zhangxiang
4ab2f3cd8e
- infra/cicd：docker-compose（gitea/jenkins）、JCasC（凭据统一 ${ENV} 注入，无硬编码）、
备份/恢复、健康检查、凭据轮换与 git 历史清除脚本
- docs/deployment/cicd：安装、高可用备份监控、凭据事故复盘
- .env.example 仅为占位模板；真实 .env 由 .gitignore 排除
113 lines
3.8 KiB
YAML
113 lines
3.8 KiB
YAML
# ============================================================
|
||
# Jenkins Configuration as Code (JCasC)
|
||
#
|
||
# 目的：把安全域、授权策略、CSRF、凭据、节点协议全部声明化，
|
||
# 避免"某次手工点了全局可写"这类不可追溯的漂移。
|
||
#
|
||
# 挂载：CASC_JENKINS_CONFIG=/var/jenkins_config/casc.yaml
|
||
# 校验：Jenkins -> Manage Jenkins -> Configuration as Code -> View Configuration
|
||
# 或用 jenkins-plugin-cli 的 casc 校验器 docker run 预检
|
||
#
|
||
# 变量来自 .env（容器 env），不要在此文件写明文。
|
||
# ============================================================
|
||
|
||
jenkins:
|
||
systemMessage: |
|
||
Novalon CI/CD (ci.f.novalon.cn) —— 生产环境，操作留痕。
|
||
未授权访问将被记录并追责。
|
||
|
||
# ---------- 安全域：Jenkins 自有用户库，禁用匿名 ----------
|
||
securityRealm:
|
||
local:
|
||
allowsSignup: false # 禁止自助注册
|
||
enableCaptcha: false
|
||
users:
|
||
- id: "${ADMIN_USER}"
|
||
# 密码由 bcrypt 存储；首次由 JCasC 写入，之后通过 UI/API 改
|
||
password: "${ADMIN_PASSWORD}"
|
||
|
||
# ---------- 授权：登录后可读，管理员全权 ----------
|
||
authorizationStrategy:
|
||
loggedInUsersCanDoAnything:
|
||
allowAnonymousRead: false # 关键：关闭匿名读取（构建日志含路径/命令，属敏感信息）
|
||
|
||
# ---------- 全局安全 ----------
|
||
crumbIssuer:
|
||
standard:
|
||
excludeClientIPFromCrumb: false
|
||
|
||
remotingSecurity:
|
||
enabled: true # 启用 agent -> controller 的调用过滤（防 RCE 类滥用）
|
||
|
||
# 无 agent 时关闭 JNLP 入站端口；有 agent 再改为 fixed:50000
|
||
agentProtocols:
|
||
- "Ping"
|
||
|
||
# Jenkins URL 必须与实际一致，否则 CSRF crumb 与邮件/通知链接会失效
|
||
location:
|
||
url: "https://ci.f.novalon.cn/"
|
||
adminAddress: "team@novalon.cn"
|
||
|
||
# ---------- 构建并发与队列 ----------
|
||
numExecutors: 2
|
||
quietPeriod: 5
|
||
scmCheckoutRetryCount: 2
|
||
|
||
# ---------- 全局环境变量（作业里用 ${...} 引用） ----------
|
||
globalNodeProperties:
|
||
- envVars:
|
||
env:
|
||
- key: "PROJECT_NAME"
|
||
value: "novalon-website"
|
||
- key: "SERVER_IP"
|
||
value: "139.155.109.62"
|
||
- key: "SERVER_USER"
|
||
value: "root"
|
||
- key: "DEPLOY_ROOT"
|
||
value: "/home/novalon/docker-app"
|
||
- key: "NGINX_CONTAINER"
|
||
value: "novalon-nginx-secure"
|
||
- key: "DOMAIN"
|
||
value: "https://novalon.cn"
|
||
- key: "NPM_REGISTRY"
|
||
value: "https://registry.npmmirror.com"
|
||
- key: "BACKUP_RETENTION_COUNT"
|
||
value: "3"
|
||
|
||
# ---------- 凭据：统一由环境变量注入，绝不写死在 JCasC ----------
|
||
credentials:
|
||
system:
|
||
domainCredentials:
|
||
- credentials:
|
||
- usernamePassword:
|
||
scope: GLOBAL
|
||
id: "gitea-credentials"
|
||
username: "${ADMIN_USER}"
|
||
password: "${GITEA_TOKEN}"
|
||
description: "Gitea 代码拉取令牌（read:repository）"
|
||
|
||
# ---------- 工具安装（与 Jenkinsfile 中 nodejs('18') 对应） ----------
|
||
tool:
|
||
nodejs:
|
||
installations:
|
||
- name: "18"
|
||
home: ""
|
||
properties:
|
||
- installSource:
|
||
installers:
|
||
- nodeJSInstaller:
|
||
id: "18.20.4"
|
||
npmPackagesRefreshHours: 72
|
||
|
||
# ---------- 插件更新站点 ----------
|
||
# updateCenter:
|
||
# sites:
|
||
# - id: "default"
|
||
# url: "https://updates.jenkins.io/update-center.json"
|
||
|
||
# ---------- 安全加固：禁用 CLI over HTTP / 旧协议 ----------
|
||
unclassified:
|
||
# 关闭 Jenkins 内置 CLI over HTTP（历史漏洞面）
|
||
# 通过 startupProbe 之外的手段无法在 JCasC 直接关，
|
||
# 已在 docker-compose 的 JAVA_OPTS 中以 -Djenkins.CLI.disabled=true 处理
|