moves secrets from the `docker-compose.yml` file to the `.env` file.

diff --git a/cookbooks/concourse-ci/.rubocop.yml b/cookbooks/concourse-ci/.rubocop.yml
index 4e84d82..40056ac 100644 (file)
--- a/cookbooks/concourse-ci/.rubocop.yml
+++ b/cookbooks/concourse-ci/.rubocop.yml
@@ -43,5 +43,5 @@ Style/WordArray:
 #  Enabled: false
 #Style/MultilineOperationIndentation:
 #  Enabled: false
-#Style/PerlBackrefs:
-#  Enabled: false
+Style/PerlBackrefs:
+  Enabled: false

diff --git a/cookbooks/concourse-ci/CHANGELOG.md b/cookbooks/concourse-ci/CHANGELOG.md
index 21b7ab6..a5c7850 100644 (file)
--- a/cookbooks/concourse-ci/CHANGELOG.md
+++ b/cookbooks/concourse-ci/CHANGELOG.md
@@ -1,6 +1,10 @@
 concourse-ci CHANGELOG
 ======================
 
+0.1.3
+-----
+- moves secrets from the `docker-compose.yml` file to the `.env` file.
+
 0.1.2
 -----
 - ensures Kernel user namespace activation.

diff --git a/cookbooks/concourse-ci/attributes/default.rb b/cookbooks/concourse-ci/attributes/default.rb
index f6f17e1..c2c4f13 100644 (file)
--- a/cookbooks/concourse-ci/attributes/default.rb
+++ b/cookbooks/concourse-ci/attributes/default.rb
@@ -92,9 +92,9 @@ version_1_config = {
       'CONCOURSE_BASIC_AUTH_PASSWORD' => nil,
       # If you sepecify no value, Chef will sets "http://#{node['ipaddress']}:8080".
       'CONCOURSE_EXTERNAL_URL' => nil,
-      # `<POSTGRES_PASSWORD>` is a placeholder of password string.
+      # `${POSTGRES_PASSWORD}` is a placeholder of password string.
       'CONCOURSE_POSTGRES_DATA_SOURCE' => \
-        'postgres://concourse:<POSTGRES_PASSWORD>@concourse-db:5432/concourse?sslmode=disable',
+        'postgres://concourse:${POSTGRES_PASSWORD}@concourse-db:5432/concourse?sslmode=disable',
     },
   },
   'concourse-worker' => {

diff --git a/cookbooks/concourse-ci/metadata.rb b/cookbooks/concourse-ci/metadata.rb
index 7e1a1c0..1e7c95b 100644 (file)
--- a/cookbooks/concourse-ci/metadata.rb
+++ b/cookbooks/concourse-ci/metadata.rb
@@ -5,7 +5,7 @@ maintainer_email ''
 license          'Apache 2.0'
 description      'Installs/Configures Concourse CI by Docker Compose'
 long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version          '0.1.2'
+version          '0.1.3'
 source_url       'http://scm.osdn.jp/gitroot/metasearch/grid-chef-repo.git'
 issues_url       'https://osdn.jp/projects/metasearch/ticket'
 

diff --git a/cookbooks/concourse-ci/recipes/docker-compose.rb b/cookbooks/concourse-ci/recipes/docker-compose.rb
index 4a83ced..a12fcf5 100644 (file)
--- a/cookbooks/concourse-ci/recipes/docker-compose.rb
+++ b/cookbooks/concourse-ci/recipes/docker-compose.rb
@@ -70,7 +70,19 @@ bash 'ssh-keygen_keys' do
   end
 end
 
+env_file = "#{app_dir}/.env"
 config_file = "#{app_dir}/docker-compose.yml"
+
+env_local = nil
+if File.exist?(env_file)
+  env_local = {}
+  File.open(env_file) do |file|
+    file.each_line do |line|
+      env_local[$1] = $2 if line =~ /^(.*)=(.*)$/
+    end
+  end
+end
+
 config_srvs_local = nil
 if File.exist?(config_file)
   require 'yaml'
@@ -95,27 +107,33 @@ db_envs_org = config_srvs['concourse-db']['environment']
 db_envs = {}
 db_vols = config_srvs['concourse-db']['volumes'].to_a
 
+db_password_reset = node['concourse-ci']['docker-compose']['db_password_reset']
 db_passwd = nil
 db_password_vault_item = node['concourse-ci']['docker-compose']['db_password_vault_item']
 if !db_password_vault_item.empty?
-  # 1.
+  # 1. from Chef Vault (recommended).
   db_passwd = get_vault_item_value(db_password_vault_item)
 else
-  # 2.
+  # 2. from Chef attribute (NOT recommended).
   db_passwd = db_envs_org['POSTGRES_PASSWORD']
   if db_passwd.nil? || db_passwd.empty?
     db_passwd = \
-      if !config_srvs_local.nil? && !node['concourse-ci']['docker-compose']['db_password_reset']
-        # 3.
+      if !config_srvs_local.nil? \
+        && config_srvs_local['concourse-db']['environment']['POSTGRES_PASSWORD'] != '${POSTGRES_PASSWORD}' \
+        && !db_password_reset
+        # 3. preserve it from the local docker-compose.yml file for backward compatibility.
         config_srvs_local['concourse-db']['environment']['POSTGRES_PASSWORD']
+      elsif !env_local.nil? && !env_local['POSTGRES_PASSWORD'].nil? && !db_password_reset
+        # 4. preserve it from the local .env file.
+        env_local['POSTGRES_PASSWORD']
       else
-        # 4.
+        # 5. auto generate.
         SecureRandom.hex  # or urlsafe_base64
       end
   end
 end
 # prevent Chef from logging password attribute value. (=> template variables)
-#db_envs['POSTGRES_PASSWORD'] = db_passwd
+db_envs['POSTGRES_PASSWORD'] = '${POSTGRES_PASSWORD}'
 
 db_vols.push("#{pgdata_dir}:#{db_envs_org['PGDATA']}") if !pgdata_dir.nil? && !pgdata_dir.empty?
 
@@ -132,35 +150,41 @@ web_vols = config_srvs['concourse-web']['volumes'].to_a
 web_ports = config_srvs['concourse-web']['ports']
 override_config_srvs['concourse-web']['ports'] = ['8080:8080'] if web_ports.empty?
 
+web_password_reset = node['concourse-ci']['docker-compose']['web_password_reset']
 basic_auth_passwd = nil
 web_password_vault_item = node['concourse-ci']['docker-compose']['web_password_vault_item']
 if !web_password_vault_item.empty?
-  # 1.
+  # 1. from Chef Vault (recommended).
   basic_auth_passwd = get_vault_item_value(web_password_vault_item)
 else
-  # 2.
+  # 2. from Chef attribute (NOT recommended).
   basic_auth_passwd = web_envs_org['CONCOURSE_BASIC_AUTH_PASSWORD']
   if basic_auth_passwd.nil? || basic_auth_passwd.empty?
     basic_auth_passwd = \
-      if !config_srvs_local.nil? && !node['concourse-ci']['docker-compose']['web_password_reset']
-        # 3.
+      if !config_srvs_local.nil? \
+        && config_srvs_local['concourse-web']['environment']['CONCOURSE_BASIC_AUTH_PASSWORD'] != '${CONCOURSE_BASIC_AUTH_PASSWORD}' \
+        && !web_password_reset
+        # 3. preserve it from the local docker-compose.yml file for backward compatibility.
         config_srvs_local['concourse-web']['environment']['CONCOURSE_BASIC_AUTH_PASSWORD']
+      elsif !env_local.nil? && !env_local['CONCOURSE_BASIC_AUTH_PASSWORD'].nil? && !web_password_reset
+        # 4. preserve it from the local .env file.
+        env_local['CONCOURSE_BASIC_AUTH_PASSWORD']
       else
-        # 4.
+        # 5. auto generate.
         SecureRandom.hex  # or urlsafe_base64
       end
   end
 end
 # prevent Chef from logging password attribute value. (=> template variables)
-#web_envs['CONCOURSE_BASIC_AUTH_PASSWORD'] = basic_auth_passwd
+web_envs['CONCOURSE_BASIC_AUTH_PASSWORD'] = '${CONCOURSE_BASIC_AUTH_PASSWORD}'
 
 external_url = web_envs_org['CONCOURSE_EXTERNAL_URL']
 web_envs['CONCOURSE_EXTERNAL_URL'] = "http://#{node['ipaddress']}:8080" if external_url.nil?
 
 data_source = web_envs_org['CONCOURSE_POSTGRES_DATA_SOURCE']
-data_source = data_source.gsub(/<POSTGRES_PASSWORD>/, db_passwd)
-# prevent Chef from logging password attribute value. (=> template variables)
-#web_envs['CONCOURSE_POSTGRES_DATA_SOURCE'] = data_source
+# for backward compatibility.
+data_source = data_source.gsub(/<POSTGRES_PASSWORD>/, '${POSTGRES_PASSWORD}')
+web_envs['CONCOURSE_POSTGRES_DATA_SOURCE'] = data_source
 
 if node['concourse-ci']['with_ssl_cert_cookbook']
   ::Chef::Recipe.send(:include, SSLCert::Helper)
@@ -177,20 +201,27 @@ force_override_config_srvs['concourse-web']['environment'] = web_envs unless web
 # reset vlumes array.
 override_config_srvs['concourse-web']['volumes'] = web_vols unless web_vols.empty?
 
-template config_file do
-  source  'opt/docker-compose/app/concourse/docker-compose.yml'
+template env_file do
+  source 'opt/docker-compose/app/concourse/.env'
   owner 'root'
   group 'root'
   mode '0600'
   sensitive true
   # prevent Chef from logging password attribute value.
   variables(
+    # secrets
     db_passwd: db_passwd,
-    basic_auth_passwd: basic_auth_passwd,
-    data_source: data_source
+    basic_auth_passwd: basic_auth_passwd
   )
 end
 
+template config_file do
+  source  'opt/docker-compose/app/concourse/docker-compose.yml'
+  owner 'root'
+  group 'root'
+  mode '0600'
+end
+
 log <<-"EOM"
 Note: You must execute the following command manually.
   See #{doc_url}

diff --git a/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/.env b/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/.env
new file mode 100644 (file)
index 0000000..0244fff
--- /dev/null
+++ b/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/.env
@@ -0,0 +1,7 @@
+<%
+# Note in this file:
+#  - Do not use quatation marks (' or ").
+#  - Do not use variable reference.
+-%>
+POSTGRES_PASSWORD=<%= @db_passwd %>
+CONCOURSE_BASIC_AUTH_PASSWORD=<%= @basic_auth_passwd %>

diff --git a/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/docker-compose.yml b/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/docker-compose.yml
index 240a87a..623d8a8 100644 (file)
--- a/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/docker-compose.yml
+++ b/cookbooks/concourse-ci/templates/default/opt/docker-compose/app/concourse/docker-compose.yml
@@ -1,20 +1,5 @@
 <%
-config_format_version = node['concourse-ci']['docker-compose']['config_format_version']
-config = node['concourse-ci']['docker-compose']['config'].to_hash
-
-config_srvs = \
-  if config_format_version == '1'
-    config
-  elsif config_format_version == '2'
-    config['services']
-  end
-
-# prevent Chef from logging password attribute value.
-config_srvs['concourse-db']['environment']['POSTGRES_PASSWORD'] = @db_passwd
-config_srvs['concourse-web']['environment']['CONCOURSE_BASIC_AUTH_PASSWORD'] = @basic_auth_passwd
-config_srvs['concourse-web']['environment']['CONCOURSE_POSTGRES_DATA_SOURCE'] = @data_source
-
 require 'yaml'
-yaml_str = config.to_yaml
+yaml_str = node['concourse-ci']['docker-compose']['config'].to_hash.to_yaml
 -%>
 <%= yaml_str %>