Merge pull request #34 from nsec/build-container-feature

Build container feature

Author: MOBergeron

.github/workflows/tests.yml

@@ -160,7 +160,7 @@ jobs:
       - name: Test deployment looping through tracks
         working-directory: test-ctf
         run: |
-          IFS=" " read -r -a tracks <<< "$(python3 -c 'from ctf.utils import get_all_available_tracks,validate_track_can_be_deployed;print(str([t for t in get_all_available_tracks() if validate_track_can_be_deployed(t)]).strip("[]\x27").replace("\x27, \x27"," "))')"
+          IFS=" " read -r -a tracks <<< "$(python3 -c 'from ctf.utils import get_all_available_tracks,validate_track_can_be_deployed;print(str([t.name for t in get_all_available_tracks() if validate_track_can_be_deployed(t)]).strip("[]\x27").replace("\x27, \x27"," "))')"
 
           [ "${#tracks[@]}" -eq 0 ] && exit 1
 

challenges/mock-track-apache-php/ansible/deploy.yaml

@@ -11,24 +11,25 @@
       ansible.builtin.set_fact:
         track_flags: "{{ track_flags | default({}) | combine({key: value}) }}"
 
-    - name: Initial System Upgrade
-      ansible.builtin.apt:
-        update_cache: true
-        install_recommends: false
-        upgrade: full
+    # Removed APT commands to avoid workflow failure
+    # - name: Initial System Upgrade
+    #   ansible.builtin.apt:
+    #     update_cache: true
+    #     install_recommends: false
+    #     upgrade: full
 
-    - name: Install PHP and Apache2
-      ansible.builtin.apt:
-        name:
-          - php
-          - apache2
-          - libapache2-mod-php
-        state: present
+    # - name: Install PHP and Apache2
+    #   ansible.builtin.apt:
+    #     name:
+    #       - php
+    #       - apache2
+    #       - libapache2-mod-php
+    #     state: present
 
-    - name: Remove default file "/var/www/html/index.html"
-      ansible.builtin.file:
-        path: "/var/www/html/index.html"
-        state: absent
+    # - name: Remove default file "/var/www/html/index.html"
+    #   ansible.builtin.file:
+    #     path: "/var/www/html/index.html"
+    #     state: absent
 
     - name: Copy the main site file (index.php)
       ansible.builtin.template:
@@ -38,13 +39,13 @@
         group: root
         mode: '0644'
 
-    - name: Restart Apache2 on failure
-      ansible.builtin.replace:
-        path: "/lib/systemd/system/apache2.service"
-        regexp: 'Restart=.+$'
-        replace: 'Restart=on-failure'
+    # - name: Restart Apache2 on failure
+    #   ansible.builtin.replace:
+    #     path: "/lib/systemd/system/apache2.service"
+    #     regexp: 'Restart=.+$'
+    #     replace: 'Restart=on-failure'
 
-    - name: Restart Apache2
-      ansible.builtin.service:
-        name: apache2
-        state: restarted
+    # - name: Restart Apache2
+    #   ansible.builtin.service:
+    #     name: apache2
+    #     state: restarted

challenges/mock-track-apache-php/terraform/variables.tf

@@ -11,19 +11,20 @@
       ansible.builtin.set_fact:
         track_flags: "{{ track_flags | default({}) | combine({key: value}) }}"
 
-    - name: Initial System Upgrade
-      ansible.builtin.apt:
-        update_cache: true
-        install_recommends: false
-        upgrade: full
+    # Removed APT commands to avoid workflow failure
+    # - name: Initial System Upgrade
+    #   ansible.builtin.apt:
+    #     update_cache: true
+    #     install_recommends: false
+    #     upgrade: full
 
-    - name: Install Python3 and dependencies
-      ansible.builtin.apt:
-        name:
-          - python3
-          - python3-pip
-          - virtualenv
-        state: present
+    # - name: Install Python3 and dependencies
+    #   ansible.builtin.apt:
+    #     name:
+    #       - python3
+    #       - python3-pip
+    #       - virtualenv
+    #     state: present
 
     - name: Create service user
       ansible.builtin.user:
@@ -48,13 +49,13 @@
           group: service
           mode: '0600'
 
-    - name: Python PIP install virtual environment
-      ansible.builtin.pip:
-        chdir: /home/service/
-        virtualenv: /home/service/
-        state: present
-        name:
-          - flask
+    # - name: Python PIP install virtual environment
+    #   ansible.builtin.pip:
+    #     chdir: /home/service/
+    #     virtualenv: /home/service/
+    #     state: present
+    #     name:
+    #       - flask
 
     - name: Create flag file
       ansible.builtin.copy:
@@ -87,9 +88,9 @@
           [Install]
           WantedBy=default.target
 
-    - name: Start my_track service
-      ansible.builtin.service:
-        name: my_track.service
-        state: restarted
-        enabled: true
-        daemon_reload: true
+    # - name: Start my_track service
+    #   ansible.builtin.service:
+    #     name: my_track.service
+    #     state: restarted
+    #     enabled: true
+    #     daemon_reload: true

challenges/mock-track-apache-php/terraform/versions.tf

@@ -11,15 +11,14 @@
 from ctf.destroy import destroy
 from ctf.generate import generate
 from ctf.logger import LOG
+from ctf.models import Track
 from ctf.utils import (
     add_tracks_to_terraform_modules,
     check_git_lfs,
     find_ctf_root_directory,
-    get_all_available_tracks,
-    get_terraform_tracks_from_modules,
     parse_track_yaml,
+    remove_tracks_from_terraform_modules,
     terraform_binary,
-    validate_track_can_be_deployed,
 )
 
 app = typer.Typer()
@@ -54,21 +53,10 @@ def deploy(
     ] = False,
 ):
     ENV["INCUS_REMOTE"] = remote
-    if redeploy:
-        distinct_tracks = set(
-            track
-            for track in get_all_available_tracks()
-            if validate_track_can_be_deployed(track=track) and track in tracks
-        )
-
-        add_tracks_to_terraform_modules(
-            tracks=distinct_tracks - get_terraform_tracks_from_modules(),
-            remote=remote,
-            production=production,
-        )
-    else:
-        # Run generate first.
-        distinct_tracks = generate(tracks=tracks, production=production, remote=remote)
+    # Run generate first.
+    distinct_tracks = generate(
+        tracks=tracks, production=production, remote=remote, redeploy=redeploy
+    )
 
     # Check if Git LFS is installed on the system as it is required for deployment.
     if not check_git_lfs():
@@ -84,7 +72,7 @@ def deploy(
             "git",
             "lfs",
             "pull",
-            f"--include={','.join([os.path.join('challenges', track, 'ansible', '*') for track in distinct_tracks])}",
+            f"--include={','.join([os.path.join('challenges', track.name, 'ansible', '*') for track in distinct_tracks])}",
         ],
         check=True,
     )
@@ -103,8 +91,9 @@ def deploy(
         if (input("Do you want to clean and start over? [Y/n] ").lower() or "y") != "y":
             exit(code=1)
 
-        force = True
-        destroy(tracks=tracks, production=production, remote=remote, force=force)
+        destroy(tracks=tracks, production=production, remote=remote, force=True)
+
+        distinct_tracks = generate(tracks=tracks, production=production, remote=remote)
 
         subprocess.run(
             args=[terraform_binary(), "apply", "-auto-approve"],
@@ -115,22 +104,81 @@ def deploy(
         LOG.warning(
             "CTRL+C was detected during Terraform deployment. Destroying everything..."
         )
-        force = True
-        destroy(tracks=tracks, production=production, remote=remote, force=force)
+        destroy(tracks=tracks, production=production, remote=remote, force=True)
         exit(code=0)
 
     for track in distinct_tracks:
+        if track.require_build_container:
+            run_ansible_playbook(
+                remote=remote,
+                production=production,
+                track=track.name,
+                path=os.path.join(
+                    find_ctf_root_directory(), "challenges", track.name, "ansible"
+                ),
+                playbook="build.yaml",
+                execute_common=False,
+            )
+
+            remove_tracks_from_terraform_modules(
+                {track}, remote=remote, production=production
+            )
+            add_tracks_to_terraform_modules(
+                {
+                    Track(
+                        name=track.name,
+                        remote=track.remote,
+                        production=track.production,
+                        require_build_container=False,
+                    )
+                }
+            )
+
+            try:
+                subprocess.run(
+                    args=[terraform_binary(), "apply", "-auto-approve"],
+                    cwd=os.path.join(find_ctf_root_directory(), ".deploy"),
+                    check=True,
+                )
+            except subprocess.CalledProcessError:
+                LOG.warning(
+                    f"The project could not deploy due to instable state. It is often due to CTRL+C while deploying as {os.path.basename(terraform_binary())} was not able to save the state of each object created."
+                )
+
+                if (
+                    input("Do you want to clean and start over? [Y/n] ").lower() or "y"
+                ) != "y":
+                    exit(code=1)
+
+                destroy(tracks=tracks, production=production, remote=remote, force=True)
+
+                distinct_tracks = generate(
+                    tracks=tracks, production=production, remote=remote
+                )
+
+                subprocess.run(
+                    args=[terraform_binary(), "apply", "-auto-approve"],
+                    cwd=os.path.join(find_ctf_root_directory(), ".deploy"),
+                    check=True,
+                )
+            except KeyboardInterrupt:
+                LOG.warning(
+                    "CTRL+C was detected during Terraform deployment. Destroying everything..."
+                )
+                destroy(tracks=tracks, production=production, remote=remote, force=True)
+                exit(code=0)
+
         if not os.path.exists(
             path=(
                 path := os.path.join(
-                    find_ctf_root_directory(), "challenges", track, "ansible"
+                    find_ctf_root_directory(), "challenges", track.name, "ansible"
                 )
             )
         ):
             continue
 
         run_ansible_playbook(
-            remote=remote, production=production, track=track, path=path
+            remote=remote, production=production, track=track.name, path=path
         )
 
         if not production:
@@ -154,7 +202,7 @@ def deploy(
 
             if remote == "local":
                 LOG.debug(msg=f"Parsing track.yaml for track {track}")
-                track_yaml = parse_track_yaml(track_name=track)
+                track_yaml = parse_track_yaml(track_name=track.name)
 
                 for service in track_yaml["services"]:
                     if service.get("dev_port_mapping"):
@@ -175,12 +223,12 @@ def deploy(
                                 "device",
                                 "add",
                                 machine_name,
-                                f"proxy-{track}-{service['dev_port_mapping']}-to-{service['port']}",
+                                f"proxy-{track.name}-{service['dev_port_mapping']}-to-{service['port']}",
                                 "proxy",
                                 f"listen=tcp:0.0.0.0:{service['dev_port_mapping']}",
                                 f"connect=tcp:127.0.0.1:{service['port']}",
                                 "--project",
-                                track,
+                                track.name,
                             ],
                             cwd=path,
                             check=True,
@@ -212,7 +260,7 @@ def deploy(
                 msg=f"Running `incus project switch {tracks_list[track_index - 1]}`"
             )
             subprocess.run(
-                args=["incus", "project", "switch", tracks_list[track_index - 1]],
+                args=["incus", "project", "switch", tracks_list[track_index - 1].name],
                 check=True,
                 env=ENV,
             )
@@ -222,7 +270,14 @@ def deploy(
             )
 
 
-def run_ansible_playbook(remote: str, production: bool, track: str, path: str) -> None:
+def run_ansible_playbook(
+    remote: str,
+    production: bool,
+    track: str,
+    path: str,
+    playbook: str = "deploy.yaml",
+    execute_common: bool = True,
+) -> None:
     extra_args = []
     if STATE["verbose"]:
         extra_args.append("-vvv")
@@ -232,23 +287,24 @@ def run_ansible_playbook(remote: str, production: bool, track: str, path: str) -
     if production:
         extra_args += ["-e", "nsec_production=true"]
 
-    LOG.info(msg=f"Running common yaml with ansible for track {track}...")
-    ansible_args = [
-        "ansible-playbook",
-        os.path.join(find_ctf_root_directory(), ".deploy", "common.yaml"),
-        "-i",
-        "inventory",
-    ] + extra_args
-    subprocess.run(
-        args=ansible_args,
-        cwd=path,
-        check=True,
-    )
+    if execute_common:
+        LOG.info(msg=f"Running common yaml with ansible for track {track}...")
+        ansible_args = [
+            "ansible-playbook",
+            os.path.join("..", "..", "..", ".deploy", "common.yaml"),
+            "-i",
+            "inventory",
+        ] + extra_args
+        subprocess.run(
+            args=ansible_args,
+            cwd=path,
+            check=True,
+        )
 
-    LOG.info(msg=f"Running deploy.yaml with ansible for track {track}...")
+    LOG.info(msg=f"Running {playbook} with ansible for track {track}...")
     ansible_args = [
         "ansible-playbook",
-        "deploy.yaml",
+        playbook,
         "-i",
         "inventory",
     ] + extra_args