Add concource

cspell.config.yaml

@@ -33,7 +33,9 @@ words:
   - cloudflared
   - codegate
   - collabora
+  - concource
   - consts
+  - containerd
   - cooldown
   - cpus
   - creds

ix-dev/community/concource/README.md

@@ -0,0 +1,3 @@
+# Concourse
+
+[Concourse](https://concourse-ci.org) is a container-based automation system written in Go.

ix-dev/community/concource/app.yaml

@@ -0,0 +1,35 @@
+app_version: 7.13.1
+capabilities: []
+categories:
+- productivity
+changelog_url: https://github.com/concourse/concourse/releases
+date_added: '2025-04-30'
+description: Concourse is a container-based automation system written in Go.
+home: https://concourse-ci.org
+host_mounts: []
+icon: https://media.sys.truenas.net/apps/concourse/icons/icon.svg
+keywords:
+- automation
+- ci
+lib_version: 2.1.19
+lib_version_hash: f77aa12d7eb7832a79a221474495865dbe5080f86f871cd8b496a2ab7a40f318
+maintainers:
+- email: [email protected]
+  name: truenas
+  url: https://www.truenas.com/
+name: concource
+run_as_context:
+- description: Concourse runs as root user.
+  gid: 0
+  group_name: root
+  uid: 0
+  user_name: root
+screenshots:
+- https://media.sys.truenas.net/apps/concourse/screenshots/screenshot1.png
+sources:
+- https://concourse-ci.org
+- https://github.com/concourse/concourse
+- https://hub.docker.com/r/concourse/concourse
+title: Concourse
+train: community
+version: 1.0.0

ix-dev/community/concource/item.yaml

@@ -0,0 +1,8 @@
+categories:
+- productivity
+icon_url: https://media.sys.truenas.net/apps/concourse/icons/icon.svg
+screenshots:
+- https://media.sys.truenas.net/apps/concourse/screenshots/screenshot1.png
+tags:
+- automation
+- ci

ix-dev/community/concource/ix_values.yaml

@@ -0,0 +1,30 @@
+images:
+  image:
+    repository: concourse/concourse
+    tag: 7.13.1
+  postgres_17_image:
+    repository: postgres
+    tag: "17.4"
+  postgres_upgrade_image:
+    repository: ixsystems/postgres-upgrade
+    tag: 1.0.1
+
+consts:
+  concourse_web_container_name: web
+  concourse_worker_container_name: worker
+  concourse_keys_container_name: keys
+  postgres_container_name: postgres
+  perms_container_name: permissions
+  db_user: concourse
+  db_name: concourse
+  worker_port: 7777
+  web_tsa_bind_port: 2222
+  worker_healthcheck_port: 8888
+
+  worker_workspace: /opt/concourse/worker
+  keys_path: /keys
+  session_signing_key_path: /keys/session_signing_key
+  tsa_public_key_path: /keys/tsa_host_key.pub
+  tsa_worker_private_key_path: /keys/worker_key
+  tsa_host_key_path: /keys/tsa_host_key
+  tsa_authorized_keys_path: /keys/authorized_keys.pub

ix-dev/community/concource/templates/docker-compose.yaml

@@ -0,0 +1,83 @@
+{% from "macros/keys.sh" import gen_keys %}
+{% set tpl = ix_lib.base.render.Render(values) %}
+
+{% set perm_container = tpl.deps.perms(values.consts.perms_container_name) %}
+{% set web = tpl.add_container(values.consts.concourse_web_container_name, "image") %}
+{% set worker = tpl.add_container(values.consts.concourse_worker_container_name, "image") %}
+{% set keys = tpl.add_container(values.consts.concourse_keys_container_name, "image") %}
+
+{% set pg_config = {
+  "user": values.consts.db_user,
+  "password": values.concourse.db_password,
+  "database": values.consts.db_name,
+  "volume": values.storage.postgres_data,
+} %}
+{% set postgres = tpl.deps.postgres(
+  values.consts.postgres_container_name,
+  values.concourse.postgres_image_selector,
+  pg_config, perm_container
+) %}
+
+{# Keys #}
+{% do keys.healthcheck.disable() %}
+{% do keys.restart.set_policy("on-failure", 1) %}
+{% do keys.deploy.resources.set_profile("low") %}
+{% do keys.configs.add("config.sh", gen_keys(values), "/config.sh", "0755") %}
+{% do keys.set_entrypoint(["/config.sh"]) %}
+{% do keys.add_storage(values.consts.keys_path, values.storage.keystore) %}
+
+{# Worker #}
+{% do worker.set_cgroup("host") %}
+{% do worker.set_privileged(true) %}
+{% do worker.set_command(["worker"]) %}
+{% do worker.depends.add_dependency(values.consts.concourse_web_container_name, "service_healthy") %}
+{% do worker.depends.add_dependency(values.consts.concourse_keys_container_name, "service_completed_successfully") %}
+{% do worker.healthcheck.set_test("http", {"port": values.consts.worker_healthcheck_port}) %}
+
+{% do worker.environment.add_env("CONCOURSE_BIND_PORT", values.consts.worker_port) %}
+{% do worker.environment.add_env("CONCOURSE_HEALTHCHECK_BIND_PORT", values.consts.worker_healthcheck_port) %}
+{% do worker.environment.add_env("CONCOURSE_RUNTIME", "containerd") %}
+{% do worker.environment.add_env("CONCOURSE_WORK_DIR", values.concourse.worker_workspace) %}
+{% do worker.environment.add_env("CONCOURSE_TSA_HOST", "%s:%d" | format(values.consts.concourse_web_container_name, values.consts.web_tsa_bind_port)) %}
+{% do worker.environment.add_env("CONCOURSE_TSA_PUBLIC_KEY", values.consts.tsa_public_key_path) %}
+{% do worker.environment.add_env("CONCOURSE_TSA_WORKER_PRIVATE_KEY", values.consts.tsa_worker_private_key_path) %}
+{% do worker.environment.add_user_envs(values.concourse.worker_additional_envs) %}
+
+{% do worker.add_storage(values.consts.worker_workspace, values.storage.workspace) %}
+{% do worker.add_storage(values.consts.keys_path, values.storage.keystore) %}
+
+{# Web #}
+{% do web.set_command(["web"]) %}
+{% do web.depends.add_dependency(values.consts.postgres_container_name, "service_healthy") %}
+{% do web.healthcheck.set_test("http", {"port": values.network.web_port.port_number, "path": "/api/v1/info"}) %}
+
+{# FIXME: This accepts a list of users #}
+{% do web.environment.add_env("CONCOURSE_ADD_LOCAL_USER", "%s:%s" | format(values.concourse.username, values.concourse.password)) %}
+{% do web.environment.add_env("CONCOURSE_BIND_PORT", values.network.web_port.port_number) %}
+{% do web.environment.add_env("CONCOURSE_TSA_BIND_PORT",  values.consts.web_tsa_bind_port) %}
+{% do web.environment.add_env("CONCOURSE_MAIN_TEAM_LOCAL_USER", values.concourse.username) %}
+{% do web.environment.add_env("CONCOURSE_SESSION_SIGNING_KEY", values.consts.session_signing_key_path) %}
+{% do web.environment.add_env("CONCOURSE_TSA_HOST_KEY", values.consts.tsa_host_key_path) %}
+{% do web.environment.add_env("CONCOURSE_TSA_AUTHORIZED_KEYS", values.consts.tsa_authorized_keys_path) %}
+{% do web.environment.add_env("CONCOURSE_POSTGRES_HOST", values.consts.postgres_container_name) %}
+{% do web.environment.add_env("CONCOURSE_POSTGRES_PORT", 5432) %}
+{% do web.environment.add_env("CONCOURSE_POSTGRES_USER", values.consts.db_user) %}
+{% do web.environment.add_env("CONCOURSE_POSTGRES_DATABASE", values.consts.db_name) %}
+{% do web.environment.add_env("CONCOURSE_POSTGRES_PASSWORD", values.concourse.db_password) %}
+{% do web.environment.add_user_envs(values.concourse.web_additional_envs) %}
+
+{% do web.add_port(values.network.web_port) %}
+{% do web.add_storage(values.consts.keys_path, values.storage.keystore) %}
+
+{% for store in values.storage.additional_storage %}
+  {% do worker.add_storage(store.mount_path, store) %}
+{% endfor %}
+
+{% if perm_container.has_actions() %}
+  {% do perm_container.activate() %}
+  {% do postgres.add_dependency(values.consts.perms_container_name, "service_completed_successfully") %}
+{% endif %}
+
+{% do tpl.portals.add_portal({"port": values.network.web_port.port_number}) %}
+
+{{ tpl.render() | tojson }}

ix-dev/community/concource/templates/library/base_v2_1_19/configs.py

@@ -0,0 +1,86 @@
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from render import Render
+
+try:
+    from .error import RenderError
+    from .formatter import escape_dollar
+    from .validations import valid_octal_mode_or_raise, valid_fs_path_or_raise
+except ImportError:
+    from error import RenderError
+    from formatter import escape_dollar
+    from validations import valid_octal_mode_or_raise, valid_fs_path_or_raise
+
+
+class Configs:
+    def __init__(self, render_instance: "Render"):
+        self._render_instance = render_instance
+        self._configs: dict[str, dict] = {}
+
+    def add(self, name: str, data: str):
+        if not isinstance(data, str):
+            raise RenderError(f"Expected [data] to be a string, got [{type(data)}]")
+
+        if name not in self._configs:
+            self._configs[name] = {"name": name, "data": data}
+            return
+
+        if data == self._configs[name]["data"]:
+            return
+
+        raise RenderError(f"Config [{name}] already added with different data")
+
+    def has_configs(self):
+        return bool(self._configs)
+
+    def render(self):
+        return {
+            c["name"]: {"content": escape_dollar(c["data"])}
+            for c in sorted(self._configs.values(), key=lambda c: c["name"])
+        }
+
+
+class ContainerConfigs:
+    def __init__(self, render_instance: "Render", configs: Configs):
+        self._render_instance = render_instance
+        self.top_level_configs: Configs = configs
+        self.container_configs: set[ContainerConfig] = set()
+
+    def add(self, name: str, data: str, target: str, mode: str = ""):
+        self.top_level_configs.add(name, data)
+
+        if target == "":
+            raise RenderError(f"Expected [target] to be set for config [{name}]")
+        if mode != "":
+            mode = valid_octal_mode_or_raise(mode)
+
+        if target in [c.target for c in self.container_configs]:
+            raise RenderError(f"Target [{target}] already used for another config")
+        target = valid_fs_path_or_raise(target)
+        self.container_configs.add(ContainerConfig(self._render_instance, name, target, mode))
+
+    def has_configs(self):
+        return bool(self.container_configs)
+
+    def render(self):
+        return [c.render() for c in sorted(self.container_configs, key=lambda c: c.source)]
+
+
+class ContainerConfig:
+    def __init__(self, render_instance: "Render", source: str, target: str, mode: str):
+        self._render_instance = render_instance
+        self.source = source
+        self.target = target
+        self.mode = mode
+
+    def render(self):
+        result: dict[str, str | int] = {
+            "source": self.source,
+            "target": self.target,
+        }
+
+        if self.mode:
+            result["mode"] = int(self.mode, 8)
+
+        return result