.gitlab-ci.yml

stages:
  - build
  - test
  - release
  - deploy

variables:
  GIT_SUBMODULE_STRATEGY: normal
  HOSTNAME: nodejs.dc-git.my.corp
  FF_NETWORK_PER_BUILD: 1
  INITIALIZATION_TIME: 180
  NODE_RED_UI_HOST: /var/run/node-red/sock

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Container-Scanning.gitlab-ci.yml
    rules:
      - if: $CI_SERVER_HOST == "gitlab.com"

#container_scanning:
#  variables:
#    CS_IMAGE: $CI_REGISTRY_IMAGE:$CI_PIPELINE_ID

container:
  image: quay.io/buildah/stable
  stage: build
  variables:
    STORAGE_DRIVER: "vfs"
  before_script:
    - if [ "${ARCH}" != "amd64" ]; then dnf -y install qemu-user-static; fi
    - buildah login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
  script:
    - |
      buildah bud --arch "${ARCH}" --variant "${VARIANT}" --format docker --isolation chroot -f Dockerfile \
          --label org.opencontainers.image.documentation="${CI_PAGES_URL}" \
          --label org.opencontainers.image.url="${CI_PROJECT_URL}" \
          --label org.opencontainers.image.source="${CI_REPOSITORY_URL}" \
          --label org.opencontainers.image.description="${CI_PROJECT_DESCRIPTION}" \
          --label org.opencontainers.image.version="${CI_COMMIT_TAG:=HEAD}" \
          --label org.opencontainers.image.revision="${CI_COMMIT_SHA}" \
          -t "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}" \
          -t "${CI_REGISTRY_IMAGE}/${ARCH}:${CI_PIPELINE_ID}" \
          .
    - if [ "${ARCH}" == "amd64" ]; then buildah push "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"; fi
    - buildah push "${CI_REGISTRY_IMAGE}/${ARCH}:${CI_PIPELINE_ID}"
  after_script:
    - buildah logout "${CI_REGISTRY}"
  parallel:
    matrix:
      - ARCH: ["amd64"]
        VARIANT: [""]
      - ARCH: ["arm"]
        VARIANT: ["v7"]
#  rules:
#    - changes:
#        - Dockerfile
#        - flows/

downloads:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get -q update
    - apt-get -q install -y curl
    - sleep ${INITIALIZATION_TIME}
  script:
    - curl -v http://${HOSTNAME}/
    - curl -v http://${HOSTNAME}/download/Root/ca.crt.pem

chain:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get -q update
    - apt-get -q install -y curl openssl
    - sleep ${INITIALIZATION_TIME}
  script:
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
    - openssl x509 -in root.crt.pem -noout -fingerprint -sha256
    - curl http://${HOSTNAME}/download/Sub/ca.crt.pem > sub.crt.pem
    - openssl verify -verbose -check_ss_sig -CAfile root.crt.pem sub.crt.pem

crls:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get -q update
    - apt-get -q install -y curl openssl
    - sleep ${INITIALIZATION_TIME}
  script:
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
    - curl http://${HOSTNAME}/download/Sub/ca.crt.pem > sub.crt.pem
    - "CRL_URI=$(openssl x509 -in sub.crt.pem -noout -text | grep -A3 'X509v3 CRL Distribution Points' | awk -FURI: '/URI:/ { print $2 }')"
    - echo CRL_URI=${CRL_URI}
    - curl -v ${CRL_URI} > root.crl.der
    - curl -v ${CRL_URI/.der/.pem} > root.crl.pem
    - openssl crl -CAfile root.crt.pem -noout -text -inform DER -in root.crl.der -verify
    - openssl verify -verbose -CAfile root.crt.pem -crl_download -crl_check sub.crt.pem
    # Check Sub-CA's CRL
    - openssl s_client -showcerts -connect ${HOSTNAME}:443 < /dev/null | openssl x509 > https.crt.pem
    - "CRL_URI=$(openssl x509 -in https.crt.pem -noout -text | grep -A3 'X509v3 CRL Distribution Points' | awk -FURI: '/URI:/ { print $2 }')"
    - echo CRL_URI=${CRL_URI}
    - curl -v ${CRL_URI} > sub.crl.der
    - openssl crl -CAfile sub.crt.pem -noout -text -inform DER -in sub.crl.der -verify
    - curl -v ${CRL_URI/.der/.pem} > sub.crl.pem
  artifacts:
    paths:
      - "*.crt.pem"
      - "*.crl.pem"
      - "*.crl.der"
    when: on_failure

ocsp:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get update
    - apt-get install -y curl openssl
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
    - curl http://${HOSTNAME}/download/Sub/ca.crt.pem > sub.crt.pem
    - openssl s_client -CAfile root.crt.pem -showcerts -connect ${HOSTNAME}:443 < /dev/null | openssl x509 > https.crt.pem
    - openssl x509 -in https.crt.pem -noout -text
  script:
    - openssl ocsp -CAfile root.crt.pem -issuer sub.crt.pem -trust_other -cert https.crt.pem -url $(openssl x509 -in https.crt.pem -noout -ocsp_uri)

metrics:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get update
    - apt-get install -y curl prometheus
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
  script:
    - curl -vv --cacert root.crt.pem -o metrics.prom https://${HOSTNAME}/metrics
    - cat metrics.prom | promtool check metrics

https 🌏:
  image: debian:bullseye
  variables:
    PHONE_OUT: "true"
    ADDITIONAL_CA_FILES: "root.crt.pem"
    GIT_STRATEGY: none
    APACHE_OCSP_STAPLING: "true"
    HTTPS_TLS_STATUS_REQUEST: "true"
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  stage: test
  before_script:
    - echo -e "\e[0Ksection_start:$(date +%s):https_pre_requisites[collapsed=true]\r\e[0KInstall pre-requisites"
    - apt-get -q update
    - apt-get -q install -y curl openssl testssl.sh
    - echo -e "\e[0Ksection_end:$(date +%s):https_pre_requisites\r\e[0K"
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > "${ADDITIONAL_CA_FILES}"
  script:
    - openssl s_client -cipher ECDHE-RSA-AES256-GCM-SHA384 -showcerts -CAfile "${ADDITIONAL_CA_FILES}" -servername "${HOSTNAME}" -connect ${HOSTNAME}:443 </dev/null || true
    - openssl s_client -cipher ECDHE-ECDSA-AES256-GCM-SHA384 -showcerts -CAfile "${ADDITIONAL_CA_FILES}" -servername "${HOSTNAME}" -connect ${HOSTNAME}:443 </dev/null
    - openssl s_client -showcerts -connect ${HOSTNAME}:443 | openssl x509 -noout -text
    - testssl --debug 2 https://${HOSTNAME}/ || echo "testssl exit code $?"

ui:
  image: debian:bullseye
  variables:
    ADMIN_CERTIFICATE: "true"
    GIT_STRATEGY: none
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
      entrypoint: ["/bin/sh", "-c", "mkdir /builds/Admin /builds/Sub /builds/Root && ln -s /builds/Admin /data/Admin && ln -s /builds/Sub /data/Sub && ln -s /builds/Root /data/Root && chown node-red /builds/Admin /builds/Sub /builds/Root && ls -l /builds/ /data/ && exec /usr/bin/entrypoint.sh"]
  stage: test
  before_script:
    - apt-get -q update
    - apt-get -q install -y curl openssl
    - sleep ${INITIALIZATION_TIME}
  script:
    - ls -lR /builds/{Admin,Root,Sub}
    - openssl x509 -noout -text -in /builds/Root/certificates/*/ca.crt.pem -nameopt multiline,show_type -certopt no_sigdump
    - openssl x509 -noout -text -in /builds/Admin/certificates/*/???*.crt.pem -nameopt multiline,show_type -certopt no_sigdump
    - echo curl -L -v --cacert /builds/Root/certificates/*/ca.crt.pem --key /builds/Admin/keys/*/???*.priv.key.pem --cert /builds/Admin/certificates/*/???*.crt.pem https://${HOSTNAME}/
    - curl -L -v --cacert /builds/Root/certificates/*/ca.crt.pem --key /builds/Admin/keys/*/???*.priv.key.pem --cert /builds/Admin/certificates/*/???*.crt.pem https://${HOSTNAME}/

websocket:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - apt-get -q update
    - apt-get -q install -y curl openssl
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
  script:
    - "echo 'I am groot' | curl --cacert root.crt.pem --location --include --no-buffer --header 'Connection: Upgrade' --header 'Upgrade: websocket' --header 'Host: ${HOSTNAME}' --header 'Origin: ${HOSTNAME}' --header 'Sec-WebSocket-Key: $(openssl rand 16 | openssl enc -base64)' --header 'Sec-WebSocket-Version: 13' https://${HOSTNAME}/admin/comms"
  when: manual

audit:
  image:
    name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
    entrypoint: ["/bin/sh", "-c"]
  stage: test
  script:
    - pwd
    - cd /usr/src/node-red
    - ls -l
    - npm audit --omit=dev || (npm audit fix --omit=dev && false)
  rules:
    - if: '$CI_PIPELINE_SOURCE != "schedule"'
      allow_failure: true
    - if: '$CI_PIPELINE_SOURCE == "schedule"'

tsa:
  image: archlinux:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  variables:
    GIT_STRATEGY: none
  stage: test
  before_script:
    - pacman --noconfirm -Syu
    - pacman --noconfirm -Sy openssl curl
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
  script:
    - dd if=/dev/urandom of=data.bin bs=1 count=512
    - openssl ts -query -data data.bin -sha256 -cert -out tsq.der
    - "curl -H 'Content-Type: application/timestamp-query' --data-binary '@tsq.der' http://${HOSTNAME}/tsa/Root > tsr.der"
    - openssl ts -verify -in tsr.der -queryfile tsq.der -CAfile root.crt.pem

acme:
  image: debian:latest
  services:
    - name: "${CI_REGISTRY_IMAGE}:${CI_PIPELINE_ID}"
      alias: nodejs.dc-git.my.corp
  stage: test
  variables:
    CERTBOT_DIR: certbot
    CERTBOT_ARGS: "--config-dir=${CERTBOT_DIR}/etc/ --work-dir=${CERTBOT_DIR}/work/ --logs-dir=${CERTBOT_DIR}/log/ --server=https://${HOSTNAME}/acme/Sub/"
    GIT_STRATEGY: none
    NODE_RED_LOGGING_CONSOLE_LEVEL: "info"
    CI_DEBUG_SERVICES: "true"
  before_script:
    - apt-get -q update
    - apt-get -q install -y certbot curl
    - sleep ${INITIALIZATION_TIME}
    - curl http://${HOSTNAME}/download/Root/ca.crt.pem > root.crt.pem
    - curl http://${HOSTNAME}/download/Sub/ca.crt.pem > sub.crt.pem
  script:
    - export REQUESTS_CA_BUNDLE=$(pwd)/root.crt.pem
    - echo ${REQUESTS_CA_BUNDLE}
    - NAME=$(hostname -f)
    - echo ${NAME}
    - certbot register ${CERTBOT_ARGS} --no-eff-email --email=node@my.corp --agree-tos
    # TODO: Certbot wasn't able to bind to :80 using IPv4, this is often expected
    # due to the dual stack nature of IPv6 socket implementations.
    # - certbot certonly ${CERTBOT_ARGS} --standalone -d ${NAME}
    # - certbot revoke ${CERTBOT_ARGS} --no-delete-after-revoke --cert-path "${CERTBOT_DIR}/etc/live/${NAME}/cert.pem"
    # - openssl ocsp -CAfile root.crt.pem -issuer sub.crt.pem -trust_other -cert "${CERTBOT_DIR}/etc/live/${NAME}/cert.pem" -url http://${HOSTNAME}/ocsp/Sub/
  artifacts:
    when: on_failure
    paths:
      - ${CERTBOT_DIR}/log/

gitlab:
  image: quay.io/buildah/stable
  stage: release
  variables:
    STORAGE_DRIVER: vfs
    GIT_STRATEGY: none
    COSIGN_YES: "true"
    REGISTRY_AUTH_FILE: ".docker/config.json"
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore
  before_script:
    - mkdir -m 700 -p "$(dirname "${REGISTRY_AUTH_FILE}")"
    - buildah login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
  script:
    - buildah manifest create list
    - buildah manifest add list "${CI_REGISTRY_IMAGE}/amd64:${CI_PIPELINE_ID}"
    - buildah manifest add --variant "v7" list "${CI_REGISTRY_IMAGE}/arm:${CI_PIPELINE_ID}"
    - buildah manifest inspect list
    - echo "Pushing $CI_COMMIT_REF_NAME into docker://${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME/${CI_DEFAULT_BRANCH}/latest}"
    - buildah manifest push --format=v2s2 --all list "docker://${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME/${CI_DEFAULT_BRANCH}/latest}"
    - if [ "${CI_SERVER_HOST}" = "gitlab.com" ]; then
        curl -o /usr/local/bin/cosign -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64";
        chmod +x /usr/local/bin/cosign;
        mkdir -p ~/.docker;
        cp -v "${REGISTRY_AUTH_FILE}" ~/.docker/config.json;
        for digest in $(buildah images --digests | awk '/sha256:/ { print $3 }'); do
          cosign sign "${CI_REGISTRY_IMAGE}@${digest}";
        done
      fi
  after_script:
    - rm -f .docker/config.json

.heroku:
  image: quay.io/buildah/stable
  resource_group: heroku
  stage: deploy
  variables:
    GIT_STRATEGY: none
    HEROKU_REGISTRY: registry.heroku.com
  before_script:
    - buildah login -u "${CI_REGISTRY_USER}" -p "${CI_REGISTRY_PASSWORD}" "${CI_REGISTRY}"
    - buildah login -u "_" -p "${HEROKU_AUTH_TOKEN}" "${HEROKU_REGISTRY}"
  script:
    - buildah pull "docker://${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME/${CI_DEFAULT_BRANCH}/latest}"
    - buildah tag "${CI_REGISTRY_IMAGE}:${CI_COMMIT_REF_NAME/${CI_DEFAULT_BRANCH}/latest}" "${HEROKU_REGISTRY}/platynum/web"
    - buildah push "${HEROKU_REGISTRY}/platynum/web"
  after_script:
    - buildah logout "${HEROKU_REGISTRY}"
    - buildah logout "${CI_REGISTRY}"
  environment:
    name: heroku
    url: https://acme.platynum.ch/admin
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'