From 44a3266071557d12d8dff2550b7ce20d6bab6576 Mon Sep 17 00:00:00 2001 From: Wes Hinsley Date: Sun, 26 Oct 2025 16:52:23 +0000 Subject: [PATCH 1/5] Update configs for acme-buddy --- production/montagu.yml | 18 +++++++++++------- science/montagu.yml | 13 +++++++++---- uat/montagu.yml | 13 +++++++++---- 3 files changed, 29 insertions(+), 15 deletions(-) diff --git a/production/montagu.yml b/production/montagu.yml index e400c76..5b336c2 100644 --- a/production/montagu.yml +++ b/production/montagu.yml @@ -31,9 +31,7 @@ volumes: static: montagu_static_volume static_logs: montagu_static_logs mq: montagu_mq - acme-challenge: montagu_acme_challenge - certificates: montagu_certificates - certbot: montagu_certbot + montagu-tls: montagu-tls api: name: montagu-api @@ -92,10 +90,16 @@ proxy: repo: nginx name: nginx-prometheus-exporter tag: 1.3.0 - acme: - email: reside@imperial.ac.uk - additional_domains: - - production2.montagu.dide.ic.ac.uk +acme_buddy: + email: reside@imperial.ac.uk + additional_domains: + - production2.dide.ic.ac.uk + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main + hdb_username: VAULT:secret/certbot-hdb/credentials:username + hdb_password: VAULT:secret/certbot-hdb/credentials:password + port: 2112 contrib: name: montagu-contrib-portal tag: main diff --git a/science/montagu.yml b/science/montagu.yml index 16f5be3..147207f 100644 --- a/science/montagu.yml +++ b/science/montagu.yml @@ -31,6 +31,7 @@ volumes: static: montagu_static_volume static_logs: montagu_static_logs mq: montagu_mq + montagu-tls: montagu-tls api: name: montagu-api @@ -80,10 +81,14 @@ proxy: repo: nginx name: nginx-prometheus-exporter tag: 0.10.0 - ssl: - key: VAULT:secret/vimc/ssl/v2/science/key:value - certificate: VAULT:secret/vimc/ssl/v2/science/cert:value - dhparam: VAULT:secret/vimc/ssl/v2/science/dhparam:value +acme_buddy: + email: reside@imperial.ac.uk + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main + hdb_username: VAULT:secret/certbot-hdb/credentials:username + hdb_password: VAULT:secret/certbot-hdb/credentials:password + port: 2112 contrib: name: montagu-contrib-portal tag: main diff --git a/uat/montagu.yml b/uat/montagu.yml index 84ded54..87b088d 100644 --- a/uat/montagu.yml +++ b/uat/montagu.yml @@ -31,6 +31,7 @@ volumes: static: montagu_static_volume static_logs: montagu_static_logs mq: montagu_mq + montagu-tls: montagu-tls api: name: montagu-api @@ -81,10 +82,14 @@ proxy: repo: nginx name: nginx-prometheus-exporter tag: 0.10.0 - ssl: - key: VAULT:secret/vimc/ssl/v2/uat/key:value - certificate: VAULT:secret/vimc/ssl/v2/uat/cert:value - dhparam: VAULT:secret/vimc/ssl/v2/uat/dhparam:value +acme_buddy: + email: reside@imperial.ac.uk + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main + hdb_username: VAULT:secret/certbot-hdb/credentials:username + hdb_password: VAULT:secret/certbot-hdb/credentials:password + port: 2112 contrib: name: montagu-contrib-portal tag: main From 313d8d17efad313674850a403e8f9f23fb46145d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Paul=20Li=C3=A9tar?= Date: Mon, 27 Oct 2025 15:07:07 +0000 Subject: [PATCH 2/5] Update renew-certificate periodic task. The interface for the montagu-deploy tool has changed a bit. The working directory should now be the root of the montagu-config checkout. We do not need to save the name of the deployment anymore as it is captured by the `.montagu_identity` file already. All of this will get removed once we migrate to acme-buddy, when we won't need an external timer to run anymore. --- scripts/install-timer.sh | 17 ++++++++--------- .../systemd/montagu-renew-certificate.service | 3 ++- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/scripts/install-timer.sh b/scripts/install-timer.sh index fc45134..fd7d413 100755 --- a/scripts/install-timer.sh +++ b/scripts/install-timer.sh @@ -1,26 +1,25 @@ #!/usr/bin/env bash set -euo pipefail -if [[ $# -ne 1 ]]; then - echo >&2 "Usage: $0 CONFIG" +if [[ $# -ne 0 ]]; then + echo >&2 "Usage: $0" exit 1 fi HERE=$(realpath "$(dirname $0)") -CONFIG="$(realpath $1)" -if [[ ! -f $CONFIG/montagu.yml ]]; then - echo >&2 "$1 is not a valid montagu configuration path" +if ! MONTAGU="$(which montagu)"; then + echo >&2 "Could not locate the montagu deployment tool" exit 1 fi -if ! MONTAGU="$(which montagu)"; then - echo >&2 "Could not locate the montagu deployment tool" +if [[ ! -f .montagu_identity ]]; then + echo >&2 "montagu is not configured, run montagu configure first" exit 1 fi -# these need to be exported for envsubst -export CONFIG MONTAGU +# this need to be exported for envsubst +export MONTAGU echo >&2 "Installing systemd units..." envsubst < $HERE/systemd/montagu-renew-certificate.service | \ diff --git a/scripts/systemd/montagu-renew-certificate.service b/scripts/systemd/montagu-renew-certificate.service index b5a974f..99909cc 100644 --- a/scripts/systemd/montagu-renew-certificate.service +++ b/scripts/systemd/montagu-renew-certificate.service @@ -1,4 +1,5 @@ [Service] Type=oneshot User=$USER -ExecStart=$MONTAGU renew-certificate $CONFIG +WorkingDirectory=$PWD +ExecStart=$MONTAGU renew-certificate From ace9ebe93532c7fb8b7b76f1075e77769987a1d0 Mon Sep 17 00:00:00 2001 From: zegibney Date: Tue, 2 Dec 2025 14:16:30 +0000 Subject: [PATCH 3/5] Add diffdf to the list of packages --- packages/packages.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/packages.yml b/packages/packages.yml index 3c2bf10..27665e3 100644 --- a/packages/packages.yml +++ b/packages/packages.yml @@ -76,6 +76,7 @@ packages: - curl - data.table - datasets + - diffdf - dbplyr - deldir - desc From eaca8f24677b95d79c16f6ab9b1a54a651a0b78c Mon Sep 17 00:00:00 2001 From: Wes Hinsley Date: Thu, 4 Dec 2025 13:51:37 +0000 Subject: [PATCH 4/5] Update configs for latest acme --- production/montagu.yml | 14 +++++++------- science/montagu.yml | 13 ++++++++----- uat/montagu.yml | 13 ++++++++----- 3 files changed, 23 insertions(+), 17 deletions(-) diff --git a/production/montagu.yml b/production/montagu.yml index 5b336c2..9237a77 100644 --- a/production/montagu.yml +++ b/production/montagu.yml @@ -91,14 +91,14 @@ proxy: name: nginx-prometheus-exporter tag: 1.3.0 acme_buddy: + image: + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main email: reside@imperial.ac.uk - additional_domains: - - production2.dide.ic.ac.uk - repo: ghcr.io/reside-ic - name: acme-buddy - tag: main - hdb_username: VAULT:secret/certbot-hdb/credentials:username - hdb_password: VAULT:secret/certbot-hdb/credentials:password + dns_provider: cloudflare + env: + CF_DNS_API_TOKEN: VAULT:secret/vimc/ssl/v2/cloudflare:CFG_DNS_API_TOKEN port: 2112 contrib: name: montagu-contrib-portal diff --git a/science/montagu.yml b/science/montagu.yml index 147207f..c2ebab1 100644 --- a/science/montagu.yml +++ b/science/montagu.yml @@ -82,12 +82,15 @@ proxy: name: nginx-prometheus-exporter tag: 0.10.0 acme_buddy: + image: + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main + dns_provider: hdb email: reside@imperial.ac.uk - repo: ghcr.io/reside-ic - name: acme-buddy - tag: main - hdb_username: VAULT:secret/certbot-hdb/credentials:username - hdb_password: VAULT:secret/certbot-hdb/credentials:password + env: + HDB_ACME_USERNAME: VAULT:secret/certbot-hdb/credentials:username + HDB_ACME_PASSWORD: VAULT:secret/certbot-hdb/credentials:password port: 2112 contrib: name: montagu-contrib-portal diff --git a/uat/montagu.yml b/uat/montagu.yml index 87b088d..680b9d3 100644 --- a/uat/montagu.yml +++ b/uat/montagu.yml @@ -83,12 +83,15 @@ proxy: name: nginx-prometheus-exporter tag: 0.10.0 acme_buddy: + image: + repo: ghcr.io/reside-ic + name: acme-buddy + tag: main + dns_provider: hdb email: reside@imperial.ac.uk - repo: ghcr.io/reside-ic - name: acme-buddy - tag: main - hdb_username: VAULT:secret/certbot-hdb/credentials:username - hdb_password: VAULT:secret/certbot-hdb/credentials:password + env: + HDB_ACME_USERNAME: VAULT:secret/certbot-hdb/credentials:username + HDB_ACME_PASSWORD: VAULT:secret/certbot-hdb/credentials:password port: 2112 contrib: name: montagu-contrib-portal From 388b3a00bdee49e08e1f8d86ec370445b0315e2d Mon Sep 17 00:00:00 2001 From: Wes Hinsley Date: Tue, 9 Dec 2025 15:56:36 +0000 Subject: [PATCH 5/5] Packit yml changes - see Montagu System PR #18 --- production/packit.yml | 7 ++++--- science/packit.yml | 7 ++++--- uat/packit.yml | 7 ++++--- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/production/packit.yml b/production/packit.yml index 3f94e5c..d3a1036 100644 --- a/production/packit.yml +++ b/production/packit.yml @@ -40,6 +40,10 @@ packit: # Location that is allowed to make the request # https://dietcode.io/p/cors/ cors_allowed_origins: "https://montagu.vaccineimpact.org" + runner: + git: + url: git@github.com:vimc/montagu-reports.git + ssh: VAULT:secret/vimc/reports/deploy:private brand: # Paths are interpreted relative to this configuration file, so @@ -60,9 +64,6 @@ orderly-runner: image: name: orderly.runner tag: main - git: - url: git@github.com:vimc/montagu-reports.git - ssh: VAULT:secret/vimc/reports/deploy:private workers: 1 env: MONTAGU_DB_DEFAULT_INSTANCE: production diff --git a/science/packit.yml b/science/packit.yml index e870fed..573cf1a 100644 --- a/science/packit.yml +++ b/science/packit.yml @@ -41,6 +41,10 @@ packit: # Location that is allowed to make the request # https://dietcode.io/p/cors/ cors_allowed_origins: "https://science.montagu.dide.ic.ac.uk" + runner: + git: + url: git@github.com:vimc/montagu-reports.git + ssh: VAULT:secret/vimc/reports/deploy:private brand: # Paths are interpreted relative to this configuration file, so @@ -61,9 +65,6 @@ orderly-runner: image: name: orderly.runner tag: main - git: - url: git@github.com:vimc/montagu-reports.git - ssh: VAULT:secret/vimc/reports/deploy:private workers: 1 env: MONTAGU_DB_DEFAULT_INSTANCE: science diff --git a/uat/packit.yml b/uat/packit.yml index 6dcd444..aa335da 100644 --- a/uat/packit.yml +++ b/uat/packit.yml @@ -41,6 +41,10 @@ packit: # Location that is allowed to make the request # https://dietcode.io/p/cors/ cors_allowed_origins: "https://uat.montagu.dide.ic.ac.uk" + runner: + git: + url: git@github.com:vimc/montagu-reports.git + ssh: VAULT:secret/vimc/reports/deploy:private brand: # Paths are interpreted relative to this configuration file, so @@ -61,9 +65,6 @@ orderly-runner: image: name: orderly.runner tag: main - git: - url: git@github.com:vimc/montagu-reports.git - ssh: VAULT:secret/vimc/reports/deploy:private workers: 1 env: MONTAGU_DB_DEFAULT_INSTANCE: uat