Skip to content

Commit 96be05d

Browse files
apostasieapostasie
committed
Add a proxy for CI resiliency
Signed-off-by: apostasie <[email protected]>
1 parent 7e4f77d commit 96be05d

File tree

4 files changed

+200
-3
lines changed

4 files changed

+200
-3
lines changed

‎.github/workflows/proxy_cache/Caddyfile.conf

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
# Caddy global config
2+
{
3+
https_port 443
4+
http_port 80
5+
6+
default_sni localhost
7+
admin :2024
8+
storage file_system {
9+
root "{$HOME}/proxy/certs"
10+
}
11+
skip_install_trust
12+
auto_https ignore_loaded_certs
13+
order cache before rewrite
14+
15+
acme_ca internal
16+
17+
log {
18+
output stdout
19+
format json
20+
level "info"
21+
}
22+
23+
cache {
24+
log_level "warn"
25+
26+
cache_keys {
27+
disable_body
28+
}
29+
30+
key {
31+
disable_body
32+
}
33+
34+
stale 31536000s
35+
ttl 31536000s
36+
37+
nuts {
38+
configuration {
39+
Dir "{$HOME}/proxy/cache"
40+
EntryIdxMode 1
41+
RWMode 0
42+
SegmentSize 1024
43+
NodeNum 42
44+
SyncEnable true
45+
StartFileLoadingMode 1
46+
}
47+
}
48+
}
49+
50+
servers {
51+
metrics
52+
}
53+
}
54+
55+
https://index.docker.io {
56+
tls internal
57+
log {
58+
output stdout
59+
format json
60+
level "info"
61+
}
62+
63+
reverse_proxy https://index.docker.io {
64+
# Try up to 5 times
65+
lb_retries 5
66+
# Wait one second between each try
67+
lb_try_interval 1s
68+
# Be sure to back out if Docker Hub gives us the 429 treatment
69+
unhealthy_status 429
70+
}
71+
}
72+
73+
https://registry-1.docker.io {
74+
tls internal
75+
76+
# Not enabling cache for Hub - doing this would require to be path specific
77+
78+
log {
79+
output stdout
80+
format json
81+
level "info"
82+
}
83+
84+
reverse_proxy https://registry-1.docker.io {
85+
# Try up to 5 times
86+
lb_retries 5
87+
# Wait one second between each try
88+
lb_try_interval 1s
89+
# Be sure to back out if Docker Hub gives us the 429 treatment
90+
unhealthy_status 429
91+
}
92+
}
93+
94+
http://deb.debian.org {
95+
cache
96+
97+
log {
98+
output stdout
99+
format json
100+
level "info"
101+
}
102+
103+
reverse_proxy http://deb.debian.org {
104+
# Try up to 5 times
105+
lb_retries 5
106+
# Wait one second between each try
107+
lb_try_interval 1s
108+
}
109+
}
110+
111+
https://deb.debian.org {
112+
tls internal
113+
114+
cache
115+
116+
log {
117+
output stdout
118+
format json
119+
level "info"
120+
}
121+
122+
reverse_proxy http://deb.debian.org {
123+
# Try up to 5 times
124+
lb_retries 5
125+
# Wait one second between each try
126+
lb_try_interval 1s
127+
}
128+
}
129+
130+
http://ports.ubuntu.com {
131+
cache
132+
133+
log {
134+
output stdout
135+
format json
136+
level "info"
137+
}
138+
139+
reverse_proxy http://ports.ubuntu.com {
140+
# Try up to 5 times
141+
lb_retries 5
142+
# Wait one second between each try
143+
lb_try_interval 1s
144+
}
145+
}
146+
147+
https://ports.ubuntu.com {
148+
tls internal
149+
150+
cache
151+
152+
log {
153+
output stdout
154+
format json
155+
level "info"
156+
}
157+
158+
reverse_proxy http://ports.ubuntu.com {
159+
# Try up to 5 times
160+
lb_retries 5
161+
# Wait one second between each try
162+
lb_try_interval 1s
163+
}
164+
}

‎.github/workflows/proxy_cache/Dockerfile

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
FROM golang:bookworm
2+
RUN go install github.com/caddyserver/xcaddy/cmd/[email protected]
3+
RUN "$(go env GOPATH)"/bin/xcaddy build --with github.com/caddyserver/cache-handler --with github.com/darkweak/storages/nuts/caddy
4+
COPY ./Caddyfile.conf /config/Caddyfile.conf
5+
CMD ["./caddy", "run", "--config", "/config/Caddyfile.conf", "--adapter", "caddyfile"]

‎.github/workflows/proxy_cache/setup.sh

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/usr/bin/env bash
2+
# shellcheck disable=SC2034,SC2015
3+
set -o errexit -o errtrace -o functrace -o nounset -o pipefail
4+
root="$(cd "$(dirname "${BASH_SOURCE[0]:-$PWD}")" 2>/dev/null 1>&2 && pwd)"
5+
readonly root
6+
7+
# Cleanup for repeat local development
8+
docker rmi -f caddy
9+
docker rm -f proxy
10+
# Build the caddy image
11+
docker build -t caddy -f "$root"/Dockerfile "$root"
12+
# Run it, exposing 80 and 443 (+2024 for the admin / trust)
13+
docker run -d --restart always --name proxy -p 80:80 -p 443:443 -p 2024:2024 caddy
14+
# Copy caddy here and trust the generated certificate
15+
docker cp proxy:/go/caddy .
16+
./caddy trust --address localhost:2024
17+
# Point docker registry to our proxy
18+
echo "127.0.0.1 registry-1.docker.io" | sudo tee -a /etc/hosts >/dev/null
19+
echo "127.0.0.1 ports.ubuntu.com" | sudo tee -a /etc/hosts >/dev/null
20+
echo "127.0.0.1 deb.debian.org" | sudo tee -a /etc/hosts >/dev/null
21+
# Restart docker to take into account the newly trusted certificate
22+
sudo systemctl restart docker

‎.github/workflows/test.yml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,10 @@ jobs:
7777
- uses: actions/[email protected]
7878
with:
7979
fetch-depth: 1
80+
- name: "Setup proxy"
81+
run: ./.github/workflows/proxy_cache/setup.sh
8082
- name: "Prepare integration test environment"
81-
run: docker build -t test-integration --target test-integration --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
83+
run: docker build --network host --add-host=ports.ubuntu.com:127.0.0.1 --add-host=deb.debian.org:127.0.0.1 -t test-integration --target test-integration --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
8284
- name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
8385
run: |
8486
sudo systemctl disable --now snapd.service snapd.socket
@@ -128,8 +130,10 @@ jobs:
128130
sudo mkdir -p /etc/docker
129131
echo '{"ipv6": true, "fixed-cidr-v6": "2001:db8:1::/64", "experimental": true, "ip6tables": true}' | sudo tee /etc/docker/daemon.json
130132
sudo systemctl restart docker
133+
- name: "Setup proxy"
134+
run: ./.github/workflows/proxy_cache/setup.sh
131135
- name: "Prepare integration test environment"
132-
run: docker build -t test-integration-ipv6 --target test-integration-ipv6 --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
136+
run: docker build --network host --add-host=ports.ubuntu.com:127.0.0.1 --add-host=deb.debian.org:127.0.0.1 -t test-integration-ipv6 --target test-integration-ipv6 --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} .
133137
- name: "Remove snap loopback devices (conflicts with our loopback devices in TestRunDevice)"
134138
run: |
135139
sudo systemctl disable --now snapd.service snapd.socket
@@ -215,8 +219,10 @@ jobs:
215219
docker run --privileged --rm tonistiigi/binfmt --install linux/amd64
216220
docker run --privileged --rm tonistiigi/binfmt --install linux/arm64
217221
docker run --privileged --rm tonistiigi/binfmt --install linux/arm/v7
222+
- name: "Setup proxy"
223+
run: ./.github/workflows/proxy_cache/setup.sh
218224
- name: "Prepare (network driver=slirp4netns, port driver=builtin)"
219-
run: docker build -t ${TEST_TARGET} --target ${TEST_TARGET} --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} --build-arg ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION} .
225+
run: docker build --network host --add-host=ports.ubuntu.com:127.0.0.1 --add-host=deb.debian.org:127.0.0.1 -t ${TEST_TARGET} --target ${TEST_TARGET} --build-arg UBUNTU_VERSION=${UBUNTU_VERSION} --build-arg CONTAINERD_VERSION=${CONTAINERD_VERSION} --build-arg ROOTLESSKIT_VERSION=${ROOTLESSKIT_VERSION} .
220226
- name: "Disable BuildKit for RootlessKit v1 (workaround for issue #622)"
221227
run: |
222228
# https://github.com/containerd/nerdctl/issues/622

0 commit comments

Comments
 (0)