在 VPS 里搭建 Drone CI 持续集成构建系统

kind: pipeline # Pipeline 的类型，其他的还有 secret and signature。
type: docker # 定义了执行任务的类型，这里会使用 Docker 执行。
name: default # 定义 Pipline 的名字，一个 .drone.yml 可以有多个不同名字的 Pipeline。

steps:
- name: some-step # 步骤名
  image: some/image # 步骤需要用到的镜像

kind: pipeline
type: docker # 在 Docker Runner 中运行
name: default

# 定义步骤 Steps，每个 step 有属于自己 name，最后显示在 Drone CI 管理页面的侧边栏，代表每一步的名字。
steps:
- name: restore-cache # 把之前缓存好的数据取出
  image: drillster/drone-volume-cache
  settings:
    restore: true
    mount: # 缓存挂载的文件夹
      - ./.npm-cache
      - ./node_modules
  volumes:
    - name: cache
      path: /cache

- name: install # 安装依赖
  image: 172.17.0.2:5000/nodejs # 使用了本地Registry的nodejs，加快拉取速度
  commands:
    - npm config set cache ./.npm-cache --global 
    - npm i --production --registry=https://registry.npm.taobao.org 
# 不用npm ci，因为 npm ci 会先把 node_modules 文件夹移除，如果非要用 npm ci 可以把 restore-cache 和 rebuild-cache 这两个 step 去掉。

- name: test
  image: 172.17.0.2:5000/nodejs
  commands:
    - npm test

- name: build # 将程序打包成 Docker，放到私有 Docker 仓库中
  image: plugins/docker
  settings:
    insecure: true # 因为使用的是私有仓库，没有 https 支持，所以要设置成 insecure 才能连接
    dockerfile: Dockerfile # 使用 Dockerfile 的名字
    username:
      from_secret: account # 声明 username 从 Secret 为 account 的值中取出，在Drone的控制面板里可以设置，后面Q&A中介绍Secret
    password:
      from_secret: registry_password
    repo: 172.17.0.2:5000/backendsample # 打包后 Docker 镜像的名字
    registry: 172.17.0.2:5000 # 私有镜像仓库的地址

- name: rebuild-cache # 把依赖和 npm 缓存放到缓存里
  image: drillster/drone-volume-cache
  settings:
    rebuild: true
    mount:
      - ./.npm-cache
      - ./node_modules
  volumes:
    - name: cache
      path: /cache
# when 定义的是运行此 step 的条件
  when: # 只在事件为 push，分支为 master 而且上一步成功的时候运行
    branch:
      - master
    event:
      - push
    status:
      - success

- name: deploy # 用SSH连接到宿主机器运行部署命令
  image: appleboy/drone-ssh
  settings:
    host: xxxx.com
    username:
      from_secret: account
    password:
      from_secret: account_password
    port: 22
    command_timeout: 30m # ssh命令行执行超时时间，30分钟
    script_stop: false # 设置为false，遇到第一次错误会继续运行后面的命令
    # script定义的是所要运行的command
    script:
      - sudo docker pull 172.17.0.2:5000/backendsample # 拉取backendsample的新镜像
      - sudo docker stop backendsample && sudo docker rm backendsample # 停止并删除旧容器
      - sudo docker run --name backendsample --network redis_network --network-alias server_network -d -p 7001:7001 172.17.0.2:5000/backendsample # 从新镜像中建立容器并运行
      - sudo docker image prune -f --filter "dangling=true" # 清除无用的镜像
  when:
    branch:
      - master
    event:
      - push
    status:
      - success

- name: notify # 用了Server酱的webhook微信通知部署消息
  image: plugins/webhook
  settings:
    urls:
      from_secret: notify_url
    content_type: application/x-www-form-urlencoded
    template: |
      text=自动部署{{ build.status }}了&desp=在{{ repo.name }}的{{build.branch}}上{{ build.event }}了{{truncate build.commit 8}}的commit, 结果 `{{ build.status }}` 了, 耗时{{ since build.started }}, 点这里[查询]({{ build.link }})
    headers: origin=https://xxxx.com
    debug: true
  when: # 无论成功失败都运行
    status:
      - failure
      - success

# 私有镜像仓库的密钥在后面填坑里详细解释
# image_pull_secrets:
# - dockerconfig

# 声明并挂载缓存文件夹，宿主机的路径为 /tmp/cache
volumes:
- name: cache
  host:
    path: /tmp/cache

# 运行一个redis服务，在npm test测试时可以作为测试环境，语法与docker-compose类似。
services:
  - name: redis
    image: 172.17.0.2:5000/redis
    ports:
      - 6379

# 设置基础镜像,如果本地没有该镜像，会从Docker.io服务器pull镜像
# 这里会直接调用宿主机的密钥登录私有仓库。
FROM 172.17.0.2:5000/node11a

# 创建app目录,保存我们的代码(下面的WORKDIR会自动创建, 这段RUN mkdir不必要)
# RUN mkdir -p /home/gadzan/node
# 设置工作目录
WORKDIR /home/xxxx/node

# 编译运行node项目，使用npm安装程序的所有依赖,利用taobao的npm安装
# 这两步在drone里已经利用缓存完成
# COPY package.json package-lock.json /home/xxxx/node/

# 复制所有文件到 工作目录。
COPY . /home/xxxx/node

# .dockerignore文件如果登记了node_modules, 上下文文件会将其忽略
# 上面COPY了所有文件包括node_modules文件, 因此不需要再安装依赖.
# RUN npm i --production --registry=https://registry.npm.taobao.org

# 暴露container的端口
EXPOSE 7001

# 运行命令
CMD ["npm", "run", "start"]

$ openssl rand -hex 16
bea26a2221fd8090ea38720fc445eca6

$ docker pull drone/drone

docker run \
  --volume=/var/lib/drone:/data \
  --env=DRONE_GITEA_SERVER={{DRONE_GITEA_SERVER}} \
  --env=DRONE_GITEA_CLIENT_ID={{DRONE_GITEA_CLIENT_ID}} \
  --env=DRONE_GITEA_CLIENT_SECRET={{DRONE_GITEA_CLIENT_SECRET}} \
  --env=DRONE_RPC_SECRET={{DRONE_RPC_SECRET}} \
  --env=DRONE_SERVER_HOST={{DRONE_SERVER_HOST}} \
  --env=DRONE_SERVER_PROTO={{DRONE_SERVER_PROTO}} \
  --publish=80:80 \
  --publish=443:443 \
  --restart=always \
  --detach=true \
  --name=drone \
  drone/drone

$ docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e DRONE_RPC_PROTO=https \
  -e DRONE_RPC_HOST=drone.company.com \
  -e DRONE_RPC_SECRET=super-duper-secret \
  -e DRONE_RUNNER_CAPACITY=2 \
  -e DRONE_RUNNER_NAME=${HOSTNAME} \
  -p 3000:3000 \
  --restart always \
  --name runner \
  drone/drone-runner-docker

docker network create alpha --subnet 172.17.0.0/16

version: "3.6"

services:
  drone-server:
    image: drone/drone
    container_name: drone_server
    volumes:
      - ./data:/var/lib/drone/:rw
    restart: always
    ports:
      - "1280:80"
      - "1243:443"
    environment:
      - DRONE_DEBUG=true
      - DRONE_GITEA_SERVER=https://gitea.xxxx.com
      - DRONE_GITEA_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx
      - DRONE_GITEA_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxx
      - DRONE_DATABASE_DRIVER=sqlite3
      - DRONE_DATABASE_DATASOURCE=/var/lib/drone/drone.sqlite
      - DRONE_RPC_SECRET=xxxxxxxxxxxxxxxxxxxxxxxx
      - DRONE_TLS_AUTOCERT=false
# 这个配置决定了你激活时仓库中的 webhook 地址的 proto
      - DRONE_SERVER_PROTO=https
      - DRONE_SERVER_HOST=drone.xxxx.com
# 创建一个管理员号，跟你的 gitea 账号一致
      - DRONE_USER_CREATE=username:admin,admin:true
# 管理员账号，一般是你 gitea 用户名
      - DRONE_USER_FILTER=admin
      - DRONE_DATADOG_ENABLE=false
# 限制注册，只有这里的用户能注册
      - DRONE_REGISTRATION_CLOSED=true
# 如果 Runner 节点在不同国家可以设置时区
      - TZ=Asia/Shanghai
# 下面是 debug 输出的 log 的配置，可以忽略
    # - DRONE_LOGS_DEBUG=true
    # - DRONE_LOGS_TEXT=true
    # - DRONE_LOGS_PRETTY=true
    # - DRONE_LOGS_COLOR=true
    networks:
      outside:
        ipv4_address: 172.17.0.5

  drone-runner:
    image: drone/drone-runner-docker
    container_name: drone_runner
    restart: always
    ports:
      - "1230:3000"
    depends_on:
      - drone-server
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:rw
#     - /home/{$user}/.docker/config.json:/root/.docker/config.json
    environment:
#     - DRONE_DOCKER_CONFIG=/root/.docker/config.json
# 设置 drone-registry-plugin 的网络地址
      - DRONE_REGISTRY_PLUGIN_ENDPOINT=http://172.17.0.12:3000
# DRONE_REGISTRY_PLUGIN_TOKEN 必须要和 drone-registry-plugin 的 DRONE_SECRET 的值一样
      - DRONE_REGISTRY_PLUGIN_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxx
      - DRONE_RPC_HOST=drone_server
      - DRONE_RPC_PROTO=http
      - DRONE_RUNNER_CAPACITY=1
      - DRONE_RUNNER_NAME=runner
      - DRONE_RUNNER_NETWORKS=alpha
      - DRONE_RPC_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxx
# Runner 的标签，可以让 Server 实现分流
      - DRONE_RUNNER_LABELS=machine1:runner1
#     - DRONE_DEBUG=true
#     - DRONE_TRACE=true
      - TZ=Asia/Shanghai
    networks:
      outside:
        ipv4_address: 172.17.0.6

  drone-registry-plugin:
    image: drone/registry-plugin
    container_name: drone_registry_plugin
    ports:
      - 3030:3000
    environment:
      - DRONE_DEBUG=true
      - DRONE_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxx
      - DRONE_CONFIG_FILE=/etc/registry_config.yml
    volumes:
      - /var/drone/registry.yml:/etc/registry_config.yml
    networks:
      outside:
        ipv4_address: 172.17.0.12

networks:
  outside:
    external: true
    name: alpha

kind: pipeline
type: docker
name: default

steps:
- name: build
  image: golang
  commands:
  - go build
  - go test

node:
  nodeA: runnerA

node:
  nodeA: runnerA
  nodeB: runnerB

kind: pipeline
name: a_service
steps:
  ...

trigger:
  changeset:
    includes:
      - a_folder/*
---
kind: pipeline
name: b_service

steps:
  ...

trigger:
  changeset:
    includes:
      - b_folder/*
---
kind: pipeline
name: c_service

steps:
- name: frontend
   image: node
   commands:
     - cd app
     - npm run test
   when:
      changeset:
        includes: [ **/**.js, **/**.css, **/**.html ]

$ openssl rand -hex 16
558f3eacbfd5928157cbfe34823ab921

-e DRONE_YAML_ENDPOINT=http://${PLUGIN_HOST}:${PLUGIN_PORT}
-e DRONE_YAML_SECRET=558f3eacbfd5928157cbfe34823ab921

docker run \
  -p ${PLUGIN_PORT}:3000 \
  -e PLUGIN_SECRET=558f3eacbfd5928157cbfe34823ab921 \
  -e GITHUB_TOKEN=xxxxxxxxxxxxxxxxx \
  --name drone-changeset-conditional \
  --detach=true \
  --restart=always \
  microadam/drone-config-plugin-changeset-conditional

environment:
  - DRONE_CONFIG_FILE=/etc/registry_config.yml
volumes:
  - /var/drone/registry.yml:/etc/registry_config.yml

# /etc/registry_config.yml 格式
- address: 172.17.0.2:5000
  username: xxxxx
  password: xxxxxxxxxxxxxx
- address: registry.xxxxxx.com
  username: xxxxx
  password: xxxxxxxxxxxxxx

  drone-runner:    
    volumes:
      - /home/{$user}/.docker/config.json:/root/.docker/config.json
    environment:
      - DRONE_DOCKER_CONFIG=/root/.docker/config.json

{
  "auths": {
    "172.17.0.2:5000": {
      "auth": "aAsaswWDWe123asfY="
    }
  }
}

image_pull_secrets:
  - dockerconfig

$ git commit -m "Updated README [CI SKIP]"

http(s)://[hostname]/api/badges/[namespace]/[name]/status.svg(?ref=[ref])

https://drone.acme.com/api/badges/octocat/hello-world/status.svg

https://drone.acme.com/api/badges/octocat/hello-world/status.svg?ref=refs/heads/master

drone.xxxxx.com {
  gzip {
    not /api/stream /stream
  }
  tls xxxx@xxxx.com
  proxy / localhost:1280 {
    websocket
    transparent
  }
}

# docker-compose.yml

version: '3.7'
services:
  git:
    image: gitea/gitea
    container_name: gitea
    restart: always
    depends_on:
      - database
    environment:
      - APP_NAME="Gadzan's Git Service"
      - DISABLE_REGISTRATION=true
      - REQUIRE_SIGNIN_VIEW=true
      - DB_TYPE=postgres
      - DB_HOST=database:2345
      - DB_NAME=gitea
      - DB_USER=root
      - DB_PASSWD=xxxxxxxxxxx
      - GITEA_CUSTOM=/data/custom
    networks:
      default:
        ipv4_address: 172.17.0.8
    volumes:
      - ./data/git:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3330:3000"
      - "9922:22"

  database:
    image: postgres:12.2-alpine
    container_name: gitea-postgres
    restart: always
    ports:
      - "2345:5432"
    networks:
      default:
        ipv4_address: 172.17.0.7
    environment:
      - POSTGRES_USER=root
      - POSTGRES_PASSWORD=xxxxxxxxxxx
      - PGDATA=/var/lib/postgresql/data/pgdata
    volumes:
      - ./data/postgre:/var/lib/postgresql/data

networks:
  default:
    external:
      name: alpha

APP_NAME = Gadzan's Git Service
RUN_MODE = prod
RUN_USER = git

[repository]
ROOT = /data/git/repositories

[repository.local]
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo

[repository.upload]
TEMP_PATH = /data/gitea/uploads

[server]
APP_DATA_PATH    = /data/gitea
SSH_DOMAIN       = gitea.domain.com
HTTP_PORT        = 3000
ROOT_URL         = https://gitea.domain.com/
DISABLE_SSH      = false
SSH_PORT         = 9922
SSH_LISTEN_PORT  = 22
LFS_START_SERVER = true
LFS_CONTENT_PATH = /data/git/lfs
DOMAIN           = localhost
LFS_JWT_SECRET   = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
OFFLINE_MODE     = false

[database]
PATH     = /data/gitea/gitea.db
DB_TYPE  = postgres
HOST     = database:5432
NAME     = giteadb
USER     = root
PASSWD   = xxxxxxxxxxxxxxxxx
SCHEMA   =
SSL_MODE = disable
CHARSET  = utf8

[indexer]
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve

[session]
PROVIDER_CONFIG = /data/gitea/sessions
PROVIDER        = file

[picture]
AVATAR_UPLOAD_PATH            = /data/gitea/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
DISABLE_GRAVATAR              = true
ENABLE_FEDERATED_AVATAR       = false

[attachment]
PATH = /data/gitea/attachments

[log]
ROOT_PATH = /data/gitea/log
MODE      = file
LEVEL     = info

[security]
INSTALL_LOCK   = true
SECRET_KEY     = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
INTERNAL_TOKEN = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[service]
DISABLE_REGISTRATION              = true
REQUIRE_SIGNIN_VIEW               = true
REGISTER_EMAIL_CONFIRM            = false
ENABLE_NOTIFY_MAIL                = true
ALLOW_ONLY_EXTERNAL_REGISTRATION  = false
ENABLE_CAPTCHA                    = false
DEFAULT_KEEP_EMAIL_PRIVATE        = false
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING       = true
NO_REPLY_ADDRESS                  = noreply.localhost

[oauth2]
JWT_SECRET = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

[mailer]
ENABLED = true
HOST    = smtp.xxxx.com:465
FROM    = xxx@domain.com
USER    = xxx@domain.com
PASSWD  = xxxxxxxxxxxxxxx

[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = false

[ui]
DEFAULT_THEME = arc-green
THEMES = gitea,arc-green