.gitlab-ci.yml

variables:
  DOCKER_DRIVER: overlay2
  IMAGE_BUILDER: gcr.io/${GCP_PROJECT_ID}/yubico/developers-builder:latest
  IMAGE_HTTPD: gcr.io/${GCP_PROJECT_ID}/yubico/developers-httpd:latest
  IMAGE_TAG: gcr.io/${GCP_PROJECT_ID}/yubico/developers-httpd:${CI_PIPELINE_ID}

stages:
  - docker
  - htdocs
  - httpd
  - deploy

# build image containing environment for running ./build script
docker:
  stage: docker
  image: google/cloud-sdk:latest
  script:
    - docker build -t ${IMAGE_BUILDER} -f Dockerfile.prod.build .
    - docker login -u _json_key -p "${GCR_ADMIN_KEY}" https://gcr.io
    - docker push ${IMAGE_BUILDER}

# generate static content using image built from previous stage.
#
# gitlab ci wants to have "image:" pulled from an external docker repository,
#   i.e. previous stage can't build locally and then refer to it via local tag.
htdocs:
  stage: htdocs
  image: ${IMAGE_BUILDER}

  before_script:

    # required to pull yubico-binaries.git
    - umask 0077
    - mkdir -p ~/.ssh
    - echo "$SSH_KEY" > ~/.ssh/id_rsa
    - echo "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
    - echo -e 'StrictHostKeyChecking yes\nIdentitiesOnly yes\n' > ~/.ssh/config

    # create git cache directory (if not already present),
    #   and symlink to working directory as .cache (to please build script).
    - mkdir -p /var/tmp/developers/git
    - ln -s /var/tmp/developers/git ./.cache

    # provide a pristine htdocs directory for build script,
    #   which is where generated static content will be written to.
    - HTDOCS=/var/tmp/developers/htdocs
    - rm -rf "$HTDOCS" && mkdir "$HTDOCS" && ln -s "$HTDOCS" ./htdocs

  script:

    # generate static content,
    #   readable by all and writeable only by owner.
    #
    # this will allow us to COPY into container as chown root:root,
    #   without having to chmod all files again.
    - umask 0022 && ./build

httpd:
  stage: httpd
  image: docker:18.09.3
  script:

    # create build context in /var/tmp/developers volume,
    #   by copying necessary files along side generated static content.
    #
    # we can't have "COPY /var/tmp/developers/..." in Dockefile,
    #   because this runs in host docker... (via socket).
    - cp Dockerfile.prod.httpd httpd.conf /var/tmp/developers/htdocs
    - cd /var/tmp/developers/htdocs

    # build final image and push to registry
    - docker build -f Dockerfile.prod.httpd -t ${IMAGE_HTTPD} .
    - docker tag ${IMAGE_HTTPD} ${IMAGE_TAG}
    - docker login -u _json_key -p "${GCR_ADMIN_KEY}" https://gcr.io
    - docker push ${IMAGE_HTTPD}
    - docker push ${IMAGE_TAG}

deploy:
  stage: deploy
  image: google/cloud-sdk:latest
  script:

    - umask 077
    - echo "${GKE_DEPLOYER_KEY}" > /tmp/deployer_key.json
    - gcloud auth activate-service-account --key-file=/tmp/deployer_key.json
    - rm /tmp/deployer_key.json

    - gcloud config set project "${GCP_PROJECT_ID}"
    - gcloud container clusters get-credentials "${GKE_NAME}" --region="${GKE_REGION}"

    # ask kubernetes to deploy new image (this is async)
    - kubectl -n developers-site set image deployment/developers-site developers-httpd="${IMAGE_TAG}"

    # block until rollout has completed
    - kubectl -n developers-site rollout status deployment/developers-site