bump version to: 4.13.2-dev

Used for go modules

.bashrc

@@ -1,5 +0,0 @@
-_bb_tasks() {
-    COMPREPLY=( $(compgen -W "$(bb tasks |tail -n +3 |cut -f1 -d ' ')" -- ${COMP_WORDS[COMP_CWORD]}) );
-}
-# autocomplete filenames as well
-complete -f -F _bb_tasks bb

.gitignore

@@ -109,5 +109,6 @@ venv.bak/
 
 .clj-kondo/
 .lsp/
-.calva
-.cpcache
+.calva/
+.cpcache/
+infrastructure/backup/image/resources/backup-repository-state.edn

.gitlab-ci.yml

@@ -87,10 +87,3 @@ kotlin-image-publish:
   stage: image
   script:
     - cd infrastructure/kotlin && pyb image publish
-
-backup-image-publish:
-  <<: *img
-  <<: *tag_only
-  stage: image
-  script:
-    - cd infrastructure/backup && pyb image publish

README.md

@@ -1,6 +1,6 @@
 # dda-devops-build
 
-[![Slack](https://img.shields.io/badge/chat-clojurians-green.svg?style=flat)](https://clojurians.slack.com/messages/#dda-pallet/) | [<img src="https://meissa-gmbh.de/img/community/Mastodon_Logotype.svg" width=20 alt="team@social.meissa-gmbh.de"> team@social.meissa-gmbh.de](https://social.meissa-gmbh.de/@team) | [Website & Blog](https://domaindrivenarchitecture.org)
+[![Slack](https://img.shields.io/badge/chat-clojurians-green.svg?style=flat)](https://clojurians.slack.com/messages/#dda-pallet/) | [<img src="https://domaindrivenarchitecture.org/img/delta-chat.svg" width=20 alt="DeltaChat"> chat over e-mail](mailto:buero@meissa-gmbh.de?subject=community-chat) | [<img src="https://meissa.de/images/parts/contact/mastodon36_hue9b2464f10b18e134322af482b9c915e_5501_filter_14705073121015236177.png" width=20 alt="M"> meissa@social.meissa-gmbh.de](https://social.meissa-gmbh.de/@meissa) | [Blog](https://domaindrivenarchitecture.org) | [Website](https://meissa.de)
 
 
 dda-devops-build integrates all the tools we use to work with clouds & provide some nice functions around.

bb.edn

@@ -1,12 +0,0 @@
-{:deps {dda/dda-devops-build {:local/root "."}}
- :tasks
- {test
-  {:extra-paths ["src/test/clj"]
-   :extra-deps {io.github.cognitect-labs/test-runner
-                {:git/tag "v0.5.1" :git/sha "dfb30dd"}}
-   :task (exec 'cognitect.test-runner.api/test)
-   :exec-args {:dirs ["src/test/clj"]}
-   :org.babashka/cli {:coerce {:nses [:symbol]
-                               :vars [:symbol]}}}
-   publish
-   {:task (clojure "-T:build deploy")}}}

build.py

@@ -33,7 +33,7 @@ default_task = "dev"
 name = "ddadevops"
 MODULE = "not-used"
 PROJECT_ROOT_PATH = "."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 summary = "tools to support builds combining gopass, terraform, dda-pallet, aws & hetzner-cloud"
 description = __doc__
 authors = [Author("meissa GmbH", "buero@meissa-gmbh.de")]
@@ -97,7 +97,6 @@ def initialize(project):
         "mixin_types": ["RELEASE"],
         "release_primary_build_file": "build.py",
         "release_secondary_build_files": [
-            "infrastructure/backup/build.py",
             "infrastructure/python/build.py",
             "infrastructure/dind/build.py",
             "infrastructure/ddadevops/build.py",
@@ -141,13 +140,7 @@ def lint(project):
         shell=True,
         check=True,
     )
-    run(
-        "pylint -d W0511,R0903,C0301,W0614,C0114,C0115,C0116,similarities,W1203,W0702,W0702,"
-        + "R0913,R0902,R0914,R1732,R1705,W0707,C0123,W0703,C0103 src/main/python/ddadevops/",
-        shell=True,
-        check=True,
-    )
-
+    
 
 @task
 def patch(project):

deps.edn

@@ -1,8 +0,0 @@
-{:paths ["src/main/clj"]
- :deps {org.clojure/spec.alpha {:mvn/version "0.4.233"}
-        orchestra/orchestra {:mvn/version "2021.01.01-1"}}
- :aliases
- {:build {:extra-paths ["src/tools/clj"]
-          :deps {io.github.clojure/tools.build {:git/tag "v0.9.6" :git/sha "8e78bcc"}
-                 slipset/deps-deploy {:mvn/version "0.2.0"}}
-          :ns-default build}}}

doc/ProvsK3sBuild.md

@@ -13,14 +13,17 @@ classDiagram
 
 ## Input
 
-| name                          | description                                                       | default   |
-| ----------------------------- | ----------------------------------------------------------------- | --------- |
-| k3s_provision_user            | the user used to provision k3s                                    | "root"    |
-| k3s_letsencrypt_email         | email address used for letsencrypt                                |           |
-| k3s_letsencrypt_endpoint      | letsencrypt endpoint. Valid values are staging, prod              | "staging" |
-| k3s_app_filename_to_provision | an k8s manifest to apply imediately after k3s setup was sucessful |           |
-| k3s_enable_echo               | provision the echo app on k3s. Valid values are true, false       | "false"   |
-| k3s_provs_template            | use a individual template for provs config                        | None      |
+| name                              | description                                                       | default   |
+| --------------------------------- | ----------------------------------------------------------------- | --------- |
+| k3s_provision_user                | the user used to provision k3s                                    | "root"    |
+| k3s_letsencrypt_email             | email address used for letsencrypt                                |           |
+| k3s_letsencrypt_endpoint          | letsencrypt endpoint. Valid values are staging, prod              | "staging" |
+| k3s_app_filename_to_provision     | an k8s manifest to apply imediately after k3s setup was sucessful |           |
+| k3s_enable_echo                   | provision the echo app on k3s. Valid values are true, false       | "false"   |
+| k3s_provs_template                | use a individual template for provs config                        | None      |
+| k3s_enable_hetzner_csi            | enable hetzner csi                                                | False     |
+| k3s_hetzner_api_token             | hetzner_api_token                                                 | None      |
+| k3s_hetzner_encryption_passphrase | encryption passphrase for volumes                                 | None      |
 
 ### Credentials Mapping defaults
 

doc/ReleaseMixin.md

@@ -35,6 +35,7 @@ classDiagram
 | release_organisation          | Optional: The repository organisation name                                                                            |                 |
 | release_repository_name       | Optional: The repository name name                                                                                    |                 |
 | release_artifacts             | Optional: The list of artifacts to publish to the release generated name                                              | []              |
+| release_tag_prefix            | Optional: Prefix of tag                                                                                               | ""              |
 
 ## Example Usage just for creating releases
 

doc/dev/clj_setup.md

@@ -1,5 +0,0 @@
-1. Install babashka
-
-## Test
-
-`bb test`

infrastructure/backup/bb.edn

@@ -1,8 +0,0 @@
-{:deps {dda/dda-devops-build {:local/root "../../."}}
- :tasks 
- {:requires ([dda.devops-build.image :as image])
-  image-build (image/dbuild {:name "dda-backup"
-                             :project-root-path "../.."
-                             :build-dir-name "target"
-                             :version "4.11.8-dev"})}}
-

infrastructure/backup/build.py

@@ -7,7 +7,7 @@ import logging
 name = 'dda-backup'
 MODULE = 'NOT_SET'
 PROJECT_ROOT_PATH = '../..'
-version = "4.11.8-dev"
+version = "4.12.2-dev"
 
 
 @init
@@ -38,6 +38,11 @@ def image(project):
     build = get_devops_build(project)
     build.image()
 
+@task
+def test(project):
+    build = get_devops_build(project)
+    build.test()
+
 @task
 def drun(project):
     build = get_devops_build(project)

infrastructure/backup/doc/backup_dev_notes.md

@@ -0,0 +1,79 @@
+## Init Statemachine
+
+### Inputs
+1. `restic-password: ""`
+2. `restic-password-to-rotate: ""`
+
+### Manual init the restic repository for the first time
+
+1. apply backup-and-restore pod:   
+   `kubectl scale deployment backup-restore --replicas=1`
+2. exec into pod and execute restore pod (press tab to get your exact pod name)   
+   `kubectl exec -it backup-restore-... -- /usr/local/bin/init.sh`
+3. remove backup-and-restore pod:   
+   `kubectl scale deployment backup-restore --replicas=0`
+
+### Password Rotation
+
+1. apply backup-and-restore pod:   
+   `kubectl scale deployment backup-restore --replicas=1`
+2. add new password to restic repository   
+    `restic key add ....`   
+    => Trigger ::   
+    field (1) credential current   
+    filed (2) credential new
+3. replace field (1) with (2) & clear (2)
+4. remove old key - ???  
+`restic remove ....`
+
+
+```mermaid
+stateDiagram-v2
+    [*] --> init
+    init --> backup_ready: trigger, restic-password !empty
+    backup_ready --> new_password_added: restic-password !empty && restic-password-to-rotate !empty 
+    new_password_added --> backup_ready: restic-password !empty && restic-password-to-rotate empty
+```
+
+### First Steps
+
+1. Cloud Testserver hochfahren
+2. Dort backup-restore deployment (leeres Secret mgl.?), neues Secret "rotation-credential-secret" als Daten
+3. mounten von angelegtem Secret in Pod backup-restore
+4. ba*bash*ka Skript in pod starten -> liest Secret ?leer
+5. Micha cons. 
+
+```mermaid
+sequenceDiagram
+    participant k8s
+    participant e as entrypoint.sh
+    participant rm as restic-management.clj
+
+    k8s ->> e: cronjob calls
+    e ->> rm: start-file
+    rm ->> rm: rotate
+    activate rm
+        rm ->> rm: read-backup-repository-state (state)
+        rm ->> rm: read-secret (backup-secret/restic-password,  rotation-credential-secret/rotation-credential)
+        rm ->> rm: switch
+        activate rm
+        rm ->> rm: if init && restic-password != null
+        activate rm
+        rm ->> rm: init.sh
+        rm ->> rm: state init -> backup-ready
+        deactivate rm
+        rm ->> rm: if backup-ready && rotation-credential != null
+        activate rm
+        rm ->> rm: add-new-password-to-restic-repository.sh
+        rm ->> rm: state backup-ready -> new-password-added
+        deactivate rm
+        rm ->> rm: if new-password-added && rotation-credential == null
+        activate rm
+        rm ->> rm: remove-old-password-from-restic-repository.sh
+        rm ->> rm: state new-password-added -> backup-ready
+        deactivate rm
+        deactivate rm
+
+        rm ->> rm: store-repository-state (state)
+    deactivate rm
+```

infrastructure/backup/image/resources/file-functions.sh

@@ -42,6 +42,7 @@ function backup-fs-from-directory() {
   
 }
 
+# Das tut so nicht!
 function restore-directory() {
   local directory="$1"; shift
   local snapshot_id="${1:-latest}"; shift

infrastructure/backup/image/resources/install.sh

@@ -2,13 +2,24 @@
 
 set -exo pipefail
 
+function babashka_install() {
+    babashka_version="1.3.189"
+    curl -SsLo /tmp/babashka-${babashka_version}-linux-amd64.tar.gz https://github.com/babashka/babashka/releases/download/v${babashka_version}/babashka-${babashka_version}-linux-amd64.tar.gz
+    curl -SsLo /tmp/checksum https://github.com/babashka/babashka/releases/download/v${babashka_version}/babashka-${babashka_version}-linux-amd64.tar.gz.sha256
+    echo "  /tmp/babashka-$babashka_version-linux-amd64.tar.gz"|tee -a /tmp/checksum
+    sha256sum -c --status /tmp/checksum
+    tar -C /tmp -xzf /tmp/babashka-${babashka_version}-linux-amd64.tar.gz 
+    install -m 0700 -o root -g root /tmp/bb /usr/local/bin/
+}
+
 function main() {
     {
         upgradeSystem
-        apt-get install -qqy ca-certificates curl gnupg postgresql-client-14
+        apt-get install -qqy ca-certificates curl gnupg postgresql-client-14 restic
         curl -Ss --fail https://www.postgresql.org/media/keys/ACCC4CF8.asc | gpg --dearmor | tee /etc/apt/trusted.gpg.d/postgresql-common_pgdg_archive_keyring.gpg
         sh -c 'echo "deb [signed-by=/etc/apt/trusted.gpg.d/postgresql-common_pgdg_archive_keyring.gpg] https://apt.postgresql.org/pub/repos/apt jammy-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
         upgradeSystem
+        babashka_install        
     } > /dev/null
 
     update-ca-certificates
@@ -16,6 +27,7 @@ function main() {
     install -m 0400 /tmp/functions.sh /usr/local/lib/
     install -m 0400 /tmp/pg-functions.sh /usr/local/lib/
     install -m 0400 /tmp/file-functions.sh /usr/local/lib/
+    install -m 0740 /tmp/restic_management.clj /usr/local/bin/
 
     cleanupDocker
 }

infrastructure/backup/image/resources/restic_management.clj

@@ -0,0 +1,51 @@
+#! /usr/bin/env bb
+
+(ns restic-management
+  (:require
+   [clojure.spec.alpha :as s]
+   [clojure.java.io :as io]
+   [clojure.edn :as edn]))
+
+(s/def ::state string?)
+
+(s/def ::backup-repository-state
+  (s/keys :req-un [::state]))
+
+(def state {:state ""})
+
+(defn store-backup-repository-state [s]
+  (spit "backup-repository-state.edn" s))
+
+(defn read-backup-repository-state []
+   (try
+     (with-open [r (io/reader "backup-repository-state.edn")]
+       (edn/read (java.io.PushbackReader. r)))
+  
+     (catch java.io.IOException e
+       (printf "Couldn't open '%s': %s\n" "backup-repository-state.edn" (.getMessage e)))
+     (catch RuntimeException e
+       (printf "Error parsing edn file '%s': %s\n" "backup-repository-state.edn" (.getMessage e)))))
+
+(defn read-secret [s]
+  (slurp (str "/var/run/secrets/" s)))
+   ;"/var/run/secrets/rotation-credential-secret/rotation-credential"))
+
+;(println (read-backup-repository-state))
+
+;(println (:state (read-backup-repository-state)))
+
+;(println (s/valid? ::backup-repository-state (read-backup-repository-state)))
+
+(println (read-secret "rotation-credential-secret/rotation-credential"))
+(println (read-secret "backup-secrets/restic-password"))
+
+(s/def ::new-password string?)
+(s/def ::old-password string?)
+(s/def ::password-state
+  (s/keys :req-un [::new-password ::old-password]))
+
+(defn rotate []
+  (let [state {:new-password (read-secret "rotation-credential-secret/rotation-credential")
+               :old-password (read-secret "backup-secrets/restic-password")}]
+    (store-backup-repository-state (prn-str state))))
+(rotate)

infrastructure/backup/test/Dockerfile

@@ -0,0 +1,7 @@
+FROM dda-backup:latest
+
+# install it
+RUN apt update && apt install -qqy openjdk-17-jre-headless
+ADD resources /tmp/
+RUN rm -rf /root/.m2
+RUN /tmp/install-test.bb

infrastructure/backup/test/resources/bb.edn

@@ -0,0 +1,4 @@
+{:deps {org.clojure/spec.alpha {:mvn/version "0.4.233"}
+        orchestra/orchestra {:mvn/version "2021.01.01-1"}
+        org.domaindrivenarchitecture/dda-backup {:mvn/version "0.1.1-SNAPSHOT"}}}
+

infrastructure/backup/test/resources/install-test.bb

@@ -0,0 +1,32 @@
+#!/usr/bin/env bb
+
+(require '[babashka.tasks :as tasks])
+
+(defn curl-and-check!
+  [filename artifact-url sha256-url]
+  (let [filepath (str "/tmp/" filename)]
+    (tasks/shell "curl" "-SsLo" filepath artifact-url)
+    (tasks/shell "curl" "-SsLo" "/tmp/checksum" sha256-url)
+    (tasks/shell "bash" "-c" (str "echo \" " filepath "\"|tee -a /tmp/checksum"))
+    ;(tasks/shell "sha256sum" "-c" "--status" "/tmp/checksum")
+    ))
+
+(defn tar-install!
+  [filename binname]
+  (let [filepath (str "/tmp/" filename)]
+    (tasks/shell "tar" "-C" "/tmp" "-xzf" filepath)
+    (tasks/shell "install" "-m" "0700" "-o" "root" "-g" "root" (str "/tmp/" binname) "/usr/local/bin/")))
+
+(defn install!
+  [filename]
+  (tasks/shell "install" "-m" "0700" "-o" "root" "-g" "root" (str "/tmp/" filename) "/usr/local/bin/"))
+
+(tasks/shell "bb" "/tmp/test.bb")
+(curl-and-check!
+ "provs-syspec.jar"
+ "https://repo.prod.meissa.de/attachments/0a1da41e-aa5b-4a3e-a3b1-215cf2d5b021"
+ "https://repo.prod.meissa.de/attachments/f227cf65-cb0f-46a7-a6cd-28f46917412a")
+(install! "provs-syspec.jar")
+(tasks/shell "apt" "update")
+(tasks/shell "apt" "install" "-qqy" "openjdk-17-jre-headless")
+(tasks/shell "java" "-jar" "/usr/local/bin/provs-syspec.jar" "local" "-c" "/tmp/spec.yml" )

infrastructure/backup/test/resources/spec.yml

@@ -0,0 +1,7 @@
+package:
+  - name: "restic"
+
+command:
+  - command: "bb -h"
+  - command: "/tmp/test.bb"
+  

infrastructure/backup/test/resources/test.bb

@@ -0,0 +1,27 @@
+#!/usr/bin/env bb
+
+(require '[babashka.tasks :as tasks]
+         '[dda.backup.management :as mgm])
+
+(defn restic-repo-init!
+  []
+  (spit "restic-pwd" "ThePassword")
+  (mgm/init! {:password-file "restic-pwd"
+              :restic-repository "restic-repo"}))
+
+(defn restic-backup!
+  []
+  (tasks/shell "mkdir" "test-backup")
+  (spit "test-backup/file" "I was here")
+  (tasks/shell "restic" "backup" "--password-file" "restic-pwd" "--repo" "restic-repo" "test-backup"))
+
+(defn restic-restore!
+  []
+  (tasks/shell "mkdir" "test-restore")
+  (tasks/shell "restic" "restore" "--password-file" "restic-pwd" "--repo" "restic-repo" "--target" "test-restore" "latest")
+  )
+
+
+(restic-repo-init!)
+(restic-backup!)
+(restic-restore!)

infrastructure/clj-cljs/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "clj-cljs"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 @init
 def initialize(project):

infrastructure/clj-cljs/image/resources/install.sh

@@ -6,7 +6,7 @@ function main() {
     upgradeSystem
 
     mkdir -p /usr/share/man/man1
-    apt-get -qqy install openjdk-17-jre-headless leiningen curl
+    apt-get -qqy install curl openjdk-17-jre-headless leiningen
     
     # shadow-cljs
     npm install -g npm
@@ -15,14 +15,14 @@ function main() {
     # download kubeconform & graalvm
     kubeconform_version="0.6.4"
 
-    curl -SsLo /tmp/kubeconform.tar.gz https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/kubeconform-linux-amd64.tar.gz
+    curl -SsLo /tmp/kubeconform-linux-amd64.tar.gz https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/kubeconform-linux-amd64.tar.gz
     curl -SsLo /tmp/CHECKSUMS https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/CHECKSUMS
 
     # checksum kubeconform
     checksum
 
     # install kubeconform
-    tar -C /usr/local/bin -xf /tmp/kubeconform.tar.gz --exclude=LICENSE
+    tar -C /usr/local/bin -xf /tmp/kubeconform-linux-amd64.tar.gz --exclude=LICENSE
 
     #install pyb
     apt-get -qqy install python3 python3-pip git
@@ -36,15 +36,9 @@ function main() {
 }
 
 function checksum() {
-    checksum_var=$(awk '{print $1}' /tmp/CHECKSUMS|sed -n '2p')
-    sha256sum_var=$(sha256sum /tmp/kubeconform.tar.gz|awk '{print $1}')
-    
-    if [ $checksum_var == $sha256sum_var ]; then
-        echo "Kubeconform checksum verification succesful" 
-    else
-        echo "Failure in kubeconform checksum verification"
-        exit 1
-    fi
+    awk '{print $1 "  /tmp/" $2}' /tmp/CHECKSUMS|sed -n '2p' > /tmp/kubeconform-checksum
+    cat /tmp/kubeconform-checksum
+    sha256sum -c --status /tmp/kubeconform-checksum
 }
 
 source /tmp/install_functions_debian.sh

infrastructure/clj/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "clj"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 @init
 def initialize(project):

infrastructure/clj/image/resources/install.sh

@@ -12,7 +12,7 @@ function main() {
     kubeconform_version="0.6.4"
     graalvm_jdk_version="21.0.2"
 
-    curl -SsLo /tmp/kubeconform.tar.gz https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/kubeconform-linux-amd64.tar.gz
+    curl -SsLo /tmp/kubeconform-linux-amd64.tar.gz https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/kubeconform-linux-amd64.tar.gz
     curl -SsLo /tmp/CHECKSUMS https://github.com/yannh/kubeconform/releases/download/v${kubeconform_version}/CHECKSUMS
     curl -SsLo /tmp/graalvm-community-jdk.tar.gz https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalvm_jdk_version}/graalvm-community-jdk-${graalvm_jdk_version}_linux-x64_bin.tar.gz
     curl -SsLo /tmp/graalvm-checksum https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-${graalvm_jdk_version}/graalvm-community-jdk-${graalvm_jdk_version}_linux-x64_bin.tar.gz.sha256
@@ -21,7 +21,7 @@ function main() {
     checksum
 
     # install kubeconform
-    tar -C /usr/local/bin -xf /tmp/kubeconform.tar.gz --exclude=LICENSE
+    tar -C /usr/local/bin -xf /tmp/kubeconform-linux-amd64.tar.gz --exclude=LICENSE
 
     # install graalvm
     tar -C /usr/lib/jvm/ -xf /tmp/graalvm-community-jdk.tar.gz
@@ -36,25 +36,21 @@ function main() {
     pip3 install pybuilder 'ddadevops>=4.7.0' deprecation dda-python-terraform boto3 pyyaml inflection --break-system-packages 
 
     #check
-    native-image --help
-    lein --help
+    native-image --version
+    lein -v
 
     cleanupDocker
     } > /dev/null
 }
 
 function checksum() {
-    checksum_kubeconform=$(awk '{print $1}' /tmp/CHECKSUMS|sed -n '2p')
-    sha256sum_kubeconform=$(sha256sum /tmp/kubeconform.tar.gz|awk '{print $1}')
-    checksum_graalvm_jdk=$(awk '{print $1}' /tmp/graalvm-checksum)
-    sha256sum_graalvm_jdk=$(sha256sum /tmp/graalvm-community-jdk.tar.gz|awk '{print $1}')
-
-    if [ $checksum_kubeconform == $sha256sum_kubeconform -a $checksum_graalvm_jdk == $sha256sum_graalvm_jdk ]; then
-        echo "Kubeconform & graalvm_jdk checksum verification succesful" 
-    else
-        echo "Failure in kubeconform|graalvm_jdk checksum verification"
-        exit 1
-    fi
+    #kubeconform
+    awk '{print $1 "  /tmp/" $2}' /tmp/CHECKSUMS|sed -n '2p' > /tmp/kubeconform-checksum
+    sha256sum -c --status /tmp/kubeconform-checksum
+    
+    #graalvm
+    echo "  /tmp/graalvm-community-jdk.tar.gz"|tee -a /tmp/graalvm-checksum
+    sha256sum -c --status /tmp/graalvm-checksum
 }
 
 source /tmp/install_functions_debian.sh

infrastructure/ddadevops/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "ddadevops"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 
 @init

infrastructure/dind/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "dind"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 
 @init

infrastructure/kotlin/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "kotlin"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 
 @init

infrastructure/python/build.py

@@ -6,7 +6,7 @@ from ddadevops import *
 name = "ddadevops"
 MODULE = "python"
 PROJECT_ROOT_PATH = "../.."
-version = "4.11.8-dev"
+version = "4.13.2-dev"
 
 
 @init

src/main/clj/dda/devops_build/devops.clj

@@ -1,19 +0,0 @@
-(ns dda.devops-build.devops
-  (:require
-   [clojure.spec.alpha :as s]
-   [dda.devops-build.devops.domain :as domain]))
-
-(s/def ::name ::domain/name)
-(s/def ::module ::domain/module)
-(s/def ::stage ::domain/stage)
-(s/def ::project-root-path ::domain/project-root-path)
-(s/def ::build-dir-name ::domain/build-dir-name)
-
-(s/def ::devops
-  (s/keys :req-un [::name]
-          :opt-un [::module ::stage ::project-root-path ::build-dir-name]))
-
-(def default {:name "dda-backup"
-              :project-root-path "."
-              :build-dir-name "target"
-              :stage "dev"})

src/main/clj/dda/devops_build/devops/domain.clj

@@ -1,35 +0,0 @@
-(ns dda.devops-build.devops.domain
-  (:require
-   [clojure.string :as str]
-   [clojure.spec.alpha :as s]
-   [orchestra.core :refer [defn-spec]]))
-
-(s/def ::name string?)
-(s/def ::module string?)
-(s/def ::stage string?)
-(s/def ::project-root-path string?)
-(s/def ::build-dir-name string?)
-
-(s/def ::devops
-  (s/keys :req-un [::name ::stage ::project-root-path ::build-dir-name]
-          :opt-un [::module]))
-
-(defn-spec build-path string?
-  [devops ::devops]
-  (let
-   [{:keys [project-root-path build-dir-name name module]} devops]
-    (str/join
-     "/"
-     (filter
-      some?
-      [project-root-path build-dir-name name module]))))
-
-(defn-spec clean-build-dir-command seq?
-  [devops ::devops]
-  (let [{:keys [name]} devops]
-    ["rm"  "-rf" (build-path devops)]))
-
-(defn-spec create-build-dir-command seq?
-  [devops ::devops]
-  (let [{:keys [name]} devops]
-    ["mkdir" "-p" (build-path devops)]))

src/main/clj/dda/devops_build/image.clj

@@ -1,17 +0,0 @@
-(ns dda.devops-build.image
-  (:require [orchestra.core :refer [defn-spec]]
-            [babashka.tasks :as t]
-            [dda.devops-build.devops :as d]
-            [dda.devops-build.devops.domain :as dd]
-            [dda.devops-build.image.domain :as domain]))
-
-(def default
-  (merge d/default {}))
-
-(defn-spec dbuild nil?
-  [devops ::d/devops]
-  (let [final (merge default devops)]
-    (apply t/shell (dd/clean-build-dir-command final))
-    (apply t/shell (dd/create-build-dir-command final))
-    (apply t/shell (domain/copy-image-command final))
-    (apply t/shell (domain/dbuild-command final))))

src/main/clj/dda/devops_build/image/domain.clj

@@ -1,16 +0,0 @@
-(ns dda.devops-build.image.domain
-  (:require [clojure.spec.alpha :as s]
-            [orchestra.core :refer [defn-spec]]
-            [dda.devops-build.devops.domain :as d]))
-
-(defn-spec copy-image-command seq?
-  [devops ::d/devops]
-  (let [{:keys [name]} devops]
-    ["cp" "-r" "image" (d/build-path devops)]))
-
-(defn-spec dbuild-command seq?
-  [devops ::d/devops]
-  (let [{:keys [name]} devops]
-    ["docker" "build" "-t" name "--file"
-     (str (d/build-path devops) "/image/Dockerfile")
-     (str (d/build-path devops) "/image")]))

src/main/clj/dda/devops_build/terragrunt.clj

@@ -1,17 +0,0 @@
-(ns dda.devops-build.image
-  (:require [orchestra.core :refer [defn-spec]]
-            [babashka.tasks :as t]
-            [dda.devops-build.devops :as d]
-            [dda.devops-build.devops.domain :as dd]
-            [dda.devops-build.terragrunt.domain :as dterra]))
-
-(def default
-  (merge d/default {}))
-
-(defn-spec plan nil?
-  [devops ::d/devops]
-  (let [final (merge default devops)]
-    (apply t/shell (dd/clean-build-dir-command final))
-    (apply t/shell (dd/create-build-dir-command final))
-    (apply t/shell (dterra/copy-terragrunt-command final))
-    (apply t/shell (dterra/plan-command final))))

src/main/python/ddadevops/application/release_mixin_services.py

@@ -53,7 +53,8 @@ class ReleaseService:
         bump_version = release_version.create_bump()
         release_message = f"release: {release_version.to_string()}"
         bump_message = f"bump version to: {bump_version.to_string()}"
-        self.git_api.tag_annotated(release_version.to_string(), release_message, 0)
+        release_tag = f"{release.release_tag_prefix}{release_version.to_string()}"
+        self.git_api.tag_annotated(release_tag, release_message, 0)
         self.__set_version_and_commit__(
             bump_version,
             release.build_files(),

src/main/python/ddadevops/domain/build_file.py

@@ -11,6 +11,7 @@ class BuildFileType(Enum):
     JS = ".json"
     JAVA_GRADLE = ".gradle"
     JAVA_CLOJURE = ".clj"
+    JAVA_CLOJURE_EDN = ".edn"
     PYTHON = ".py"
 
 
@@ -41,6 +42,8 @@ class BuildFile(Validateable):
                 result = BuildFileType.JAVA_CLOJURE
             case ".py":
                 result = BuildFileType.PYTHON
+            case ".edn":
+                result = BuildFileType.JAVA_CLOJURE_EDN
             case _:
                 result = None
         return result
@@ -48,11 +51,13 @@ class BuildFile(Validateable):
     def __get_file_type_regex_str(self, file_type: BuildFileType):
         match file_type:
             case BuildFileType.JAVA_GRADLE:
-                return r'(?P<pre_version>\bversion\s?=\s?)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT)?)\"'
+                return r"(?P<pre_version>\bversion\s?=\s?)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT)?)\""
             case BuildFileType.PYTHON:
-                return r'(?P<pre_version>\bversion\s?=\s?)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT|-dev\d*)?)\"'
+                return r"(?P<pre_version>\bversion\s?=\s?)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT|-dev\d*)?)\""
             case BuildFileType.JAVA_CLOJURE:
-                return r'(?P<pre_version>\(defproject\s(\S)*\s)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT)?)\"'
+                return r"(?P<pre_version>\(defproject\s(\S)*\s)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT)?)\""
+            case BuildFileType.JAVA_CLOJURE_EDN:
+                return r"(?P<pre_version>\:version\s+)\"(?P<version>\d*\.\d*\.\d*(-SNAPSHOT)?)\""
             case _:
                 return ""
 
@@ -62,8 +67,15 @@ class BuildFile(Validateable):
             match build_file_type:
                 case BuildFileType.JS:
                     version_str = json.loads(self.content)["version"]
-                case BuildFileType.JAVA_GRADLE | BuildFileType.PYTHON | BuildFileType.JAVA_CLOJURE:
-                    version_str = re.search(self.__get_file_type_regex_str(build_file_type), self.content).group("version")
+                case (
+                    BuildFileType.JAVA_GRADLE
+                    | BuildFileType.PYTHON
+                    | BuildFileType.JAVA_CLOJURE
+                    | BuildFileType.JAVA_CLOJURE_EDN
+                ):
+                    version_str = re.search(
+                        self.__get_file_type_regex_str(build_file_type), self.content
+                    ).group("version")
         except:
             raise RuntimeError(f"Version not found in file {self.file_path}")
 
@@ -84,10 +96,15 @@ class BuildFile(Validateable):
                     json_data = json.loads(self.content)
                     json_data["version"] = new_version.to_string()
                     self.content = json.dumps(json_data, indent=4)
-                case BuildFileType.JAVA_GRADLE | BuildFileType.PYTHON | BuildFileType.JAVA_CLOJURE:
+                case (
+                    BuildFileType.JAVA_GRADLE
+                    | BuildFileType.PYTHON
+                    | BuildFileType.JAVA_CLOJURE
+                    | BuildFileType.JAVA_CLOJURE_EDN
+                ):
                     substitute = re.sub(
                         self.__get_file_type_regex_str(build_file_type),
-                        fr'\g<pre_version>"{new_version.to_string()}"',
+                        rf'\g<pre_version>"{new_version.to_string()}"',
                         self.content,
                         1,
                     )

src/main/python/ddadevops/domain/common.py

@@ -78,6 +78,12 @@ class DnsRecord(Validateable):
             result.append("ipv4 & ipv6 may not both be empty.")
         return result
 
+    def ip(self) -> str:
+        if (self.ipv4):
+            return self.ipv4
+        else:
+            return self.ipv6
+
 
 class Devops(Validateable):
     def __init__(

src/main/python/ddadevops/domain/provs_k3s.py

@@ -20,6 +20,14 @@ CONFIG_CERTMANAGER = """certmanager:
 """
 CONFIG_ECHO = """echo: $echo
 """
+CONFIG_HETZNER_CSI = """hetzner:
+  hcloudApiToken:
+    source: "PLAIN"                  # PLAIN, GOPASS or PROMPT
+    parameter: $hcloud_api     # the api key for the hetzner cloud
+  encryptionPassphrase:
+    source: "PLAIN"                  # PLAIN, GOPASS or PROMPT
+    parameter: $encryption   # the encryption passphrase for created volumes
+"""
 
 
 class K3s(Validateable):
@@ -28,8 +36,11 @@ class K3s(Validateable):
         self.k3s_letsencrypt_email = inp.get("k3s_letsencrypt_email")
         self.k3s_letsencrypt_endpoint = inp.get("k3s_letsencrypt_endpoint", "staging")
         self.k3s_app_filename_to_provision = inp.get("k3s_app_filename_to_provision")
-        self.k3s_enable_echo = inp.get("k3s_enable_echo", "false")
+        self.k3s_enable_echo = inp.get("k3s_enable_echo", None)
         self.k3s_provs_template = inp.get("k3s_provs_template", None)
+        self.k3s_enable_hetzner_csi = inp.get("k3s_enable_hetzner_csi", False)
+        self.k3s_hetzner_api_token = inp.get("k3s_hetzner_api_token", None)
+        self.k3s_hetzner_encryption_passphrase = inp.get("k3s_hetzner_encryption_passphrase", None)
         self.provision_dns: Optional[DnsRecord] = None
 
     def validate(self) -> List[str]:
@@ -37,6 +48,9 @@ class K3s(Validateable):
         result += self.__validate_is_not_empty__("k3s_letsencrypt_email")
         result += self.__validate_is_not_empty__("k3s_letsencrypt_endpoint")
         result += self.__validate_is_not_empty__("k3s_app_filename_to_provision")
+        if self.k3s_enable_hetzner_csi:
+            result += self.__validate_is_not_empty__("k3s_hetzner_api_token")
+            result += self.__validate_is_not_empty__("k3s_hetzner_encryption_passphrase")
         if self.provision_dns:
             result += self.provision_dns.validate()
         return result
@@ -61,6 +75,9 @@ class K3s(Validateable):
             substitutes["letsencrypt_endpoint"] = self.k3s_letsencrypt_endpoint
         if self.k3s_enable_echo is not None:
             substitutes["echo"] = self.k3s_enable_echo
+        if self.k3s_enable_hetzner_csi:
+            substitutes["hcloud_api"] = self.k3s_hetzner_api_token
+            substitutes["encryption"] = self.k3s_hetzner_encryption_passphrase
         return self.__config_template__().substitute(substitutes)
 
     def command(self, devops: Devops):
@@ -69,7 +86,7 @@ class K3s(Validateable):
         cmd = [
             "provs-server.jar",
             "k3s",
-            f"{self.k3s_provision_user}@{self.provision_dns.fqdn}",
+            f"{self.k3s_provision_user}@{self.provision_dns.ip()}",
             "-c",
             f"{devops.build_path()}/out_k3sServerConfig.yaml",
             "-a",
@@ -89,4 +106,6 @@ class K3s(Validateable):
                 template_text += CONFIG_IPV4
             if self.provision_dns.ipv6 is not None:
                 template_text += CONFIG_IPV6
+            if self.k3s_enable_hetzner_csi:
+                template_text += CONFIG_HETZNER_CSI
         return Template(template_text)

src/main/python/ddadevops/domain/release.py

@@ -24,6 +24,7 @@ class Release(Validateable):
             "release_secondary_build_files", []
         )
         self.version = version
+        self.release_tag_prefix = inp.get("release_tag_prefix", "")
         self.release_artifact_server_url = inp.get("release_artifact_server_url")
         self.release_organisation = inp.get("release_organisation")
         self.release_repository_name = inp.get("release_repository_name")

src/test/clj/dda/devops_build/devops/domain_test.clj

@@ -1,40 +0,0 @@
-(ns dda.devops-build.devops.domain-test
-  (:require
-   [clojure.test :refer [deftest is are testing run-tests]]
-   [clojure.spec.test.alpha :as st]
-   [dda.devops-build.devops.domain :as cut]))
-
-(st/instrument `cut/build-path)
-(st/instrument `cut/create-build-dir-command)
-
-(deftest should-calculate-build-path
-  (is (= "../../target/dda-backup"
-         (cut/build-path {:name "dda-backup"
-                          :project-root-path "../.."
-                          :build-dir-name "target"
-                          :version "4.11.8-dev"
-                          :stage "dev"})))
-  (is (= "../../target/dda/backup"
-         (cut/build-path {:name "dda"
-                          :module "backup"
-                          :project-root-path "../.."
-                          :build-dir-name "target"
-                          :version "4.11.8-dev"
-                          :stage "dev"}))))
-
-(deftest should-calculate-clean-build-dir-command
-  (is (= ["rm" "-rf" "../../target/dda-backup"]
-         (cut/clean-build-dir-command {:name "dda-backup"
-                                       :project-root-path "../.."
-                                       :build-dir-name "target"
-                                       :version "4.11.8-dev"
-                                       :stage "dev"}))))
-
-(deftest should-calculate-create-build-dir-command
-  (is (= ["mkdir" "-p" "../../target/dda-backup"]
-         (cut/create-build-dir-command {:name "dda-backup"
-                                        :project-root-path "../.."
-                                        :build-dir-name "target"
-                                        :version "4.11.8-dev"
-                                        :stage "dev"}))))
-

src/test/clj/dda/devops_build/image/domain_test.clj

@@ -1,32 +0,0 @@
-(ns dda.devops-build.image.domain-test
-  (:require
-   [clojure.test :refer [deftest is are testing run-tests]]
-   [clojure.spec.test.alpha :as st]
-   [dda.devops-build.image.domain :as cut]))
-
-(st/instrument `cut/copy-image-command)
-(st/instrument `cut/dbuild-command)
- 
-
-(deftest should-calculate-copy-image-command
-  (is (= ["cp" "-r" "image" "../../target/dda-backup"]
-         (cut/copy-image-command {:name "dda-backup"
-                                  :project-root-path "../.."
-                                  :build-dir-name "target"
-                                  :version "4.11.8-dev"
-                                  :stage "dev"}))))
-
-(deftest should-calculate-dbuild-command
-  (is (= ["docker"
-          "build"
-          "-t"
-          "dda-backup"
-          "--file"
-          "../../target/dda-backup/image/Dockerfile"
-          "../../target/dda-backup/image"]
-         (cut/dbuild-command {:name "dda-backup"
-                              :project-root-path "../.."
-                              :build-dir-name "target"
-                              :version "4.11.8-dev"
-                              :stage "dev"}))))
-

src/test/python/domain/test_build_file.py

@@ -183,6 +183,34 @@ def test_should_parse_and_set_version_for_clj():
         == sut.content
     )
 
+def test_should_parse_and_set_version_for_clj_edn():
+    sut = BuildFile(
+        Path("./deps.edn"),
+        """
+{:project {:name org.domaindrivenarchitecture/dda-backup
+           :version "1.1.5-SNAPSHOT"}
+
+}
+""",
+    )
+    assert sut.get_version() == Version.from_str("1.1.5-SNAPSHOT", "SNAPSHOT")
+
+    sut = BuildFile(
+        Path("./deps.edn"),
+        """
+{:project {:name org.domaindrivenarchitecture/dda-backup
+           :version "1.1.5-SNAPSHOT"}
+
+}
+""",
+    )
+    sut.set_version(Version.from_str("1.1.5-SNAPSHOT", "SNAPSHOT").create_major())
+    assert (
+        '\n{:project {:name org.domaindrivenarchitecture/dda-backup\n           :version "2.0.0"}\n\n}\n'
+        == sut.content
+    )
+
+
 def test_should_throw_for_clj_wrong_version():
     sut = BuildFile(
         Path("./project.clj"),

src/test/python/domain/test_provs_k3s.py

@@ -24,7 +24,7 @@ def test_should_calculate_command():
     assert (
         "provs-server.jar "
         + "k3s "
-        + "k3s_provision_user@example.org "
+        + "k3s_provision_user@::1 "
         + "-c "
         + "root_path/target/name/module/out_k3sServerConfig.yaml "
         + "-a "

src/tools/clj/build.clj

@@ -1,64 +0,0 @@
-(ns build
-  (:require [clojure.tools.build.api :as b]
-            [clojure.edn :as edn]))
-
-(def project (-> (edn/read-string (slurp "deps.edn"))
-                 :aliases :neil :project))
-(def lib (or (:name project) 'my/lib1))
-
-;; use neil project set version 1.2.0 to update the version in deps.edn
-
-(def version (or (:version project)
-                 "1.2.0"))
-(def class-dir "target/classes")
-(def basis (b/create-basis {:project "deps.edn"}))
-(def uber-file (format "target/%s-%s-standalone.jar" (name lib) version))
-(def jar-file (format "target/%s-%s.jar" (name lib) version))
-
-(defn clean [_]
-  (b/delete {:path "target"}))
-
-(defn jar [_]
-  (b/write-pom {:class-dir class-dir
-                :lib lib
-                :version version
-                :basis basis
-                :src-dirs ["src"]
-                :pom-data
-                [[:licenses
-                  [:license
-                   [:name "MIT License"]
-                   [:url "https://opensource.org/license/mit/"]]]]})
-  (b/copy-dir {:src-dirs ["src" "resources"]
-               :target-dir class-dir})
-  (b/jar {:class-dir class-dir
-          :jar-file jar-file}))
-
-(defn install [_]
-  (jar {})
-  (b/install {:basis basis
-              :lib lib
-              :version version
-              :jar-file jar-file
-              :class-dir class-dir}))
-
-(defn uber [_]
-  (clean nil)
-  (b/copy-dir {:src-dirs ["src" "resources"]
-               :target-dir class-dir})
-  (b/compile-clj {:basis basis
-                  :src-dirs ["src"]
-                  :class-dir class-dir})
-  (b/uber {:class-dir class-dir
-           :uber-file uber-file
-           :basis basis}))
-
-(defn deploy [opts]
-  (clean opts)
-  (jar opts)
-  ((requiring-resolve 'deps-deploy.deps-deploy/deploy)
-   (merge {:installer :remote
-           :artifact jar-file
-           :pom-file (b/pom-path {:lib lib :class-dir class-dir})}
-          opts))
-  opts)

src/tools/clj/deps.edn

@@ -1 +0,0 @@
-{:deps {}}

src/tools/clj/test-runner.clj

@@ -1,15 +0,0 @@
-#!/usr/bin/env bb
-
-(require '[clojure.test :as t]
-         '[babashka.classpath :as cp])
-
-(cp/add-classpath "src:test")
-
-(require 'your.test-a 'your.test-b)
-
-(def test-results
-  (t/run-tests 'your.test-a 'your.test-b))
-
-(let [{:keys [fail error]} test-results]
-  (when (pos? (+ fail error))
-    (System/exit 1)))                

tests.edn

@@ -1,38 +0,0 @@
-#kaocha/v1
-{:kaocha/tests
- [{:kaocha.testable/id      :unit
-   :kaocha.testable/type    :kaocha.type/clojure.test
-   :kaocha/ns-patterns      ["-test$"],
-   :kaocha/source-paths     ["src/test/clj" "src/test/cljc"],
-   :kaocha/test-paths       ["src/test/clj" "src/test/cljc"],
-   :kaocha.filter/skip-meta [:kaocha/skip]}
-
-  {:kaocha.testable/id            :generative-fdef-checks
-   :kaocha.testable/type          :kaocha.type/spec.test.check
-   :kaocha/source-paths           ["src/main/clj" "src/main/cljc"]
-   :kaocha.spec.test.check/checks [{:kaocha.spec.test.check/syms            :all-fdefs
-                                    :clojure.spec.test.check/instrument?    true
-                                    :clojure.spec.test.check/check-asserts? true
-                                    :clojure.spec.test.check/opts           {:num-tests 10}}]}
-  ]
-
- :kaocha/reporter [kaocha.report/documentation]
-
- :kaocha/color? #profile {:default true
-                          :ci      false}
-
- ;; Run tests of file changes, unless running in CI server
- :kaocha/watch #profile {:default true :ci false}
-
- :kaocha/fail-fast? true
-
- :kaocha.plugin.randomize/randomize? false
-
- :kaocha/plugins
- [:kaocha.plugin/randomize
-  :kaocha.plugin/filter
-  :kaocha.plugin/capture-output
-  :kaocha.plugin.alpha/spec-test-check]
-
- :kaocha.plugin.capture-output/capture-output? true
- }