Add release machinery: version bump, nfpm RPM, release-on-tag pipeline
- Makefile: add make patch|minor|major (tag + push), dist-build, completions, and rpm/rpm-package targets. - packaging/nfpm.yaml + scripts/build-rpm.sh: package the tomswall binary with bash/zsh completions, the example config, and a systemd agent unit into an RPM. - packaging/tomswall-agent.service + agent.env: run `tomswall agent` as a systemd service (CAP_NET_ADMIN/CAP_NET_RAW), configured via /etc/tomswall/agent.env. - .woodpecker/release.yaml: on v* tag, test -> build -> package RPM -> PUT to the artifactapi rpm-internal repo. Matches node-lookup conventions.
This commit is contained in:
benvin
@@ -0,0 +1,82 @@
|
||||
when:
|
||||
- event: tag
|
||||
ref: refs/tags/v*
|
||||
|
||||
steps:
|
||||
- name: test
|
||||
image: golang:1.23
|
||||
commands:
|
||||
- go test ./...
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
- name: build
|
||||
image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
|
||||
commands:
|
||||
- make dist-build VERSION=${CI_COMMIT_TAG}
|
||||
depends_on: [test]
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
- name: package
|
||||
image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
|
||||
commands:
|
||||
- ./scripts/build-rpm.sh ${CI_COMMIT_TAG}
|
||||
depends_on: [build]
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
- name: upload-rpm
|
||||
image: git.unkin.net/unkin/almalinux9-base:20260606
|
||||
commands:
|
||||
- |
|
||||
HOST="https://artifactapi.k8s.syd1.au.unkin.net"
|
||||
REPO="rpm-internal"
|
||||
for rpm in dist/*.rpm; do
|
||||
FILE=$$(basename "$$rpm")
|
||||
code=$$(curl -s -o /dev/null -w '%{http_code}' "$$HOST/api/v2/remotes/$$REPO/files/Packages/$$FILE" || true)
|
||||
if [ "$$code" = "200" ]; then
|
||||
echo "$$FILE already exists in $$REPO (HTTP $$code); skipping upload"
|
||||
continue
|
||||
fi
|
||||
echo "Uploading $$FILE to $$REPO (existence probe returned $$code)"
|
||||
curl -f -X PUT \
|
||||
"$$HOST/api/v2/remotes/$$REPO/files/$$FILE" \
|
||||
-H "Content-Type: application/x-rpm" \
|
||||
--data-binary @"$$rpm"
|
||||
done
|
||||
depends_on: [package]
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
@@ -1,12 +1,17 @@
|
||||
BINARY := tomswall
|
||||
MODULE := git.unkin.net/unkin/tomswall
|
||||
PREFIX := /usr/local
|
||||
BINARY := tomswall
|
||||
MODULE := git.unkin.net/unkin/tomswall
|
||||
PREFIX := /usr/local
|
||||
CONFDIR := /etc/tomswall
|
||||
DIST := dist
|
||||
VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
|
||||
GOFLAGS := -ldflags="-s -w -X main.version=$(VERSION)"
|
||||
OS ?= $(shell go env GOOS)
|
||||
ARCH ?= $(shell go env GOARCH)
|
||||
|
||||
.PHONY: build install clean check test
|
||||
.PHONY: build install clean check test fmt dist-build completions rpm rpm-package patch minor major _tag
|
||||
|
||||
build:
|
||||
go build -o $(BINARY) ./cmd/tomswall
|
||||
go build $(GOFLAGS) -o $(BINARY) ./cmd/tomswall
|
||||
|
||||
install: build
|
||||
install -Dm755 $(BINARY) $(DESTDIR)$(PREFIX)/sbin/$(BINARY)
|
||||
@@ -17,9 +22,54 @@ install: build
|
||||
|
||||
clean:
|
||||
rm -f $(BINARY)
|
||||
rm -rf $(DIST)
|
||||
|
||||
check:
|
||||
go vet ./...
|
||||
|
||||
test:
|
||||
go test ./...
|
||||
|
||||
fmt:
|
||||
gofmt -w .
|
||||
|
||||
# Build the binary into dist/ for the RPM packaging step.
|
||||
dist-build:
|
||||
@mkdir -p $(DIST)
|
||||
CGO_ENABLED=0 GOOS=$(OS) GOARCH=$(ARCH) go build $(GOFLAGS) -o $(DIST)/$(BINARY) ./cmd/tomswall
|
||||
|
||||
# Generate bash/zsh completions into dist/completions.
|
||||
completions: dist-build
|
||||
@mkdir -p $(DIST)/completions
|
||||
$(DIST)/$(BINARY) completion bash > $(DIST)/completions/$(BINARY).bash
|
||||
$(DIST)/$(BINARY) completion zsh > $(DIST)/completions/_$(BINARY)
|
||||
|
||||
# Build the binary then package it (with completions) into an RPM via nfpm.
|
||||
rpm: dist-build rpm-package
|
||||
|
||||
# Package an already-built dist/ binary into an RPM (used by CI after build).
|
||||
rpm-package:
|
||||
./scripts/build-rpm.sh $(VERSION)
|
||||
|
||||
# Bump helpers — read the latest semver tag and create+push the next one, which
|
||||
# triggers the release-on-tag pipeline. Starts from v0.0.0 when no tag exists.
|
||||
_LATEST := $(shell git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$$' | head -1)
|
||||
_BASE := $(if $(_LATEST),$(_LATEST),v0.0.0)
|
||||
_MAJ := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f1)
|
||||
_MIN := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f2)
|
||||
_PAT := $(shell echo $(_BASE) | sed 's/^v//' | cut -d. -f3)
|
||||
|
||||
patch:
|
||||
@NEW=v$(_MAJ).$(_MIN).$(shell expr $(_PAT) + 1); \
|
||||
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||
|
||||
minor:
|
||||
@NEW=v$(_MAJ).$(shell expr $(_MIN) + 1).0; \
|
||||
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||
|
||||
major:
|
||||
@NEW=v$(shell expr $(_MAJ) + 1).0.0; \
|
||||
git tag $$NEW && echo "Tagged $$NEW" && $(MAKE) _tag TAG=$$NEW
|
||||
|
||||
_tag:
|
||||
git push origin $(TAG)
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
# nfpm config for building the tomswall RPM.
|
||||
# Rendered through envsubst (see scripts/build-rpm.sh) then fed to `nfpm pkg`.
|
||||
|
||||
name: ${PACKAGE_NAME}
|
||||
version: ${PACKAGE_VERSION}
|
||||
release: ${PACKAGE_RELEASE}
|
||||
arch: ${PACKAGE_ARCH}
|
||||
platform: ${PACKAGE_PLATFORM}
|
||||
section: default
|
||||
priority: extra
|
||||
description: "${PACKAGE_DESCRIPTION}"
|
||||
|
||||
maintainer: ${PACKAGE_MAINTAINER}
|
||||
homepage: ${PACKAGE_HOMEPAGE}
|
||||
license: ${PACKAGE_LICENSE}
|
||||
|
||||
disable_globbing: false
|
||||
|
||||
replaces:
|
||||
- tomswall
|
||||
provides:
|
||||
- tomswall
|
||||
|
||||
contents:
|
||||
- src: dist/tomswall
|
||||
dst: /usr/sbin/tomswall
|
||||
file_info:
|
||||
mode: 0755
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
# Example configuration (never overwrites an existing tomswall.yaml).
|
||||
- src: tomswall.example.yaml
|
||||
dst: /etc/tomswall/tomswall.example.yaml
|
||||
file_info:
|
||||
mode: 0644
|
||||
|
||||
# systemd unit + environment file for the control-plane agent.
|
||||
- src: packaging/tomswall-agent.service
|
||||
dst: /usr/lib/systemd/system/tomswall-agent.service
|
||||
file_info:
|
||||
mode: 0644
|
||||
- src: packaging/tomswall-agent.env
|
||||
dst: /etc/tomswall/agent.env
|
||||
type: config|noreplace
|
||||
file_info:
|
||||
mode: 0640
|
||||
|
||||
# Shell completions (generated by scripts/build-rpm.sh before packaging).
|
||||
- src: dist/completions/tomswall.bash
|
||||
dst: /usr/share/bash-completion/completions/tomswall
|
||||
file_info:
|
||||
mode: 0644
|
||||
- src: dist/completions/_tomswall
|
||||
dst: /usr/share/zsh/site-functions/_tomswall
|
||||
file_info:
|
||||
mode: 0644
|
||||
@@ -0,0 +1,12 @@
|
||||
# Environment for the tomswall control-plane agent (tomswall-agent.service).
|
||||
# The agent reads these; flags may also be passed via ExecStart.
|
||||
|
||||
# Base URL of the tomswallapi control plane.
|
||||
TOMSWALL_API_URL=https://tomswallapi.k8s.syd1.au.unkin.net
|
||||
|
||||
# Agent bearer token (issued by the control plane / Vault). Keep this file 0640.
|
||||
TOMSWALL_AGENT_TOKEN=
|
||||
|
||||
# The device name defaults to the system hostname. To override it, add
|
||||
# `--device <name>` to ExecStart in the unit (drop-in), e.g.:
|
||||
# ExecStart=/usr/sbin/tomswall agent --device fw-a
|
||||
@@ -0,0 +1,18 @@
|
||||
[Unit]
|
||||
Description=tomswall control-plane agent (pull and apply firewall config)
|
||||
Documentation=https://git.unkin.net/unkin/tomswall
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
EnvironmentFile=/etc/tomswall/agent.env
|
||||
ExecStart=/usr/sbin/tomswall agent
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
# The agent programs nftables and needs the requisite capabilities.
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Package the (already built) tomswall binary into an RPM with nfpm, bundling
|
||||
# generated bash/zsh shell completions and the systemd agent unit.
|
||||
# Usage: scripts/build-rpm.sh [version] (version defaults to $CI_COMMIT_TAG)
|
||||
#
|
||||
set -euo pipefail
|
||||
|
||||
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "${ROOT_DIR}"
|
||||
|
||||
VERSION="${1:-${CI_COMMIT_TAG:-0.0.0-dev}}"
|
||||
VERSION="${VERSION#v}" # strip a leading v
|
||||
BINARY="tomswall"
|
||||
DIST="dist"
|
||||
|
||||
if [ ! -f "${DIST}/${BINARY}" ]; then
|
||||
echo "ERROR: ${DIST}/${BINARY} not found; run 'make dist-build' first" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate shell completions from the freshly built binary so they always match
|
||||
# the shipped flags/subcommands.
|
||||
COMP_DIR="${DIST}/completions"
|
||||
mkdir -p "${COMP_DIR}"
|
||||
"./${DIST}/${BINARY}" completion bash >"${COMP_DIR}/${BINARY}.bash"
|
||||
"./${DIST}/${BINARY}" completion zsh >"${COMP_DIR}/_${BINARY}"
|
||||
|
||||
export PACKAGE_NAME="${BINARY}"
|
||||
export PACKAGE_VERSION="${VERSION}"
|
||||
export PACKAGE_RELEASE="1"
|
||||
export PACKAGE_ARCH="amd64"
|
||||
export PACKAGE_PLATFORM="linux"
|
||||
export PACKAGE_DESCRIPTION="Spiritual successor to shorewall — nftables firewall manager, with a control-plane agent that pulls compiled config from tomswallapi"
|
||||
export PACKAGE_MAINTAINER="Ben Vincent <ben@unkin.net>"
|
||||
export PACKAGE_HOMEPAGE="https://git.unkin.net/unkin/tomswall"
|
||||
export PACKAGE_LICENSE="MIT"
|
||||
|
||||
envsubst <packaging/nfpm.yaml >"${DIST}/nfpm.yaml"
|
||||
nfpm pkg --config "${DIST}/nfpm.yaml" --target "${DIST}" --packager rpm
|
||||
|
||||
echo "Built:"
|
||||
ls -1 "${DIST}"/*.rpm
|
||||
Reference in New Issue
Block a user