chore(infra): 新增 Gitea+Jenkins CI/CD 部署与凭据整改
- infra/cicd：docker-compose（gitea/jenkins）、JCasC（凭据统一 ${ENV} 注入，无硬编码）、
备份/恢复、健康检查、凭据轮换与 git 历史清除脚本
- docs/deployment/cicd：安装、高可用备份监控、凭据事故复盘
- .env.example 仅为占位模板；真实 .env 由 .gitignore 排除
This commit was merged in pull request #27.
This commit is contained in:
@@ -0,0 +1,112 @@
|
||||
# ============================================================
|
||||
# Jenkins Configuration as Code (JCasC)
|
||||
#
|
||||
# 目的：把安全域、授权策略、CSRF、凭据、节点协议全部声明化，
|
||||
# 避免"某次手工点了全局可写"这类不可追溯的漂移。
|
||||
#
|
||||
# 挂载：CASC_JENKINS_CONFIG=/var/jenkins_config/casc.yaml
|
||||
# 校验：Jenkins -> Manage Jenkins -> Configuration as Code -> View Configuration
|
||||
# 或用 jenkins-plugin-cli 的 casc 校验器 docker run 预检
|
||||
#
|
||||
# 变量来自 .env（容器 env），不要在此文件写明文。
|
||||
# ============================================================
|
||||
|
||||
jenkins:
|
||||
systemMessage: |
|
||||
Novalon CI/CD (ci.f.novalon.cn) —— 生产环境，操作留痕。
|
||||
未授权访问将被记录并追责。
|
||||
|
||||
# ---------- 安全域：Jenkins 自有用户库，禁用匿名 ----------
|
||||
securityRealm:
|
||||
local:
|
||||
allowsSignup: false # 禁止自助注册
|
||||
enableCaptcha: false
|
||||
users:
|
||||
- id: "${ADMIN_USER}"
|
||||
# 密码由 bcrypt 存储；首次由 JCasC 写入，之后通过 UI/API 改
|
||||
password: "${ADMIN_PASSWORD}"
|
||||
|
||||
# ---------- 授权：登录后可读，管理员全权 ----------
|
||||
authorizationStrategy:
|
||||
loggedInUsersCanDoAnything:
|
||||
allowAnonymousRead: false # 关键：关闭匿名读取（构建日志含路径/命令，属敏感信息）
|
||||
|
||||
# ---------- 全局安全 ----------
|
||||
crumbIssuer:
|
||||
standard:
|
||||
excludeClientIPFromCrumb: false
|
||||
|
||||
remotingSecurity:
|
||||
enabled: true # 启用 agent -> controller 的调用过滤（防 RCE 类滥用）
|
||||
|
||||
# 无 agent 时关闭 JNLP 入站端口；有 agent 再改为 fixed:50000
|
||||
agentProtocols:
|
||||
- "Ping"
|
||||
|
||||
# Jenkins URL 必须与实际一致，否则 CSRF crumb 与邮件/通知链接会失效
|
||||
location:
|
||||
url: "https://ci.f.novalon.cn/"
|
||||
adminAddress: "team@novalon.cn"
|
||||
|
||||
# ---------- 构建并发与队列 ----------
|
||||
numExecutors: 2
|
||||
quietPeriod: 5
|
||||
scmCheckoutRetryCount: 2
|
||||
|
||||
# ---------- 全局环境变量（作业里用 ${...} 引用） ----------
|
||||
globalNodeProperties:
|
||||
- envVars:
|
||||
env:
|
||||
- key: "PROJECT_NAME"
|
||||
value: "novalon-website"
|
||||
- key: "SERVER_IP"
|
||||
value: "139.155.109.62"
|
||||
- key: "SERVER_USER"
|
||||
value: "root"
|
||||
- key: "DEPLOY_ROOT"
|
||||
value: "/home/novalon/docker-app"
|
||||
- key: "NGINX_CONTAINER"
|
||||
value: "novalon-nginx-secure"
|
||||
- key: "DOMAIN"
|
||||
value: "https://novalon.cn"
|
||||
- key: "NPM_REGISTRY"
|
||||
value: "https://registry.npmmirror.com"
|
||||
- key: "BACKUP_RETENTION_COUNT"
|
||||
value: "3"
|
||||
|
||||
# ---------- 凭据：统一由环境变量注入，绝不写死在 JCasC ----------
|
||||
credentials:
|
||||
system:
|
||||
domainCredentials:
|
||||
- credentials:
|
||||
- usernamePassword:
|
||||
scope: GLOBAL
|
||||
id: "gitea-credentials"
|
||||
username: "${ADMIN_USER}"
|
||||
password: "${GITEA_TOKEN}"
|
||||
description: "Gitea 代码拉取令牌（read:repository）"
|
||||
|
||||
# ---------- 工具安装（与 Jenkinsfile 中 nodejs('18') 对应） ----------
|
||||
tool:
|
||||
nodejs:
|
||||
installations:
|
||||
- name: "18"
|
||||
home: ""
|
||||
properties:
|
||||
- installSource:
|
||||
installers:
|
||||
- nodeJSInstaller:
|
||||
id: "18.20.4"
|
||||
npmPackagesRefreshHours: 72
|
||||
|
||||
# ---------- 插件更新站点 ----------
|
||||
# updateCenter:
|
||||
# sites:
|
||||
# - id: "default"
|
||||
# url: "https://updates.jenkins.io/update-center.json"
|
||||
|
||||
# ---------- 安全加固：禁用 CLI over HTTP / 旧协议 ----------
|
||||
unclassified:
|
||||
# 关闭 Jenkins 内置 CLI over HTTP（历史漏洞面）
|
||||
# 通过 startupProbe 之外的手段无法在 JCasC 直接关，
|
||||
# 已在 docker-compose 的 JAVA_OPTS 中以 -Djenkins.CLI.disabled=true 处理
|
||||
@@ -0,0 +1,41 @@
|
||||
# Jenkins 必备插件清单（生产最小集，按现状 268 个插件裁剪治理的基线）
|
||||
# 安装：docker compose exec jenkins jenkins-plugin-cli --plugin-file /var/jenkins_config/plugins.txt
|
||||
#
|
||||
# 说明：现状容器里 plugins 目录混有 .jpi 与 .bak 残留（268 条记录），
|
||||
# 建议按此清单重建，避免僵尸插件带来的 CVE 面。
|
||||
|
||||
# --- 核心流水线 ---
|
||||
workflow-aggregator # Pipeline 全家桶
|
||||
pipeline-stage-view
|
||||
pipeline-utility-steps
|
||||
git
|
||||
git-client
|
||||
scm-api
|
||||
|
||||
# --- Gitea 集成 ---
|
||||
gitea # Gitea Server 插件（提供 Gitea Organization / webhook 端点）
|
||||
generic-webhook-trigger # Jenkinsfile 中 GenericTrigger 依赖，Gitea push 触发
|
||||
|
||||
# --- 凭据 ---
|
||||
credentials
|
||||
credentials-binding # withCredentials / sshagent
|
||||
plain-credentials
|
||||
ssh-credentials
|
||||
|
||||
# --- 构建工具 ---
|
||||
nodejs # Jenkinsfile 中 nodejs(nodeJSInstallationName:'18') 依赖
|
||||
timestamper # options { timestamps() }
|
||||
ansicolor # options { ansiColor('xterm') }
|
||||
build-timeout
|
||||
|
||||
# --- 报告与产物 ---
|
||||
htmlpublisher # publishHTML：覆盖率 / E2E 报告
|
||||
junit # 测试结果趋势
|
||||
warnings-ng # ESLint / tsc 警告可视化
|
||||
|
||||
# --- 运维 ---
|
||||
disk-usage # JENKINS_HOME 增长监控（本次磁盘 85% 事故的直接看板）
|
||||
monitoring # 内置监控
|
||||
mailer # post { failure { mail } }
|
||||
configuration-as-code # JCasC，本目录 casc.yaml 依赖
|
||||
job-dsl # 作业声明化（可选，用于重建 novalon-website-ci-cd）
|
||||
Reference in New Issue
Block a user