Added zuul_server container to docker-compose

Generalized the zuul-server container to get all settings and
credentials from external resources and then made docker-compose invoke
it.
Had to also change the zuul_base container because the way permissions
work in Zuul containers needed to change.

zuul_ci/docker-compose.yaml

@@ -43,4 +43,23 @@ services:
       default:
         aliases:
           - 'gerrit.zuul.example.com'
+  zuul_server:
+    build:
+      context: ./zuul_server
+    depends_on:
+      - gerrit
+    environment:
+      GERRIT_SERVER: 'gerrit.zuul.example.com'
+      GERRIT_BASEURL: 'http://gerrit.zuul.example.com:8080'
+      GERRIT_USER: 'zuul'
+      GERRIT_SSH_KEY: '/etc/zuul/ssh/id_zuul_rsa'
+    volumes:
+      - /etc/zuul/layout
+      - ssh-keys:/etc/zuul/ssh:z
+    networks:
+      default:
+        aliases:
+          - 'zuul_server.zuul.example.com'
+          - 'gearman'
+          - 'gearman.zuul.example.com'
 

zuul_ci/zuul_base/Dockerfile

@@ -3,5 +3,4 @@ MAINTAINER Barak Korren <[email protected]>
 RUN scl enable python27 -- pip install --user zuul
 USER root
 RUN install -o default -g root -m 755 -d /var/lib/zuul
-USER default
-VOLUME ["/etc/zuul", "/var/lib/zuul"]
+VOLUME ["/var/lib/zuul"]

zuul_ci/zuul_server/Dockerfile

@@ -4,6 +4,15 @@ MAINTAINER Barak Korren <[email protected]>
 EXPOSE 8001
 EXPOSE 4730
 
+VOLUME /etc/zuul/layout /etc/zuul/ssh
+
+ENV \
+    GERRIT_SERVER=gerrit.example.com \
+    GERRIT_PORT=29418 \
+    GERRIT_BASEURL=http://gerrit.example.com:8080/ \
+    GERRIT_USER=zuul \
+    GERRIT_SSH_KEY=/etc/zuul/ssh/id_zuul_rsa
+
 CMD start_zuul_server.sh
 
 ADD zuul.conf.template /usr/share/zuul/zuul.conf.template

zuul_ci/zuul_server/start_zuul_server.sh

@@ -1,25 +1,42 @@
 #!/bin/bash -e
-mkdir -p '/etc/zuul'
+ZUUL_USER=default
+ZUUL_HOME="$(getent passwd "$ZUUL_USER" | cut -d: -f6)"
 
-if [[ ! -e '/etc/zuul/zuul.conf' ]]; then
-    cp '/usr/share/zuul/zuul.conf.template' '/etc/zuul/zuul.conf'
+SSH_DIR="$ZUUL_HOME/.ssh"
+if [[ ! -d "$SSH_DIR" ]]; then
+    install -o "$ZUUL_USER" -m 700 -d "$SSH_DIR"
 fi
 
-if [[ ! -e '/etc/zuul/layout.yaml' ]]; then
-    cp '/usr/share/zuul/layout.yaml.template' '/etc/zuul/layout.yaml'
+if [[ ! -e "$GERRIT_SSH_KEY" ]]; then
+    # If we don't have an SSH key provided, generate it
+    ssh-keygen -b 2048 -t rsa -N '' -f "$GERRIT_SSH_KEY"
 fi
+# We need to copy the private key to our own location so the file
+# will have the right permissions
+SSH_KEY="$SSH_DIR/id_rsa"
+install -o "$ZUUL_USER" -m 600 "$GERRIT_SSH_KEY" "$SSH_KEY"
 
-if [[ ! -d '/etc/zuul/ssh' ]]; then
-    install -m 700 -d '/etc/zuul/ssh'
+if [[ ! -e "$SSH_DIR/known_hosts" ]]; then
+    /usr/bin/ssh-keyscan -t rsa -p "$GERRIT_PORT" "$GERRIT_SERVER" \
+        | sed -re "s|^(${GERRIT_SERVER//.\\./})|[\1]:$GERRIT_PORT|" \
+        > "$SSH_DIR/known_hosts"
+    chown "$ZUUL_USER" "$SSH_DIR/known_hosts"
 fi
 
-if [[ ! -e '/etc/zuul/ssh/id_rsa' ]]; then
-    ssh-keygen -b 2048 -t rsa -N '' -f '/etc/zuul/ssh/id_rsa'
+mkdir -p '/etc/zuul'
+
+if [[ ! -e '/etc/zuul/zuul.conf' ]]; then
+    sed \
+        -e "s|__GERRIT_SERVER__|$GERRIT_SERVER|" \
+        -e "s|__GERRIT_PORT__|$GERRIT_PORT|" \
+        -e "s|__GERRIT_BASEURL__|$GERRIT_BASEURL|" \
+        -e "s|__GERRIT_USER__|$GERRIT_USER|" \
+        -e "s|__GERRIT_SSH_KEY__|$SSH_KEY|" \
+        '/usr/share/zuul/zuul.conf.template' > '/etc/zuul/zuul.conf'
 fi
 
-if [[ ! -e "$HOME/.ssh/known_hosts" ]]; then
-    install -m 700 -d "$HOME/.ssh"
-    ln -s '/etc/zuul/ssh/known_hosts' "$HOME/.ssh/known_hosts"
+if [[ ! -e '/etc/zuul/layout/layout.yaml' ]]; then
+    cp '/usr/share/zuul/layout.yaml.template' '/etc/zuul/layout/layout.yaml'
 fi
 
-exec zuul-server -d
+exec runuser -u "$ZUUL_USER" -- zuul-server -d

zuul_ci/zuul_server/zuul.conf.template

@@ -1,17 +1,17 @@
 [zuul]
-layout_config=/etc/zuul/layout.yaml
+layout_config=/etc/zuul/layout/layout.yaml
 
 [gearman_server]
 start=true
 
 [gearman]
-server=172.17.0.4
+server=127.0.0.1
 
 [connection gerrit]
 driver=gerrit
-server=172.17.0.3
-port=29418
-baseurl=http://172.17.0.3:8080/
-user=zuul
-sshkey=/etc/zuul/ssh/id_rsa
+server=__GERRIT_SERVER__
+port=__GERRIT_PORT__
+baseurl=__GERRIT_BASEURL__
+user=__GERRIT_USER__
+sshkey=__GERRIT_SSH_KEY__