Skip to content

Commit 50d4d66

Browse files
florianowflorianow
authored
Merge pull request #1 from meshcloud/feature/refactoring
Feature/refactoring
2 parents 6fa73dd + d3e2e42 commit 50d4d66

28 files changed

+1695
-452
lines changed

‎.github/actions/setup-nix-shell/action.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: 'Setup nix shell'
2+
inputs:
3+
prepare_terraform:
4+
description: prepare a terraform execution environment with cache and backend authentication
5+
default: false
6+
required: false
7+
outputs: {}
8+
runs:
9+
using: "composite"
10+
steps:
11+
- uses: nixbuild/nix-quick-install-action@v26
12+
with:
13+
# gh actions runners have 16 GiB of memory by default, we happily trade some of that for a significant speedup
14+
# of nix install (empirically this cut install times from from 75s to 30s when introduced)
15+
nix_on_tmpfs: true
16+
17+
- uses: rrbutani/use-nix-shell-action@v1
18+
with:
19+
devShell: .#github_actions # use a special github actions shell
20+
21+
- name: create terraform cache
22+
if: ${{ inputs.prepare_terraform }}
23+
shell: bash
24+
run: |
25+
dir=${{ runner.temp }}/.terraform.d/plugin-cache
26+
mkdir -p $dir # create terraform plugin cache
27+
echo "TF_PLUGIN_CACHE_DIR=$dir" >> $GITHUB_ENV

‎.github/workflows/build-container.yml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
name: Build and Push Coraza-Caddy Container
2+
3+
on:
4+
schedule:
5+
# Build weekly to get latest security updates
6+
- cron: '0 2 * * 1'
7+
push:
8+
branches: [ main, feature/* ]
9+
paths:
10+
- 'Dockerfile'
11+
- 'Caddyfile'
12+
- '.github/workflows/build-container.yml'
13+
pull_request:
14+
branches: [ main ]
15+
paths:
16+
- 'Dockerfile'
17+
- 'Caddyfile'
18+
workflow_dispatch:
19+
inputs:
20+
branch:
21+
description: 'Branch to build from'
22+
required: false
23+
default: 'main'
24+
type: string
25+
caddy_version:
26+
description: 'Caddy version to build'
27+
required: false
28+
default: '2.7'
29+
type: string
30+
coraza_version:
31+
description: 'Coraza version to build'
32+
required: false
33+
default: 'v2'
34+
type: string
35+
push_image:
36+
description: 'Push image to registry'
37+
required: false
38+
default: true
39+
type: boolean
40+
test_locally:
41+
description: 'Run local container tests'
42+
required: false
43+
default: true
44+
type: boolean
45+
46+
env:
47+
REGISTRY: ghcr.io
48+
IMAGE_NAME: ${{ github.repository }}/coraza-caddy
49+
50+
jobs:
51+
check:
52+
name: Container Checks
53+
runs-on: ubuntu-latest
54+
permissions:
55+
contents: read
56+
steps:
57+
- uses: actions/checkout@v4
58+
59+
- name: Setup environment
60+
uses: ./.github/actions/setup-nix-shell
61+
62+
- name: Run container-specific pre-commit hooks
63+
run: pre-commit run --files Dockerfile Caddyfile --show-diff-on-failure
64+
65+
build:
66+
runs-on: ubuntu-latest
67+
permissions:
68+
contents: read
69+
packages: write
70+
security-events: write
71+
72+
steps:
73+
- name: Checkout repository
74+
uses: actions/checkout@v4
75+
76+
- name: Set up Docker Buildx
77+
uses: docker/setup-buildx-action@v3
78+
79+
- name: Log in to Container Registry
80+
uses: docker/login-action@v3
81+
with:
82+
registry: ${{ env.REGISTRY }}
83+
username: ${{ github.actor }}
84+
password: ${{ secrets.GITHUB_TOKEN }}
85+
86+
- name: Extract metadata
87+
id: meta
88+
uses: docker/metadata-action@v5
89+
with:
90+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
91+
tags: |
92+
type=raw,value=caddy-${{ github.event.inputs.caddy_version || '2.8' }}-coraza-${{ github.event.inputs.coraza_version || 'v2.0.0' }}
93+
type=sha,prefix=build-
94+
type=raw,value=latest,enable={{is_default_branch}}
95+
96+
- name: Build and push Docker image
97+
uses: docker/build-push-action@v5
98+
with:
99+
context: .
100+
platforms: linux/amd64,linux/arm64
101+
push: ${{ github.ref == 'refs/heads/main' || (github.event.inputs.push_image == 'true') }}
102+
tags: ${{ steps.meta.outputs.tags }}
103+
labels: ${{ steps.meta.outputs.labels }}
104+
build-args: |
105+
CADDY_VERSION=${{ github.event.inputs.caddy_version || '2.8' }}
106+
CORAZA_VERSION=${{ github.event.inputs.coraza_version || 'v2.0.0' }}
107+
cache-from: type=gha
108+
cache-to: type=gha,mode=max
109+
110+
- name: Run Trivy vulnerability scanner
111+
uses: aquasecurity/trivy-action@master
112+
with:
113+
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
114+
format: 'sarif'
115+
output: 'trivy-results.sarif'
116+
117+
- name: Upload Trivy scan results to GitHub Security tab
118+
uses: github/codeql-action/upload-sarif@v3
119+
if: always()
120+
with:
121+
sarif_file: 'trivy-results.sarif'
122+
123+
- name: Test container
124+
if: ${{ github.event.inputs.test_locally != 'false' }}
125+
run: |
126+
set -euo pipefail
127+
IMAGE_TAG=${{ fromJSON(steps.meta.outputs.json).tags[0] }}
128+
echo "🧪 Testing image: $IMAGE_TAG"
129+
130+
echo "Testing built container..."
131+
docker run --rm -d --name test-coraza \
132+
-p 8080:8080 -p 8443:8443 \
133+
$IMAGE_TAG
134+
135+
sleep 15
136+
137+
# Test health endpoint
138+
echo "Testing health endpoint..."
139+
curl -f http://localhost:8080/health || exit 1
140+
141+
# Test WAF is responding
142+
echo "Testing WAF response..."
143+
curl -k -f https://localhost:8443/ -o /dev/null -w "%{http_code}" || echo "Expected failure - no backend"
144+
145+
docker stop test-coraza
146+
echo "Container tests completed successfully!"
147+
148+
- name: Build summary
149+
run: |
150+
echo "## 🐳 Container Build Summary" >> $GITHUB_STEP_SUMMARY
151+
echo "- **Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
152+
echo "- **Image:** ${{ fromJSON(steps.meta.outputs.json).tags[0] }}" >> $GITHUB_STEP_SUMMARY
153+
if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
154+
echo "- **Status:** ✅ Built and pushed to registry" >> $GITHUB_STEP_SUMMARY
155+
else
156+
echo "- **Status:** ✅ Built successfully (not pushed - feature branch)" >> $GITHUB_STEP_SUMMARY
157+
fi

‎.github/workflows/terraform-test.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Terraform Validation and Testing
2+
3+
on:
4+
push:
5+
branches: [ main, feature/* ]
6+
paths:
7+
- '*.tf'
8+
- '*.tfvars'
9+
- '*.tftest.hcl'
10+
- '.terraform-docs.yml'
11+
- '.tflint.hcl'
12+
- '.pre-commit-config.yaml'
13+
- '.github/workflows/terraform-test.yml'
14+
pull_request:
15+
branches: [ main ]
16+
paths:
17+
- '*.tf'
18+
- '*.tfvars'
19+
- '*.tftest.hcl'
20+
- '.terraform-docs.yml'
21+
- '.tflint.hcl'
22+
- '.pre-commit-config.yaml'
23+
workflow_dispatch:
24+
25+
jobs:
26+
terraform-checks:
27+
name: Terraform Checks & Validation
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
32+
steps:
33+
- name: Checkout repository
34+
uses: actions/checkout@v4
35+
36+
- name: Setup environment
37+
uses: ./.github/actions/setup-nix-shell
38+
with:
39+
prepare_terraform: true
40+
41+
- name: Run pre-commit hooks
42+
run: pre-commit run --all-files --show-diff-on-failure
43+
44+
- name: Terraform Init
45+
run: terraform init -backend=false
46+
47+
- name: Terraform Validate
48+
run: terraform validate
49+
50+
# TODO: creating a subccription and a service principal for testing
51+
# terraform-test:
52+
# name: Terraform Test Suite
53+
# runs-on: ubuntu-latest
54+
# needs: terraform-checks
55+
# permissions:
56+
# contents: read
57+
58+
# steps:
59+
# - name: Checkout repository
60+
# uses: actions/checkout@v4
61+
62+
# - name: Setup environment
63+
# uses: ./.github/actions/setup-nix-shell
64+
# with:
65+
# prepare_terraform: true
66+
67+
# - name: Terraform Init
68+
# run: terraform init -backend=false
69+
70+
# - name: Terraform Test
71+
# run: terraform test

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,4 +79,4 @@ helpers/foundation-deployer/.steps.json
7979
*.tf-e
8080

8181
# Go multi-module workspace sum
82-
go.work.sum
82+
go.work.sum

‎.pre-commit-config.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
repos:
2+
- repo: https://github.com/antonbabenko/pre-commit-terraform
3+
rev: v1.88.4
4+
hooks:
5+
- id: terraform_docs
6+
args:
7+
- --args=--config=.terraform-docs.yml
8+
- id: terraform_fmt
9+
- id: terragrunt_fmt
10+
- id: terragrunt_providers_lock
11+
stages:
12+
- manual # note: this step is very expensive, so you need to invoke it explicitly via `--hook-stage manual`
13+
args:
14+
- --args=-platform=darwin_arm64
15+
- --args=-platform=darwin_amd64
16+
- --args=-platform=linux_amd64
17+
18+
- id: terraform_tflint
19+
args:
20+
- --args=--config=.tflint.hcl
21+
22+
# tfupdate hooks for aligning terraform and provider versions
23+
# aligning versions helps build performance becuase there's less providers to download/cache across all our modules
24+
- id: tfupdate
25+
name: tfupdate terraform
26+
args:
27+
- --args=terraform
28+
- --args=--version ">= 1.0"
29+
30+
- id: tfupdate
31+
name: tfupdate hashicorp/azurerm
32+
args:
33+
- --args=provider hashicorp/azurerm
34+
- --args=--version "4.36.0"
35+
- --args=--ignore-path "kit/.*/buildingblocks/.*"
36+
- --args=--ignore-path "kit/.*/demos/.*"
37+
- --args=--ignore-path "kit/azure/meshplatform-au"
38+
- --args=--ignore-path "kit/azure/landingzones/au-cloud-native"
39+
40+
41+
- repo: https://github.com/pre-commit/pre-commit-hooks
42+
rev: v4.4.0 # Use the ref you want to point at
43+
hooks:
44+
- id: trailing-whitespace
45+
- id: end-of-file-fixer
46+
- id: check-merge-conflict
47+
48+
- repo: https://github.com/hadolint/hadolint
49+
rev: v2.12.0
50+
hooks:
51+
- id: hadolint-docker
52+
args: ['--ignore', 'DL3008', '--ignore', 'DL3009', '--ignore', 'DL3018']

‎.terraform-docs.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
formatter: "markdown" # this is required
2+
3+
version: ""
4+
5+
recursive:
6+
enabled: false
7+
path: kit
8+
9+
content: ""
10+
11+
output:
12+
file: "README.md"
13+
mode: inject
14+
template: |-
15+
<!-- BEGIN_TF_DOCS -->
16+
{{ .Content }}
17+
<!-- END_TF_DOCS -->
18+
19+
sort:
20+
enabled: true
21+
by: name
22+
23+
sections:
24+
hide:
25+
- providers

‎.tflint.hcl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
rule "terraform_typed_variables" {
2+
enabled = false
3+
}
4+
5+
rule "terraform_required_version" {
6+
enabled = false
7+
}
8+
9+
//terraform_unused_declarations
10+
rule "terraform_unused_declarations" {
11+
enabled = false
12+
}

0 commit comments

Comments
 (0)