined else value.passphrase }} {% endif %} {% if key == 'docker' %} - forceBasicAuth: {{ team_hosted_repo.forceBasicAuth if team_hosted_repo.forceBasicAuth is defined else value.forceBasicAuth }} - v1Enabled: {{ team_hosted_repo.v1Enabled if team_hosted_repo.v1Enabled is defined else value.v1Enabled }} - httpPort: {{ team_hosted_repo.httpPort if team_hosted_repo.httpPort is defined else value.httpPort }} - subdomain: {{ team_hosted_repo.subdomain if team_hosted_repo.subdomain is defined else value.subdomain }} + force_basic_auth: {{ team_hosted_repo.force_basic_auth if team_hosted_repo.force_basic_auth is defined else value.force_basic_auth }} + v1_enabled: {{ team_hosted_repo.v1_enabled if team_hosted_repo.v1_enabled is defined else value.v1_enabled }} + http_port: {{ team_hosted_repo.http_port if team_hosted_repo.http_port is defined else value.http_port }} + sub_domain: {{ team_hosted_repo.sub_domain if team_hosted_repo.sub_domain is defined else value.sub_domain }} {% endif %} {% if key == 'raw' %} contentDisposition: {{ team_hosted_repo.contentDisposition if team_hosted_repo.contentDisposition is defined else value.contentDisposition }} From bb8187ecdec16eb31ceac1ddd00376c83e5e84b9 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Wed, 22 May 2024 13:25:00 +0000 Subject: [PATCH 09/23] hosted fixed proxy repos started --- molecule/default-converge.yml | 2 +- molecule/repo-defaults.yml | 503 +++++++++++++++++----------------- molecule/teams.yml | 4 + templates/hosted.yml.j2 | 4 +- templates/proxies.yml.j2 | 75 +++-- 5 files changed, 309 insertions(+), 279 deletions(-) diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index beb1ba6d..dde59d51 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -10,7 +10,7 @@ - teams.yml - repo-defaults.yml - .nexus-downloads/hosted-result.yml - # - .nexus-downloads/proxies-result.yml + - .nexus-downloads/proxies-result.yml environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" diff --git a/molecule/repo-defaults.yml b/molecule/repo-defaults.yml index 8f30816b..a09a4581 100644 --- a/molecule/repo-defaults.yml +++ b/molecule/repo-defaults.yml @@ -109,267 +109,268 @@ hosted_defaults: deployPolicy: strict # strict or permissive proxy_defaults: - maven: - - name: maven-central - format: maven2 - online: true - blocked: false - auto_block: true - remote: - url: https://repo.maven.apache.org/maven2 - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - version_policy: - layout_policy: - content_disposition: + maven2: + name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + blob_store: blob-mvn + strict_content_validation: true + remote: + url: https://repo.maven.apache.org/maven2 + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: '' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + cleanup_policies: + - mvn_cleanup python: - - name: pypi-central - format: pypi - online: true - blocked: false - auto_block: true - remote: - url: https://pypi.org/simple - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: pypi-central + format: pypi + online: true + blocked: false + auto_block: true + remote: + url: https://pypi.org/simple + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 npm: - - name: npm-registry - format: npm - online: true - blocked: false - auto_block: true - remote: - url: https://registry.npmjs.org/ - username: - password: - bearerToken: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: npm-registry + format: npm + online: true + blocked: false + auto_block: true + remote: + url: https://registry.npmjs.org/ + username: + password: + bearerToken: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 nuget: - - name: nuget-gallery - format: nuget - online: true - blocked: false - auto_block: true - nuget_version: v3 - remote: - url: https://api.nuget.org/v3/index.json - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: nuget-gallery + format: nuget + online: true + blocked: false + auto_block: true + nuget_version: v3 + remote: + url: https://api.nuget.org/v3/index.json + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 apt: - - name: ubuntu-apt - format: apt - online: true - blocked: false - auto_block: true - distribution: bionic - flat: false - remote: - url: http://archive.ubuntu.com/ubuntu/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: ubuntu-apt + format: apt + online: true + blocked: false + auto_block: true + distribution: bionic + flat: false + remote: + url: http://archive.ubuntu.com/ubuntu/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 helm: - - name: helm-proxy - format: helm - online: true - blocked: false - auto_block: true - remote: - url: https://kubernetes-charts.storage.googleapis.com - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: helm-proxy + format: helm + online: true + blocked: false + auto_block: true + remote: + url: https://kubernetes-charts.storage.googleapis.com + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 r: - - name: r-proxy - format: r - online: true - blocked: false - auto_block: true - remote: - url: https://cran.r-project.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: r-proxy + format: r + online: true + blocked: false + auto_block: true + remote: + url: https://cran.r-project.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 raw: - - name: raw-proxy - format: raw - online: true - blocked: false - auto_block: true - remote: - url: https://www.jfrog.com/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - contentDisposition: + name: raw-proxy + format: raw + online: true + blocked: false + auto_block: true + remote: + url: https://www.jfrog.com/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + contentDisposition: conda: - - name: conda-proxy - format: conda - online: true - blocked: false - auto_block: true - remote: - url: https://repo.anaconda.com/pkgs/main - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: conda-proxy + format: conda + online: true + blocked: false + auto_block: true + remote: + url: https://repo.anaconda.com/pkgs/main + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 go: - - name: go-proxy - format: go - online: true - blocked: false - auto_block: true - remote: - url: https://proxy.golang.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: go-proxy + format: go + online: true + blocked: false + auto_block: true + remote: + url: https://proxy.golang.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 yum: - - name: yum-proxy - format: yum - online: true - blocked: false - auto_block: true - remote: - url: http://mirror.centos.org/centos/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 + name: yum-proxy + format: yum + online: true + blocked: false + auto_block: true + remote: + url: http://mirror.centos.org/centos/ + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: 'cn' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 group_defaults: maven: python: diff --git a/molecule/teams.yml b/molecule/teams.yml index 9f656af6..12203c27 100644 --- a/molecule/teams.yml +++ b/molecule/teams.yml @@ -6,6 +6,8 @@ teams: hosted: - name: maven-repo1 format: maven2 + - name: maven-repo2 + format: maven2 - name: python-repo1 format: pypi - name: npm-repo1 @@ -16,6 +18,8 @@ teams: format: docker - name: helm-repo1 format: helm + - name: raw-repo1 + format: raw proxy: - name: proxy-repo1 format: maven2 diff --git a/templates/hosted.yml.j2 b/templates/hosted.yml.j2 index 44db59d1..323bfe29 100644 --- a/templates/hosted.yml.j2 +++ b/templates/hosted.yml.j2 @@ -1,14 +1,12 @@ {% for key, value in hosted_defaults.items() %} -{% set hadData = false %} {% for team in teams %} {% for team_hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} -{% if team_hosted_repo|length > 0 and hadData == false %} +{% if team_hosted_repo|length > 0 and loop.first %} {% if key == 'maven2' %} nexus_repos_{{ key[:-1] }}_hosted: {% else %} nexus_repos_{{ key }}_hosted: {% endif %} -{% set hadData = true %} {% endif %} - name: {{ team_hosted_repo.name }} recipeName: {{ key }} diff --git a/templates/proxies.yml.j2 b/templates/proxies.yml.j2 index 5e18d36f..84fa0a6e 100644 --- a/templates/proxies.yml.j2 +++ b/templates/proxies.yml.j2 @@ -1,32 +1,59 @@ -{# {% for proxy_default in proxy_defaults %} -{% for key, value in proxy_default.items() %} -nexus_repos_{{ key }}_proxy: +{% for key, value in proxy_defaults.items() %} {% for team in teams %} -{% for default in value %} - - name: {{ team.name }} - format: {{ team.format }} - online: {{ default.online }} - blocked: {{ default.blocked }} - auto_block: {{ default.auto_block }} +{% for team_proxy_repo in team.repos.requestedBy.proxy | selectattr("format", "equalto", key) %} +{% if team_proxy_repo|length > 0 and loop.first %} +{% if key == 'maven2' %} +nexus_repos_{{ key[:-1] }}_proxy: +{% else %} +nexus_repos_{{ key }}_proxy: +{% endif %} +{% endif %} + - name: {{ team_proxy_repo.name }} + recipeName: {{ key }} + online: {{ team_proxy_repo.online if team_proxy_repo.online is defined else value.online }} + blob_store: {{ team_proxy_repo.blob_store if team_proxy_repo.blob_store is defined else value.blob_store }} + layout_policy: {{ team_proxy_repo.layout_policy if team_proxy_repo.layout_policy is defined else value.layout_policy }} + write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} + blocked: {{ team_proxy_repo.blocked if team_proxy_repo.blocked is defined else value.blocked }} + auto_block: {{ team_proxy_repo.auto_block if team_proxy_repo.auto_block is defined else value.auto_block }} remote: - username: {{ default.remote.username }} - password: {{ default.remote.password }} - remoteUrl: {{ default.remote.url }} + username: {{ team_proxy_repo.remote.username if team_proxy_repo.remote.username is defined else value.remote.username }} + password: {{ team_proxy_repo.remote.password if team_proxy_repo.remote.password is defined else value.remote.password }} + remote_url: {{ team_proxy_repo.remote_url if team_proxy_repo.remote_url is defined else value.remote.url }} connection: - useTrustStore: {{ default.connection.useTrustStore }} - retries: {{ default.connection.retries }} - user_agent_suffix: {{ default.connection.user_agent_suffix }} - enable_cookies: {{ default.connection.enable_cookies }} - enable_circular_redirects: {{ default.connection.enable_circular_redirects }} - timeout: {{ default.connection.timeout }} - maximum_component_age: {{ default.maximum_component_age }} - maximum_metadata_age: {{ default.maximum_metadata_age }} - negative_cache_enabled: {{ default.negative_cache_enabled }} - negative_cache_ttl: {{ default.negative_cache_ttl }} + retries: {{ team_proxy_repo.connection.retries if team_proxy_repo.connection.retries is defined else value.connection.retries }} + user_agent_suffix: {{ team_proxy_repo.connection.user_agent_suffix if team_proxy_repo.connection.user_agent_suffix is defined else value.connection.user_agent_suffix }} + enable_cookies: {{ team_proxy_repo.connection.enable_cookies if team_proxy_repo.connection.enable_cookies is defined else value.connection.enable_cookies }} + enable_circular_redirects: {{ team_proxy_repo.connection.enable_circular_redirects if team_proxy_repo.connection.enable_circular_redirects is defined else value.connection.enable_circular_redirects }} + timeout: {{ team_proxy_repo.connection.timeout if team_proxy_repo.connection.timeout is defined else value.connection.timeout }} + maximum_component_age: {{ team_proxy_repo.maximum_component_age if team_proxy_repo.maximum_component_age is defined else value.maximum_component_age }} + maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} + negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} + negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} cleanup_policies: -{% for policy in default.cleanup_policies %} +{% if team.policy is defined %} +{% for policy in team.cleanup_policies %} - {{ policy }} {% endfor %} +{% else %} +{% for policy in value.cleanup_policies %} + - {{ policy }} +{% endfor %} +{% endif %} +{% if key == 'apt' %} + distribution: {{ team_proxy_repo.distribution if team_proxy_repo.distribution is defined else value.distribution }} + keypair: {{ team_proxy_repo.keypair if team_proxy_repo.keypair is defined else value.keypair }} + passphrase: {{ team_proxy_repo.passphrase if team_proxy_repo.passphrase is defined else value.passphrase }} +{% endif %} +{% if key == 'docker' %} + force_basic_auth: {{ team_proxy_repo.force_basic_auth if team_proxy_repo.force_basic_auth is defined else value.force_basic_auth }} + v1_enabled: {{ team_proxy_repo.v1_enabled if team_proxy_repo.v1_enabled is defined else value.v1_enabled }} + http_port: {{ team_proxy_repo.http_port if team_proxy_repo.http_port is defined else value.http_port }} + sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} +{% endif %} +{% if key == 'raw' %} + contentDisposition: {{ team_proxy_repo.contentDisposition if team_proxy_repo.contentDisposition is defined else value.contentDisposition }} +{% endif %} {% endfor %} {% endfor %} -{% endfor %} #} \ No newline at end of file +{% endfor %} \ No newline at end of file From 891e8159465fff63cb5cba9d688d512c1ab78a87 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Tue, 28 May 2024 14:05:43 +0000 Subject: [PATCH 10/23] Create a Role named nexus3-repository-templates --- molecule/default-converge.yml | 3 +- molecule/repo-defaults.yml | 55 ++- .../nexus3-repository-templates/README.md | 38 ++ .../defaults/main.yml | 461 ++++++++++++++++++ .../handlers/main.yml | 2 + .../nexus3-repository-templates/meta/main.yml | 52 ++ .../tasks/main.yml | 14 + .../templates}/hosted.yml.j2 | 3 +- .../templates}/proxies.yml.j2 | 0 .../tests/inventory | 2 + .../tests/test.yml | 5 + .../nexus3-repository-templates/vars/main.yml | 2 + molecule/teams.yml | 6 +- tasks/create_proxy_defaults.yml | 26 +- 14 files changed, 642 insertions(+), 27 deletions(-) create mode 100644 molecule/roles/nexus3-repository-templates/README.md create mode 100644 molecule/roles/nexus3-repository-templates/defaults/main.yml create mode 100644 molecule/roles/nexus3-repository-templates/handlers/main.yml create mode 100644 molecule/roles/nexus3-repository-templates/meta/main.yml create mode 100644 molecule/roles/nexus3-repository-templates/tasks/main.yml rename {templates => molecule/roles/nexus3-repository-templates/templates}/hosted.yml.j2 (97%) rename {templates => molecule/roles/nexus3-repository-templates/templates}/proxies.yml.j2 (100%) create mode 100644 molecule/roles/nexus3-repository-templates/tests/inventory create mode 100644 molecule/roles/nexus3-repository-templates/tests/test.yml create mode 100644 molecule/roles/nexus3-repository-templates/vars/main.yml diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index dde59d51..f4d21d7b 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -2,13 +2,12 @@ - name: Converge hosts: nexus roles: + - role: nexus3-repository-templates - role: nexus3-pro vars_files: - ssl-{{ ansible_os_family }}.yml - nexus_common_test_vars.yml - nexus_ldap_test_vars.yml - - teams.yml - - repo-defaults.yml - .nexus-downloads/hosted-result.yml - .nexus-downloads/proxies-result.yml diff --git a/molecule/repo-defaults.yml b/molecule/repo-defaults.yml index a09a4581..0e0a9d44 100644 --- a/molecule/repo-defaults.yml +++ b/molecule/repo-defaults.yml @@ -13,15 +13,16 @@ hosted_defaults: docker: online: true blob_store: blob-docker + remote_url: 'https://a.a' force_basic_auth: true strict_content_validation: true allow_redeploy_latest: false version_policy: release # release, snapshot or mixed write_policy: allow_once layout_policy: strict # strict or permissive - http_port: null - https_port: null - sub_domain: '' + http_port: + https_port: + sub_domain: v1_enabled: false cleanup_policies: - docker_cleanup @@ -137,6 +138,38 @@ proxy_defaults: content_disposition: inline cleanup_policies: - mvn_cleanup + docker: + name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + blob_store: blob-mvn + strict_content_validation: true + force_basic_auth: true + v1_enabled: false + http_port: NaN + sub_domain: '' + remote: + url: https://repo.maven.apache.org/maven2 + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: '' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + cleanup_policies: + - mvn_cleanup python: name: pypi-central format: pypi @@ -350,11 +383,10 @@ proxy_defaults: cleanup_policies: - policy-1 yum: - name: yum-proxy - format: yum online: true blocked: false auto_block: true + blob_store: blob-yum remote: url: http://mirror.centos.org/centos/ username: '' @@ -365,10 +397,15 @@ proxy_defaults: enable_cookies: false enable_circular_redirects: false timeout: '' - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + strict_content_validation: true + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline cleanup_policies: - policy-1 group_defaults: diff --git a/molecule/roles/nexus3-repository-templates/README.md b/molecule/roles/nexus3-repository-templates/README.md new file mode 100644 index 00000000..225dd44b --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/README.md @@ -0,0 +1,38 @@ +Role Name +========= + +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml new file mode 100644 index 00000000..bb17f695 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -0,0 +1,461 @@ +--- +# defaults file for nexus3-repository-templates +teams: + - ID: 1 + name: Team 1 + repos: + requestedBy: + hosted: + - name: maven-repo1 + format: maven2 + - name: maven-repo2 + format: maven2 + - name: python-repo1 + format: pypi + - name: npm-repo1 + format: npm + - name: apt-repo1 + format: apt + - name: docker-repo1 + format: docker + - name: helm-repo1 + format: helm + - name: raw-repo1 + format: raw + proxy: + - name: mvn-proxy-repo1 + format: maven2 + - name: yum-proxy-repo1 + format: yum + # - name: docker-proxy-repo1 + # format: docker + group: + - name: group-repo-1 + members: + - maven-repo2 + - npm-repo1 + - name: group-repo-2 + members: + - maven-repo2 + - npm-repo1 + sharedAccessTo: + hosted: + - name: maven-repo1 + proxy: + - name: proxy_defaults.maven_defaults + group: [] + +hosted_defaults: + apt: + blob_store: blob-apt + online: true + distribution: dist + keypair: 'none' + passphrase: 'none' + strict_content_validation: true + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - apt_cleanup + docker: + online: true + blob_store: blob-docker + remote_url: 'https://a.a' + force_basic_auth: true + strict_content_validation: true + allow_redeploy_latest: false + version_policy: release # release, snapshot or mixed + write_policy: allow_once + layout_policy: strict # strict or permissive + http_port: + https_port: + sub_domain: + v1_enabled: false + cleanup_policies: + - docker_cleanup + gitlfs: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-gitlfs + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - gitlfs_cleanup + helm: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-helm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - helm_cleanup + maven2: + online: true + blob_store: blob-mvn + strict_content_validation: true + version_policy: release # release, snapshot or mixed + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + cleanup_policies: + - mvn_cleanup + npm: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-npm + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - npm_cleanup + nuget: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-nuget + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - nuget_cleanup + pypi: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-pypi + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - python_cleanup + raw: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-raw + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - raw_cleanup + contentDisposition: INLINE + yum: + repositoryName: -repo + recipeName: recipeName, + online: true + blob_store: blob-yum + layout_policy: strict # strict or permissive + write_policy: allow_once # ALLOW_ONCE or ALLOW + strict_content_validation: true + cleanup_policies: + - yum_cleanup + repodataDepth: 1 + deployPolicy: strict # strict or permissive + +proxy_defaults: + maven2: + name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + blob_store: blob-mvn + strict_content_validation: true + remote: + url: https://repo.maven.apache.org/maven2 + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: '' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + cleanup_policies: + - mvn_cleanup + docker: + name: maven-central + format: maven2 + online: true + blocked: false + auto_block: true + blob_store: blob-mvn + strict_content_validation: true + force_basic_auth: true + v1_enabled: false + http_port: NaN + sub_domain: '' + remote: + url: https://repo.maven.apache.org/maven2 + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: '' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + cleanup_policies: + - mvn_cleanup + python: + name: pypi-central + format: pypi + online: true + blocked: false + auto_block: true + remote: + url: https://pypi.org/simple + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + npm: + name: npm-registry + format: npm + online: true + blocked: false + auto_block: true + remote: + url: https://registry.npmjs.org/ + username: + password: + bearerToken: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + nuget: + name: nuget-gallery + format: nuget + online: true + blocked: false + auto_block: true + nuget_version: v3 + remote: + url: https://api.nuget.org/v3/index.json + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + apt: + name: ubuntu-apt + format: apt + online: true + blocked: false + auto_block: true + distribution: bionic + flat: false + remote: + url: http://archive.ubuntu.com/ubuntu/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + helm: + name: helm-proxy + format: helm + online: true + blocked: false + auto_block: true + remote: + url: https://kubernetes-charts.storage.googleapis.com + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + r: + name: r-proxy + format: r + online: true + blocked: false + auto_block: true + remote: + url: https://cran.r-project.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + raw: + name: raw-proxy + format: raw + online: true + blocked: false + auto_block: true + remote: + url: https://www.jfrog.com/ + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + contentDisposition: + conda: + name: conda-proxy + format: conda + online: true + blocked: false + auto_block: true + remote: + url: https://repo.anaconda.com/pkgs/main + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + go: + name: go-proxy + format: go + online: true + blocked: false + auto_block: true + remote: + url: https://proxy.golang.org + username: + password: + connection: + useTrustStore: false + retries: + user_agent_suffix: + enable_cookies: + enable_circular_redirects: + timeout: + maximum_component_age: + maximum_metadata_age: + negative_cache_enabled: + negative_cache_ttl: + cleanup_policies: + - policy-1 + yum: + online: true + blocked: false + auto_block: true + blob_store: blob-yum + remote: + url: http://mirror.centos.org/centos/ + username: '' + password: '' + connection: + retries: 5 + user_agent_suffix: 'cn' + enable_cookies: false + enable_circular_redirects: false + timeout: '' + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: true + negative_cache_ttl: 1440 + strict_content_validation: true + version_policy: release + layout_policy: strict + write_policy: allow_once + content_disposition: inline + cleanup_policies: + - policy-1 + +group_defaults: + maven: + python: diff --git a/molecule/roles/nexus3-repository-templates/handlers/main.yml b/molecule/roles/nexus3-repository-templates/handlers/main.yml new file mode 100644 index 00000000..9cd987b1 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for nexus3-repository-templates diff --git a/molecule/roles/nexus3-repository-templates/meta/main.yml b/molecule/roles/nexus3-repository-templates/meta/main.yml new file mode 100644 index 00000000..563930b6 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/meta/main.yml @@ -0,0 +1,52 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: '2.1' + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. diff --git a/molecule/roles/nexus3-repository-templates/tasks/main.yml b/molecule/roles/nexus3-repository-templates/tasks/main.yml new file mode 100644 index 00000000..0c0e4179 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tasks/main.yml @@ -0,0 +1,14 @@ +--- +# tasks file for nexus3-repository-templates +- name: Transform proxy_defaults into nexus_repos + ansible.builtin.template: + src: "proxies.yml.j2" + dest: "/nexus-downloads/proxies-result.yml" + #remote_src: true + tags: transform +- name: Transform hosted_defaults into nexus_repos + ansible.builtin.template: + src: "hosted.yml.j2" + dest: "/nexus-downloads/hosted-result.yml" + #remote_src: true + tags: transform diff --git a/templates/hosted.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 similarity index 97% rename from templates/hosted.yml.j2 rename to molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 index 323bfe29..ac74a4f5 100644 --- a/templates/hosted.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 @@ -9,7 +9,6 @@ nexus_repos_{{ key }}_hosted: {% endif %} {% endif %} - name: {{ team_hosted_repo.name }} - recipeName: {{ key }} online: {{ team_hosted_repo.online if team_hosted_repo.online is defined else value.online }} blob_store: {{ team_hosted_repo.blob_store if team_hosted_repo.blob_store is defined else value.blob_store }} layout_policy: {{ team_hosted_repo.layout_policy if team_hosted_repo.layout_policy is defined else value.layout_policy }} @@ -21,7 +20,7 @@ nexus_repos_{{ key }}_hosted: {% endfor %} {% else %} {% for policy in value.cleanup_policies %} - - {{ policy }} + - {{ policy }} {% endfor %} {% endif %} {% if key == 'apt' %} diff --git a/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 similarity index 100% rename from templates/proxies.yml.j2 rename to molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 diff --git a/molecule/roles/nexus3-repository-templates/tests/inventory b/molecule/roles/nexus3-repository-templates/tests/inventory new file mode 100644 index 00000000..878877b0 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/molecule/roles/nexus3-repository-templates/tests/test.yml b/molecule/roles/nexus3-repository-templates/tests/test.yml new file mode 100644 index 00000000..192d0d6d --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - nexus3-repository-templates diff --git a/molecule/roles/nexus3-repository-templates/vars/main.yml b/molecule/roles/nexus3-repository-templates/vars/main.yml new file mode 100644 index 00000000..b3f817a7 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for nexus3-repository-templates diff --git a/molecule/teams.yml b/molecule/teams.yml index 12203c27..49649ee6 100644 --- a/molecule/teams.yml +++ b/molecule/teams.yml @@ -21,8 +21,12 @@ teams: - name: raw-repo1 format: raw proxy: - - name: proxy-repo1 + - name: mvn-proxy-repo1 format: maven2 + - name: yum-proxy-repo1 + format: yum + # - name: docker-proxy-repo1 + # format: docker group: - name: group-repo-1 members: diff --git a/tasks/create_proxy_defaults.yml b/tasks/create_proxy_defaults.yml index b0f4db9e..d9eb7b0a 100644 --- a/tasks/create_proxy_defaults.yml +++ b/tasks/create_proxy_defaults.yml @@ -1,13 +1,13 @@ ---- -- name: Transform proxy_defaults into nexus_repos - ansible.builtin.template: - src: "/workspaces/nexus3-pro/templates/proxies.yml.j2" - dest: "/nexus-downloads/proxies-result.yml" - #remote_src: true - tags: transform -- name: Transform hosted_defaults into nexus_repos - ansible.builtin.template: - src: "/workspaces/nexus3-pro/templates/hosted.yml.j2" - dest: "/nexus-downloads/hosted-result.yml" - #remote_src: true - tags: transform +# --- +# - name: Transform proxy_defaults into nexus_repos +# ansible.builtin.template: +# src: "/workspaces/nexus3-pro/templates/proxies.yml.j2" +# dest: "/nexus-downloads/proxies-result.yml" +# #remote_src: true +# tags: transform +# - name: Transform hosted_defaults into nexus_repos +# ansible.builtin.template: +# src: "/workspaces/nexus3-pro/templates/hosted.yml.j2" +# dest: "/nexus-downloads/hosted-result.yml" +# #remote_src: true +# tags: transform From 95383ef9802c0de0803209d8137a4df6a6f411bf Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Wed, 29 May 2024 13:31:12 +0000 Subject: [PATCH 11/23] Docker proxy fixed. cleanup deprecated yml file because a role has been created. --- .../defaults/main.yml | 29 +++++++++---------- .../templates/proxies.yml.j2 | 9 ++++-- tasks/create_proxy_defaults.yml | 13 --------- tasks/main.yml | 5 ---- 4 files changed, 20 insertions(+), 36 deletions(-) delete mode 100644 tasks/create_proxy_defaults.yml diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index bb17f695..0a2ad2d9 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -27,8 +27,8 @@ teams: format: maven2 - name: yum-proxy-repo1 format: yum - # - name: docker-proxy-repo1 - # format: docker + - name: docker-proxy-repo1 + format: docker group: - name: group-repo-1 members: @@ -158,8 +158,6 @@ hosted_defaults: proxy_defaults: maven2: - name: maven-central - format: maven2 online: true blocked: false auto_block: true @@ -186,27 +184,24 @@ proxy_defaults: cleanup_policies: - mvn_cleanup docker: - name: maven-central - format: maven2 online: true blocked: false auto_block: true - blob_store: blob-mvn + blob_store: blob-docker strict_content_validation: true force_basic_auth: true v1_enabled: false - http_port: NaN - sub_domain: '' + http_port: remote: - url: https://repo.maven.apache.org/maven2 - username: '' - password: '' + url: https://registry-1.docker.io + username: + password: connection: retries: 5 - user_agent_suffix: '' + user_agent_suffix: enable_cookies: false enable_circular_redirects: false - timeout: '' + timeout: maximum_component_age: -1 maximum_metadata_age: 1440 negative_cache_enabled: true @@ -215,8 +210,12 @@ proxy_defaults: layout_policy: strict write_policy: allow_once content_disposition: inline + index_type: HUB + use_nexus_certificates_to_access_index: false + cache_foreign_layers: true + foreign_layer_url_whitelist: [] cleanup_policies: - - mvn_cleanup + - docker_cleanup python: name: pypi-central format: pypi diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index 84fa0a6e..d42a406c 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -9,7 +9,6 @@ nexus_repos_{{ key }}_proxy: {% endif %} {% endif %} - name: {{ team_proxy_repo.name }} - recipeName: {{ key }} online: {{ team_proxy_repo.online if team_proxy_repo.online is defined else value.online }} blob_store: {{ team_proxy_repo.blob_store if team_proxy_repo.blob_store is defined else value.blob_store }} layout_policy: {{ team_proxy_repo.layout_policy if team_proxy_repo.layout_policy is defined else value.layout_policy }} @@ -37,7 +36,7 @@ nexus_repos_{{ key }}_proxy: {% endfor %} {% else %} {% for policy in value.cleanup_policies %} - - {{ policy }} + - {{ policy }} {% endfor %} {% endif %} {% if key == 'apt' %} @@ -49,7 +48,11 @@ nexus_repos_{{ key }}_proxy: force_basic_auth: {{ team_proxy_repo.force_basic_auth if team_proxy_repo.force_basic_auth is defined else value.force_basic_auth }} v1_enabled: {{ team_proxy_repo.v1_enabled if team_proxy_repo.v1_enabled is defined else value.v1_enabled }} http_port: {{ team_proxy_repo.http_port if team_proxy_repo.http_port is defined else value.http_port }} - sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} +{# sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} #} + index_type: {{ team_proxy_repo.index_type if team_proxy_repo.index_type is defined else value.index_type }} + use_nexus_certificates_to_access_index: {{ team_proxy_repo.use_nexus_certificates_to_access_index if team_proxy_repo.use_nexus_certificates_to_access_index is defined else value.use_nexus_certificates_to_access_index }} + cache_foreign_layers: {{ team_proxy_repo.cache_foreign_layers if team_proxy_repo.cache_foreign_layers is defined else value.cache_foreign_layers }} + foreign_layer_url_whitelist: {{ team_proxy_repo.foreign_layer_url_whitelist if team_proxy_repo.foreign_layer_url_whitelist is defined else value.foreign_layer_url_whitelist }} {% endif %} {% if key == 'raw' %} contentDisposition: {{ team_proxy_repo.contentDisposition if team_proxy_repo.contentDisposition is defined else value.contentDisposition }} diff --git a/tasks/create_proxy_defaults.yml b/tasks/create_proxy_defaults.yml deleted file mode 100644 index d9eb7b0a..00000000 --- a/tasks/create_proxy_defaults.yml +++ /dev/null @@ -1,13 +0,0 @@ -# --- -# - name: Transform proxy_defaults into nexus_repos -# ansible.builtin.template: -# src: "/workspaces/nexus3-pro/templates/proxies.yml.j2" -# dest: "/nexus-downloads/proxies-result.yml" -# #remote_src: true -# tags: transform -# - name: Transform hosted_defaults into nexus_repos -# ansible.builtin.template: -# src: "/workspaces/nexus3-pro/templates/hosted.yml.j2" -# dest: "/nexus-downloads/hosted-result.yml" -# #remote_src: true -# tags: transform diff --git a/tasks/main.yml b/tasks/main.yml index 4124fe72..e42b6d1a 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -302,8 +302,3 @@ ansible.builtin.include_tasks: migrate_database.yml tags: nexus-migrate, nexus-healthcheck when: nexus_migrate_database | default(false) | bool - -- name: Transform default proxies to yml - ansible.builtin.include_tasks: create_proxy_defaults.yml - tags: transform - when: nexus_transform | default(false) | bool From b037c40c0155e45f56f05c53734ddf5550577614 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Thu, 6 Jun 2024 13:12:57 +0000 Subject: [PATCH 12/23] Tested other proxy repos. --- .../defaults/main.yml | 101 +++++++++++------- .../templates/hosted.yml.j2 | 2 +- .../templates/proxies.yml.j2 | 6 +- 3 files changed, 67 insertions(+), 42 deletions(-) diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index 0a2ad2d9..d06df9f7 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -29,6 +29,14 @@ teams: format: yum - name: docker-proxy-repo1 format: docker + - name: raw-proxy-repo1 + format: raw + - name: helm-proxy-repo1 + format: helm + - name: python-proxy-repo1 + format: pypi + - name: npm-proxy-repo1 + format: npm group: - name: group-repo-1 members: @@ -142,7 +150,7 @@ hosted_defaults: strict_content_validation: true cleanup_policies: - raw_cleanup - contentDisposition: INLINE + content_disposition: INLINE yum: repositoryName: -repo recipeName: recipeName, @@ -214,11 +222,13 @@ proxy_defaults: use_nexus_certificates_to_access_index: false cache_foreign_layers: true foreign_layer_url_whitelist: [] + sub_domain: cleanup_policies: - docker_cleanup python: name: pypi-central format: pypi + blob_store: blob-pypi online: true blocked: false auto_block: true @@ -233,16 +243,17 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 npm: name: npm-registry format: npm online: true + blob_store: blob-npm blocked: false auto_block: true remote: @@ -257,16 +268,20 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + strict_content_validation: true + layout_policy: strict + write_policy: allow_once # one of "allow", "allow_once" or "deny" + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 nuget: name: nuget-gallery format: nuget online: true + blob_store: blob-nuget blocked: false auto_block: true nuget_version: v3 @@ -281,16 +296,17 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 apt: name: ubuntu-apt format: apt online: true + blob_store: blob-apt blocked: false auto_block: true distribution: bionic @@ -306,16 +322,17 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 helm: name: helm-proxy format: helm online: true + blob_store: blob-helm blocked: false auto_block: true remote: @@ -329,10 +346,13 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + strict_content_validation: true + layout_policy: strict # strict or permissive + write_policy: allow_once # one of "allow", "allow_once" or "deny" + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 r: @@ -340,6 +360,7 @@ proxy_defaults: format: r online: true blocked: false + blob_store: blob-r auto_block: true remote: url: https://cran.r-project.org @@ -352,14 +373,15 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 raw: name: raw-proxy + blob_store: blob-raw format: raw online: true blocked: false @@ -375,15 +397,17 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + layout_policy: strict + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 - contentDisposition: + content_disposition: inline conda: name: conda-proxy + blob_store: blob-conda format: conda online: true blocked: false @@ -399,14 +423,15 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 go: name: go-proxy + blob_store: blob-go format: go online: true blocked: false @@ -422,10 +447,10 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: + maximum_component_age: -1 + maximum_metadata_age: 1440 + negative_cache_enabled: True + negative_cache_ttl: 1440 cleanup_policies: - policy-1 yum: diff --git a/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 index ac74a4f5..4ae78073 100644 --- a/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 @@ -35,7 +35,7 @@ nexus_repos_{{ key }}_hosted: sub_domain: {{ team_hosted_repo.sub_domain if team_hosted_repo.sub_domain is defined else value.sub_domain }} {% endif %} {% if key == 'raw' %} - contentDisposition: {{ team_hosted_repo.contentDisposition if team_hosted_repo.contentDisposition is defined else value.contentDisposition }} + content_disposition: {{ team_hosted_repo.content_disposition if team_hosted_repo.content_disposition is defined else value.content_disposition }} {% endif %} {% endfor %} {% endfor %} diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index d42a406c..44f5d001 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -12,7 +12,7 @@ nexus_repos_{{ key }}_proxy: online: {{ team_proxy_repo.online if team_proxy_repo.online is defined else value.online }} blob_store: {{ team_proxy_repo.blob_store if team_proxy_repo.blob_store is defined else value.blob_store }} layout_policy: {{ team_proxy_repo.layout_policy if team_proxy_repo.layout_policy is defined else value.layout_policy }} - write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} +{# write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} #} blocked: {{ team_proxy_repo.blocked if team_proxy_repo.blocked is defined else value.blocked }} auto_block: {{ team_proxy_repo.auto_block if team_proxy_repo.auto_block is defined else value.auto_block }} remote: @@ -48,14 +48,14 @@ nexus_repos_{{ key }}_proxy: force_basic_auth: {{ team_proxy_repo.force_basic_auth if team_proxy_repo.force_basic_auth is defined else value.force_basic_auth }} v1_enabled: {{ team_proxy_repo.v1_enabled if team_proxy_repo.v1_enabled is defined else value.v1_enabled }} http_port: {{ team_proxy_repo.http_port if team_proxy_repo.http_port is defined else value.http_port }} -{# sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} #} + sub_domain: {{ team_proxy_repo.sub_domain if team_proxy_repo.sub_domain is defined else value.sub_domain }} index_type: {{ team_proxy_repo.index_type if team_proxy_repo.index_type is defined else value.index_type }} use_nexus_certificates_to_access_index: {{ team_proxy_repo.use_nexus_certificates_to_access_index if team_proxy_repo.use_nexus_certificates_to_access_index is defined else value.use_nexus_certificates_to_access_index }} cache_foreign_layers: {{ team_proxy_repo.cache_foreign_layers if team_proxy_repo.cache_foreign_layers is defined else value.cache_foreign_layers }} foreign_layer_url_whitelist: {{ team_proxy_repo.foreign_layer_url_whitelist if team_proxy_repo.foreign_layer_url_whitelist is defined else value.foreign_layer_url_whitelist }} {% endif %} {% if key == 'raw' %} - contentDisposition: {{ team_proxy_repo.contentDisposition if team_proxy_repo.contentDisposition is defined else value.contentDisposition }} + content_disposition: {{ team_proxy_repo.content_disposition if team_proxy_repo.content_disposition is defined else value.content_disposition }} {% endif %} {% endfor %} {% endfor %} From 64b151134c049169324ac72ac01ee814d3614cb8 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Fri, 7 Jun 2024 16:12:57 +0200 Subject: [PATCH 13/23] init extra requirements. --- .../templates/privileges-roles.yml.j2 | 170 ++++++++++++++ .../templates/repository-requirements.yml.j2 | 219 ++++++++++++++++++ .../templates/routing-rules.yml.j2 | 12 + 3 files changed, 401 insertions(+) create mode 100644 molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 create mode 100644 molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 create mode 100644 molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 diff --git a/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 new file mode 100644 index 00000000..e3cb8def --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 @@ -0,0 +1,170 @@ +--- +nexus_content_selectors: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-container-content + description: {{ item.team }}-repo push conventions + search_expression: format == 'docker' and path=^ "/v2/{{ item.team }}/" +{% endfor %} + - name: all-gitlfs + description: Selector for Git LFS repositories + search_expression: format=='gitlfs' + - name: container-content + description: only allowed to download images + search_expression: format == 'docker' + - name: amos-container-content + description: amos-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/pet-system/" or path =^ "/v2/amos-pet/" ) + - name: sens-container-content + description: sens-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/sens/" or path =^ "/v2/viz/" or path =^ "/v2/anpr/" or path =^ "/v2/kolibrie/" ) + +nexus_privileges: +{#INIT: START NECESSITIES FIRST#} + - name: docker-group-read-browse # used as key to update a privilege + type: repository-content-selector + description: Read & Browse access for docker-group + repository: docker-group + contentSelector: container-content + actions: # can be add, browse, create, delete, edit, read or * (all) + - read + - browse +{#INIT: END#} +{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} + - name: {{ item.team }}-gitlfs-add-delete-edit-read-browse + description: {{ item.team }} Git LFS privileges + repository: {{ item.team }}-gitlfs + format: gitlfs + actions: + - add + - delete + - edit + - read + - browse +{% endfor %} +{% for item in group_repo_teams %} + - name: {{ item.team }}-docker-group-all-privileges # used as key to update a privilege + type: repository-content-selector + description: All privileges for {{ item.team }}-repo + repository: {{ item.team }}-docker-group + contentSelector: {{ item.team }}-container-content + actions: + - add + - delete + - edit + - read + - browse + - name: {{ item.team }}-docker-group-read-browse # used as key to update a privilege + type: repository-content-selector + description: Read & Browse access for {{ item.team }}-repo + repository: {{ item.team }}-docker-group + contentSelector: container-content + actions: # can be add, browse, create, delete, edit, read or * (all) + - read + - browse +{% endfor %} +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-docker-all-privileges # used as key to update a privilege + type: repository-content-selector + description: All privileges for {{ item.team }}-repo + repository: {{ item.team }}-repo + contentSelector: {{ item.team }}-container-content + actions: + - add + - delete + - edit + - read + - browse + - name: {{ item.team }}-docker-read-browse # used as key to update a privilege + type: repository-content-selector + description: Read & Browse access for {{ item.team }}-repo + repository: {{ item.team }}-repo + contentSelector: container-content + actions: # can be add, browse, create, delete, edit, read or * (all) + - read + - browse +{% endfor %} + +nexus_roles: +{#INIT: NECESSITIES FIRST#} + - id: nx-deployment + name: nx-deployment + description: nx-deployment (legacy) + privileges: + - nx-apikey-all + - nx-component-upload + - nx-search-read + - nx-repository-view-docker-*-read + - nx-usertoken-current + roles: [] +{#INIT: END +#STANDARD AUTOMATED: START #} +{% for item in docker_repo_teams %} + - id: {{ item.team|upper }}-members + name: {{ item.team|upper }}-members + description: {{ item.team|upper }}-members + privileges: +{% if item.repo == "true" %} + - {{ item.team }}-docker-read-browse + - {{ item.team }}-docker-all-privileges + - docker-group-read-browse +{% endif %} +{% if item.gitlfs == "true" %} + - nx-search-read + - {{ item.team }}-gitlfs-add-delete-edit-read-browse +{% endif %} +{% for proxyitem in group_repo_teams %} +{% if item.team == proxyitem.team %} + - {{ proxyitem.team }}-docker-group-read-browse + - {{ proxyitem.team }}-docker-group-all-privileges +{% endif %} +{% endfor %} + roles: +{% if item.repo == "true" %} + - nx-deployment +{% endif %} +{% endfor %} +{# STANDARD AUTOMATED: END +SPECIAL CASES: START #} + - id: TPE-members + name: TPE-members + description: TPE-members + privileges: + - tpe-docker-read-browse + - bettyblocks-docker-read-browse + - tpe-docker-all-privileges + - bettyblocks-docker-all-privileges + - bettyblocks-docker-group-all-privileges + - tpe-gitlfs-add-delete-edit-read-browse + - docker-group-read-browse + - nx-search-read + roles: + - nx-admin + - nx-deployment + - id: BHT-members + name: BHT-members + description: BHT-members + privileges: + - bht-docker-read-browse + - bht-docker-all-privileges + - bht-docker-group-read-browse + - bht-docker-group-all-privileges + - docker-group-read-browse + - laas-docker-read-browse + - laas-docker-all-privileges + - laas-docker-group-read-browse + - laas-docker-group-all-privileges + roles: + - nx-deployment + - id: BVI-BV-members + name: BVI-BV-members + description: BVI-BV-members special case + privileges: + - bvibv-docker-all-privileges + - bvibv-docker-group-all-privileges + - bvibv-docker-read-browse + - bvibv-docker-group-read-browse + - docker-group-read-browse + roles: + - nx-deployment +{#SPECIAL CASES: END #} +... diff --git a/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 new file mode 100644 index 00000000..d7877ef5 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 @@ -0,0 +1,219 @@ +--- +nexus_blobstores: + - name: dockerhub-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/dockerhub-blob + - name: proxy-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/proxy-blob +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }}-blob +{% endfor %} +{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} + - name: {{ item.team }} + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }} +{% endfor %} + +nexus_repos_gitlfs_hosted: +{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} + - name: {{ item.team }}-gitlfs + blob_store: {{ item.team }} +{% endfor %} + +### START: Docker repositories + +nexus_repos_docker_hosted: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-repo +{% if item.port_suffix is defined %} + http_port: 8{{ item.port_suffix }} +{% endif %} + blob_store: {{ item.team }}-blob + v1_enabled: False +{% if item.redeploy | default('true') == 'true' %} + write_policy: allow +{% elif item.redeploy | default('true') == 'false' %} + write_policy: allow_once +{% endif %} +{% if item.cleanup == "BASE" %} + cleanup_policies: + - base-image-cleanup +{% elif item.cleanup == "DEFAULT" %} + cleanup_policies: + - remove-snapshot-containers + - remove-release-containers +{% elif item.cleanup == "SNAPSHOT" %} + cleanup_policies: + - remove-snapshot-containers +{% endif %} +{% endfor %} + +nexus_repos_docker_proxy: + - name: docker-proxy + v1_enabled: False + index_type: "HUB" + remote_url: "https://registry-1.docker.io" + use_nexus_certificates_to_access_index: false + blob_store: dockerhub-blob + cleanup_policies: + - base-image-docker-cleanup +{% for item in proxy_repos %} + - name: docker-{{ item.proxyname }} + v1_enabled: False + index_type: "{{ item.type }}" + maximum_component_age: 0 + maximum_metadata_age: 0 + remote_url: "{{ item.remote.url }}" +{% if (item.remote.user | default("") != "" or item.remote.pass | default("") != "") %} + remote_username: {{ item.remote.user }} + remote_password: {{ item.remote.pass }} +{% endif %} +{% if (item.remote.cache | default("") != "") %} + negative_cache_ttl: {{ item.remote.cache }} +{% endif %} + use_nexus_certificates_to_access_index: true + blob_store: proxy-blob + cleanup_policies: + - base-image-{{ item.proxyname }}-cleanup +{% endfor %} + +nexus_repos_docker_group: + - name: docker-group + http_port: 8082 + v1_enabled: False +{% if 'gip_' in inventory_hostname %} + sub_domain: containers +{% else %} + sub_domain: containers-staging +{% endif %} + member_repos: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - {{ item.team }}-repo +{% endfor %} + - name: containers-cicd-gnr + sub_domain: containers-cicd + member_repos: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - {{ item.team }}-repo +{% endfor %} +{% for item in group_repo_teams %} + - name: {{ item.team }}-docker-group +{% if item.port_suffix is defined %} + http_port: 8{{ item.port_suffix }} +{% endif %} + sub_domain: {{ item.team }} + writable_member_repo: {{ item.team }}-repo + blob_store: {{ item.team }}-blob + v1_enabled: False + member_repos: + - {{ item.team }}-repo +{% if item.proxyname is defined %} +{% for proxyitem in item.proxyname %} + - docker-{{ proxyitem }} +{% endfor %} +{% endif %} +{% endfor %} + +### End: Docker repositories + +nexus_repos_cleanup_policies: +{% for item in proxy_repos %} + - name: base-image-{{ item.proxyname }}-cleanup + format: docker + notes: Clean up policy for base images {{ item.proxyname }}-proxy + criteria: +{% if item.cleanup.lastupdated != "" %} + lastBlobUpdated: {{ item.cleanup.lastupdated }} +{% endif %} +{% if item.cleanup.lastdownloaded != "" %} + lastDownloaded: {{ item.cleanup.lastdownloaded }} +{% endif %} +{% if item.cleanup.regex != "" %} + regexKey: "{{ item.cleanup.regex }}" +{% endif %} +{% endfor %} + - name: base-image-docker-cleanup + format: docker + notes: "Clean up policy for base images docker-proxy" + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 + regexKey: ".*(library|linuxserver|xebialabs).*" + - name: remove-snapshot-containers + format: docker + notes: Policy for removing temporary container images + criteria: + lastDownloaded: 14 + lastBlobUpdated: 30 + regexKey: ".*(SNAPSHOT|snapshot|DEVELOP|develop|BUILD|build).*" + - name: remove-release-containers + format: docker + notes: Policy for removing that were considered release at some time + criteria: + lastBlobUpdated: 90 + - name: base-image-cleanup + format: docker + notes: Clean up policy for base images + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 + +nexus_scheduled_tasks: +{% for item in docker_repo_teams | selectattr('repo', 'equalto', 'true') %} +{% if item.cleanup != 'NONE'%} + - name: docker-delete-unused-manifests-and-images-{{ item.team }}-repo + cron: 0 15 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: {{ item.team }}-repo + deployOffset: "24" +{% endif %} + - name: {{ item.team }}-compact-blobstore + cron: 0 45 1 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }}-blob +{% endfor %} +{% for item in docker_repo_teams | selectattr('gitlfs', 'equalto', 'true') %} + - name: {{ item.team }}-compact-blobstore-gitlfs + cron: 0 0 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }} +{% endfor %} +{% for item in proxy_repos %} + - name: docker-delete-unused-manifests-and-images-{{ item.proxyname }} + cron: 0 15 0 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-{{ item.proxyname }} + deployOffset: "24" +{% endfor %} + - name: proxy-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: proxy-blob + - name: docker-delete-unused-manifests-and-images-docker-proxy + cron: 0 30 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-proxy + deployOffset: "24" + - name: dockerhub-blob-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: dockerhub-blob + - name: docker-delete-incomplete-uploads + cron: 0 45 1 * * ? + typeId: "repository.docker.upload-purge" + taskProperties: + age: "24" + - name: Nexus export configuration and metadata backup + cron: 0 0 1 * * ? + typeId: "db.backup" + task_alert_email: "monitoring-tpe@politie.nl" + taskProperties: + notificationCondition: Failure + location: "{{ nexus_nfs_mount_path }}/orientdb_backup" +... diff --git a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 new file mode 100644 index 00000000..af113f34 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 @@ -0,0 +1,12 @@ +--- +nexus_routing_rules: + routingRules: +{% for item in proxy_repos %} +{% if item.routing is defined %} + - name: {{ item.routing.publisher }} + description: Restrict only to {{ item.routing.publisher }} images + mode: Allow + matchers: {{ item.routing.matchers }} + proxyname: docker-{{ item.proxyname }} +{% endif %} +{% endfor %} From 63700c22e2b76e57c6fadc9913f454c0f1522732 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Mon, 10 Jun 2024 13:41:33 +0000 Subject: [PATCH 14/23] Fixed creation of mulitple repos types for different teams. Removed testing defaults because they will be overwritten anyways. Init roles.yml.j2 --- molecule/default-converge.yml | 1 + molecule/nexus_common_test_vars.yml | 713 +++++++++--------- .../defaults/main.yml | 40 +- .../tasks/main.yml | 6 + .../templates/hosted.yml.j2 | 4 +- .../templates/proxies.yml.j2 | 4 +- .../templates/roles.yml.j2 | 32 + 7 files changed, 437 insertions(+), 363 deletions(-) create mode 100644 molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index f4d21d7b..955e385b 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -10,6 +10,7 @@ - nexus_ldap_test_vars.yml - .nexus-downloads/hosted-result.yml - .nexus-downloads/proxies-result.yml + - .nexus-downloads/roles-result.yml environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index 4a27a530..cdf9935c 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -211,362 +211,363 @@ nexus_repos_cleanup_policies: lastBlobUpdated: 60 lastDownloaded: 120 regexKey: "beta-*" -nexus_repos_maven_proxy: - - name: central - remote_url: https://repo1.maven.org/maven2/ - layout_policy: permissive - cleanup_policies: - - mvn_cleanup - - name: jboss - remote_url: https://repository.jboss.org/nexus/content/groups/public-jboss/ - cleanup_policies: - - mvn_cleanup - -nexus_repos_maven_hosted: - - name: private-release - version_policy: release - write_policy: allow_once # one of "allow", "allow_once" or "deny" - cleanup_policies: - - mvn_cleanup - -nexus_repos_maven_group: - - name: public - member_repos: - - central - - jboss - layout_policy: permissive - version_policy: mixed - - name: public-offline - online: false - member_repos: - - central - - jboss - layout_policy: permissive - version_policy: mixed - -nexus_repos_npm_hosted: [] -nexus_repos_npm_group: - - name: npm-public - member_repos: - - npm-registry -nexus_repos_npm_proxy: - - name: npm-registry - remote_url: https://registry.npmjs.org/ - negative_cache_enabled: false - enable_circular_redirects: true - enable_cookies: true - connection_timeout: 300 - connection_retries: 5 - - name: npm-registry-blocked - remote_url: https://registry.npmjs.org/ - blocked: true - auto_block: false - user_agent_suffix: custom-agent - -nexus_repos_yum_hosted: - - name: private_yum_centos_7 - repodata_depth: 1 -nexus_repos_yum_proxy: - - name: epel_centos_7_x86_64 - remote_url: http://download.fedoraproject.org/pub/epel/7/x86_64 - maximum_component_age: -1 - maximum_metadata_age: -1 - negative_cache_ttl: 60 - enable_circular_redirects: true - enable_cookies: true -nexus_repos_yum_group: - - name: yum_all - member_repos: - - private_yum_centos_7 - - epel_centos_7_x86_64 - -nexus_repos_docker_hosted: - - name: docker-private - http_port: "5000" - force_basic_auth: true - v1_enabled: true - write_policy: allow - - name: docker-private-redeploy - write_policy: deny # will be ignored when allow_redeploy_latest is true - allow_redeploy_latest: true - - name: docker-private-no-redeploy - write_policy: deny # will be effective when allow_redeploy_latest is false - allow_redeploy_latest: false - -nexus_repos_docker_proxy: [] -nexus_repos_apt_hosted: - - name: private_apt - distribution: all - keypair: |- - -----BEGIN PGP PRIVATE KEY BLOCK----- - - lQWGBGNSbLEBDADGJXWoQwhjjgmGbMdnhfneYU2qjfMlgdoTH2oqkir6aaqHdS6l - 88YUt/4mBAzaQhcETm7sIlrlAvXyfH4/i3ATwI4SUYUCl1fIZ9beRD3WWBwCiYMZ - XT0ZByrDL+aGpRO6xl0LCPr1loqHbvt2ZesoSn77Zv4tGHVLPiryG1KTxQPRCU4d - Ydg9wCwlrGseExA4O8ujgOeyo/ObxXrCilxJzvNf/21/KGSa54FzMyGiWvN7tOMT - Z9kau/bToIjwi4ME4nLx4T5c5qtYAoqlnbRR12pHBlx7RckncS1M/r+E1nX6GzeJ - cx4qAgd0HD226Kro3bahfM8ZWktbtJ7cytbPBwZ64Fu7kTzS0tfMPu0VBNK+EfrK - woDOoqg1i92r8VgTL6BQ+ouQy7BwWLKc6AEk/+M2f/L1ifDWay/uQdjNa27OKn0R - 3cBBSYhmu7swnQqJ5Xl/M6qSFZXd0O6qiddZ/wynAsw7AHmi/BLWrd867hRHYLaS - a29lQPgU8+WRVzUAEQEAAf4HAwLjlFgkkxZE9v9sCLksoRlKptpG5OATXAzFslcf - RUjsBFVX86QvHLrYYJix5E3LD2+RLOl4Z97yZAdmhGZhJRN5r02jcZHD4nO9I1bT - JXN2OwVP0zgv5bxscXiFYa274O3pvPbhbqZ6tGqZ8/gPv2dbMUc2Xgv+CdJB9j1p - ytPomh0wQHIohnVuZQ2A/BYs/fG6SFaGHwHwBOD3kQvlDf5egdzKrY9e4xIKvAEL - M8ZuatSJf2plvawkJDKlWYSm8gxIb1ZiT3BdiiyYTP2ZFQpwVwFUSKhqZtv37b51 - 197U1kUNloQF4nmf4mDYXuyLmXknp4l8LOvO2x527A8BBP6DuPUSFH/0+YYZmJ3q - vbUvEIvkwEU/GtfpMr24yaFglxPbOK+DYmGt6LXeFAxxL/EM3/BqBU3+exZqMzGx - n+F7zy2QWyYjyvJGX0V9TH0b2rUqvc14C0GQLpB7+aDrsJKXBndPLThlIIDLSp9w - 8zo78jddUqRrhyxcJiszP6HAEz7ubpgi0ZCUydBRjdbNmzOf0fTi8/2vLOOu9s5k - IE5JAdv3MMVSoXhR8JNvWk8HvtdqqzPcqoQuxaO2NfycEUEvKFbMhuc8EL1nEgqx - MvVr8tUlPDwP9rEg+YBTC4EAi8d8OiWWna0SxALv8dayOKShjsUwfSYCjmzAqVK8 - 4q3/pf0mMoe3m/JBsWfmJqdSXXQ8gJ0WUL/EBuzNyrbHZ07Mo7gUeV35Ks2cX7Uu - Ayrm41n0aSjnjfeWW11WCv8VlOV7CuXXaEnd0GQ1fY4E9g92A4bag/NXN+tOOoLp - llj6XTBfQ1l/YbBcatdUMIjcXX9hDmkMBrrLKBdChBVYMMe+E8/Nv4AEUkt5I3m7 - dDDFADxSm0IQKVHHR6jspm13S55wwDUz0clD9RVa5O0SCckkiQllhaz4kxSt3oDW - gy6WZNnJS4gK9N75kZMrMhc44pRV7nW3KUB/HPHwmNk83cFA55R3WiQJkfwySvPQ - wKdmvUrTlPlycnKbXgPbDPRDndcnC3ZPKNPYwIPkiSB5iksFjZkviXMWIy+dGXrh - tyfY0wLlkM2EnrQCfjWs6emm+8W0sKNow4yrdUAJ6cHDh3Cx5UePrNFc4GZmGsc4 - 619lS9cBRHrN0n2UskdcFeQAxA4Aj4MMWGj0M+vPE4tz9DLUUGE1nHU8OlIE+MUe - cymaqPAr3OBLkQhtSROOjsIpk7jNuhQxByOQywDQa1WUn7ewhmCJl6GW9Q2QPPAz - pIXAbfDWClXDmcfxO35C7WCQOTOoJvLPV0AdHpKYDhybwKg7urBC1Uhg5WXxMzTT - upyu3plDsKZLVCUfMiRQg1pGjpONO9SQ4bRsVGhvVGVhbSBOZXh1czMgQ0kgKEtl - eSBmb3IgYXB0IGNpIHRlc3Qgb24gaHR0cHM6Ly9naXRodWIuY29tL2Fuc2libGUt - VGhvVGVhbS9uZXh1czMtb3NzKSA8dGhvdGVhbUBuZXh1czMuY2k+iQHOBBMBCgA4 - FiEEB5LYtM4/VAJnIFfdA/IJDIG6oBMFAmNSbLECGwMFCwkIBwIGFQoJCAsCBBYC - AwECHgECF4AACgkQA/IJDIG6oBO0AwwAsC/mtjOi/SAsDeDVNoaOOT9iGI02Ddjp - z+FzucSL384VrBwQVrIEYRJ0OYCTdKVeArAer7CAe34vtPMAm3tTWwQg4hTYeTR6 - 59Iq5t2a+zyT9EGB3y7bzpGU9yZ8V/4cFva2pvTXjIv5HjEu0nuHQlau9pXSeKxE - DHkxG2DeCmIs+QPohtizP7ZlBkAiOd094p1SlEs8ZmgjqZ+MyN30I/BpPIGxwrWN - QqichYmLNP0TIl+ZMukx2qVnNhfls+2ZtXWzERg2OkEHhyLcLsIqr24/WusWkqwn - QnswPPiIV9bjpigh3GEb6xw2/JhZyMOnSFeND7B/9MqR5tWkaq8bnxviIct71kga - tYVIhZbEcg51cm9Pwncd/HeOFokuVrYsk+40yc6lIdqYAPJhOPdr0G/BFXjQ5m/Z - AmQHr8ykUwGy+bjN4AzuX4sfkazkYRLP8Wnt4WnrPAU4Y3FEGTnueYK/w0f8sk9X - 6QY5qkwjqglEgOyDqKVcJ0GEwYp9C+0OnQWGBGNSbLEBDADIix1iE8wJb3y9pl0N - XJO4D1LFzGQXVupzOKUeHPAO03tSv3nBSpWtbQBz8eK1CaLDXnRhGA3SppHwtv5r - jTp/FWohRl2CEUGKZFYft3o0jshysOpd4SdDm5n+ONQWY17YozCaf+ic0pYkIx5C - taAhguJSe6hHfjfDAz2Xt51CjKafsa5Hvbya0NbYKkOu+6n06XYJhghSWkYr0SyV - R7ejxQBsrdQU69d9mOouL7QJGPmhPLtGG+yX/dw85qT45AXri0hsAy5bfKIMhGpl - vZTbIsSLEmItVDnil3wwAXDD/czbsg39MdA2r7bgtixjtaP9t4S4jkrZqS9yl6sC - GhcLMr6TiSdfibKs9f2MxYZRV3Js439WjppGTLgwTICcdW+qna1bmqc1oGewrr1l - aOER3q3+C221cVjr8Puac0aBZuGPcBIGsd9L8MwzNAu1t8zHKc3jlfs7B0++NSKT - AJNyJRhw9CKUqL9xenUazaqpe5n60i//cB1aOF0qb8vCEocAEQEAAf4HAwLhYZJ1 - q2iPB/+luVezfm77sp1ngSNNaRTtnmSKo6u5csOFcrJLAfPcslDC2kFOu9KzL4uw - VLWalWLqhuDGO0KGqiAbRyM7Jj68SsSKXMfIbbuWxJFNBqEwoqK81UvQhqJmk0qI - foOWfMP4covr9I1vSohHF3AZxnCPcaU4n3nBRL2XOYb++HmO3oRwRUIwWJZOFW94 - 9Hy3ImY01VbGf+CUkGXNTRqATV85utjZjGbb99k8aIv5qS4ZOCnGcnL2qx+H579V - ngsB4IKiC//jP35qSvbi3TN1BxWB0qs5qNNzprjosrC7vUqLWZH2vU0SHLLZ5rA0 - a1ZhICCv5UjEmG5JnJtSa6T7LxLWdCLnfX3J4SJ5Jc+qbIAH+fL5J0xoJGN0ttRn - +yllt6YA2PtwEUGeZJh4qlswYVltlAggjwkLu0HQOkkrOiQhwM7O3/oRhjVb3EPy - wa5BcgfZBUjP2D3KHnrm6iYI3W+P+EMVZ9GGGufHdSk8rhWnU6+UENUbUUR/QlMC - 3gOLD5Q80+R7SG51J6j1aPTDJWlzQppfabHqZBstMvef4bhiZDfyZimzbwyr8oim - 0P1ZBbp9PN0olNsF9bfh9N+3wb0B8QKAIpprV8wLOpp/713nJ6pNi37o0ErlGmYK - 4PnpMw659g+ZnwpYRvIMb3IRMN55Bs5vEPCpxLjTi8ze9Il7tGuhhX/NwpS6+Fbg - awvHxCKLfl6vderWkbHg4voMvzWgg3+phwYvRI2UoSzff1T5yFHBQQBg75K2xAWZ - toI7mMbWEi8digk7Ry54t2A+3y/VwRbI6hOVDaKn/cLlCZwBzOZxw6VPC7RIAhCt - TQJqDNQ3znE+yARRgeT60oXfqPzIEagrrjMHJMRCFseo6Mzk3RGVyAVxzoMdi/20 - wbi1lS7R23OpfO7nzJVLtaPSN34N4kfEbVK4+e0oW1PfzgrNdEBMWPU3nByIyRW1 - J4GwcFEUcltQLGo885VoK3ob+sm/ymw9Zus78H6li8UHt4/dWvIxtb/o79cS7kbS - vaiViQZHLe1hBV4+jPglQyxyVGZ+w6R+kurO6sT6ESi5v4jjOx1ytCcPWVkNgrLw - 5chwlbnodzBDKs6g3ROd7fTCD9q84vjMbk3G2PS8tMpyRY9rN7o1tLwcEM4CjkSV - HIX5FRt5vhjYc8y8g3SvufpkxL7V/ttlmqFDQz2nPICV4Jys+ImxUMySGyfPu7tJ - cd9HppAoeyR6edB0c8U8uVRx/0x+5TW81z2+ILvdp9VlyWDMFyVHtV7TxIu7LS6H - 7KcHeYnaydNRh56BKsosxy9V9TEZoWJeQGSkm8PVb7xJWaXb2nsaQNeyo9EpUO2Y - a4kBtgQYAQoAIBYhBAeS2LTOP1QCZyBX3QPyCQyBuqATBQJjUmyxAhsMAAoJEAPy - CQyBuqAT6qsMAI9tFK4C4I01o6sD5MI6lnXHGFXfsN6/QJV6AOHC64g+s3K6+XM+ - 8dOy4KcnfDdouEQYs5X1n2zxnOV760YmnqCA7yk4p32LsW4zRp9Hs4rNPU0K4MnL - LkEs24S99ohNQQhKauMxmFAZyH767j1oN2vFTdwANKswpkszfzEnGo0rFN+uIok1 - ENsB0cQWoyF/BSpOX2/MvCapLvf8yzAWqdQiF1zgcShKrpXny+rbI3owrDBSJ4VT - AsKWbiXgbEh7gx7kZQOj4IlubEKDmCbp2KH1RTlYGxR36x4B2i6oC+wJ1KYqbX/Z - OsyXajH6s35fR551Ttlkz1HHkUFDmTnFRhIhaiG8aytyHrQpNdXQz9pUcLZEtttB - cAvelj5iWiWg86nkPGR/fFzsKETG0Jx8lydvuBtPlK+MgTRsPDr3sntDrkdmE5CW - vk75VekDO5zTuLFS2QTkhWSIztL8V2T47uABUGCunyFxhVRM7q9VQIRC+i7bEO3v - 0J6R2RZlI2A7tQ== - =GPnF - -----END PGP PRIVATE KEY BLOCK----- - passphrase: password - # Allow redeploy to allow repeated failing tests when debugging - # !! Don't do this for a release repo on production - write_policy: allow - -nexus_repos_apt_proxy: - - name: apt_ubuntu_18.04 - remote_url: http://archive.ubuntu.com/ubuntu/ - distribution: bionic - maximum_component_age: -1 - maximum_metadata_age: -1 - negative_cache_ttl: 60 - -nexus_repos_helm_hosted: - - name: helm-hosted - -nexus_repos_helm_proxy: - - name: helm-proxy - remote_url: https://kubernetes-charts.storage.googleapis.com/ - -nexus_repos_r_proxy: - - name: r-proxy - remote_url: https://cran.r-project.org/ - -nexus_repos_r_hosted: - - name: r-internal - version_policy: release - write_policy: allow - -nexus_repos_r_group: - - name: r-all - member_repos: - - r-internal - - r-proxy - -nexus_repos_conda_proxy: - - name: conda-proxy - remote_url: https://repo.continuum.io/pkgs/ - -nexus_repos_go_proxy: - - name: go-proxy - remote_url: https://golang.org/pkg/ - -nexus_repos_nuget_hosted: - - name: nuget-internal - blob_store: "{{ nexus_blob_names.nuget.blob }}" - -nexus_repos_nuget_group: - - name: nuget-all - blob_store: "{{ nexus_blob_names.nuget.blob }}" - member_repos: - - nuget-internal - - nuget-proxy - -nexus_repos_nuget_proxy: - - name: nuget-proxy-with-version - blob_store: "{{ nexus_blob_names.nuget.blob }}" - remote_url: http://www.nuget.org/api/v2 - nuget_version: v2 - - name: nuget-proxy-default - remote_url: https://api.nuget.org/v3/index.json - -nexus_content_selectors: - # Docker by namespace. For mode details see: - # https://help.sonatype.com/repomanager3/formats/docker-registry/content-selectors-and-docker - - name: docker-login-search - description: Selector for docker login privilege - search_expression: format == "docker" and (path == "/v2/" of path == "/v1/search") - - name: docker-private-team1 - description: Selector for docker team1 - search_expression: format == "docker" and path =^ "/v2/team1/" - - name: docker-private-team2 - description: Selector for docker team2 - search_expression: format == "docker" and path =^ "/v2/team2/" - -nexus_privileges: - - name: all-repos-read - description: Read & Browse access to all repos - repository: "*" - actions: - - read - - browse - - name: wildcard1 - type: wildcard - description: first wilcard - pattern: nexus:repository-view:yum:* - - name: some_application - type: application - description: some nexus configuration - domain: some_nexus_domain - actions: - - some action - - name: script1 - type: script - description: first script - script_name: the_script_name - actions: - - some actions - - name: docker-login-search-all - type: repository-content-selector - contentSelector: docker-login-search - description: Login to and search docker registry - repository: "*" - actions: - - read - - name: docker-private-team1-rw - type: repository-content-selector - contentSelector: docker-private-team1 - description: write access to /team1 namespace on docker-private - repository: docker-private - actions: - - read, - - add - - edit - - browse - - name: docker-private-team2-rw - type: repository-content-selector - contentSelector: docker-private-team2 - description: write access to /team2 namespace on docker-hosted - repository: docker-private - actions: - - read - - add - - edit - - browse - -nexus_roles: - - name: c-ro-private_yum_centos_7 - id: c-ro-private_yum_centos_7 - description: Custom read-only role for private_yum_centos_7 hosted repository - privileges: - - nx-repository-view-yum-private_yum_centos_7-read - - nx-repository-view-yum-private_yum_centos_7-browse - - name: developers - id: developers - description: Developers - privileges: - - all-repos-read - - wildcard1 - - docker-login-search-all - - name: role-team1 - id: role-team1 - description: team1 - privileges: - - docker-private-team1-rw - - name: role-team2 - id: role-team2 - description: team2 - privileges: - - docker-private-team2-rw - -nexus_local_users: - - username: jenkins - first_name: Jenkins - last_name: CI - email: support@company.com - password: s3cr3t - roles: - - developers - - username: olduser # make sure this old account is removed - state: absent - - username: test_roles - first_name: Test - last_name: Roles - email: test@roles.com - password: s3cr3t - roles: - - c-ro-private_yum_centos_7 - - username: team1 - first_name: team - last_name: one - email: team@one.com - password: theone - roles: - - developers - - role-team1 - - username: team2 - first_name: team - last_name: two - email: team@two.com - password: thetwo - roles: - - developers - - role-team2 + +# nexus_repos_maven_proxy: +# - name: central +# remote_url: https://repo1.maven.org/maven2/ +# layout_policy: permissive +# cleanup_policies: +# - mvn_cleanup +# - name: jboss +# remote_url: https://repository.jboss.org/nexus/content/groups/public-jboss/ +# cleanup_policies: +# - mvn_cleanup + +# nexus_repos_maven_hosted: +# - name: private-release +# version_policy: release +# write_policy: allow_once # one of "allow", "allow_once" or "deny" +# cleanup_policies: +# - mvn_cleanup + +# nexus_repos_maven_group: +# - name: public +# member_repos: +# - central +# - jboss +# layout_policy: permissive +# version_policy: mixed +# - name: public-offline +# online: false +# member_repos: +# - central +# - jboss +# layout_policy: permissive +# version_policy: mixed + +# nexus_repos_npm_hosted: [] +# nexus_repos_npm_group: +# - name: npm-public +# member_repos: +# - npm-registry +# nexus_repos_npm_proxy: +# - name: npm-registry +# remote_url: https://registry.npmjs.org/ +# negative_cache_enabled: false +# enable_circular_redirects: true +# enable_cookies: true +# connection_timeout: 300 +# connection_retries: 5 +# - name: npm-registry-blocked +# remote_url: https://registry.npmjs.org/ +# blocked: true +# auto_block: false +# user_agent_suffix: custom-agent + +# nexus_repos_yum_hosted: +# - name: private_yum_centos_7 +# repodata_depth: 1 +# nexus_repos_yum_proxy: +# - name: epel_centos_7_x86_64 +# remote_url: http://download.fedoraproject.org/pub/epel/7/x86_64 +# maximum_component_age: -1 +# maximum_metadata_age: -1 +# negative_cache_ttl: 60 +# enable_circular_redirects: true +# enable_cookies: true +# nexus_repos_yum_group: +# - name: yum_all +# member_repos: +# - private_yum_centos_7 +# - epel_centos_7_x86_64 + +# nexus_repos_docker_hosted: +# - name: docker-private +# http_port: "5000" +# force_basic_auth: true +# v1_enabled: true +# write_policy: allow +# - name: docker-private-redeploy +# write_policy: deny # will be ignored when allow_redeploy_latest is true +# allow_redeploy_latest: true +# - name: docker-private-no-redeploy +# write_policy: deny # will be effective when allow_redeploy_latest is false +# allow_redeploy_latest: false + +# nexus_repos_docker_proxy: [] +# nexus_repos_apt_hosted: +# - name: private_apt +# distribution: all +# keypair: |- +# -----BEGIN PGP PRIVATE KEY BLOCK----- + +# lQWGBGNSbLEBDADGJXWoQwhjjgmGbMdnhfneYU2qjfMlgdoTH2oqkir6aaqHdS6l +# 88YUt/4mBAzaQhcETm7sIlrlAvXyfH4/i3ATwI4SUYUCl1fIZ9beRD3WWBwCiYMZ +# XT0ZByrDL+aGpRO6xl0LCPr1loqHbvt2ZesoSn77Zv4tGHVLPiryG1KTxQPRCU4d +# Ydg9wCwlrGseExA4O8ujgOeyo/ObxXrCilxJzvNf/21/KGSa54FzMyGiWvN7tOMT +# Z9kau/bToIjwi4ME4nLx4T5c5qtYAoqlnbRR12pHBlx7RckncS1M/r+E1nX6GzeJ +# cx4qAgd0HD226Kro3bahfM8ZWktbtJ7cytbPBwZ64Fu7kTzS0tfMPu0VBNK+EfrK +# woDOoqg1i92r8VgTL6BQ+ouQy7BwWLKc6AEk/+M2f/L1ifDWay/uQdjNa27OKn0R +# 3cBBSYhmu7swnQqJ5Xl/M6qSFZXd0O6qiddZ/wynAsw7AHmi/BLWrd867hRHYLaS +# a29lQPgU8+WRVzUAEQEAAf4HAwLjlFgkkxZE9v9sCLksoRlKptpG5OATXAzFslcf +# RUjsBFVX86QvHLrYYJix5E3LD2+RLOl4Z97yZAdmhGZhJRN5r02jcZHD4nO9I1bT +# JXN2OwVP0zgv5bxscXiFYa274O3pvPbhbqZ6tGqZ8/gPv2dbMUc2Xgv+CdJB9j1p +# ytPomh0wQHIohnVuZQ2A/BYs/fG6SFaGHwHwBOD3kQvlDf5egdzKrY9e4xIKvAEL +# M8ZuatSJf2plvawkJDKlWYSm8gxIb1ZiT3BdiiyYTP2ZFQpwVwFUSKhqZtv37b51 +# 197U1kUNloQF4nmf4mDYXuyLmXknp4l8LOvO2x527A8BBP6DuPUSFH/0+YYZmJ3q +# vbUvEIvkwEU/GtfpMr24yaFglxPbOK+DYmGt6LXeFAxxL/EM3/BqBU3+exZqMzGx +# n+F7zy2QWyYjyvJGX0V9TH0b2rUqvc14C0GQLpB7+aDrsJKXBndPLThlIIDLSp9w +# 8zo78jddUqRrhyxcJiszP6HAEz7ubpgi0ZCUydBRjdbNmzOf0fTi8/2vLOOu9s5k +# IE5JAdv3MMVSoXhR8JNvWk8HvtdqqzPcqoQuxaO2NfycEUEvKFbMhuc8EL1nEgqx +# MvVr8tUlPDwP9rEg+YBTC4EAi8d8OiWWna0SxALv8dayOKShjsUwfSYCjmzAqVK8 +# 4q3/pf0mMoe3m/JBsWfmJqdSXXQ8gJ0WUL/EBuzNyrbHZ07Mo7gUeV35Ks2cX7Uu +# Ayrm41n0aSjnjfeWW11WCv8VlOV7CuXXaEnd0GQ1fY4E9g92A4bag/NXN+tOOoLp +# llj6XTBfQ1l/YbBcatdUMIjcXX9hDmkMBrrLKBdChBVYMMe+E8/Nv4AEUkt5I3m7 +# dDDFADxSm0IQKVHHR6jspm13S55wwDUz0clD9RVa5O0SCckkiQllhaz4kxSt3oDW +# gy6WZNnJS4gK9N75kZMrMhc44pRV7nW3KUB/HPHwmNk83cFA55R3WiQJkfwySvPQ +# wKdmvUrTlPlycnKbXgPbDPRDndcnC3ZPKNPYwIPkiSB5iksFjZkviXMWIy+dGXrh +# tyfY0wLlkM2EnrQCfjWs6emm+8W0sKNow4yrdUAJ6cHDh3Cx5UePrNFc4GZmGsc4 +# 619lS9cBRHrN0n2UskdcFeQAxA4Aj4MMWGj0M+vPE4tz9DLUUGE1nHU8OlIE+MUe +# cymaqPAr3OBLkQhtSROOjsIpk7jNuhQxByOQywDQa1WUn7ewhmCJl6GW9Q2QPPAz +# pIXAbfDWClXDmcfxO35C7WCQOTOoJvLPV0AdHpKYDhybwKg7urBC1Uhg5WXxMzTT +# upyu3plDsKZLVCUfMiRQg1pGjpONO9SQ4bRsVGhvVGVhbSBOZXh1czMgQ0kgKEtl +# eSBmb3IgYXB0IGNpIHRlc3Qgb24gaHR0cHM6Ly9naXRodWIuY29tL2Fuc2libGUt +# VGhvVGVhbS9uZXh1czMtb3NzKSA8dGhvdGVhbUBuZXh1czMuY2k+iQHOBBMBCgA4 +# FiEEB5LYtM4/VAJnIFfdA/IJDIG6oBMFAmNSbLECGwMFCwkIBwIGFQoJCAsCBBYC +# AwECHgECF4AACgkQA/IJDIG6oBO0AwwAsC/mtjOi/SAsDeDVNoaOOT9iGI02Ddjp +# z+FzucSL384VrBwQVrIEYRJ0OYCTdKVeArAer7CAe34vtPMAm3tTWwQg4hTYeTR6 +# 59Iq5t2a+zyT9EGB3y7bzpGU9yZ8V/4cFva2pvTXjIv5HjEu0nuHQlau9pXSeKxE +# DHkxG2DeCmIs+QPohtizP7ZlBkAiOd094p1SlEs8ZmgjqZ+MyN30I/BpPIGxwrWN +# QqichYmLNP0TIl+ZMukx2qVnNhfls+2ZtXWzERg2OkEHhyLcLsIqr24/WusWkqwn +# QnswPPiIV9bjpigh3GEb6xw2/JhZyMOnSFeND7B/9MqR5tWkaq8bnxviIct71kga +# tYVIhZbEcg51cm9Pwncd/HeOFokuVrYsk+40yc6lIdqYAPJhOPdr0G/BFXjQ5m/Z +# AmQHr8ykUwGy+bjN4AzuX4sfkazkYRLP8Wnt4WnrPAU4Y3FEGTnueYK/w0f8sk9X +# 6QY5qkwjqglEgOyDqKVcJ0GEwYp9C+0OnQWGBGNSbLEBDADIix1iE8wJb3y9pl0N +# XJO4D1LFzGQXVupzOKUeHPAO03tSv3nBSpWtbQBz8eK1CaLDXnRhGA3SppHwtv5r +# jTp/FWohRl2CEUGKZFYft3o0jshysOpd4SdDm5n+ONQWY17YozCaf+ic0pYkIx5C +# taAhguJSe6hHfjfDAz2Xt51CjKafsa5Hvbya0NbYKkOu+6n06XYJhghSWkYr0SyV +# R7ejxQBsrdQU69d9mOouL7QJGPmhPLtGG+yX/dw85qT45AXri0hsAy5bfKIMhGpl +# vZTbIsSLEmItVDnil3wwAXDD/czbsg39MdA2r7bgtixjtaP9t4S4jkrZqS9yl6sC +# GhcLMr6TiSdfibKs9f2MxYZRV3Js439WjppGTLgwTICcdW+qna1bmqc1oGewrr1l +# aOER3q3+C221cVjr8Puac0aBZuGPcBIGsd9L8MwzNAu1t8zHKc3jlfs7B0++NSKT +# AJNyJRhw9CKUqL9xenUazaqpe5n60i//cB1aOF0qb8vCEocAEQEAAf4HAwLhYZJ1 +# q2iPB/+luVezfm77sp1ngSNNaRTtnmSKo6u5csOFcrJLAfPcslDC2kFOu9KzL4uw +# VLWalWLqhuDGO0KGqiAbRyM7Jj68SsSKXMfIbbuWxJFNBqEwoqK81UvQhqJmk0qI +# foOWfMP4covr9I1vSohHF3AZxnCPcaU4n3nBRL2XOYb++HmO3oRwRUIwWJZOFW94 +# 9Hy3ImY01VbGf+CUkGXNTRqATV85utjZjGbb99k8aIv5qS4ZOCnGcnL2qx+H579V +# ngsB4IKiC//jP35qSvbi3TN1BxWB0qs5qNNzprjosrC7vUqLWZH2vU0SHLLZ5rA0 +# a1ZhICCv5UjEmG5JnJtSa6T7LxLWdCLnfX3J4SJ5Jc+qbIAH+fL5J0xoJGN0ttRn +# +yllt6YA2PtwEUGeZJh4qlswYVltlAggjwkLu0HQOkkrOiQhwM7O3/oRhjVb3EPy +# wa5BcgfZBUjP2D3KHnrm6iYI3W+P+EMVZ9GGGufHdSk8rhWnU6+UENUbUUR/QlMC +# 3gOLD5Q80+R7SG51J6j1aPTDJWlzQppfabHqZBstMvef4bhiZDfyZimzbwyr8oim +# 0P1ZBbp9PN0olNsF9bfh9N+3wb0B8QKAIpprV8wLOpp/713nJ6pNi37o0ErlGmYK +# 4PnpMw659g+ZnwpYRvIMb3IRMN55Bs5vEPCpxLjTi8ze9Il7tGuhhX/NwpS6+Fbg +# awvHxCKLfl6vderWkbHg4voMvzWgg3+phwYvRI2UoSzff1T5yFHBQQBg75K2xAWZ +# toI7mMbWEi8digk7Ry54t2A+3y/VwRbI6hOVDaKn/cLlCZwBzOZxw6VPC7RIAhCt +# TQJqDNQ3znE+yARRgeT60oXfqPzIEagrrjMHJMRCFseo6Mzk3RGVyAVxzoMdi/20 +# wbi1lS7R23OpfO7nzJVLtaPSN34N4kfEbVK4+e0oW1PfzgrNdEBMWPU3nByIyRW1 +# J4GwcFEUcltQLGo885VoK3ob+sm/ymw9Zus78H6li8UHt4/dWvIxtb/o79cS7kbS +# vaiViQZHLe1hBV4+jPglQyxyVGZ+w6R+kurO6sT6ESi5v4jjOx1ytCcPWVkNgrLw +# 5chwlbnodzBDKs6g3ROd7fTCD9q84vjMbk3G2PS8tMpyRY9rN7o1tLwcEM4CjkSV +# HIX5FRt5vhjYc8y8g3SvufpkxL7V/ttlmqFDQz2nPICV4Jys+ImxUMySGyfPu7tJ +# cd9HppAoeyR6edB0c8U8uVRx/0x+5TW81z2+ILvdp9VlyWDMFyVHtV7TxIu7LS6H +# 7KcHeYnaydNRh56BKsosxy9V9TEZoWJeQGSkm8PVb7xJWaXb2nsaQNeyo9EpUO2Y +# a4kBtgQYAQoAIBYhBAeS2LTOP1QCZyBX3QPyCQyBuqATBQJjUmyxAhsMAAoJEAPy +# CQyBuqAT6qsMAI9tFK4C4I01o6sD5MI6lnXHGFXfsN6/QJV6AOHC64g+s3K6+XM+ +# 8dOy4KcnfDdouEQYs5X1n2zxnOV760YmnqCA7yk4p32LsW4zRp9Hs4rNPU0K4MnL +# LkEs24S99ohNQQhKauMxmFAZyH767j1oN2vFTdwANKswpkszfzEnGo0rFN+uIok1 +# ENsB0cQWoyF/BSpOX2/MvCapLvf8yzAWqdQiF1zgcShKrpXny+rbI3owrDBSJ4VT +# AsKWbiXgbEh7gx7kZQOj4IlubEKDmCbp2KH1RTlYGxR36x4B2i6oC+wJ1KYqbX/Z +# OsyXajH6s35fR551Ttlkz1HHkUFDmTnFRhIhaiG8aytyHrQpNdXQz9pUcLZEtttB +# cAvelj5iWiWg86nkPGR/fFzsKETG0Jx8lydvuBtPlK+MgTRsPDr3sntDrkdmE5CW +# vk75VekDO5zTuLFS2QTkhWSIztL8V2T47uABUGCunyFxhVRM7q9VQIRC+i7bEO3v +# 0J6R2RZlI2A7tQ== +# =GPnF +# -----END PGP PRIVATE KEY BLOCK----- +# passphrase: password +# # Allow redeploy to allow repeated failing tests when debugging +# # !! Don't do this for a release repo on production +# write_policy: allow + +# nexus_repos_apt_proxy: +# - name: apt_ubuntu_18.04 +# remote_url: http://archive.ubuntu.com/ubuntu/ +# distribution: bionic +# maximum_component_age: -1 +# maximum_metadata_age: -1 +# negative_cache_ttl: 60 + +# nexus_repos_helm_hosted: +# - name: helm-hosted + +# nexus_repos_helm_proxy: +# - name: helm-proxy +# remote_url: https://kubernetes-charts.storage.googleapis.com/ + +# nexus_repos_r_proxy: +# - name: r-proxy +# remote_url: https://cran.r-project.org/ + +# nexus_repos_r_hosted: +# - name: r-internal +# version_policy: release +# write_policy: allow + +# nexus_repos_r_group: +# - name: r-all +# member_repos: +# - r-internal +# - r-proxy + +# nexus_repos_conda_proxy: +# - name: conda-proxy +# remote_url: https://repo.continuum.io/pkgs/ + +# nexus_repos_go_proxy: +# - name: go-proxy +# remote_url: https://golang.org/pkg/ + +# nexus_repos_nuget_hosted: +# - name: nuget-internal +# blob_store: "{{ nexus_blob_names.nuget.blob }}" + +# nexus_repos_nuget_group: +# - name: nuget-all +# blob_store: "{{ nexus_blob_names.nuget.blob }}" +# member_repos: +# - nuget-internal +# - nuget-proxy + +# nexus_repos_nuget_proxy: +# - name: nuget-proxy-with-version +# blob_store: "{{ nexus_blob_names.nuget.blob }}" +# remote_url: http://www.nuget.org/api/v2 +# nuget_version: v2 +# - name: nuget-proxy-default +# remote_url: https://api.nuget.org/v3/index.json + +# nexus_content_selectors: +# # Docker by namespace. For mode details see: +# # https://help.sonatype.com/repomanager3/formats/docker-registry/content-selectors-and-docker +# - name: docker-login-search +# description: Selector for docker login privilege +# search_expression: format == "docker" and (path == "/v2/" of path == "/v1/search") +# - name: docker-private-team1 +# description: Selector for docker team1 +# search_expression: format == "docker" and path =^ "/v2/team1/" +# - name: docker-private-team2 +# description: Selector for docker team2 +# search_expression: format == "docker" and path =^ "/v2/team2/" + +# nexus_privileges: +# - name: all-repos-read +# description: Read & Browse access to all repos +# repository: "*" +# actions: +# - read +# - browse +# - name: wildcard1 +# type: wildcard +# description: first wilcard +# pattern: nexus:repository-view:yum:* +# - name: some_application +# type: application +# description: some nexus configuration +# domain: some_nexus_domain +# actions: +# - some action +# - name: script1 +# type: script +# description: first script +# script_name: the_script_name +# actions: +# - some actions +# - name: docker-login-search-all +# type: repository-content-selector +# contentSelector: docker-login-search +# description: Login to and search docker registry +# repository: "*" +# actions: +# - read +# - name: docker-private-team1-rw +# type: repository-content-selector +# contentSelector: docker-private-team1 +# description: write access to /team1 namespace on docker-private +# repository: docker-private +# actions: +# - read, +# - add +# - edit +# - browse +# - name: docker-private-team2-rw +# type: repository-content-selector +# contentSelector: docker-private-team2 +# description: write access to /team2 namespace on docker-hosted +# repository: docker-private +# actions: +# - read +# - add +# - edit +# - browse + +# nexus_roles: +# - name: c-ro-private_yum_centos_7 +# id: c-ro-private_yum_centos_7 +# description: Custom read-only role for private_yum_centos_7 hosted repository +# privileges: +# - nx-repository-view-yum-private_yum_centos_7-read +# - nx-repository-view-yum-private_yum_centos_7-browse +# - name: developers +# id: developers +# description: Developers +# privileges: +# - all-repos-read +# - wildcard1 +# - docker-login-search-all +# - name: role-team1 +# id: role-team1 +# description: team1 +# privileges: +# - docker-private-team1-rw +# - name: role-team2 +# id: role-team2 +# description: team2 +# privileges: +# - docker-private-team2-rw + +# nexus_local_users: +# - username: jenkins +# first_name: Jenkins +# last_name: CI +# email: support@company.com +# password: s3cr3t +# roles: +# - developers +# - username: olduser # make sure this old account is removed +# state: absent +# - username: test_roles +# first_name: Test +# last_name: Roles +# email: test@roles.com +# password: s3cr3t +# roles: +# - c-ro-private_yum_centos_7 +# - username: team1 +# first_name: team +# last_name: one +# email: team@one.com +# password: theone +# roles: +# - developers +# - role-team1 +# - username: team2 +# first_name: team +# last_name: two +# email: team@two.com +# password: thetwo +# roles: +# - developers +# - role-team2 nexus_scheduled_tasks: # Example task to purge maven snapshots with cron schedule diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index d06df9f7..c1ab04f7 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -1,8 +1,9 @@ --- +nexus_delete_default_repos: true # defaults file for nexus3-repository-templates teams: - - ID: 1 - name: Team 1 + - ID: Team1 + name: Team1 repos: requestedBy: hosted: @@ -39,20 +40,47 @@ teams: format: npm group: - name: group-repo-1 + format: maven2 members: - maven-repo2 - - npm-repo1 + - maven-repo1 + - mvn-proxy-repo1 - name: group-repo-2 + format: npm members: - - maven-repo2 + - npm-proxy-repo1 - npm-repo1 sharedAccessTo: hosted: - name: maven-repo1 + teams: [] proxy: - name: proxy_defaults.maven_defaults + teams: [] + group: [] + - ID: Team2 + name: Team2 + repos: + requestedBy: + hosted: + - name: maven-repo-team2 + format: maven2 + - name: python-repo-team2 + format: pypi + proxy: + - name: python-proxy-team2 + format: pypi + group: [] + sharedAccessTo: + hosted: + - name: maven-repo-team2 + teams: [1] + proxy: + - name: proxy_defaults.maven_defaults + teams: [] group: [] + hosted_defaults: apt: blob_store: blob-apt @@ -225,7 +253,7 @@ proxy_defaults: sub_domain: cleanup_policies: - docker_cleanup - python: + pypi: name: pypi-central format: pypi blob_store: blob-pypi @@ -243,6 +271,8 @@ proxy_defaults: enable_cookies: enable_circular_redirects: timeout: + layout_policy: strict + write_policy: allow_once # one of "allow", "allow_once" or "deny" maximum_component_age: -1 maximum_metadata_age: 1440 negative_cache_enabled: True diff --git a/molecule/roles/nexus3-repository-templates/tasks/main.yml b/molecule/roles/nexus3-repository-templates/tasks/main.yml index 0c0e4179..8bbf3e60 100644 --- a/molecule/roles/nexus3-repository-templates/tasks/main.yml +++ b/molecule/roles/nexus3-repository-templates/tasks/main.yml @@ -12,3 +12,9 @@ dest: "/nexus-downloads/hosted-result.yml" #remote_src: true tags: transform +- name: Transform roles_defaults into nexus_repos + ansible.builtin.template: + src: "roles.yml.j2" + dest: "/nexus-downloads/roles-result.yml" + #remote_src: true + tags: transform diff --git a/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 index 4ae78073..7e61e4ea 100644 --- a/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/hosted.yml.j2 @@ -1,7 +1,9 @@ {% for key, value in hosted_defaults.items() %} {% for team in teams %} +{% set teams_loop = loop %} {% for team_hosted_repo in team.repos.requestedBy.hosted | selectattr("format", "equalto", key) %} -{% if team_hosted_repo|length > 0 and loop.first %} +{% set team_hosted_repo_loop = loop %} +{% if team_hosted_repo|length > 0 and team_hosted_repo_loop.first and teams_loop.first %} {% if key == 'maven2' %} nexus_repos_{{ key[:-1] }}_hosted: {% else %} diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index 44f5d001..3064876d 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -1,7 +1,9 @@ {% for key, value in proxy_defaults.items() %} {% for team in teams %} +{% set teams_loop = loop %} {% for team_proxy_repo in team.repos.requestedBy.proxy | selectattr("format", "equalto", key) %} -{% if team_proxy_repo|length > 0 and loop.first %} +{% set team_hosted_repo_loop = loop %} +{% if team_proxy_repo|length > 0 and team_hosted_repo_loop.first and teams_loop.first %} {% if key == 'maven2' %} nexus_repos_{{ key[:-1] }}_proxy: {% else %} diff --git a/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 new file mode 100644 index 00000000..eb5f524e --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 @@ -0,0 +1,32 @@ +--- +{% for team in teams %} +{% if teams|length > 0 and loop.first %} +nexus_roles: +{% endif %} + - id: {{ team.ID|upper }}-members + name: {{ team.ID|upper }}-members + description: '{{ team.name|upper }} role.' + privileges: +{% for team_hosted_repo in team.repos.requestedBy.hosted %} +{% if team_hosted_repo|length > 0 %} + - nx-repository-view-{{ team_hosted_repo.format }}-{{ team_hosted_repo.name }}-read + - nx-repository-view-{{ team_hosted_repo.format }}-{{ team_hosted_repo.name }}-browse +{% endif %} +{% endfor %} +{% for team_proxy_repo in team.repos.requestedBy.proxy %} +{% if team_proxy_repo|length > 0 %} + - nx-repository-view-{{ team_proxy_repo.format }}-{{ team_proxy_repo.name }}-read + - nx-repository-view-{{ team_proxy_repo.format }}-{{ team_proxy_repo.name }}-browse +{% endif %} +{% endfor %} +{# {% for team_group_repo in team.repos.requestedBy.group %} +{% if team_group_repo|length > 0 %} + - nx-repository-view-{{ team_group_repo.format }}-{{ team_group_repo.name }}-read + - nx-repository-view-{{ team_group_repo.format }}-{{ team_group_repo.name }}-browse +{% endif %} +{% endfor %} #} +{# {% for team.repos.sharedAcsharedAccessTo.hosted | selectattr("format", "equalto", key) %} +{% endfor %} #} + roles: [] +{# TODO: depending on data impolementation #} +{% endfor %} From 9b24bb6b72f28d8942c28cc49b679ef5d17d67c4 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Mon, 10 Jun 2024 14:43:16 +0000 Subject: [PATCH 15/23] Added shared repo functionality to roles. --- .../defaults/main.yml | 18 +++---- .../templates/roles.yml.j2 | 54 ++++++++++++++++++- 2 files changed, 61 insertions(+), 11 deletions(-) diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index c1ab04f7..a7fedc71 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -51,12 +51,12 @@ teams: - npm-proxy-repo1 - npm-repo1 sharedAccessTo: - hosted: - - name: maven-repo1 - teams: [] + hosted: + - name: raw-repo1 + teams: [Team2] proxy: - - name: proxy_defaults.maven_defaults - teams: [] + - name: raw-proxy-repo1 + teams: [Team2] group: [] - ID: Team2 name: Team2 @@ -74,10 +74,10 @@ teams: sharedAccessTo: hosted: - name: maven-repo-team2 - teams: [1] - proxy: - - name: proxy_defaults.maven_defaults - teams: [] + teams: [Team1] + proxy: + - name: python-proxy-team2 + teams: [Team1] group: [] diff --git a/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 index eb5f524e..61eb9a2a 100644 --- a/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/roles.yml.j2 @@ -25,8 +25,58 @@ nexus_roles: - nx-repository-view-{{ team_group_repo.format }}-{{ team_group_repo.name }}-browse {% endif %} {% endfor %} #} -{# {% for team.repos.sharedAcsharedAccessTo.hosted | selectattr("format", "equalto", key) %} -{% endfor %} #} +{# Start shared loop #} +{% for team_shared in teams %} +{# Start shared Hosted repo #} +{% for hosted_shared in team_shared.repos.sharedAccessTo.hosted %} +{% for repo_shared in hosted_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.hosted %} +{% if hosted_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Hosted repo #} +{# Start shared Proxy repo #} +{% for proxy_shared in team_shared.repos.sharedAccessTo.proxy %} +{% for repo_shared in proxy_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.proxy %} +{% if proxy_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Proxy repo #} +{# Start shared Group repo #} +{% for group_shared in team_shared.repos.sharedAccessTo.group %} +{% for repo_shared in group_shared.teams %} +{% if repo_shared == team.ID %} +{% for team_data in teams %} +{% for repo_data in team_data.repos.requestedBy.group %} +{% if group_shared.name == repo_data.name %} + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-read + - nx-repository-view-{{ repo_data.format }}-{{ repo_data.name }}-browse +{% endif %} +{% endfor %} +{% endfor %} +{% endif %} +{% endfor %} +{% endfor %} +{# End shared Group repo #} +{% endfor %} +{# End shared loop #} roles: [] {# TODO: depending on data impolementation #} {% endfor %} From 82947b6e87de465f36881f8e562813dbc0c931bc Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Mon, 10 Jun 2024 14:50:17 +0000 Subject: [PATCH 16/23] split-up nexus features in seperate files. --- .../templates/blobstores.yml.j2 | 14 ++ .../templates/cleanup-policies.yml.j2 | 42 ++++ .../templates/content-selectors.yml.j2 | 19 ++ .../templates/privileges-roles.yml.j2 | 170 -------------- .../templates/repository-requirements.yml.j2 | 219 ------------------ .../templates/scheduled-tasks.yml.j2 | 61 +++++ 6 files changed, 136 insertions(+), 389 deletions(-) create mode 100644 molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 create mode 100644 molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 create mode 100644 molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 delete mode 100644 molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 delete mode 100644 molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 create mode 100644 molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 diff --git a/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 new file mode 100644 index 00000000..b1dcf56f --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 @@ -0,0 +1,14 @@ +--- +nexus_blobstores: + - name: dockerhub-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/dockerhub-blob + - name: proxy-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/proxy-blob +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-blob + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }}-blob +{% endfor %} +{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} + - name: {{ item.team }} + path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }} +{% endfor %} diff --git a/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 new file mode 100644 index 00000000..18ed3871 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/cleanup-policies.yml.j2 @@ -0,0 +1,42 @@ +--- +nexus_repos_cleanup_policies: +{% for item in proxy_repos %} + - name: base-image-{{ item.proxyname }}-cleanup + format: docker + notes: Clean up policy for base images {{ item.proxyname }}-proxy + criteria: +{% if item.cleanup.lastupdated != "" %} + lastBlobUpdated: {{ item.cleanup.lastupdated }} +{% endif %} +{% if item.cleanup.lastdownloaded != "" %} + lastDownloaded: {{ item.cleanup.lastdownloaded }} +{% endif %} +{% if item.cleanup.regex != "" %} + regexKey: "{{ item.cleanup.regex }}" +{% endif %} +{% endfor %} + - name: base-image-docker-cleanup + format: docker + notes: "Clean up policy for base images docker-proxy" + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 + regexKey: ".*(library|linuxserver|xebialabs).*" + - name: remove-snapshot-containers + format: docker + notes: Policy for removing temporary container images + criteria: + lastDownloaded: 14 + lastBlobUpdated: 30 + regexKey: ".*(SNAPSHOT|snapshot|DEVELOP|develop|BUILD|build).*" + - name: remove-release-containers + format: docker + notes: Policy for removing that were considered release at some time + criteria: + lastBlobUpdated: 90 + - name: base-image-cleanup + format: docker + notes: Clean up policy for base images + criteria: + lastBlobUpdated: 90 + lastDownloaded: 30 diff --git a/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 new file mode 100644 index 00000000..cf14bcc7 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/content-selectors.yml.j2 @@ -0,0 +1,19 @@ +--- +nexus_content_selectors: +{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} + - name: {{ item.team }}-container-content + description: {{ item.team }}-repo push conventions + search_expression: format == 'docker' and path=^ "/v2/{{ item.team }}/" +{% endfor %} + - name: all-gitlfs + description: Selector for Git LFS repositories + search_expression: format=='gitlfs' + - name: container-content + description: only allowed to download images + search_expression: format == 'docker' + - name: amos-container-content + description: amos-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/pet-system/" or path =^ "/v2/amos-pet/" ) + - name: sens-container-content + description: sens-repo push conventions + search_expression: format == 'docker' and ( path =^ "/v2/sens/" or path =^ "/v2/viz/" or path =^ "/v2/anpr/" or path =^ "/v2/kolibrie/" ) diff --git a/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 deleted file mode 100644 index e3cb8def..00000000 --- a/molecule/roles/nexus3-repository-templates/templates/privileges-roles.yml.j2 +++ /dev/null @@ -1,170 +0,0 @@ ---- -nexus_content_selectors: -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - name: {{ item.team }}-container-content - description: {{ item.team }}-repo push conventions - search_expression: format == 'docker' and path=^ "/v2/{{ item.team }}/" -{% endfor %} - - name: all-gitlfs - description: Selector for Git LFS repositories - search_expression: format=='gitlfs' - - name: container-content - description: only allowed to download images - search_expression: format == 'docker' - - name: amos-container-content - description: amos-repo push conventions - search_expression: format == 'docker' and ( path =^ "/v2/pet-system/" or path =^ "/v2/amos-pet/" ) - - name: sens-container-content - description: sens-repo push conventions - search_expression: format == 'docker' and ( path =^ "/v2/sens/" or path =^ "/v2/viz/" or path =^ "/v2/anpr/" or path =^ "/v2/kolibrie/" ) - -nexus_privileges: -{#INIT: START NECESSITIES FIRST#} - - name: docker-group-read-browse # used as key to update a privilege - type: repository-content-selector - description: Read & Browse access for docker-group - repository: docker-group - contentSelector: container-content - actions: # can be add, browse, create, delete, edit, read or * (all) - - read - - browse -{#INIT: END#} -{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} - - name: {{ item.team }}-gitlfs-add-delete-edit-read-browse - description: {{ item.team }} Git LFS privileges - repository: {{ item.team }}-gitlfs - format: gitlfs - actions: - - add - - delete - - edit - - read - - browse -{% endfor %} -{% for item in group_repo_teams %} - - name: {{ item.team }}-docker-group-all-privileges # used as key to update a privilege - type: repository-content-selector - description: All privileges for {{ item.team }}-repo - repository: {{ item.team }}-docker-group - contentSelector: {{ item.team }}-container-content - actions: - - add - - delete - - edit - - read - - browse - - name: {{ item.team }}-docker-group-read-browse # used as key to update a privilege - type: repository-content-selector - description: Read & Browse access for {{ item.team }}-repo - repository: {{ item.team }}-docker-group - contentSelector: container-content - actions: # can be add, browse, create, delete, edit, read or * (all) - - read - - browse -{% endfor %} -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - name: {{ item.team }}-docker-all-privileges # used as key to update a privilege - type: repository-content-selector - description: All privileges for {{ item.team }}-repo - repository: {{ item.team }}-repo - contentSelector: {{ item.team }}-container-content - actions: - - add - - delete - - edit - - read - - browse - - name: {{ item.team }}-docker-read-browse # used as key to update a privilege - type: repository-content-selector - description: Read & Browse access for {{ item.team }}-repo - repository: {{ item.team }}-repo - contentSelector: container-content - actions: # can be add, browse, create, delete, edit, read or * (all) - - read - - browse -{% endfor %} - -nexus_roles: -{#INIT: NECESSITIES FIRST#} - - id: nx-deployment - name: nx-deployment - description: nx-deployment (legacy) - privileges: - - nx-apikey-all - - nx-component-upload - - nx-search-read - - nx-repository-view-docker-*-read - - nx-usertoken-current - roles: [] -{#INIT: END -#STANDARD AUTOMATED: START #} -{% for item in docker_repo_teams %} - - id: {{ item.team|upper }}-members - name: {{ item.team|upper }}-members - description: {{ item.team|upper }}-members - privileges: -{% if item.repo == "true" %} - - {{ item.team }}-docker-read-browse - - {{ item.team }}-docker-all-privileges - - docker-group-read-browse -{% endif %} -{% if item.gitlfs == "true" %} - - nx-search-read - - {{ item.team }}-gitlfs-add-delete-edit-read-browse -{% endif %} -{% for proxyitem in group_repo_teams %} -{% if item.team == proxyitem.team %} - - {{ proxyitem.team }}-docker-group-read-browse - - {{ proxyitem.team }}-docker-group-all-privileges -{% endif %} -{% endfor %} - roles: -{% if item.repo == "true" %} - - nx-deployment -{% endif %} -{% endfor %} -{# STANDARD AUTOMATED: END -SPECIAL CASES: START #} - - id: TPE-members - name: TPE-members - description: TPE-members - privileges: - - tpe-docker-read-browse - - bettyblocks-docker-read-browse - - tpe-docker-all-privileges - - bettyblocks-docker-all-privileges - - bettyblocks-docker-group-all-privileges - - tpe-gitlfs-add-delete-edit-read-browse - - docker-group-read-browse - - nx-search-read - roles: - - nx-admin - - nx-deployment - - id: BHT-members - name: BHT-members - description: BHT-members - privileges: - - bht-docker-read-browse - - bht-docker-all-privileges - - bht-docker-group-read-browse - - bht-docker-group-all-privileges - - docker-group-read-browse - - laas-docker-read-browse - - laas-docker-all-privileges - - laas-docker-group-read-browse - - laas-docker-group-all-privileges - roles: - - nx-deployment - - id: BVI-BV-members - name: BVI-BV-members - description: BVI-BV-members special case - privileges: - - bvibv-docker-all-privileges - - bvibv-docker-group-all-privileges - - bvibv-docker-read-browse - - bvibv-docker-group-read-browse - - docker-group-read-browse - roles: - - nx-deployment -{#SPECIAL CASES: END #} -... diff --git a/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 deleted file mode 100644 index d7877ef5..00000000 --- a/molecule/roles/nexus3-repository-templates/templates/repository-requirements.yml.j2 +++ /dev/null @@ -1,219 +0,0 @@ ---- -nexus_blobstores: - - name: dockerhub-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/dockerhub-blob - - name: proxy-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/proxy-blob -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - name: {{ item.team }}-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }}-blob -{% endfor %} -{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} - - name: {{ item.team }} - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }} -{% endfor %} - -nexus_repos_gitlfs_hosted: -{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} - - name: {{ item.team }}-gitlfs - blob_store: {{ item.team }} -{% endfor %} - -### START: Docker repositories - -nexus_repos_docker_hosted: -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - name: {{ item.team }}-repo -{% if item.port_suffix is defined %} - http_port: 8{{ item.port_suffix }} -{% endif %} - blob_store: {{ item.team }}-blob - v1_enabled: False -{% if item.redeploy | default('true') == 'true' %} - write_policy: allow -{% elif item.redeploy | default('true') == 'false' %} - write_policy: allow_once -{% endif %} -{% if item.cleanup == "BASE" %} - cleanup_policies: - - base-image-cleanup -{% elif item.cleanup == "DEFAULT" %} - cleanup_policies: - - remove-snapshot-containers - - remove-release-containers -{% elif item.cleanup == "SNAPSHOT" %} - cleanup_policies: - - remove-snapshot-containers -{% endif %} -{% endfor %} - -nexus_repos_docker_proxy: - - name: docker-proxy - v1_enabled: False - index_type: "HUB" - remote_url: "https://registry-1.docker.io" - use_nexus_certificates_to_access_index: false - blob_store: dockerhub-blob - cleanup_policies: - - base-image-docker-cleanup -{% for item in proxy_repos %} - - name: docker-{{ item.proxyname }} - v1_enabled: False - index_type: "{{ item.type }}" - maximum_component_age: 0 - maximum_metadata_age: 0 - remote_url: "{{ item.remote.url }}" -{% if (item.remote.user | default("") != "" or item.remote.pass | default("") != "") %} - remote_username: {{ item.remote.user }} - remote_password: {{ item.remote.pass }} -{% endif %} -{% if (item.remote.cache | default("") != "") %} - negative_cache_ttl: {{ item.remote.cache }} -{% endif %} - use_nexus_certificates_to_access_index: true - blob_store: proxy-blob - cleanup_policies: - - base-image-{{ item.proxyname }}-cleanup -{% endfor %} - -nexus_repos_docker_group: - - name: docker-group - http_port: 8082 - v1_enabled: False -{% if 'gip_' in inventory_hostname %} - sub_domain: containers -{% else %} - sub_domain: containers-staging -{% endif %} - member_repos: -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - {{ item.team }}-repo -{% endfor %} - - name: containers-cicd-gnr - sub_domain: containers-cicd - member_repos: -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - {{ item.team }}-repo -{% endfor %} -{% for item in group_repo_teams %} - - name: {{ item.team }}-docker-group -{% if item.port_suffix is defined %} - http_port: 8{{ item.port_suffix }} -{% endif %} - sub_domain: {{ item.team }} - writable_member_repo: {{ item.team }}-repo - blob_store: {{ item.team }}-blob - v1_enabled: False - member_repos: - - {{ item.team }}-repo -{% if item.proxyname is defined %} -{% for proxyitem in item.proxyname %} - - docker-{{ proxyitem }} -{% endfor %} -{% endif %} -{% endfor %} - -### End: Docker repositories - -nexus_repos_cleanup_policies: -{% for item in proxy_repos %} - - name: base-image-{{ item.proxyname }}-cleanup - format: docker - notes: Clean up policy for base images {{ item.proxyname }}-proxy - criteria: -{% if item.cleanup.lastupdated != "" %} - lastBlobUpdated: {{ item.cleanup.lastupdated }} -{% endif %} -{% if item.cleanup.lastdownloaded != "" %} - lastDownloaded: {{ item.cleanup.lastdownloaded }} -{% endif %} -{% if item.cleanup.regex != "" %} - regexKey: "{{ item.cleanup.regex }}" -{% endif %} -{% endfor %} - - name: base-image-docker-cleanup - format: docker - notes: "Clean up policy for base images docker-proxy" - criteria: - lastBlobUpdated: 90 - lastDownloaded: 30 - regexKey: ".*(library|linuxserver|xebialabs).*" - - name: remove-snapshot-containers - format: docker - notes: Policy for removing temporary container images - criteria: - lastDownloaded: 14 - lastBlobUpdated: 30 - regexKey: ".*(SNAPSHOT|snapshot|DEVELOP|develop|BUILD|build).*" - - name: remove-release-containers - format: docker - notes: Policy for removing that were considered release at some time - criteria: - lastBlobUpdated: 90 - - name: base-image-cleanup - format: docker - notes: Clean up policy for base images - criteria: - lastBlobUpdated: 90 - lastDownloaded: 30 - -nexus_scheduled_tasks: -{% for item in docker_repo_teams | selectattr('repo', 'equalto', 'true') %} -{% if item.cleanup != 'NONE'%} - - name: docker-delete-unused-manifests-and-images-{{ item.team }}-repo - cron: 0 15 1 * * ? - typeId: "repository.docker.gc" - taskProperties: - repositoryName: {{ item.team }}-repo - deployOffset: "24" -{% endif %} - - name: {{ item.team }}-compact-blobstore - cron: 0 45 1 * * ? - typeId: blobstore.compact - taskProperties: - blobstoreName: {{ item.team }}-blob -{% endfor %} -{% for item in docker_repo_teams | selectattr('gitlfs', 'equalto', 'true') %} - - name: {{ item.team }}-compact-blobstore-gitlfs - cron: 0 0 0 * * ? - typeId: blobstore.compact - taskProperties: - blobstoreName: {{ item.team }} -{% endfor %} -{% for item in proxy_repos %} - - name: docker-delete-unused-manifests-and-images-{{ item.proxyname }} - cron: 0 15 0 * * ? - typeId: "repository.docker.gc" - taskProperties: - repositoryName: docker-{{ item.proxyname }} - deployOffset: "24" -{% endfor %} - - name: proxy-compact-blobstore - cron: 0 50 0 * * ? - typeId: blobstore.compact - taskProperties: - blobstoreName: proxy-blob - - name: docker-delete-unused-manifests-and-images-docker-proxy - cron: 0 30 1 * * ? - typeId: "repository.docker.gc" - taskProperties: - repositoryName: docker-proxy - deployOffset: "24" - - name: dockerhub-blob-compact-blobstore - cron: 0 50 0 * * ? - typeId: blobstore.compact - taskProperties: - blobstoreName: dockerhub-blob - - name: docker-delete-incomplete-uploads - cron: 0 45 1 * * ? - typeId: "repository.docker.upload-purge" - taskProperties: - age: "24" - - name: Nexus export configuration and metadata backup - cron: 0 0 1 * * ? - typeId: "db.backup" - task_alert_email: "monitoring-tpe@politie.nl" - taskProperties: - notificationCondition: Failure - location: "{{ nexus_nfs_mount_path }}/orientdb_backup" -... diff --git a/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 new file mode 100644 index 00000000..c75357d0 --- /dev/null +++ b/molecule/roles/nexus3-repository-templates/templates/scheduled-tasks.yml.j2 @@ -0,0 +1,61 @@ +--- +nexus_scheduled_tasks: +{% for item in docker_repo_teams | selectattr('repo', 'equalto', 'true') %} +{% if item.cleanup != 'NONE'%} + - name: docker-delete-unused-manifests-and-images-{{ item.team }}-repo + cron: 0 15 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: {{ item.team }}-repo + deployOffset: "24" +{% endif %} + - name: {{ item.team }}-compact-blobstore + cron: 0 45 1 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }}-blob +{% endfor %} +{% for item in docker_repo_teams | selectattr('gitlfs', 'equalto', 'true') %} + - name: {{ item.team }}-compact-blobstore-gitlfs + cron: 0 0 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: {{ item.team }} +{% endfor %} +{% for item in proxy_repos %} + - name: docker-delete-unused-manifests-and-images-{{ item.proxyname }} + cron: 0 15 0 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-{{ item.proxyname }} + deployOffset: "24" +{% endfor %} + - name: proxy-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: proxy-blob + - name: docker-delete-unused-manifests-and-images-docker-proxy + cron: 0 30 1 * * ? + typeId: "repository.docker.gc" + taskProperties: + repositoryName: docker-proxy + deployOffset: "24" + - name: dockerhub-blob-compact-blobstore + cron: 0 50 0 * * ? + typeId: blobstore.compact + taskProperties: + blobstoreName: dockerhub-blob + - name: docker-delete-incomplete-uploads + cron: 0 45 1 * * ? + typeId: "repository.docker.upload-purge" + taskProperties: + age: "24" + - name: Nexus export configuration and metadata backup + cron: 0 0 1 * * ? + typeId: "db.backup" + task_alert_email: "monitoring-tpe@politie.nl" + taskProperties: + notificationCondition: Failure + location: "{{ nexus_nfs_mount_path }}/orientdb_backup" +... From e9bbcc4cbdae0fbfb3e441f340f8e284e5f92548 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Tue, 11 Jun 2024 14:38:54 +0000 Subject: [PATCH 17/23] Added routingrule functionality to Nexus. --- defaults/main.yml | 9 + files/groovy/ScriptBaseClass.groovy | 93 ++++ files/groovy/syncReposWithRoutingRules.groovy | 102 +++++ files/groovy/syncRoutingRules.groovy | 129 ++++++ molecule/default-converge.yml | 1 + molecule/repo-defaults.yml | 413 ------------------ .../defaults/main.yml | 27 ++ .../tasks/main.yml | 6 + .../templates/blobstores.yml.j2 | 14 - .../templates/proxies.yml.j2 | 3 +- .../templates/routing-rules.yml.j2 | 12 +- molecule/teams.yml | 46 -- tasks/main.yml | 3 + tasks/routing_rules.yml | 31 ++ 14 files changed, 409 insertions(+), 480 deletions(-) create mode 100644 files/groovy/ScriptBaseClass.groovy create mode 100644 files/groovy/syncReposWithRoutingRules.groovy create mode 100644 files/groovy/syncRoutingRules.groovy delete mode 100644 molecule/repo-defaults.yml delete mode 100644 molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 delete mode 100644 molecule/teams.yml create mode 100644 tasks/routing_rules.yml diff --git a/defaults/main.yml b/defaults/main.yml index 7567f89a..7223ea27 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -214,6 +214,15 @@ nexus_config_p2: false nexus_config_conda: false nexus_config_go: false +# routing_rules.yml +nexus_routing_rules_config: + nexus: + deleteUnknownItems: + routingRules: true + # customLocalUsers: false +nexus_routing_rules: + routingRules: [] + nexus_content_selectors: [] # example selector item : # - name: docker-login diff --git a/files/groovy/ScriptBaseClass.groovy b/files/groovy/ScriptBaseClass.groovy new file mode 100644 index 00000000..2580735b --- /dev/null +++ b/files/groovy/ScriptBaseClass.groovy @@ -0,0 +1,93 @@ +import groovy.json.JsonOutput +import groovy.json.JsonSlurper +import org.slf4j.Logger +import org.sonatype.nexus.BlobStoreApi +import org.sonatype.nexus.CoreApi +import org.sonatype.nexus.common.app.GlobalComponentLookupHelper +import org.sonatype.nexus.script.plugin.RepositoryApi +import org.sonatype.nexus.security.SecurityApi + +abstract class ScriptBaseClass { + + protected final Logger log + protected final SecurityApi security + protected final CoreApi core + protected final RepositoryApi repository + protected final BlobStoreApi blobStore + protected final GlobalComponentLookupHelper container + protected final Map config + protected final ScriptResult scriptResult + + ScriptBaseClass(context) { + log = context.log + security = context.security + core = context.core + repository = context.repository + blobStore = context.blobStore + container = context.container + scriptResult = new ScriptResult(false, false) + config = new JsonSlurper().parseText(context.args as String) as Map + } + + String sendResponse() { + return JsonOutput.toJson(scriptResult) + } + + abstract String execute() + + class ScriptResult implements Serializable { + Boolean changed + Boolean error + List> actionDetails + + ScriptResult(changed, error) { + this.changed = changed + this.error = error + actionDetails = new ArrayList<>() + } + + void hasChanged() { + this.changed = true + } + + void hasError() { + this.error = true + } + + Map newAction(Map initValues = [:]) { + return new HashMap(initValues) + } + + void addActionDetails(Map action, Throwable error) { + action.put('errorMsg', error.toString()) + hasError() + addActionDetails(action, Status.ERROR) + } + + void addActionDetails(Map action, Status status) { + action.put('status', status.toString().toLowerCase()) + + if (status.isChanged) { + hasChanged() + } + + actionDetails.add(action) + } + + enum Status implements Serializable { + CREATED(true), + CHANGED(true), + UPDATED(true), + DELETED(true), + UNCHANGED(false), + FORBIDDEN(false), + ERROR(false) + + protected Boolean isChanged + + Status(Boolean isChanged) { + this.isChanged = isChanged + } + } + } +} \ No newline at end of file diff --git a/files/groovy/syncReposWithRoutingRules.groovy b/files/groovy/syncReposWithRoutingRules.groovy new file mode 100644 index 00000000..4ea21efd --- /dev/null +++ b/files/groovy/syncReposWithRoutingRules.groovy @@ -0,0 +1,102 @@ +import org.sonatype.nexus.repository.Repository +import org.sonatype.nexus.repository.config.Configuration +import org.sonatype.nexus.repository.manager.RepositoryManager +import org.sonatype.nexus.repository.routing.RoutingRuleStore + +class SyncRepositories extends ScriptBaseClass { + + SyncRepositories(context) { + super(context) + } + + @SuppressWarnings('GrMethodMayBeStatic') + Boolean findRepositoryInConfig(Repository repo, List> repositories) { + return repositories.any { repoConfig -> + return repo.getType().getValue() == (repoConfig.type as String) && + repo.getFormat().getValue() == (repoConfig.format as String) && + repo.getName() == (repoConfig.name as String) + } + } + + Configuration newConfiguration(Map map) { + RepositoryManager repositoryManager = repository.getRepositoryManager() + Configuration config + + try { + config = repositoryManager.newConfiguration() + } catch (ignored) { + // Compatibility with nexus versions older than 3.21 + config = Configuration.newInstance() + } + + config.with { + repositoryName = map.repositoryName + recipeName = map.recipeName + online = Boolean.parseBoolean(map.online as String) + attributes = map.attributes as Map + } + + return config + } + + @SuppressWarnings('GrMethodMayBeStatic') + boolean configurationEquals(Configuration currentConfig, Configuration configDef) { + if (currentConfig.attributes.httpclient) { + if (currentConfig.attributes.httpclient.authentication == [:]) { + currentConfig.attributes.httpclient.authentication = null + } + if (currentConfig.attributes.httpclient.connection == [:]) { + currentConfig.attributes.httpclient.connection = null + } + if (currentConfig.attributes.httpclient == [:]) { + currentConfig.attributes.httpclient = null + } + } + + if (currentConfig.attributes.maven == [:]) { + currentConfig.attributes.remove('maven') + } + + return currentConfig.properties == configDef.properties + } + + void createOrUpdateRepositories(List> repos) { + RepositoryManager repositoryManager = repository.getRepositoryManager() + + repos.each { repoDef -> + String name = repoDef.proxyname + Configuration configuration + def action = scriptResult.newAction(name: name) + Repository existingRepo = repositoryManager.get(name) + + try { + log.info('Loading configuration for existing repo {})', name) + // Load existing repository configuration + configuration = existingRepo.getConfiguration().copy() + + configuration.routingRuleId = container.lookup(RoutingRuleStore) + .getByName(repoDef.name as String)?.id() + + if (!configurationEquals(existingRepo.configuration, configuration)) { + repositoryManager.update(configuration) + log.info('Configuration for repo {} updated', name) + scriptResult.addActionDetails(action, ScriptResult.Status.UPDATED) + } else { + log.info('Configuration for repo {} not changed', name) + scriptResult.addActionDetails(action, ScriptResult.Status.UNCHANGED) + } + } catch (Exception e) { + log.error('Configuration for repo {} could not be saved: {}', name, e.toString()) + scriptResult.addActionDetails(action, e) + } + } + } + + String execute() { + List> reposDefs = (config?.routingRules as List>) ?: [] + createOrUpdateRepositories(reposDefs) + return sendResponse() + } +} + +return new SyncRepositories(this).execute() \ No newline at end of file diff --git a/files/groovy/syncRoutingRules.groovy b/files/groovy/syncRoutingRules.groovy new file mode 100644 index 00000000..754a9d23 --- /dev/null +++ b/files/groovy/syncRoutingRules.groovy @@ -0,0 +1,129 @@ +import org.sonatype.nexus.repository.routing.RoutingMode +import org.sonatype.nexus.repository.routing.RoutingRule +import org.sonatype.nexus.repository.routing.RoutingRuleStore + +class SyncRoutingRules extends ScriptBaseClass { + + private final RoutingRuleStore routingRuleStore + + SyncRoutingRules(context) { + super(context) + this.routingRuleStore = context.container.lookup(RoutingRuleStore) + } + + @SuppressWarnings('GrMethodMayBeStatic') + Boolean isRuleEqual(RoutingRule existingRule, Map ruleDef) { + Boolean equals = true + + equals &= existingRule.name() == ruleDef.name + equals &= existingRule.description() == ruleDef.description + equals &= existingRule.mode() == (ruleDef.mode as String).toUpperCase() as RoutingMode + equals &= existingRule.matchers() == ruleDef.matchers as List + + return equals + } + + @SuppressWarnings('GrMethodMayBeStatic') + void setValues(RoutingRule currentRule, Map ruleDef) { + currentRule.name(ruleDef.name as String) + currentRule.description(ruleDef.description as String ?: '') + currentRule.mode((ruleDef.mode as String).toUpperCase() as RoutingMode) + currentRule.matchers(ruleDef.matchers as List) + } + + void createRoutingRule(Map ruleDef, Map action) { + String name = ruleDef.name + + try { + def newRoutingRule = routingRuleStore.newRoutingRule() + setValues(newRoutingRule, ruleDef) + routingRuleStore.create(newRoutingRule) + log.info('Routing rule {} created', name) + scriptResult.addActionDetails(action, ScriptResult.Status.CREATED) + + } catch (Exception e) { + log.error('Routing rule {} could not be created: {}', name, e.toString()) + scriptResult.addActionDetails(action, e) + } + } + + void updateRoutingRule(Map routingRuleDef, Map action) { + String name = routingRuleDef.name + + try { + def existingRule = routingRuleStore.list().find { it.name().toLowerCase() == name.toLowerCase() } + + if (isRuleEqual(existingRule, routingRuleDef)) { + log.info('No change routing rule {}', name) + scriptResult.addActionDetails(action, ScriptResult.Status.UNCHANGED) + + } else { + setValues(existingRule, routingRuleDef) + routingRuleStore.update(existingRule) + log.info('Update Routing rule {}', name) + scriptResult.addActionDetails(action, ScriptResult.Status.UPDATED) + } + + } catch (Exception e) { + log.error('Routing rule {} could not be updated: {}', name, e.toString()) + scriptResult.addActionDetails(action, e) + } + } + + void deleteRoutingRule(String name, Map action) { + try { + def existingRule = routingRuleStore.list().find { it.name().toLowerCase() == name.toLowerCase() } + routingRuleStore.delete(existingRule) + log.info('Routing rule {} deleted', name) + scriptResult.addActionDetails(action, ScriptResult.Status.DELETED) + + } catch (Exception e) { + log.error('Routing rule {} could not be deleted: {}', name, e.toString()) + scriptResult.addActionDetails(action, e) + } + } + + String execute() { + Boolean deleteUnknownRoutingRules = (config?.nexus?.deleteUnknownItems?.routingRules) ?: false + List> routingRulesDefs = (config?.routingRules as List>) ?: [] + + // Delete unknown existing rules + if (deleteUnknownRoutingRules) { + routingRuleStore.list().each { existingRule -> + String name = existingRule.name() + Boolean ruleInDef = routingRulesDefs.any { + (it.name as String).toLowerCase() == name.toLowerCase() + } + + if (ruleInDef) { + log.info('Routing rule {} found. Left untouched', name) + } else { + def action = scriptResult.newAction(name: name, mode: existingRule.mode().name()) + deleteRoutingRule(name, action) + } + } + } + + // Create or update rules + routingRulesDefs.each { routingRuleDef -> + String name = routingRuleDef.name + String mode = routingRuleDef.mode + + def action = scriptResult.newAction(name: name, mode: mode) + + Boolean ruleExists = routingRuleStore.list().any { routingRule -> + routingRule.name().toLowerCase() == name.toLowerCase() + } + + if (ruleExists) { + updateRoutingRule(routingRuleDef, action) + } else { + createRoutingRule(routingRuleDef, action) + } + } + + return sendResponse() + } +} + +return new SyncRoutingRules(this).execute() \ No newline at end of file diff --git a/molecule/default-converge.yml b/molecule/default-converge.yml index 955e385b..f61b8266 100644 --- a/molecule/default-converge.yml +++ b/molecule/default-converge.yml @@ -11,6 +11,7 @@ - .nexus-downloads/hosted-result.yml - .nexus-downloads/proxies-result.yml - .nexus-downloads/roles-result.yml + - .nexus-downloads/routing-rules-result.yml environment: http_proxy: "{{ lookup('env', 'http_proxy') }}" diff --git a/molecule/repo-defaults.yml b/molecule/repo-defaults.yml deleted file mode 100644 index 0e0a9d44..00000000 --- a/molecule/repo-defaults.yml +++ /dev/null @@ -1,413 +0,0 @@ -hosted_defaults: - apt: - blob_store: blob-apt - online: true - distribution: dist - keypair: 'none' - passphrase: 'none' - strict_content_validation: true - layout_policy: strict # strict or permissive - write_policy: allow_once # one of "allow", "allow_once" or "deny" - cleanup_policies: - - apt_cleanup - docker: - online: true - blob_store: blob-docker - remote_url: 'https://a.a' - force_basic_auth: true - strict_content_validation: true - allow_redeploy_latest: false - version_policy: release # release, snapshot or mixed - write_policy: allow_once - layout_policy: strict # strict or permissive - http_port: - https_port: - sub_domain: - v1_enabled: false - cleanup_policies: - - docker_cleanup - gitlfs: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-gitlfs - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - gitlfs_cleanup - helm: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-helm - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - helm_cleanup - maven2: - online: true - blob_store: blob-mvn - strict_content_validation: true - version_policy: release # release, snapshot or mixed - layout_policy: strict # strict or permissive - write_policy: allow_once # one of "allow", "allow_once" or "deny" - cleanup_policies: - - mvn_cleanup - npm: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-npm - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - npm_cleanup - nuget: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-nuget - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - nuget_cleanup - pypi: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-pypi - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - python_cleanup - raw: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-raw - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - raw_cleanup - contentDisposition: INLINE - yum: - repositoryName: -repo - recipeName: recipeName, - online: true - blob_store: blob-yum - layout_policy: strict # strict or permissive - write_policy: allow_once # ALLOW_ONCE or ALLOW - strict_content_validation: true - cleanup_policies: - - yum_cleanup - repodataDepth: 1 - deployPolicy: strict # strict or permissive - -proxy_defaults: - maven2: - name: maven-central - format: maven2 - online: true - blocked: false - auto_block: true - blob_store: blob-mvn - strict_content_validation: true - remote: - url: https://repo.maven.apache.org/maven2 - username: '' - password: '' - connection: - retries: 5 - user_agent_suffix: '' - enable_cookies: false - enable_circular_redirects: false - timeout: '' - maximum_component_age: -1 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - version_policy: release - layout_policy: strict - write_policy: allow_once - content_disposition: inline - cleanup_policies: - - mvn_cleanup - docker: - name: maven-central - format: maven2 - online: true - blocked: false - auto_block: true - blob_store: blob-mvn - strict_content_validation: true - force_basic_auth: true - v1_enabled: false - http_port: NaN - sub_domain: '' - remote: - url: https://repo.maven.apache.org/maven2 - username: '' - password: '' - connection: - retries: 5 - user_agent_suffix: '' - enable_cookies: false - enable_circular_redirects: false - timeout: '' - maximum_component_age: -1 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - version_policy: release - layout_policy: strict - write_policy: allow_once - content_disposition: inline - cleanup_policies: - - mvn_cleanup - python: - name: pypi-central - format: pypi - online: true - blocked: false - auto_block: true - remote: - url: https://pypi.org/simple - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - npm: - name: npm-registry - format: npm - online: true - blocked: false - auto_block: true - remote: - url: https://registry.npmjs.org/ - username: - password: - bearerToken: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - nuget: - name: nuget-gallery - format: nuget - online: true - blocked: false - auto_block: true - nuget_version: v3 - remote: - url: https://api.nuget.org/v3/index.json - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - apt: - name: ubuntu-apt - format: apt - online: true - blocked: false - auto_block: true - distribution: bionic - flat: false - remote: - url: http://archive.ubuntu.com/ubuntu/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - helm: - name: helm-proxy - format: helm - online: true - blocked: false - auto_block: true - remote: - url: https://kubernetes-charts.storage.googleapis.com - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - r: - name: r-proxy - format: r - online: true - blocked: false - auto_block: true - remote: - url: https://cran.r-project.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - raw: - name: raw-proxy - format: raw - online: true - blocked: false - auto_block: true - remote: - url: https://www.jfrog.com/ - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - contentDisposition: - conda: - name: conda-proxy - format: conda - online: true - blocked: false - auto_block: true - remote: - url: https://repo.anaconda.com/pkgs/main - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - go: - name: go-proxy - format: go - online: true - blocked: false - auto_block: true - remote: - url: https://proxy.golang.org - username: - password: - connection: - useTrustStore: false - retries: - user_agent_suffix: - enable_cookies: - enable_circular_redirects: - timeout: - maximum_component_age: - maximum_metadata_age: - negative_cache_enabled: - negative_cache_ttl: - cleanup_policies: - - policy-1 - yum: - online: true - blocked: false - auto_block: true - blob_store: blob-yum - remote: - url: http://mirror.centos.org/centos/ - username: '' - password: '' - connection: - retries: 5 - user_agent_suffix: 'cn' - enable_cookies: false - enable_circular_redirects: false - timeout: '' - maximum_component_age: -1 - maximum_metadata_age: 1440 - negative_cache_enabled: true - negative_cache_ttl: 1440 - strict_content_validation: true - version_policy: release - layout_policy: strict - write_policy: allow_once - content_disposition: inline - cleanup_policies: - - policy-1 -group_defaults: - maven: - python: diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index a7fedc71..495353e9 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -1,5 +1,13 @@ --- nexus_delete_default_repos: true + +# routing_rules.yml +nexus_routing_rules_config: + nexus: + deleteUnknownItems: + routingRules: true + # customLocalUsers: false + # defaults file for nexus3-repository-templates teams: - ID: Team1 @@ -26,6 +34,7 @@ teams: proxy: - name: mvn-proxy-repo1 format: maven2 + routing_rule: 'wop' - name: yum-proxy-repo1 format: yum - name: docker-proxy-repo1 @@ -217,6 +226,7 @@ proxy_defaults: layout_policy: strict write_policy: allow_once content_disposition: inline + routing_rule: '' cleanup_policies: - mvn_cleanup docker: @@ -251,6 +261,7 @@ proxy_defaults: cache_foreign_layers: true foreign_layer_url_whitelist: [] sub_domain: + routing_rule: '' cleanup_policies: - docker_cleanup pypi: @@ -277,6 +288,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + routing_rule: '' cleanup_policies: - policy-1 npm: @@ -305,6 +317,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + routing_rule: '' cleanup_policies: - policy-1 nuget: @@ -330,6 +343,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 apt: @@ -356,6 +371,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 helm: @@ -383,6 +400,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + routing_rule: '' cleanup_policies: - policy-1 r: @@ -407,6 +425,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 raw: @@ -432,6 +452,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 content_disposition: inline @@ -457,6 +479,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 go: @@ -481,6 +505,8 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 + write_policy: allow_once # one of "allow", "allow_once" or "deny" + routing_rule: '' cleanup_policies: - policy-1 yum: @@ -507,6 +533,7 @@ proxy_defaults: layout_policy: strict write_policy: allow_once content_disposition: inline + routing_rule: '' cleanup_policies: - policy-1 diff --git a/molecule/roles/nexus3-repository-templates/tasks/main.yml b/molecule/roles/nexus3-repository-templates/tasks/main.yml index 8bbf3e60..6476003a 100644 --- a/molecule/roles/nexus3-repository-templates/tasks/main.yml +++ b/molecule/roles/nexus3-repository-templates/tasks/main.yml @@ -18,3 +18,9 @@ dest: "/nexus-downloads/roles-result.yml" #remote_src: true tags: transform +- name: Transform routing-rules_defaults into nexus_repos + ansible.builtin.template: + src: "routing-rules.yml.j2" + dest: "/nexus-downloads/routing-rules-result.yml" + #remote_src: true + tags: transform diff --git a/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 deleted file mode 100644 index b1dcf56f..00000000 --- a/molecule/roles/nexus3-repository-templates/templates/blobstores.yml.j2 +++ /dev/null @@ -1,14 +0,0 @@ ---- -nexus_blobstores: - - name: dockerhub-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/dockerhub-blob - - name: proxy-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/proxy-blob -{% for item in docker_repo_teams | selectattr("repo", "equalto", "true") %} - - name: {{ item.team }}-blob - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }}-blob -{% endfor %} -{% for item in docker_repo_teams | selectattr("gitlfs", "equalto", "true") %} - - name: {{ item.team }} - path: {{ nexus_nfs_mount_path }}/sonatype-work/nexus3/blobs/{{ item.team }} -{% endfor %} diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index 3064876d..b58ab813 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -14,7 +14,7 @@ nexus_repos_{{ key }}_proxy: online: {{ team_proxy_repo.online if team_proxy_repo.online is defined else value.online }} blob_store: {{ team_proxy_repo.blob_store if team_proxy_repo.blob_store is defined else value.blob_store }} layout_policy: {{ team_proxy_repo.layout_policy if team_proxy_repo.layout_policy is defined else value.layout_policy }} -{# write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} #} + write_policy: {{ team_proxy_repo.write_policy if team_proxy_repo.write_policy is defined else value.write_policy }} blocked: {{ team_proxy_repo.blocked if team_proxy_repo.blocked is defined else value.blocked }} auto_block: {{ team_proxy_repo.auto_block if team_proxy_repo.auto_block is defined else value.auto_block }} remote: @@ -31,6 +31,7 @@ nexus_repos_{{ key }}_proxy: maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} + routing_rule: {{ team_proxy_repo.routing_rule if team_proxy_repo.routing_rule is defined else value.routing_rule }} cleanup_policies: {% if team.policy is defined %} {% for policy in team.cleanup_policies %} diff --git a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 index af113f34..451bab6e 100644 --- a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 @@ -1,12 +1,12 @@ --- nexus_routing_rules: routingRules: -{% for item in proxy_repos %} -{% if item.routing is defined %} - - name: {{ item.routing.publisher }} - description: Restrict only to {{ item.routing.publisher }} images +{% for item in nexus_repos_maven_proxy %} +{% if item.routing_rule is defined and item.routing_rule != None %} + - name: {{ item.name }}-routing-rule + description: Restrict only to {{ item.name }} images mode: Allow - matchers: {{ item.routing.matchers }} - proxyname: docker-{{ item.proxyname }} + matchers: {{ item.routing_rule }} + proxyname: {{ item.name }} {% endif %} {% endfor %} diff --git a/molecule/teams.yml b/molecule/teams.yml deleted file mode 100644 index 49649ee6..00000000 --- a/molecule/teams.yml +++ /dev/null @@ -1,46 +0,0 @@ -teams: - - ID: 1 - name: Team 1 - repos: - requestedBy: - hosted: - - name: maven-repo1 - format: maven2 - - name: maven-repo2 - format: maven2 - - name: python-repo1 - format: pypi - - name: npm-repo1 - format: npm - - name: apt-repo1 - format: apt - - name: docker-repo1 - format: docker - - name: helm-repo1 - format: helm - - name: raw-repo1 - format: raw - proxy: - - name: mvn-proxy-repo1 - format: maven2 - - name: yum-proxy-repo1 - format: yum - # - name: docker-proxy-repo1 - # format: docker - group: - - name: group-repo-1 - members: - - maven-repo2 - - npm-repo1 - - name: group-repo-2 - members: - - maven-repo2 - - npm-repo1 - sharedAccessTo: - hosted: - - name: maven-repo1 - proxy: - - name: proxy_defaults.maven_defaults - group: [] - -proxy_repos: diff --git a/tasks/main.yml b/tasks/main.yml index e42b6d1a..a2cc0267 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -302,3 +302,6 @@ ansible.builtin.include_tasks: migrate_database.yml tags: nexus-migrate, nexus-healthcheck when: nexus_migrate_database | default(false) | bool + +- name: Create routing rules for proxy repositories + include_tasks: routing_rules.yml diff --git a/tasks/routing_rules.yml b/tasks/routing_rules.yml new file mode 100644 index 00000000..3c006909 --- /dev/null +++ b/tasks/routing_rules.yml @@ -0,0 +1,31 @@ +--- +- name: Show the combined dictionary for routing rules configuration + debug: + msg: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" + +- name: Declare new or changed groovy scripts in Nexus + include_tasks: declare_script_each.yml + loop: + - ScriptBaseClass + - syncRoutingRules + - syncReposWithRoutingRules + +- name: Calling Groovy script {{ script_name }} + uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}\ + {{ nexus_api_context_path }}{{ nexus_rest_api_endpoint }}/{{ script_name }}/run" + user: 'admin' + password: "{{ current_nexus_admin_password }}" + headers: + Content-Type: "text/plain" + method: POST + force_basic_auth: yes + validate_certs: "{{ nexus_api_validate_certs }}" + body: "{{ args | to_json }}" + vars: + script_name: "{{ item.script }}" + args: "{{ item.args }}" + loop: + - { script: ScriptBaseClass, args: "" } + - { script: syncRoutingRules, args: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" } + - { script: syncReposWithRoutingRules, args: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" } \ No newline at end of file From 091762b59a4aee9913c786ecb04519944b558160 Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 13 Jun 2024 16:12:21 +0200 Subject: [PATCH 18/23] Use nexus API for creating routing rules --- files/groovy/ScriptBaseClass.groovy | 93 ------------- files/groovy/syncReposWithRoutingRules.groovy | 102 -------------- files/groovy/syncRoutingRules.groovy | 129 ------------------ tasks/main.yml | 8 +- tasks/routing_rules.yml | 55 ++++---- 5 files changed, 33 insertions(+), 354 deletions(-) delete mode 100644 files/groovy/ScriptBaseClass.groovy delete mode 100644 files/groovy/syncReposWithRoutingRules.groovy delete mode 100644 files/groovy/syncRoutingRules.groovy diff --git a/files/groovy/ScriptBaseClass.groovy b/files/groovy/ScriptBaseClass.groovy deleted file mode 100644 index 2580735b..00000000 --- a/files/groovy/ScriptBaseClass.groovy +++ /dev/null @@ -1,93 +0,0 @@ -import groovy.json.JsonOutput -import groovy.json.JsonSlurper -import org.slf4j.Logger -import org.sonatype.nexus.BlobStoreApi -import org.sonatype.nexus.CoreApi -import org.sonatype.nexus.common.app.GlobalComponentLookupHelper -import org.sonatype.nexus.script.plugin.RepositoryApi -import org.sonatype.nexus.security.SecurityApi - -abstract class ScriptBaseClass { - - protected final Logger log - protected final SecurityApi security - protected final CoreApi core - protected final RepositoryApi repository - protected final BlobStoreApi blobStore - protected final GlobalComponentLookupHelper container - protected final Map config - protected final ScriptResult scriptResult - - ScriptBaseClass(context) { - log = context.log - security = context.security - core = context.core - repository = context.repository - blobStore = context.blobStore - container = context.container - scriptResult = new ScriptResult(false, false) - config = new JsonSlurper().parseText(context.args as String) as Map - } - - String sendResponse() { - return JsonOutput.toJson(scriptResult) - } - - abstract String execute() - - class ScriptResult implements Serializable { - Boolean changed - Boolean error - List> actionDetails - - ScriptResult(changed, error) { - this.changed = changed - this.error = error - actionDetails = new ArrayList<>() - } - - void hasChanged() { - this.changed = true - } - - void hasError() { - this.error = true - } - - Map newAction(Map initValues = [:]) { - return new HashMap(initValues) - } - - void addActionDetails(Map action, Throwable error) { - action.put('errorMsg', error.toString()) - hasError() - addActionDetails(action, Status.ERROR) - } - - void addActionDetails(Map action, Status status) { - action.put('status', status.toString().toLowerCase()) - - if (status.isChanged) { - hasChanged() - } - - actionDetails.add(action) - } - - enum Status implements Serializable { - CREATED(true), - CHANGED(true), - UPDATED(true), - DELETED(true), - UNCHANGED(false), - FORBIDDEN(false), - ERROR(false) - - protected Boolean isChanged - - Status(Boolean isChanged) { - this.isChanged = isChanged - } - } - } -} \ No newline at end of file diff --git a/files/groovy/syncReposWithRoutingRules.groovy b/files/groovy/syncReposWithRoutingRules.groovy deleted file mode 100644 index 4ea21efd..00000000 --- a/files/groovy/syncReposWithRoutingRules.groovy +++ /dev/null @@ -1,102 +0,0 @@ -import org.sonatype.nexus.repository.Repository -import org.sonatype.nexus.repository.config.Configuration -import org.sonatype.nexus.repository.manager.RepositoryManager -import org.sonatype.nexus.repository.routing.RoutingRuleStore - -class SyncRepositories extends ScriptBaseClass { - - SyncRepositories(context) { - super(context) - } - - @SuppressWarnings('GrMethodMayBeStatic') - Boolean findRepositoryInConfig(Repository repo, List> repositories) { - return repositories.any { repoConfig -> - return repo.getType().getValue() == (repoConfig.type as String) && - repo.getFormat().getValue() == (repoConfig.format as String) && - repo.getName() == (repoConfig.name as String) - } - } - - Configuration newConfiguration(Map map) { - RepositoryManager repositoryManager = repository.getRepositoryManager() - Configuration config - - try { - config = repositoryManager.newConfiguration() - } catch (ignored) { - // Compatibility with nexus versions older than 3.21 - config = Configuration.newInstance() - } - - config.with { - repositoryName = map.repositoryName - recipeName = map.recipeName - online = Boolean.parseBoolean(map.online as String) - attributes = map.attributes as Map - } - - return config - } - - @SuppressWarnings('GrMethodMayBeStatic') - boolean configurationEquals(Configuration currentConfig, Configuration configDef) { - if (currentConfig.attributes.httpclient) { - if (currentConfig.attributes.httpclient.authentication == [:]) { - currentConfig.attributes.httpclient.authentication = null - } - if (currentConfig.attributes.httpclient.connection == [:]) { - currentConfig.attributes.httpclient.connection = null - } - if (currentConfig.attributes.httpclient == [:]) { - currentConfig.attributes.httpclient = null - } - } - - if (currentConfig.attributes.maven == [:]) { - currentConfig.attributes.remove('maven') - } - - return currentConfig.properties == configDef.properties - } - - void createOrUpdateRepositories(List> repos) { - RepositoryManager repositoryManager = repository.getRepositoryManager() - - repos.each { repoDef -> - String name = repoDef.proxyname - Configuration configuration - def action = scriptResult.newAction(name: name) - Repository existingRepo = repositoryManager.get(name) - - try { - log.info('Loading configuration for existing repo {})', name) - // Load existing repository configuration - configuration = existingRepo.getConfiguration().copy() - - configuration.routingRuleId = container.lookup(RoutingRuleStore) - .getByName(repoDef.name as String)?.id() - - if (!configurationEquals(existingRepo.configuration, configuration)) { - repositoryManager.update(configuration) - log.info('Configuration for repo {} updated', name) - scriptResult.addActionDetails(action, ScriptResult.Status.UPDATED) - } else { - log.info('Configuration for repo {} not changed', name) - scriptResult.addActionDetails(action, ScriptResult.Status.UNCHANGED) - } - } catch (Exception e) { - log.error('Configuration for repo {} could not be saved: {}', name, e.toString()) - scriptResult.addActionDetails(action, e) - } - } - } - - String execute() { - List> reposDefs = (config?.routingRules as List>) ?: [] - createOrUpdateRepositories(reposDefs) - return sendResponse() - } -} - -return new SyncRepositories(this).execute() \ No newline at end of file diff --git a/files/groovy/syncRoutingRules.groovy b/files/groovy/syncRoutingRules.groovy deleted file mode 100644 index 754a9d23..00000000 --- a/files/groovy/syncRoutingRules.groovy +++ /dev/null @@ -1,129 +0,0 @@ -import org.sonatype.nexus.repository.routing.RoutingMode -import org.sonatype.nexus.repository.routing.RoutingRule -import org.sonatype.nexus.repository.routing.RoutingRuleStore - -class SyncRoutingRules extends ScriptBaseClass { - - private final RoutingRuleStore routingRuleStore - - SyncRoutingRules(context) { - super(context) - this.routingRuleStore = context.container.lookup(RoutingRuleStore) - } - - @SuppressWarnings('GrMethodMayBeStatic') - Boolean isRuleEqual(RoutingRule existingRule, Map ruleDef) { - Boolean equals = true - - equals &= existingRule.name() == ruleDef.name - equals &= existingRule.description() == ruleDef.description - equals &= existingRule.mode() == (ruleDef.mode as String).toUpperCase() as RoutingMode - equals &= existingRule.matchers() == ruleDef.matchers as List - - return equals - } - - @SuppressWarnings('GrMethodMayBeStatic') - void setValues(RoutingRule currentRule, Map ruleDef) { - currentRule.name(ruleDef.name as String) - currentRule.description(ruleDef.description as String ?: '') - currentRule.mode((ruleDef.mode as String).toUpperCase() as RoutingMode) - currentRule.matchers(ruleDef.matchers as List) - } - - void createRoutingRule(Map ruleDef, Map action) { - String name = ruleDef.name - - try { - def newRoutingRule = routingRuleStore.newRoutingRule() - setValues(newRoutingRule, ruleDef) - routingRuleStore.create(newRoutingRule) - log.info('Routing rule {} created', name) - scriptResult.addActionDetails(action, ScriptResult.Status.CREATED) - - } catch (Exception e) { - log.error('Routing rule {} could not be created: {}', name, e.toString()) - scriptResult.addActionDetails(action, e) - } - } - - void updateRoutingRule(Map routingRuleDef, Map action) { - String name = routingRuleDef.name - - try { - def existingRule = routingRuleStore.list().find { it.name().toLowerCase() == name.toLowerCase() } - - if (isRuleEqual(existingRule, routingRuleDef)) { - log.info('No change routing rule {}', name) - scriptResult.addActionDetails(action, ScriptResult.Status.UNCHANGED) - - } else { - setValues(existingRule, routingRuleDef) - routingRuleStore.update(existingRule) - log.info('Update Routing rule {}', name) - scriptResult.addActionDetails(action, ScriptResult.Status.UPDATED) - } - - } catch (Exception e) { - log.error('Routing rule {} could not be updated: {}', name, e.toString()) - scriptResult.addActionDetails(action, e) - } - } - - void deleteRoutingRule(String name, Map action) { - try { - def existingRule = routingRuleStore.list().find { it.name().toLowerCase() == name.toLowerCase() } - routingRuleStore.delete(existingRule) - log.info('Routing rule {} deleted', name) - scriptResult.addActionDetails(action, ScriptResult.Status.DELETED) - - } catch (Exception e) { - log.error('Routing rule {} could not be deleted: {}', name, e.toString()) - scriptResult.addActionDetails(action, e) - } - } - - String execute() { - Boolean deleteUnknownRoutingRules = (config?.nexus?.deleteUnknownItems?.routingRules) ?: false - List> routingRulesDefs = (config?.routingRules as List>) ?: [] - - // Delete unknown existing rules - if (deleteUnknownRoutingRules) { - routingRuleStore.list().each { existingRule -> - String name = existingRule.name() - Boolean ruleInDef = routingRulesDefs.any { - (it.name as String).toLowerCase() == name.toLowerCase() - } - - if (ruleInDef) { - log.info('Routing rule {} found. Left untouched', name) - } else { - def action = scriptResult.newAction(name: name, mode: existingRule.mode().name()) - deleteRoutingRule(name, action) - } - } - } - - // Create or update rules - routingRulesDefs.each { routingRuleDef -> - String name = routingRuleDef.name - String mode = routingRuleDef.mode - - def action = scriptResult.newAction(name: name, mode: mode) - - Boolean ruleExists = routingRuleStore.list().any { routingRule -> - routingRule.name().toLowerCase() == name.toLowerCase() - } - - if (ruleExists) { - updateRoutingRule(routingRuleDef, action) - } else { - createRoutingRule(routingRuleDef, action) - } - } - - return sendResponse() - } -} - -return new SyncRoutingRules(this).execute() \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml index 6397dd5e..ac03e788 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -152,6 +152,11 @@ when: nexus_repos_cleanup_policies | length > 0 tags: cleanup + - name: Create/Update routing rules using API + ansible.builtin.include_tasks: routing_rules.yml + vars: + api_payload: "{{ nexus_routing_rules | d([]) }}" + - name: Apply defaults to repositories configurations and process a single list ansible.builtin.include_tasks: process_repos_list.yml vars: @@ -389,6 +394,3 @@ ansible.builtin.include_tasks: migrate_database.yml tags: nexus-migrate, nexus-healthcheck when: nexus_migrate_database | default(false) | bool - -- name: Create routing rules for proxy repositories - include_tasks: routing_rules.yml \ No newline at end of file diff --git a/tasks/routing_rules.yml b/tasks/routing_rules.yml index 3c006909..dd2955c7 100644 --- a/tasks/routing_rules.yml +++ b/tasks/routing_rules.yml @@ -1,31 +1,32 @@ --- -- name: Show the combined dictionary for routing rules configuration - debug: - msg: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" - -- name: Declare new or changed groovy scripts in Nexus - include_tasks: declare_script_each.yml - loop: - - ScriptBaseClass - - syncRoutingRules - - syncReposWithRoutingRules - -- name: Calling Groovy script {{ script_name }} - uri: - url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}\ - {{ nexus_api_context_path }}{{ nexus_rest_api_endpoint }}/{{ script_name }}/run" - user: 'admin' +- name: Create Routing rules + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules" + user: admin password: "{{ current_nexus_admin_password }}" - headers: - Content-Type: "text/plain" method: POST - force_basic_auth: yes + force_basic_auth: true validate_certs: "{{ nexus_api_validate_certs }}" - body: "{{ args | to_json }}" - vars: - script_name: "{{ item.script }}" - args: "{{ item.args }}" - loop: - - { script: ScriptBaseClass, args: "" } - - { script: syncRoutingRules, args: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" } - - { script: syncReposWithRoutingRules, args: "{{ nexus_routing_rules_config | combine (nexus_routing_rules) }}" } \ No newline at end of file + body_format: json + body: "{{ routing_rules }}" + status_code: 204 + loop: "{{ api_payload }}" + loop_control: + loop_var: routing_rules + # when: repo.name not in __nexus_existing_repos__.json | map(attribute='name') | list + +# - name: Update repositories when repository exists +# ansible.builtin.uri: +# url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/repositories/{{ repo.format }}/{{ repo.type}}/{{ repo.name }}" +# user: admin +# password: "{{ current_nexus_admin_password }}" +# method: PUT +# force_basic_auth: true +# validate_certs: "{{ nexus_api_validate_certs }}" +# body_format: json +# body: "{{ repo }}" +# status_code: 204 +# loop: "{{ api_payload }}" +# loop_control: +# loop_var: repo + # when: repo.name in __nexus_existing_repos__.json | map(attribute='name') | list \ No newline at end of file From 0f57cce885cc665ae8af4bdf9b494d8f326f5ff4 Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 13 Jun 2024 16:13:00 +0200 Subject: [PATCH 19/23] Use routing rule matchers --- .../defaults/main.yml | 38 +++++++++---------- .../templates/proxies.yml.j2 | 2 +- .../templates/routing-rules.yml.j2 | 9 +++-- 3 files changed, 25 insertions(+), 24 deletions(-) diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index 495353e9..36b386d4 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -1,8 +1,8 @@ --- nexus_delete_default_repos: true -# routing_rules.yml -nexus_routing_rules_config: +# routing_rule_matchers.yml +nexus_routing_rule_matchers_config: nexus: deleteUnknownItems: routingRules: true @@ -34,7 +34,7 @@ teams: proxy: - name: mvn-proxy-repo1 format: maven2 - routing_rule: 'wop' + routing_rule_matcher: wop - name: yum-proxy-repo1 format: yum - name: docker-proxy-repo1 @@ -60,7 +60,7 @@ teams: - npm-proxy-repo1 - npm-repo1 sharedAccessTo: - hosted: + hosted: - name: raw-repo1 teams: [Team2] proxy: @@ -76,7 +76,7 @@ teams: format: maven2 - name: python-repo-team2 format: pypi - proxy: + proxy: - name: python-proxy-team2 format: pypi group: [] @@ -84,7 +84,7 @@ teams: hosted: - name: maven-repo-team2 teams: [Team1] - proxy: + proxy: - name: python-proxy-team2 teams: [Team1] group: [] @@ -226,7 +226,7 @@ proxy_defaults: layout_policy: strict write_policy: allow_once content_disposition: inline - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - mvn_cleanup docker: @@ -261,7 +261,7 @@ proxy_defaults: cache_foreign_layers: true foreign_layer_url_whitelist: [] sub_domain: - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - docker_cleanup pypi: @@ -288,7 +288,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 npm: @@ -317,7 +317,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 nuget: @@ -344,7 +344,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 apt: @@ -372,7 +372,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 helm: @@ -400,7 +400,7 @@ proxy_defaults: maximum_metadata_age: 1440 negative_cache_enabled: True negative_cache_ttl: 1440 - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 r: @@ -426,7 +426,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 raw: @@ -453,7 +453,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 content_disposition: inline @@ -480,7 +480,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 go: @@ -506,7 +506,7 @@ proxy_defaults: negative_cache_enabled: True negative_cache_ttl: 1440 write_policy: allow_once # one of "allow", "allow_once" or "deny" - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 yum: @@ -533,10 +533,10 @@ proxy_defaults: layout_policy: strict write_policy: allow_once content_disposition: inline - routing_rule: '' + routing_rule_matcher: '' cleanup_policies: - policy-1 - + group_defaults: maven: python: diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index b58ab813..f4c27647 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -31,7 +31,7 @@ nexus_repos_{{ key }}_proxy: maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} - routing_rule: {{ team_proxy_repo.routing_rule if team_proxy_repo.routing_rule is defined else value.routing_rule }} + routing_rule_matcher: {{ team_proxy_repo.routing_rule_matcher if team_proxy_repo.routing_rule_matcher is defined else value.routing_rule_matcher }} cleanup_policies: {% if team.policy is defined %} {% for policy in team.cleanup_policies %} diff --git a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 index 451bab6e..2257faaf 100644 --- a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 @@ -1,12 +1,13 @@ --- nexus_routing_rules: - routingRules: {% for item in nexus_repos_maven_proxy %} -{% if item.routing_rule is defined and item.routing_rule != None %} +{% if item.routing_rule_matcher is defined and item.routing_rule_matcher != None %} - name: {{ item.name }}-routing-rule description: Restrict only to {{ item.name }} images mode: Allow - matchers: {{ item.routing_rule }} - proxyname: {{ item.name }} + matchers: +{% for matcher in item.routing_rule_matcher %} + - {{ matcher }} +{% endfor %} {% endif %} {% endfor %} From b2a08315803acf088150305dc49650ae6d6da30d Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 13 Jun 2024 16:13:26 +0200 Subject: [PATCH 20/23] Bug fix: dont run postgres tasks when not using pro --- tasks/nexus_install.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tasks/nexus_install.yml b/tasks/nexus_install.yml index 57da7752..44f24350 100644 --- a/tasks/nexus_install.yml +++ b/tasks/nexus_install.yml @@ -471,6 +471,7 @@ - name: Config Postgres ansible.builtin.include_tasks: enable_postgres.yml + when: nexus_enable_pro_version | default(false) | bool tags: nexus-postgres - name: Enable nexus systemd service and make sure it is started From 79422e2f121e9f58aa3efe893f589c4456b334a3 Mon Sep 17 00:00:00 2001 From: Brian Veltman <2551674+brianveltman@users.noreply.github.com> Date: Thu, 13 Jun 2024 16:13:39 +0200 Subject: [PATCH 21/23] Cleanup test data --- defaults/main.yml | 19 +----- molecule/nexus_common_test_vars.yml | 97 +++++++++++++++-------------- 2 files changed, 52 insertions(+), 64 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 4badd0bd..14d66fc0 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -450,11 +450,7 @@ nexus_repos_pypi_hosted: version_policy: release write_policy: allow # one of "allow", "allow_once" or "deny" -nexus_repos_pypi_group: - - name: pypi-all - member_repos: - - pypi-internal - - pypi +nexus_repos_pypi_group: [] nexus_repos_pypi_proxy: - name: pypi @@ -490,11 +486,7 @@ nexus_repos_raw_hosted: version_policy: release write_policy: allow_once # one of "allow", "allow_once" or "deny" -nexus_repos_raw_group: - - name: raw-all - member_repos: - - raw-internal - - ubuntu-archive +nexus_repos_raw_group: [] # Docker support _nexus_repos_docker_defaults: @@ -645,12 +637,7 @@ nexus_repos_nuget_hosted: - name: nuget-internal blob_store: "{{ nexus_blob_names.nuget.blob }}" -nexus_repos_nuget_group: - - name: nuget-all - blob_store: "{{ nexus_blob_names.nuget.blob }}" - member_repos: - - nuget-internal - - nuget-proxy +nexus_repos_nuget_group: [] nexus_repos_nuget_proxy: - name: nuget-proxy diff --git a/molecule/nexus_common_test_vars.yml b/molecule/nexus_common_test_vars.yml index 813e0528..bc49ecd6 100644 --- a/molecule/nexus_common_test_vars.yml +++ b/molecule/nexus_common_test_vars.yml @@ -5,6 +5,7 @@ httpd_ssl_cert_file_location: "{{ default_cert }}" httpd_ssl_cert_key_location: "{{ default_key }}" nexus_public_hostname: localhost nexus_api_timeout: 45 +nexus_use_api_for_provisioning: true nexus_transform: true @@ -242,22 +243,22 @@ nexus_repos_maven_hosted: cleanup_policies: - mvn_cleanup -nexus_repos_maven_group: - - name: public-mixed-permissive - member_repos: - - private-release-cleanup-mvn-cleanup - - jcenter-api - layout_policy: permissive - version_policy: mixed - - - name: public-offline-mixed-permissive - online: false - member_repos: - - private-release-cleanup-mvn-cleanup - - jcenter-api - - jboss-api-blob-default - layout_policy: permissive - version_policy: mixed +nexus_repos_maven_group: [] + # - name: public-mixed-permissive + # member_repos: + # - private-release-cleanup-mvn-cleanup + # - jcenter-api + # layout_policy: permissive + # version_policy: mixed + + # - name: public-offline-mixed-permissive + # online: false + # member_repos: + # - private-release-cleanup-mvn-cleanup + # - jcenter-api + # - jboss-api-blob-default + # layout_policy: permissive + # version_policy: mixed nexus_repos_npm_hosted: - name: npm-registry-hosted @@ -272,12 +273,12 @@ nexus_repos_npm_hosted: write_policy: deny blocked: true auto_block: false -nexus_repos_npm_group: - - name: npm-public - member_repos: - - npm-registry - - npm-registry-blocked - - npm-registry-hosted +nexus_repos_npm_group: [] + # - name: npm-public + # member_repos: + # - npm-registry + # - npm-registry-blocked + # - npm-registry-hosted nexus_repos_npm_proxy: - name: npm-registry remote_url: https://registry.npmjs.org/ @@ -307,11 +308,11 @@ nexus_repos_yum_proxy: negative_cache_ttl: 60 enable_circular_redirects: true enable_cookies: true -nexus_repos_yum_group: - - name: yum_all - member_repos: - - private_yum_centos_7 - - epel_centos_7_x86_64 +nexus_repos_yum_group: [] + # - name: yum_all + # member_repos: + # - private_yum_centos_7 + # - epel_centos_7_x86_64 # nexus_repos_yum_hosted: # - name: private_yum_centos_7 @@ -340,11 +341,11 @@ nexus_repos_docker_proxy: v1_enabled: true write_policy: allow -nexus_repos_docker_group: - - name: docker-all - member_repos: - - docker-private - - docker-hub +nexus_repos_docker_group: [] + # - name: docker-all + # member_repos: + # - docker-private + # - docker-hub nexus_repos_pypi_proxy: - name: pypi-proxy remote_url: https://pypi.python.org/simple/ @@ -358,11 +359,11 @@ nexus_repos_pypi_hosted: force_basic_auth: true v1_enabled: true write_policy: allow -nexus_repos_pypi_group: - - name: pypi-all - member_repos: - - pypi-hosted - - pypi-proxy +# nexus_repos_pypi_group: +# - name: pypi-all +# member_repos: +# - pypi-hosted +# - pypi-proxy nexus_repos_apt_hosted: - name: private_apt distribution: all @@ -477,11 +478,11 @@ nexus_repos_raw_hosted: - name: raw-hosted write_policy: allow -nexus_repos_raw_group: - - name: raw-all - member_repos: - - raw-hosted - - raw-proxy +# nexus_repos_raw_group: +# - name: raw-all +# member_repos: +# - raw-hosted +# - raw-proxy nexus_repos_rubygems_proxy: - name: rubygems-proxy @@ -553,12 +554,12 @@ nexus_repos_nuget_hosted: - name: nuget-internal blob_store: "{{ nexus_blob_names.nuget.blob }}" -nexus_repos_nuget_group: - - name: nuget-all - blob_store: "{{ nexus_blob_names.nuget.blob }}" - member_repos: - - nuget-internal - - nuget-proxy-with-version +# nexus_repos_nuget_group: +# - name: nuget-all +# blob_store: "{{ nexus_blob_names.nuget.blob }}" +# member_repos: +# - nuget-internal +# - nuget-proxy-with-version # nexus_repos_nuget_group: # - name: nuget-all From 2b6fa2517d5f95e44cf918a1df893a0bd9ceb5a6 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Fri, 14 Jun 2024 09:56:37 +0000 Subject: [PATCH 22/23] Creating routing rules with api Syncing repo with routing rule with api --- .../templates/proxies.yml.j2 | 1 + tasks/main.yml | 16 ++++++++++ tasks/routing_rules.yml | 32 +++++++++---------- 3 files changed, 33 insertions(+), 16 deletions(-) diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index f4c27647..8bab6e31 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -31,6 +31,7 @@ nexus_repos_{{ key }}_proxy: maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} + routing_rule: {{ team_proxy_repo.name }}-routing-rule routing_rule_matcher: {{ team_proxy_repo.routing_rule_matcher if team_proxy_repo.routing_rule_matcher is defined else value.routing_rule_matcher }} cleanup_policies: {% if team.policy is defined %} diff --git a/tasks/main.yml b/tasks/main.yml index ac03e788..30c3e451 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -151,11 +151,27 @@ call_args: "{{ nexus_repos_cleanup_policies }}" when: nexus_repos_cleanup_policies | length > 0 tags: cleanup + + - name: Get all existing routing rules + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules" + user: admin + password: "{{ current_nexus_admin_password }}" + method: GET + force_basic_auth: true + validate_certs: "{{ nexus_api_validate_certs }}" + body_format: json + return_content: yes + status_code: 200 + register: __nexus_existing_routing_rules__ + tags: repos + when: nexus_use_api_for_provisioning | default(false) | bool - name: Create/Update routing rules using API ansible.builtin.include_tasks: routing_rules.yml vars: api_payload: "{{ nexus_routing_rules | d([]) }}" + tags: repos - name: Apply defaults to repositories configurations and process a single list ansible.builtin.include_tasks: process_repos_list.yml diff --git a/tasks/routing_rules.yml b/tasks/routing_rules.yml index dd2955c7..1c7c5394 100644 --- a/tasks/routing_rules.yml +++ b/tasks/routing_rules.yml @@ -13,20 +13,20 @@ loop: "{{ api_payload }}" loop_control: loop_var: routing_rules - # when: repo.name not in __nexus_existing_repos__.json | map(attribute='name') | list + when: routing_rules.name not in __nexus_existing_routing_rules__.json | map(attribute='name') | list -# - name: Update repositories when repository exists -# ansible.builtin.uri: -# url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/repositories/{{ repo.format }}/{{ repo.type}}/{{ repo.name }}" -# user: admin -# password: "{{ current_nexus_admin_password }}" -# method: PUT -# force_basic_auth: true -# validate_certs: "{{ nexus_api_validate_certs }}" -# body_format: json -# body: "{{ repo }}" -# status_code: 204 -# loop: "{{ api_payload }}" -# loop_control: -# loop_var: repo - # when: repo.name in __nexus_existing_repos__.json | map(attribute='name') | list \ No newline at end of file +- name: Update Routing rules when Routing rules exists + ansible.builtin.uri: + url: "{{ nexus_api_scheme }}://{{ nexus_api_hostname }}:{{ nexus_api_port }}{{ nexus_api_context_path }}service/rest/v1/routing-rules/{{ routing_rules.name }}" + user: admin + password: "{{ current_nexus_admin_password }}" + method: PUT + force_basic_auth: true + validate_certs: "{{ nexus_api_validate_certs }}" + body_format: json + body: "{{ routing_rules }}" + status_code: 204 + loop: "{{ api_payload }}" + loop_control: + loop_var: routing_rules + when: routing_rules.name in __nexus_existing_routing_rules__.json | map(attribute='name') | list \ No newline at end of file From 1ce42b265ed1f883d7da16a6b167754ffc182d80 Mon Sep 17 00:00:00 2001 From: Ruben Wesselink Date: Fri, 14 Jun 2024 11:37:58 +0000 Subject: [PATCH 23/23] cleanup and added more testdata if routing_rule_matcher isnt set, don't set routing_rule routing rules use all proxy lists now. --- .../nexus3-repository-templates/defaults/main.yml | 13 +++++-------- .../templates/proxies.yml.j2 | 2 +- .../templates/routing-rules.yml.j2 | 9 ++++++++- 3 files changed, 14 insertions(+), 10 deletions(-) diff --git a/molecule/roles/nexus3-repository-templates/defaults/main.yml b/molecule/roles/nexus3-repository-templates/defaults/main.yml index 36b386d4..920a991c 100644 --- a/molecule/roles/nexus3-repository-templates/defaults/main.yml +++ b/molecule/roles/nexus3-repository-templates/defaults/main.yml @@ -1,13 +1,6 @@ --- nexus_delete_default_repos: true -# routing_rule_matchers.yml -nexus_routing_rule_matchers_config: - nexus: - deleteUnknownItems: - routingRules: true - # customLocalUsers: false - # defaults file for nexus3-repository-templates teams: - ID: Team1 @@ -34,9 +27,13 @@ teams: proxy: - name: mvn-proxy-repo1 format: maven2 - routing_rule_matcher: wop + routing_rule_matcher: test + - name: mvn-proxy-team1 + format: maven2 + routing_rule_matcher: alleenimages - name: yum-proxy-repo1 format: yum + routing_rule_matcher: yumtest - name: docker-proxy-repo1 format: docker - name: raw-proxy-repo1 diff --git a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 index 8bab6e31..421f5f40 100644 --- a/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/proxies.yml.j2 @@ -31,7 +31,7 @@ nexus_repos_{{ key }}_proxy: maximum_metadata_age: {{ team_proxy_repo.maximum_metadata_age if team_proxy_repo.maximum_metadata_age is defined else value.maximum_metadata_age }} negative_cache_enabled: {{ team_proxy_repo.negative_cache_enabled if team_proxy_repo.negative_cache_enabled is defined else value.negative_cache_enabled }} negative_cache_ttl: {{ team_proxy_repo.negative_cache_ttl if team_proxy_repo.negative_cache_ttl is defined else value.negative_cache_ttl }} - routing_rule: {{ team_proxy_repo.name }}-routing-rule + routing_rule: {{ team_proxy_repo.name+'-routing-rule' if team_proxy_repo.routing_rule_matcher is defined | default(omit) }} routing_rule_matcher: {{ team_proxy_repo.routing_rule_matcher if team_proxy_repo.routing_rule_matcher is defined else value.routing_rule_matcher }} cleanup_policies: {% if team.policy is defined %} diff --git a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 index 2257faaf..14798110 100644 --- a/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 +++ b/molecule/roles/nexus3-repository-templates/templates/routing-rules.yml.j2 @@ -1,6 +1,13 @@ --- nexus_routing_rules: -{% for item in nexus_repos_maven_proxy %} +{% set nexus_combined_repos_proxy = nexus_repos_maven_proxy + + nexus_repos_yum_proxy + + nexus_repos_npm_proxy + + nexus_repos_docker_proxy + + nexus_repos_pypi_proxy + + nexus_repos_helm_proxy + + nexus_repos_raw_proxy %} +{% for item in nexus_combined_repos_proxy%} {% if item.routing_rule_matcher is defined and item.routing_rule_matcher != None %} - name: {{ item.name }}-routing-rule description: Restrict only to {{ item.name }} images