# BASTION
It's server system, that serves for control projects.


## Architecture
All architecture can be seen in Documentation/bastion.{jpg/drawio}

Bastion are separates on parts (stacks), that works in containers 



## Host

Requirments
1) debian 

2) docker

installing docker: https://docs.docker.com/engine/install/debian/#install-using-the-repository

## Each stack

### Portainer
Portainer is great option for control docker on machine and fast deploy stacks.

docker run -d --name="portainer" --restart on-failure -p 9000:9000 -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce:latest

### Nginx 
Main Web server. Through it each other container goes out. 
Locates on each stack network (to working reverse proxy)

Has one working container
Web-Server container
main nginx container, has outs to 80, 8000, 443
has next volumes:
1. nginx conf directory, each service has own nginx file
2. letsencrypt etc - letsencrypt SSL certs
3. lts_site - letsencrypt plug site (now not works)
4. dhparam - dhparam cert

certbot
letsencrypt container, that gives certs to certs volume
for work need running nginx container (acma) (and in firtst case it needed to disable ssl part of nginx conf)
it runs via run_certbot.sh script, where i can setup email, domian...


Instruction for build
1) create directories:
a. nginx conf (f.e. /var/nginx/conf) and copy nginx.conf to it
b. dh_param (f.e. /var/dh_param) and create cert: sudo openssl dhparam -out dhparam-2048.pem 2048
c. letsencrypt dir (f.e. /var/letsencrypt) and two subdirs for it: 
 c.a. /var/letsencrypt/etc - for lts certificates
 c.b. /var/letsencrypt/lts_site - for lts site (now not worknig :( ) and copy index.html to it 

2) run nginx server 
docker compose up 
IMPORTANT: now there is bug, where i can run nginx without ready certs, therefore it needed to comment ssl part of nginx.conf
3) run certbot script, it will create certs
4) rerun nginx server (with uncommented SSL part)

TODO:
1) make automatic renew of certificate
2) make normal locating of nginx configs

Usefull links:
https://phoenixnap.com/kb/letsencrypt-docker
https://stackoverflow.com/questions/51399883/adding-ssl-certs-to-nginx-docker-container




### Ghost 
### Git
Git stack has git server, cgit and gerrit.

Git server, that provides access to git repos via ssh(22 port) and git(9418)
It's simple container with openssh, git and git daemon.

Based on https://github.com/jkarlosb/git-server-docker/

Notes:
1) git daemon runnnig via runuser, because we need to run daemon from git user

Usefull links:
https://gpanders.com/blog/creating-your-own-git-server
https://linuxconfig.org/how-to-export-repositories-with-the-git-daemon
https://askubuntu.com/questions/1550366/ssh-sshd-breaking-changes-in-24-04 (why choose debian instead of ubuntu)

TODO:
1) maybe create git.service with systemd (somehow) instead of running from script with detach?


Cgit

### Jenkins
### Nexus
Nexus Repository Manager for storing build artifacts (Maven, generic, etc.) and hosting a private Docker registry.
Runs as a single container (`sonatype/nexus3`) on `nexus_network`. The web UI is accessible at `https://nexus.swave.lol` and `https://swave.lol/nexus`. A Docker hosted repository on port 5000 provides a private registry at `https://registry.swave.lol`.


## Firewall
ATM is developing
In final it must allow only 80,8080, 8000, 443, 22, 4096, ssh port and maybe some debug purpose port

## Backup