Me ya sa webhooks na GitHub ke ƙarewa a kan Jenkins a bayan VPN

Shafin isarwa yana nuna ƙarewar lokaci kuma Jenkins ba ya rubuta komai, wanda shine alamar haɗin da bai taɓa isowa ba. GitHub na aika webhook a matsayin HTTP POST mai fita daga nasa kayan aiki zuwa payload URL da ka saita. VPN na kare Jenkins ta hanyar ƙin irin wannan haɗin kai tsaye. Babu abin da ya lalace a kowane bangare. Matsalar ita ce alkiblar buƙatar.

Abin da isarwar ke ƙoƙarin yi a zahiri

GitHub na warware sunan mai masauki a cikin payload URL kuma yana haɗi da shi daga intanet na jama’a. Idan wannan URL yana nuni ga adireshi na sirri, ko ga sunan da ake warware shi kawai a cikin cibiyar sadarwarka, ƙoƙarin yana gazawa kafin a yi wata buƙata. Idan yana nuni ga sunan jama’a da gefenka ke watsarwa, ƙoƙarin yana ƙarewa a maimakon haka.

Wannan bambanci yana da mahimmanci ga bincike. Gazawar DNS da tashar jiragen ruwa da aka tace duka suna kama da babu abin da ya faru a bangaren Jenkins, kuma duka suna bayyana a GitHub a matsayin isarwa da ta kasa tare da wani dalili daban a haɗe. Karanta wannan dalilin kafin ka canza URL.

Ramin da ke yin kira zuwa waje ba ya ƙirƙirar mai sauraro. Wannan shine ɓangaren da mutane suke tsammanin zai yi aiki daban.

Hanyoyi uku don gyara alkiblar haɗin

Kowace maganin yana canza wanda ke fara haɗin, kuma akwai siffofi uku kawai.

Bincike shine mafi ƙarancin kyau kuma mafi sauƙin gudanarwa. Relay yana riƙe da amsa kusan nan take ba tare da buɗe tashar jiragen ruwa ba. Runner yawanci shine amsar da ta dace lokacin da sirrin payload ya keɓe wani ɓangare na uku, domin aikin zai iya gudana a kan na’urar da ta riga ta kasance cikin cibiyar sadarwa.

Zaɓi bisa ga abin da za ka iya gudanarwa, ba bisa ga abin da ke sauti na zamani ba.

Aika isarwa zuwa waje da smee

Ƙirƙiri tashar a kan sabis ɗin relay kuma ka riƙe URL ɗinta. A cikin cibiyar sadarwa, shigar da abokin ciniki kuma aika isarwa zuwa hanyar da Jenkins ke tsammani. Payload URL a cikin saitunan ajiya ya zama URL ɗin tashar, tare da nau’in abun ciki da aka saita zuwa application/json.

sudo npm install --global smee-client
smee -u CHANNEL_URL --path /github-webhook/ --port 8080

Cikakkun bayanai uku ne ke yanke shawarar ko zai yi aiki. Hanyar dole ta dace da abin da Jenkins ke tsammani ga abubuwan da suka faru na GitHub, wanda bisa tsoho shine /github-webhook/. Jenkins dole ne ya kasance yana saurara a tashar da ka ba abokin ciniki. Kuma Jenkins URL ɗin da aka saita a aikin dole ya yarda da wannan hanyar, in ba haka ba abin da ya faru zai iso sannan a jefar da shi.

Rashin daidaiton slash na ƙarshe yana haifar da 404 wanda ake karanta a matsayin gazawar isarwa kuma ba haka ba ne.

Gudanar da shi yadda zai tsira da satin

Abokin ciniki na gaba yana mutuwa tare da tashar, kuma webhooks suna aiki kwana ɗaya sannan su tsaya. Ba shi unit mai Restart=always, gudanar da shi a matsayin mai amfani Jenkins, kuma karanta journal bayan isar da gaske ta farko. Wannan matakin na ƙarshe shine ya bambanta relay mai aiki da wanda aka saita.

[Unit]
Description=smee webhook relay
After=network.target

[Service]
Type=simple
Restart=always
RestartSec=2
User=jenkins
ExecStart=/usr/bin/smee -u CHANNEL_URL --path /github-webhook/ --port 8080

[Install]
WantedBy=multi-user.target

Gwada da push na gaske maimakon maɓallin sake kunnawa. Sake kunnawa yana gwada payload ɗin da relay ya adana, ba hanyar daga GitHub zuwa tasharka ba, don haka zai iya wucewa yayin da isar da kai tsaye har yanzu ya kasa.

Ba da faɗakarwa lokacin da unit ya tsaya. Relay da ya fadi yana shiru ta hanyar gini, kuma shiru shine abin da kake gyara tuni.

Abin da relay zai iya gani, da lokacin da ba za a yi amfani da shi ba

Relay yana ƙare payload, don haka yana ganin sunayen ajiya, bayanan commit da duk abin da taron ke ɗauka. Ka ɗauki URL ɗin tashar a matsayin ƙarshen wuri na jama’a. Ka riƙe secret token na Jenkins da aka saita domin a ƙi isar da jabu, kuma ka iyakance token ɗin da Jenkins ke amfani da shi zuwa mafi ƙarancin da ake buƙata.

Idan sirrin payload ya hana hakan, runner mai ɗaukar kansa ko rami mai juyawa da aka tabbatar ita ce amsa.

Relay yanzu kayan aiki ne, kuma ya cancanci irin wannan bita da build ɗin da yake jawowa. Juya tashar idan ta zube, kuma rubuta ranar da ka ƙarshe tabbatar da isar da kai tsaye. Saka wannan ranar a cikin runbook kusa da URL ɗin tashar. Relay da babu wanda ya bita shekara ɗaya ƙarshen wuri ne na jama’a wanda babu wanda ya mallaka.