JetBrains Upsource: установка и запуск на Linux с NGINX и SSL

Upsource – система от JetBrains для код ревью, который через плагин интегрируется во все IDE от JetBrains.

Представляет собой Java-приложение с Apache Cassandra в роли локального хранилища данных и индексов.

Минимальные требования к машине, на которой будет запускаться – 8 ГБ памяти, что, впрочем, не удивительно.

До 10-ти пользователей – бесплатна.

В этом посте – пример запуска на AWS EC2 и подключение из PyCharm.

Перед самим Upsource будет NGINX с SSL от Let’s Encrypt.

NGINX и Let’s Encrypt уже установлены, см. детали в посте TestRail: QA Test Case Management система — установка на Linux.

Документация – тут>>>.

Содержание

Установка Upsource

Создаём пользователя:

[simterm]

root@bttrm-testrail:/home/admin# useradd -r upsource

[/simterm]

Создаём каталог сервиса:

[simterm]

root@bttrm-testrail:/var/www# mkdir upsource.example.com

[/simterm]

Загружаем архив со страницы загрузок, распаковываем:

[simterm]

root@bttrm-testrail:/var/www# wget https://download.jetbrains.com/upsource/upsource-2018.2.1154.zip
root@bttrm-testrail:/var/www# unzip upsource-2018.2.1154.zip

[/simterm]

Переносим в домашнюю директорию проекта:

[simterm]

root@bttrm-testrail:/var/www# mv upsource-2018.2.1154/* upsource.example.com/
root@bttrm-testrail:/var/www# cd upsource.example.com/

[/simterm]

Скрипты запуска располагаются в bin/:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# ll bin/
total 8
-rw-r--r-- 1 root root 3458 Dec 31 16:06 upsource.bat
-rwxr-xr-x 1 root root 2981 Dec 31 16:06 upsource.sh

[/simterm]

Устанавливаем Java:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# apt install default-jdk
root@bttrm-testrail:/var/www/upsource.example.com# java -version
openjdk version "1.8.0_212"

[/simterm]

Запускаем Upsource.

Используем run для проверки, start – для запуска в бекграунде. Остальные команды см. по help:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# ./bin/upsource.sh help

Usage:
  /bin/sh /var/www/upsource.example.com/bin/upsource.sh <command>

<command> can be one of the following:

  configure
    configures Upsource, call "help configure" for details

  start
    starts Upsource in background, call "help start" for details
...

[/simterm]

Сейчас запускаем с run:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# ./bin/upsource.sh run
Starting Upsource...
* Configuring JetBrains Upsource 2018.2 
command [hostname]: hostname: Name or service not known
* Made default base-url 'http://127.0.0.1:8080/' from hostname '127.0.0.1' and listen port '8080' 
* JetBrains Upsource 2018.2 runtime environment is successfully configured 
* Loading logging configuration from /var/www/upsource.example.com/lib/ext/log4j.xml 
* Redirecting JetBrains Upsource 2018.2 logging to /var/www/upsource.example.com/logs/internal/services/bundleProcess 
* Configuring Service-Container[bundleProcess] 
* Configuring Bundle Backend Service 
* Configuring Configuration Wizard 
command [hostname]: hostname: Name or service not known
* Starting Service-Container[bundleProcess] 
* Starting Bundle Backend Service 
* Starting Configuration Wizard 
* JetBrains Upsource 2018.2 Configuration Wizard will be available on [http://127.0.0.1:8080?wizard_token=pikhg8iuYJ7OdssGkXbF] after start

[/simterm]

Вроде работает – переходим к SSL.

Let’s Encrypt

Получаем сертификат через standalone аутентификатор, т.к. конфига NGINX ещё нет:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# systemctl stop nginx
root@bttrm-testrail:/var/www/upsource.example.com# /opt/letsencrypt/letsencrypt-auto certonly -d upsource.example.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Nginx Web Server plugin (nginx)
2: Spin up a temporary webserver (standalone)
3: Place files in webroot directory (webroot)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 2
Plugins selected: Authenticator standalone, Installer None
...

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/upsource.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/upsource.example.com/privkey.pem
...

[/simterm]

NGINX

Создаём файл настроек виртуалхоста, документация тут>>>:

server {

    listen 80;
    server_name  upsource.example.com;

    # Lets Encrypt Webroot
    location ~ /.well-known {

    root /var/www/html;
        allow all;
    }

    location / {

        # office1
        allow 194.***.***.24/29;
        # office2
        allow 91.***.***.78/32;
        # arseny home
        allow 188.***.***.48/32;
        # unknown
        #allow 93.***.***.125/32;
        deny  all;

        return 301 https://upsource.example.com;
    }
}

server {

    listen       443 ssl;
    server_name  upsource.example.com;

    root /var/www/upsource.example.com;

    access_log  /var/log/nginx/upsource.example.com-access.log;
    error_log /var/log/nginx/upsource.example.com-error.log warn;

    # office1
    allow 194.***.***.24/29;
    # office2
    allow 91.***.***.78/32;
    # arseny home
    allow 188.***.***.48/32;
    deny  all;

    ssl_certificate /etc/letsencrypt/live/upsource.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/upsource.example.com/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/nginx/dhparams.pem;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_session_timeout 1d;
    ssl_stapling on;
    ssl_stapling_verify on;

    location / {
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://localhost:8080;
        proxy_pass_header Sec-Websocket-Extensions;
    }
}

Проверяем, перечитываем конфиги NGINX:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
root@bttrm-testrail:/var/www/upsource.example.com# service nginx reload

[/simterm]

Запуск Upsource

Обновляем /etc/security/limits.conf.

В документации пример указывает на увеличение лимитов всем – имхо не очень идея, меняем лимиты только для нашего пользователя:

upsource        -       memlock         unlimited
upsource        -       nofile          100000
upsource        -       nproc           32768
upsource        -       as              unlimited

Обновляем файл /etc/hosts – $HOSTNAME должен быть добавлен, иначе не заведётся Apache Cassandra.

Проверяем имя:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# hostnamectl 
   Static hostname: bttrm-testrail
...

[/simterm]

Добавляем его:

...
127.0.0.1 localhost bttrm-testrail
...

Меняем владельца каталога и файлов:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# chown -R upsource:upsource /var/www/upsource.example.com/

[/simterm]

Переключаемся на пользователя upsource и запускаем используя start:

[simterm]

root@bttrm-testrail:/var/www/upsource.example.com# su -l upsource
$ bash
upsource@bttrm-testrail:~$ cd /var/www/upsource.example.com/
upsource@bttrm-testrail:/var/www/upsource.example.com$ ./bin/upsource.sh start
Starting Upsource...
* Configuring JetBrains Upsource 2018.2 
* JetBrains Upsource 2018.2 runtime environment is successfully configured 
* Loading logging configuration from /var/www/upsource.example.com/lib/ext/log4j.xml 
* Redirecting JetBrains Upsource 2018.2 logging to /var/www/upsource.example.com/logs/internal/services/bundleProcess 
* Configuring Service-Container[bundleProcess] 
* Configuring Bundle Backend Service 
* Configuring Starting Page Service 
* Configuring Upsource Configurator 
* Configuring Hub 
* Configuring Bundle Hub Configurator 
* Configuring Apache Cassandra 
* Configuring Upsource Cluster Initialize Service 
* Configuring Upsource Frontend 
* Starting Service-Container[bundleProcess] 
* Starting Bundle Backend Service 
* Starting Starting Page Service 
* JetBrains Upsource 2018.2 will be available on [https://upsource.example.com/bundle/starting] after start 
* Starting Upsource Configurator 
Upsource is running

[/simterm]

При первом запуске Upsource сгенерирует токен авториpации в файле /var/www/upsource.example.com/conf/internal/services/configurationWizard/wizard_token.txt.

`systemd` unit

Для управления сервисом – создаём файл /etc/systemd/system/upsource.service:

[Unit]
Description=JetBrains Upsource
Requires=network.target
After=network.target

[Service]
User=upsource
Group=upsource
TimeoutStartSec=10min
WorkingDirectory=/var/www/upsource.example.com/
PIDFile=/var/www/upsource.example.com/logs/upsource.pid
ExecStart=/var/www/upsource.example.com/bin/upsource.sh start
ExecStop=/var/www/upsource.example.com/bin/upsource.sh stop
ExecReload=/var/www/upsource.example.com/bin/upsource.sh restart

[Install]
WantedBy=multi-user.target

Останавливаем Upsource, который запускали вручную:

[simterm]

upsource@bttrm-testrail:/var/www/upsource.example.com$ ./bin/upsource.sh stop

[/simterm]

И запускаем уже через systemd:

[simterm]

root@bttrm-testrail:/etc/nginx/conf.d# systemctl start upsource.service
root@bttrm-testrail:/etc/nginx/conf.d# systemctl status upsource.service
● upsource.service - Upsource Code Review service
   Loaded: loaded (/etc/systemd/system/upsource.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2019-04-02 10:23:43 UTC; 2s ago
 Main PID: 5356 (bash)
    Tasks: 53 (limit: 4915)
   CGroup: /system.slice/upsource.service
           ├─5356 /bin/bash upsource.sh start
           ...
Apr 02 10:23:43 bttrm-testrail systemd[1]: Started Upsource Code Review service.
Apr 02 10:23:44 bttrm-testrail bash[5356]: Starting Upsource...

[/simterm]

Добавляем в автозапуск:

[simterm]

root@bttrm-testrail:/etc/nginx/conf.d# systemctl enable upsource.service
Created symlink /etc/systemd/system/multi-user.target.wants/upsource.service → /etc/systemd/system/upsource.service.

[/simterm]