Skip to content

Commit 0345f30

Browse files
wmuldergovray-oxd
wmuldergov
authored and
ray-oxd
committed
DBC22-5253: Further harden the environment
1 parent 1ef8667 commit 0345f30

24 files changed

Lines changed: 372 additions & 506 deletions

‎.github/workflows/dev.yml‎

Lines changed: 40 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -21,32 +21,44 @@ jobs:
2121
environment: dev
2222

2323
steps:
24-
- name: Checkout Code
25-
uses: actions/checkout@v6
26-
27-
- name: Build Static
28-
id: build_image
29-
uses: redhat-actions/buildah-build@v2
30-
with:
31-
context: .
32-
layers: true
33-
image: drivebc-static
34-
tags: latest latest-dev ${{ github.sha }}
35-
labels: |
36-
app=drivebc
37-
containerfiles: ./compose/frontend/StaticBuild
38-
build-args: |
39-
FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}
40-
DEBUG_BUILD=true
41-
42-
- name: Push to Github Packages
43-
uses: redhat-actions/push-to-registry@v2
44-
with:
45-
image: ${{ steps.build_image.outputs.image }}
46-
tags: ${{ steps.build_image.outputs.tags }}
47-
registry: ${{ env.IMAGE_REGISTRY }}
48-
username: ${{ env.REGISTRY_USER }}
49-
password: ${{ env.REGISTRY_PASSWORD }}
24+
- name: Checkout Code
25+
uses: actions/checkout@v6
26+
27+
- name: Log in to the Container registry
28+
uses: docker/login-action@v3
29+
with:
30+
registry: ${{ env.IMAGE_REGISTRY }}
31+
username: ${{ env.REGISTRY_USER }}
32+
password: ${{ env.REGISTRY_PASSWORD }}
33+
34+
- name: Extract metadata (tags, labels) for Docker
35+
id: meta
36+
uses: docker/metadata-action@v5
37+
with:
38+
images: ${{ env.IMAGE_REGISTRY }}/drivebc-static
39+
tags: |
40+
type=raw,value=latest
41+
type=raw,value=latest-dev
42+
type=sha,format=long
43+
44+
- name: Set up Docker Buildx
45+
uses: docker/setup-buildx-action@v3
46+
47+
- name: Build and push Docker image
48+
id: push
49+
uses: docker/build-push-action@v6
50+
with:
51+
context: .
52+
file: ./compose/frontend/StaticBuild
53+
push: true
54+
tags: ${{ steps.meta.outputs.tags }}
55+
labels: |
56+
${{ steps.meta.outputs.labels }}
57+
app=drivebc
58+
build-args: |
59+
DEBUG_BUILD=true
60+
secrets: |
61+
"FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}"
5062
5163
build-backend:
5264
runs-on: ubuntu-latest
@@ -164,7 +176,7 @@ jobs:
164176
insecure_skip_tls_verify: false
165177
- name: Helm upgrade on OpenShift Gold Environment
166178
run: |
167-
helm upgrade dev-drivebc -f ./infrastructure/main/values-dev.yaml ./infrastructure/main --set static.image.tag=${{ github.sha }} --set django.image.tag=${{ github.sha }} --set tasks.image.tag=${{ github.sha }} --set image-consumer.image.tag=${{ github.sha }} --set redis.image.tag=${{ github.sha }} --set openshiftjobs.image.tag=${{ github.sha }}
179+
helm upgrade dev-drivebc -f ./infrastructure/main/values-dev.yaml ./infrastructure/main --set static.image.tag=sha-${{ github.sha }} --set django.image.tag=${{ github.sha }} --set tasks.image.tag=${{ github.sha }} --set image-consumer.image.tag=${{ github.sha }} --set redis.image.tag=${{ github.sha }} --set openshiftjobs.image.tag=${{ github.sha }}
168180
169181
# I have this run after the push to Gold because I want to make sure that Gold runs the migrations first. Gold DR can't run migrations as DB is read-only
170182
update-openshift-golddr:
@@ -194,7 +206,7 @@ jobs:
194206

195207
- name: Helm upgrade on OpenShift GoldDR Environment
196208
run: |
197-
helm upgrade dev-drivebc -f ./infrastructure/main/values-dev.yaml -f ./infrastructure/main/values-dev-dr.yaml ./infrastructure/main --set static.image.tag=${{ github.sha }} --set django.image.tag=${{ github.sha }} --set tasks.image.tag=${{ github.sha }} --set image-consumer.image.tag=${{ github.sha }} --set redis.image.tag=${{ github.sha }} --set openshiftjobs.image.tag=${{ github.sha }}
209+
helm upgrade dev-drivebc -f ./infrastructure/main/values-dev.yaml -f ./infrastructure/main/values-dev-dr.yaml ./infrastructure/main --set static.image.tag=sha-${{ github.sha }} --set django.image.tag=${{ github.sha }} --set tasks.image.tag=${{ github.sha }} --set image-consumer.image.tag=${{ github.sha }} --set redis.image.tag=${{ github.sha }} --set openshiftjobs.image.tag=${{ github.sha }}
198210
199211
200212

‎.github/workflows/test.yml‎

Lines changed: 49 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -61,44 +61,55 @@ jobs:
6161
environment: test
6262

6363
steps:
64-
- name: Checkout Code
65-
uses: actions/checkout@v6
66-
with:
67-
ref: ${{ needs.tag.outputs.tag }}
68-
69-
- name: Build Static
70-
id: build_image
71-
uses: redhat-actions/buildah-build@v2
72-
with:
73-
context: .
74-
layers: true
75-
image: drivebc-static
76-
tags: latest latest-test ${{ github.sha }} ${{ needs.tag.outputs.tag }}
77-
labels: |
78-
app=drivebc
79-
containerfiles: ./compose/frontend/StaticBuild
80-
build-args: |
81-
FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}
82-
DEBUG_BUILD=true
83-
84-
- name: Push to Github Packages
85-
uses: redhat-actions/push-to-registry@v2
86-
with:
87-
image: ${{ steps.build_image.outputs.image }}
88-
tags: ${{ steps.build_image.outputs.tags }}
89-
registry: ${{ env.IMAGE_REGISTRY }}
90-
username: ${{ env.REGISTRY_USER }}
91-
password: ${{ env.REGISTRY_PASSWORD }}
92-
93-
# Backup to handle scenarios where Github packages is down. Confluence has documentation on switching the source.
94-
- name: Push to OpenShift ImageStream
95-
uses: redhat-actions/push-to-registry@v2
96-
with:
97-
image: ${{ steps.build_image.outputs.image }}
98-
tags: latest latest-test
99-
registry: ${{ vars.OPENSHIFT_IMAGESTREAM_URL }}
100-
username: ${{ secrets.OPENSHIFT_IMAGESTREAM_USERNAME }}
101-
password: ${{ secrets.OPENSHIFT_IMAGESTREAM_TOKEN }}
64+
- name: Checkout Code
65+
uses: actions/checkout@v6
66+
with:
67+
ref: ${{ needs.tag.outputs.tag }}
68+
69+
- name: Log in to the Container registry (GitHub)
70+
uses: docker/login-action@v3
71+
with:
72+
registry: ${{ env.IMAGE_REGISTRY }}
73+
username: ${{ env.REGISTRY_USER }}
74+
password: ${{ env.REGISTRY_PASSWORD }}
75+
76+
- name: Log in to OpenShift Registry
77+
uses: docker/login-action@v3
78+
with:
79+
registry: ${{ vars.OPENSHIFT_IMAGESTREAM_URL }}
80+
username: ${{ secrets.OPENSHIFT_IMAGESTREAM_USERNAME }}
81+
password: ${{ secrets.OPENSHIFT_IMAGESTREAM_TOKEN }}
82+
83+
- name: Extract metadata
84+
id: meta
85+
uses: docker/metadata-action@v5
86+
with:
87+
images: |
88+
${{ env.IMAGE_REGISTRY }}/drivebc-static
89+
${{ vars.OPENSHIFT_IMAGESTREAM_URL }}drivebc-static
90+
tags: |
91+
type=raw,value=latest
92+
type=raw,value=latest-test
93+
type=sha,format=long
94+
type=raw,value=${{ needs.tag.outputs.tag }}
95+
96+
- name: Set up Docker Buildx
97+
uses: docker/setup-buildx-action@v3
98+
99+
- name: Build and push to both registries
100+
uses: docker/build-push-action@v6
101+
with:
102+
context: .
103+
file: ./compose/frontend/StaticBuild
104+
push: true
105+
tags: ${{ steps.meta.outputs.tags }}
106+
labels: |
107+
${{ steps.meta.outputs.labels }}
108+
app=drivebc
109+
build-args: |
110+
DEBUG_BUILD=true
111+
secrets: |
112+
"FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}"
102113
103114
build-backend:
104115
needs: [tag]

‎.github/workflows/uat.yml‎

Lines changed: 49 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -61,44 +61,55 @@ jobs:
6161
environment: uat
6262

6363
steps:
64-
- name: Checkout Code
65-
uses: actions/checkout@v6
66-
with:
67-
ref: ${{ needs.tag.outputs.tag }}
68-
69-
- name: Build Static
70-
id: build_image
71-
uses: redhat-actions/buildah-build@v2
72-
with:
73-
context: .
74-
layers: true
75-
image: drivebc-static
76-
tags: latest latest-uat ${{ github.sha }} ${{ needs.tag.outputs.tag }}
77-
labels: |
78-
app=drivebc
79-
containerfiles: ./compose/frontend/StaticBuild
80-
build-args: |
81-
FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}
82-
DEBUG_BUILD=false
83-
84-
- name: Push to Github Packages
85-
uses: redhat-actions/push-to-registry@v2
86-
with:
87-
image: ${{ steps.build_image.outputs.image }}
88-
tags: ${{ steps.build_image.outputs.tags }}
89-
registry: ${{ env.IMAGE_REGISTRY }}
90-
username: ${{ env.REGISTRY_USER }}
91-
password: ${{ env.REGISTRY_PASSWORD }}
92-
93-
# Backup to handle scenarios where Github packages is down. Confluence has documentation on switching the source.
94-
- name: Push to OpenShift ImageStream
95-
uses: redhat-actions/push-to-registry@v2
96-
with:
97-
image: ${{ steps.build_image.outputs.image }}
98-
tags: latest latest-uat ${{ needs.tag.outputs.tag }}
99-
registry: ${{ vars.OPENSHIFT_IMAGESTREAM_URL }}
100-
username: ${{ secrets.OPENSHIFT_IMAGESTREAM_USERNAME }}
101-
password: ${{ secrets.OPENSHIFT_IMAGESTREAM_TOKEN }}
64+
- name: Checkout Code
65+
uses: actions/checkout@v6
66+
with:
67+
ref: ${{ needs.tag.outputs.tag }}
68+
69+
- name: Log in to the Container registry (GitHub)
70+
uses: docker/login-action@v3
71+
with:
72+
registry: ${{ env.IMAGE_REGISTRY }}
73+
username: ${{ env.REGISTRY_USER }}
74+
password: ${{ env.REGISTRY_PASSWORD }}
75+
76+
- name: Log in to OpenShift Registry
77+
uses: docker/login-action@v3
78+
with:
79+
registry: ${{ vars.OPENSHIFT_IMAGESTREAM_URL }}
80+
username: ${{ secrets.OPENSHIFT_IMAGESTREAM_USERNAME }}
81+
password: ${{ secrets.OPENSHIFT_IMAGESTREAM_TOKEN }}
82+
83+
- name: Extract metadata
84+
id: meta
85+
uses: docker/metadata-action@v5
86+
with:
87+
images: |
88+
${{ env.IMAGE_REGISTRY }}/drivebc-static
89+
${{ vars.OPENSHIFT_IMAGESTREAM_URL }}drivebc-static
90+
tags: |
91+
type=raw,value=latest
92+
type=raw,value=latest-test
93+
type=sha,format=long
94+
type=raw,value=${{ needs.tag.outputs.tag }}
95+
96+
- name: Set up Docker Buildx
97+
uses: docker/setup-buildx-action@v3
98+
99+
- name: Build and push to both registries
100+
uses: docker/build-push-action@v6
101+
with:
102+
context: .
103+
file: ./compose/frontend/StaticBuild
104+
push: true
105+
tags: ${{ steps.meta.outputs.tags }}
106+
labels: |
107+
${{ steps.meta.outputs.labels }}
108+
app=drivebc
109+
build-args: |
110+
DEBUG_BUILD=false
111+
secrets: |
112+
"FONTAWESOME_PACKAGE_TOKEN=${{ secrets.FONTAWESOME_PACKAGE_TOKEN }}"
102113
103114
build-backend:
104115
needs: [tag]

‎compose/frontend/StaticBuild‎

Lines changed: 32 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,46 @@
1-
# Use an official node runtime as a parent image
2-
FROM node:22-slim AS buildnode
1+
# syntax=docker/dockerfile:1
32

4-
WORKDIR /app/
5-
RUN chown node:root /app
6-
7-
ARG FONTAWESOME_PACKAGE_TOKEN
8-
ENV FONTAWESOME_PACKAGE_TOKEN=${FONTAWESOME_PACKAGE_TOKEN}
3+
############################################
4+
# Builder: install deps and build frontend #
5+
############################################
6+
FROM node:24-alpine AS buildnode
97

10-
# Install dependencies
11-
COPY ./src/frontend/package.json /app/
12-
COPY ./src/frontend/package-lock.json /app/
13-
COPY ./src/frontend/.npmrc /app/
14-
RUN npm install
8+
WORKDIR /app/
9+
COPY ./src/frontend/package.json ./src/frontend/package-lock.json ./src/frontend/.npmrc ./
1510

16-
# Add rest of the client code
17-
COPY ./src/frontend /app/
18-
RUN chown node:root /app/node_modules
11+
RUN --mount=type=secret,id=FONTAWESOME_PACKAGE_TOKEN \
12+
test -s /run/secrets/FONTAWESOME_PACKAGE_TOKEN || { echo "FONTAWESOME_PACKAGE_TOKEN secret missing"; exit 1; }; \
13+
export FONTAWESOME_PACKAGE_TOKEN="$(cat /run/secrets/FONTAWESOME_PACKAGE_TOKEN)" && \
14+
npm ci
1915

20-
# OpenShift runs as node, not as root (while docker runs as root), so need to
21-
# ensure running user can write to its home directory--without setting this,
22-
# home is /, so node can't create a cache dir
23-
ENV HOME /home/node
16+
COPY ./src/frontend/ /app/
2417

2518
RUN npm run openshift_build
2619

27-
FROM nginx:stable-alpine
20+
############################################
21+
# Runtime: nginx serving built assets #
22+
############################################
23+
FROM nginxinc/nginx-unprivileged:stable-alpine
2824

2925
EXPOSE 3000
3026

31-
RUN touch /run/nginx.pid
32-
33-
COPY ./compose/frontend/default.conf /etc/nginx/conf.d
34-
COPY ./compose/frontend/default_maintenance.txt /etc/nginx
35-
COPY ./compose/frontend/legacy_redirects.conf /etc/nginx
36-
COPY ./compose/frontend/security_headers.conf /etc/nginx/conf.d
37-
COPY ./compose/frontend/blocked_ips.conf /etc/nginx/conf.d
27+
# Copy built assets
28+
RUN mkdir -p /usr/share/nginx/html
3829
COPY --from=buildnode /app/build /usr/share/nginx/html
39-
RUN chmod -R 777 /run /var/log/nginx /var/cache/nginx /usr/share/nginx/html/static/js /usr/share/nginx/html/static/css /usr/share/nginx/html/static/media /etc/nginx/conf.d
4030

41-
ARG DEBUG_BUILD=false
31+
USER root
32+
RUN mkdir -p /tmp/cache/nginx && \
33+
chgrp -R 0 /tmp/cache && \
34+
chmod -R g=u /tmp/cache
35+
USER nginx
36+
37+
# Nginx config and runtime permissions
38+
COPY ./compose/frontend/default.conf /etc/nginx/conf.d/default.conf
39+
COPY ./compose/frontend/security_headers.conf /etc/nginx/conf.d/security_headers.conf
40+
COPY ./compose/frontend/blocked_ips.conf /etc/nginx/conf.d/blocked_ips.conf
41+
COPY ./compose/frontend/legacy_redirects.conf /etc/nginx/legacy_redirects.conf
4242

43-
# Add debugging tools into builds if enabled
44-
RUN if [ ${DEBUG_BUILD} = true ]; then \
45-
apk update && apk add --no-cache jq vim procps less; \
46-
fi
43+
COPY ./compose/frontend/default_maintenance.txt /etc/nginx/default_maintenance.txt
4744

48-
COPY ./compose/frontend/entrypoint /docker-entrypoint.d/add_client_env.sh
49-
RUN sed -i 's/\r$//g' /docker-entrypoint.d/add_client_env.sh && chmod +x /docker-entrypoint.d/add_client_env.sh
45+
# Runtime env injection hook (This will be run by an initContainer in OpenShift)
46+
COPY --chmod=755 ./compose/frontend/generate-config.sh /tmp/generate-config.sh

0 commit comments

Comments
 (0)