From 25edfd088f4d6a18c691e2af77da85ff36ae3716 Mon Sep 17 00:00:00 2001 From: Codex Date: Thu, 9 Jul 2026 15:57:58 +0200 Subject: [PATCH] fix: move Gitea public exposure to NC01 --- config/platform-infra/gitea.yaml | 8 +++-- scripts/src/platform-infra-gitea-remote.sh | 40 +++++++++++++++++----- scripts/src/platform-infra-gitea.ts | 4 +++ 3 files changed, 40 insertions(+), 12 deletions(-) diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml index 1388ac59..03994c3e 100644 --- a/config/platform-infra/gitea.yaml +++ b/config/platform-infra/gitea.yaml @@ -13,7 +13,7 @@ metadata: - 1560 defaults: - targetId: JD01 + targetId: NC01 migration: role: gitea-pac-cicd-source-authority @@ -247,6 +247,8 @@ targets: enabled: true createNamespace: true storageClassName: local-path + publicExposure: + enabled: false - id: NC01 route: NC01:k3s namespace: devops-infra @@ -255,7 +257,7 @@ targets: createNamespace: true storageClassName: local-path publicExposure: - enabled: false + enabled: true webhookSync: publicPath: /_unidesk/github-to-gitea/nc01 frpc: @@ -296,7 +298,7 @@ app: image: fatedier/frpc:v0.68.1 serverAddr: 82.156.23.220 serverPort: 22000 - proxyName: platform-infra-gitea-jd01-web + proxyName: platform-infra-gitea-nc01-web remotePort: 22080 localIP: gitea-http.devops-infra.svc.cluster.local localPort: 3000 diff --git a/scripts/src/platform-infra-gitea-remote.sh b/scripts/src/platform-infra-gitea-remote.sh index bd83ab79..acb6b02e 100644 --- a/scripts/src/platform-infra-gitea-remote.sh +++ b/scripts/src/platform-infra-gitea-remote.sh @@ -109,6 +109,27 @@ run_apply() { printf '%s\n' "frpc disabled" >"$tmp/frpc-rollout.err" fi fi + if [ "$UNIDESK_GITEA_FRPC_ENABLED" = "0" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then + kubectl -n "$UNIDESK_GITEA_NAMESPACE" delete deployment "$UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME" --ignore-not-found >"$tmp/frpc-cleanup.out" 2>"$tmp/frpc-cleanup.err" + frpc_cleanup_deploy_rc=$? + kubectl -n "$UNIDESK_GITEA_NAMESPACE" delete secret "$UNIDESK_GITEA_FRPC_SECRET_NAME" --ignore-not-found >>"$tmp/frpc-cleanup.out" 2>>"$tmp/frpc-cleanup.err" + frpc_cleanup_secret_rc=$? + if [ "$frpc_cleanup_deploy_rc" -eq 0 ] && [ "$frpc_cleanup_secret_rc" -eq 0 ]; then + frpc_cleanup_rc=0 + else + frpc_cleanup_rc=1 + fi + else + frpc_cleanup_rc=0 + : >"$tmp/frpc-cleanup.out" + if [ "$UNIDESK_GITEA_DRY_RUN" = "1" ]; then + printf '%s\n' "dry-run: frpc cleanup skipped" >"$tmp/frpc-cleanup.err" + elif [ "$UNIDESK_GITEA_FRPC_ENABLED" = "1" ]; then + printf '%s\n' "frpc enabled" >"$tmp/frpc-cleanup.err" + else + printf '%s\n' "frpc cleanup skipped" >"$tmp/frpc-cleanup.err" + fi + fi if [ "$apply_rc" -eq 0 ] && [ "$UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED" = "1" ] && [ "$UNIDESK_GITEA_DRY_RUN" != "1" ]; then kubectl -n "$UNIDESK_GITEA_NAMESPACE" rollout restart "deployment/$UNIDESK_GITEA_WEBHOOK_DEPLOYMENT" >"$tmp/webhook-rollout.out" 2>"$tmp/webhook-rollout.err" webhook_rollout_rc=$? @@ -127,9 +148,9 @@ run_apply() { printf '%s\n' "webhook sync disabled" >"$tmp/webhook-rollout.err" fi fi - python3 - "$frpc_rc" "$webhook_secret_rc" "$apply_rc" "$rollout_rc" "$frpc_rollout_rc" "$webhook_rollout_rc" "$tmp/frpc-secret.out" "$tmp/frpc-secret.err" "$tmp/webhook-secret.out" "$tmp/webhook-secret.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout.out" "$tmp/rollout.err" "$tmp/frpc-rollout.out" "$tmp/frpc-rollout.err" "$tmp/webhook-rollout.out" "$tmp/webhook-rollout.err" <<'PY' + python3 - "$frpc_rc" "$webhook_secret_rc" "$apply_rc" "$rollout_rc" "$frpc_rollout_rc" "$webhook_rollout_rc" "$frpc_cleanup_rc" "$tmp/frpc-secret.out" "$tmp/frpc-secret.err" "$tmp/frpc-cleanup.out" "$tmp/frpc-cleanup.err" "$tmp/webhook-secret.out" "$tmp/webhook-secret.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout.out" "$tmp/rollout.err" "$tmp/frpc-rollout.out" "$tmp/frpc-rollout.err" "$tmp/webhook-rollout.out" "$tmp/webhook-rollout.err" <<'PY' import json, os, sys -frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc = [int(value) for value in sys.argv[1:7]] +frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc, frpc_cleanup_rc = [int(value) for value in sys.argv[1:8]] def text(path, limit=3000): try: return open(path, encoding="utf-8", errors="replace").read()[-limit:] @@ -137,7 +158,7 @@ def text(path, limit=3000): return "" dry = os.environ.get("UNIDESK_GITEA_DRY_RUN") == "1" payload = { - "ok": all(value == 0 for value in [frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc]), + "ok": all(value == 0 for value in [frpc_rc, webhook_secret_rc, apply_rc, rollout_rc, frpc_rollout_rc, webhook_rollout_rc, frpc_cleanup_rc]), "target": os.environ.get("UNIDESK_GITEA_TARGET_ID"), "route": os.environ.get("UNIDESK_GITEA_ROUTE"), "namespace": os.environ.get("UNIDESK_GITEA_NAMESPACE"), @@ -150,12 +171,13 @@ payload = { "networkPolicy": "allow-all", }, "steps": { - "frpcSecret": {"exitCode": frpc_rc, "stdoutTail": text(sys.argv[7]), "stderrTail": text(sys.argv[8])}, - "webhookSyncSecret": {"exitCode": webhook_secret_rc, "stdoutTail": text(sys.argv[9]), "stderrTail": text(sys.argv[10])}, - "apply": {"exitCode": apply_rc, "stdoutTail": text(sys.argv[11]), "stderrTail": text(sys.argv[12])}, - "rollout": {"exitCode": rollout_rc, "stdoutTail": text(sys.argv[13]), "stderrTail": text(sys.argv[14])}, - "frpcRollout": {"exitCode": frpc_rollout_rc, "stdoutTail": text(sys.argv[15]), "stderrTail": text(sys.argv[16])}, - "webhookSyncRollout": {"exitCode": webhook_rollout_rc, "stdoutTail": text(sys.argv[17]), "stderrTail": text(sys.argv[18])}, + "frpcSecret": {"exitCode": frpc_rc, "stdoutTail": text(sys.argv[8]), "stderrTail": text(sys.argv[9])}, + "frpcCleanup": {"exitCode": frpc_cleanup_rc, "stdoutTail": text(sys.argv[10]), "stderrTail": text(sys.argv[11])}, + "webhookSyncSecret": {"exitCode": webhook_secret_rc, "stdoutTail": text(sys.argv[12]), "stderrTail": text(sys.argv[13])}, + "apply": {"exitCode": apply_rc, "stdoutTail": text(sys.argv[14]), "stderrTail": text(sys.argv[15])}, + "rollout": {"exitCode": rollout_rc, "stdoutTail": text(sys.argv[16]), "stderrTail": text(sys.argv[17])}, + "frpcRollout": {"exitCode": frpc_rollout_rc, "stdoutTail": text(sys.argv[18]), "stderrTail": text(sys.argv[19])}, + "webhookSyncRollout": {"exitCode": webhook_rollout_rc, "stdoutTail": text(sys.argv[20]), "stderrTail": text(sys.argv[21])}, }, "valuesPrinted": False, } diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts index 62cfd390..f4ae0e4f 100644 --- a/scripts/src/platform-infra-gitea.ts +++ b/scripts/src/platform-infra-gitea.ts @@ -1336,6 +1336,8 @@ function remoteScript(action: "apply" | "status" | "validate" | "mirror-bootstra UNIDESK_GITEA_NO_PROXY: gitea.sourceAuthority.githubProxy.noProxy.join(","), UNIDESK_GITEA_FRPC_ENABLED: frpcExposure === null ? "0" : "1", UNIDESK_GITEA_FRPC_DEPLOYMENT_NAME: frpcExposure?.frpc.deploymentName ?? gitea.app.publicExposure.frpc.deploymentName, + UNIDESK_GITEA_FRPC_SECRET_NAME: frpcExposure?.frpc.secretName ?? gitea.app.publicExposure.frpc.secretName, + UNIDESK_GITEA_FRPC_SECRET_KEY: frpcExposure?.frpc.secretKey ?? gitea.app.publicExposure.frpc.secretKey, UNIDESK_GITEA_WEBHOOK_SYNC_ENABLED: gitea.sourceAuthority.webhookSync.enabled ? "1" : "0", UNIDESK_GITEA_WEBHOOK_PUBLIC_URL: githubWebhookPublicUrl(gitea, target), UNIDESK_GITEA_WEBHOOK_PATH: sync.publicPath, @@ -2039,6 +2041,7 @@ function renderApply(result: Record): RenderedCliResult { const remote = record(result.remote); const steps = record(remote.steps); const frpcStep = record(steps.frpcSecret); + const frpcCleanupStep = record(steps.frpcCleanup); const webhookSecretStep = record(steps.webhookSyncSecret); const applyStep = record(steps.apply); const rolloutStep = record(steps.rollout); @@ -2052,6 +2055,7 @@ function renderApply(result: Record): RenderedCliResult { "STEPS", ...table(["STEP", "EXIT", "DETAIL"], [ ["frpc-secret", stringValue(frpcStep.exitCode), compactLine(stringValue(frpcStep.stderrTail, stringValue(frpcStep.stdoutTail)))], + ["frpc-cleanup", stringValue(frpcCleanupStep.exitCode), compactLine(stringValue(frpcCleanupStep.stderrTail, stringValue(frpcCleanupStep.stdoutTail)))], ["webhook-secret", stringValue(webhookSecretStep.exitCode), compactLine(stringValue(webhookSecretStep.stderrTail, stringValue(webhookSecretStep.stdoutTail)))], ["apply", stringValue(applyStep.exitCode), compactLine(stringValue(applyStep.stderrTail, stringValue(applyStep.stdoutTail)))], ["rollout", stringValue(rolloutStep.exitCode), compactLine(stringValue(rolloutStep.stderrTail, stringValue(rolloutStep.stdoutTail)))],