From 60b0f220fbb5f9cdfa44040e28a97879339d55a0 Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Mon, 21 Sep 2026 10:40:59 +0200 Subject: [PATCH 1/9] Initial commit --- README.md | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..f3a368e --- /dev/null +++ b/README.md @@ -0,0 +1,2 @@ +# healthycode-deploy +AboutCode-hosted private deployment scripts From 7267025643e26de75b6e157ac72cea832ef68ac4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luis=20Ca=C3=B1as-D=C3=ADaz?= Date: Tue, 22 Sep 2026 13:41:34 +0200 Subject: [PATCH 2/9] [compose] Add instructions to deploy GrimoireLab with docker compose MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add instructions and the docker compose file to deploy GrimoireLab 2 without exposing ports to the internet. The compose file uses a shared network that will be available to other compose files. Signed-off-by: Luis Cañas-Díaz --- docker-compose/README.md | 88 ++++++++ .../nginx.conf.template | 23 +++ .../default-grimoirelab-settings/uwsgi_params | 13 ++ .../docker-compose-grimoirelab2.yml | 188 ++++++++++++++++++ 4 files changed, 312 insertions(+) create mode 100644 docker-compose/README.md create mode 100644 docker-compose/default-grimoirelab-settings/nginx.conf.template create mode 100644 docker-compose/default-grimoirelab-settings/uwsgi_params create mode 100644 docker-compose/docker-compose-grimoirelab2.yml diff --git a/docker-compose/README.md b/docker-compose/README.md new file mode 100644 index 0000000..be70d31 --- /dev/null +++ b/docker-compose/README.md @@ -0,0 +1,88 @@ +# GrimoireLab + + +Welcome, + +this how-to explains how to deploy the GrimoireLab 2 components. + +## Let's get ready + +### Requirements + +These are the requirements: + + - A Git client + - Docker Engine and Docker Compose + - A machine with >= 32GB RAM is recommended + +### The max_map_count for OpenSearch + +Before we start the OpenSearch container, make sure the Linux setting +`vm.max_map_count` is set to at least 262144. Set this value on the host machine. + +To check the current value, run this command: + +``` +cat /proc/sys/vm/max_map_count +``` + +To increase the value, add the following line to /etc/sysctl.conf: + +``` +vm.max_map_count=262144 +``` + +Then run `sudo sysctl -p` to reload. + +### Ports and networks + +The main services needed from outside (other docker compose environments) +are grimoirelab_core, served by nginx in the port 8000 by default and opensearch +served by default in the port 9200. Both services are included in a docker network +named `grimoirelab_shared`, they will be reachable using these endpoints + + - web server for the GrimoireLab API: http://grimoirelab-nginx:8000/ + - OpenSearch endpoint: https://grimoirelab-opensearch:9200/ + + +### Credentials + +Where are the credentials you need to connect to the GrimoireLab scheduler and the +data? + +The events used by grimoirelab-metrics are stored in an opensearch cluster. The +credentials for the `admin` user are set with the password variable `OPENSEARCH_INITIAL_ADMIN_PASSWORD`. +Be careful, OpenSearch does not like weak passwords and will not start up unless the +password is strong. These OpenSearch credentials are the ones needed by the +`grimoirelab_core_archivists` component. The user should be `admin` and the password, +the same you set for OpenSearch: + + - `GRIMOIRELAB_ARCHIVIST_STORAGE_USERNAME` + - `GRIMOIRELAB_ARCHIVIST_STORAGE_PASSWORD` + +Set the credentials for the scheduler and its API. This component is used by grimoirelab-metrics +to schedule the data collection. Set the following variables for the scheduler: + + - `GRIMOIRELAB_SUPERUSER_USERNAME` + - `GRIMOIRELAB_SUPERUSER_PASSWORD` + +There are two containers (`valkey` and `maria_db`) that are accessed with empty credentials. +This is not a good practice for production services, but only containers inside this compose +project can reach them. In any case, as a good practice the following variables should be +set for a production enviroment: + + - For mariadb, the ones ending in: + - `*_DB_USER` + - `*_DB_PASSWORD` + + - For Valkey, the ones ending in: + - `*_REDIS_PASSWORD` + +## Deploy + +If you are reaching this point, everything is ready to launch the containers. Execute + +``` +cd docker-compose/ +docker compose -f docker-compose-grimoirelab2.yml up -d +``` \ No newline at end of file diff --git a/docker-compose/default-grimoirelab-settings/nginx.conf.template b/docker-compose/default-grimoirelab-settings/nginx.conf.template new file mode 100644 index 0000000..d020e7a --- /dev/null +++ b/docker-compose/default-grimoirelab-settings/nginx.conf.template @@ -0,0 +1,23 @@ +upstream grimoirelab_core { + server grimoirelab_core:9314; +} +server { + include mime.types; + sendfile on; + listen 8000; + + server_name localhost nginx; + + location / { + include /etc/nginx/uwsgi_params; + uwsgi_pass grimoirelab_core; + uwsgi_param Host $host; + uwsgi_param X-Real-IP $remote_addr; + uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for; + uwsgi_param X-Forwarded-Proto $http_x_forwarded_proto; + } + + location /static/ { + alias /grimoirelab_core/; + } +} diff --git a/docker-compose/default-grimoirelab-settings/uwsgi_params b/docker-compose/default-grimoirelab-settings/uwsgi_params new file mode 100644 index 0000000..1eab45f --- /dev/null +++ b/docker-compose/default-grimoirelab-settings/uwsgi_params @@ -0,0 +1,13 @@ +uwsgi_param QUERY_STRING $query_string; +uwsgi_param REQUEST_METHOD $request_method; +uwsgi_param CONTENT_TYPE $content_type; +uwsgi_param CONTENT_LENGTH $content_length; +uwsgi_param REQUEST_URI $request_uri; +uwsgi_param PATH_INFO $document_uri; +uwsgi_param DOCUMENT_ROOT $document_root; +uwsgi_param SERVER_PROTOCOL $server_protocol; +uwsgi_param HTTPS $https if_not_empty; +uwsgi_param REMOTE_ADDR $remote_addr; +uwsgi_param REMOTE_PORT $remote_port; +uwsgi_param SERVER_PORT $server_port; +uwsgi_param SERVER_NAME $server_name; diff --git a/docker-compose/docker-compose-grimoirelab2.yml b/docker-compose/docker-compose-grimoirelab2.yml new file mode 100644 index 0000000..90f379b --- /dev/null +++ b/docker-compose/docker-compose-grimoirelab2.yml @@ -0,0 +1,188 @@ +services: + mariadb: + image: mariadb:11.4 + expose: + - "3306" + environment: + MYSQL_ROOT_PASSWORD: "" + MYSQL_ALLOW_EMPTY_PASSWORD: yes + healthcheck: + test: [ "CMD", "/usr/local/bin/healthcheck.sh", "--su=root", "--connect", "--innodb_initialized" ] + retries: 5 + volumes: + - mariadb_data:/var/lib/mysql + + valkey: + image: valkey/valkey:8 + expose: + - "6379" + healthcheck: + test: [ "CMD", "valkey-cli", "--raw", "incr", "ping" ] + retries: 5 + volumes: + - valkey_data:/data + + grimoirelab_core: + restart: on-failure:3 + image: grimoirelab/grimoirelab:2.x + environment: + GRIMOIRELAB_DB_HOST: mariadb + GRIMOIRELAB_DB_PORT: 3306 + GRIMOIRELAB_DB_DATABASE: core_db + GRIMOIRELAB_DB_USER: root + GRIMOIRELAB_DB_PASSWORD: "" + GRIMOIRELAB_REDIS_HOST: valkey + GRIMOIRELAB_REDIS_PORT: 6379 + GRIMOIRELAB_REDIS_PASSWORD: "" + GRIMOIRELAB_SUPERUSER_USERNAME: admin + GRIMOIRELAB_SUPERUSER_PASSWORD: admin + expose: + - "9314" + volumes: + - core-static:/core_static/ + depends_on: + mariadb: + condition: service_healthy + valkey: + condition: service_healthy + command: grimoirelab run server + + grimoirelab_core_eventizers: + restart: on-failure:3 + image: grimoirelab/grimoirelab:2.x + environment: + GRIMOIRELAB_DB_HOST: mariadb + GRIMOIRELAB_DB_PORT: 3306 + GRIMOIRELAB_DB_DATABASE: core_db + GRIMOIRELAB_DB_USER: root + GRIMOIRELAB_DB_PASSWORD: "" + GRIMOIRELAB_REDIS_HOST: valkey + GRIMOIRELAB_REDIS_PORT: 6379 + GRIMOIRELAB_REDIS_PASSWORD: "" + depends_on: + mariadb: + condition: service_healthy + valkey: + condition: service_healthy + command: grimoirelab run eventizers + + grimoirelab_core_archivists: + restart: on-failure:3 + image: grimoirelab/grimoirelab:2.x + environment: + GRIMOIRELAB_DB_HOST: mariadb + GRIMOIRELAB_DB_PORT: 3306 + GRIMOIRELAB_DB_DATABASE: core_db + GRIMOIRELAB_DB_USER: root + GRIMOIRELAB_DB_PASSWORD: "" + GRIMOIRELAB_REDIS_HOST: valkey + GRIMOIRELAB_REDIS_PORT: 6379 + GRIMOIRELAB_REDIS_PASSWORD: "" + GRIMOIRELAB_ARCHIVIST_STORAGE_URL: "https://opensearch-node1:9200" + GRIMOIRELAB_ARCHIVIST_STORAGE_USERNAME: "admin" + GRIMOIRELAB_ARCHIVIST_STORAGE_PASSWORD: "GrimoireLab.1" + depends_on: + mariadb: + condition: service_healthy + valkey: + condition: service_healthy + opensearch-node1: + condition: service_started + command: grimoirelab run archivists + + grimoirelab_core_ushers: + restart: on-failure:3 + image: grimoirelab/grimoirelab:2.x + environment: + GRIMOIRELAB_DB_HOST: mariadb + GRIMOIRELAB_DB_PORT: 3306 + GRIMOIRELAB_DB_DATABASE: core_db + GRIMOIRELAB_DB_USER: root + GRIMOIRELAB_DB_PASSWORD: "" + GRIMOIRELAB_REDIS_HOST: valkey + GRIMOIRELAB_REDIS_PORT: 6379 + GRIMOIRELAB_REDIS_PASSWORD: "" + depends_on: + mariadb: + condition: service_healthy + valkey: + condition: service_healthy + command: grimoirelab run ushers + + sortinghat_worker: + image: grimoirelab/sortinghat-worker + environment: + SORTINGHAT_SECRET_KEY: secret + SORTINGHAT_DB_HOST: mariadb + SORTINGHAT_DB_PORT: 3306 + SORTINGHAT_DB_DATABASE: core_db + SORTINGHAT_DB_USER: root + SORTINGHAT_DB_PASSWORD: "" + SORTINGHAT_REDIS_HOST: valkey + SORTINGHAT_REDIS_PORT: 6379 + SORTINGHAT_REDIS_PASSWORD: "" + depends_on: + mariadb: + condition: service_healthy + valkey: + condition: service_healthy + + opensearch-node1: + image: opensearchproject/opensearch:3 + environment: + cluster.name: opensearch-cluster + node.name: opensearch-node1 + discovery.type: single-node + bootstrap.memory_lock: true + OPENSEARCH_JAVA_OPTS: "-Xms2g -Xmx2g" + OPENSEARCH_INITIAL_ADMIN_PASSWORD: "GrimoireLab.1" + ulimits: + memlock: + soft: -1 + hard: -1 + nofile: + soft: 65536 + hard: 65536 + expose: + - "9200" + - "9600" + volumes: + - opensearch_data:/usr/share/opensearch/data + networks: + default: + shared: + aliases: + - grimoirelab-opensearch + + nginx: + restart: on-failure:3 + image: nginx:latest + volumes: + - ./default-grimoirelab-settings/nginx.conf.template:/etc/nginx/templates/default.conf.template + - ./default-grimoirelab-settings/uwsgi_params:/etc/nginx/uwsgi_params + - core-static:/grimoirelab_core:ro + expose: + - "8000" + networks: + default: + shared: + aliases: + - grimoirelab-nginx + depends_on: + - grimoirelab_core + healthcheck: + test: ["CMD", "curl", "-f", "http://localhost:8000/"] + interval: 30s + timeout: 10s + retries: 5 + +volumes: + mariadb_data: + opensearch_data: + valkey_data: + core-static: + +networks: + default: + shared: + name: grimoirelab_shared From 8d3c139940330229aac798af819a8e3b3e860b86 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Mon, 5 Oct 2026 21:37:11 +0530 Subject: [PATCH 3/9] fix: add allowed host to grimoirelab_core Signed-off-by: Keshav Priyadarshi --- README.md | 2 -- docker-compose/docker-compose-grimoirelab2.yml | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-) delete mode 100644 README.md diff --git a/README.md b/README.md deleted file mode 100644 index f3a368e..0000000 --- a/README.md +++ /dev/null @@ -1,2 +0,0 @@ -# healthycode-deploy -AboutCode-hosted private deployment scripts diff --git a/docker-compose/docker-compose-grimoirelab2.yml b/docker-compose/docker-compose-grimoirelab2.yml index 90f379b..6e63143 100644 --- a/docker-compose/docker-compose-grimoirelab2.yml +++ b/docker-compose/docker-compose-grimoirelab2.yml @@ -1,3 +1,5 @@ +name: compose + services: mariadb: image: mariadb:11.4 @@ -36,6 +38,7 @@ services: GRIMOIRELAB_REDIS_PASSWORD: "" GRIMOIRELAB_SUPERUSER_USERNAME: admin GRIMOIRELAB_SUPERUSER_PASSWORD: admin + GRIMOIRELAB_ALLOWED_HOST: "grimoirelab-nginx" expose: - "9314" volumes: From 1710b158940dbc8798a72d49e096f92e7bc7bc25 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Mon, 5 Oct 2026 21:38:09 +0530 Subject: [PATCH 4/9] chore: move README Signed-off-by: Keshav Priyadarshi --- docker-compose/README.md => README.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename docker-compose/README.md => README.md (100%) diff --git a/docker-compose/README.md b/README.md similarity index 100% rename from docker-compose/README.md rename to README.md From c4ccf5a30fc05e766ce2df739afca9ab8db51a78 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Wed, 14 Oct 2026 23:07:30 +0530 Subject: [PATCH 5/9] feat: add shared docker network for SCIO Signed-off-by: Keshav Priyadarshi --- etc/scancodeio/network.yml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 etc/scancodeio/network.yml diff --git a/etc/scancodeio/network.yml b/etc/scancodeio/network.yml new file mode 100644 index 0000000..dd6c815 --- /dev/null +++ b/etc/scancodeio/network.yml @@ -0,0 +1,4 @@ +networks: + default: + name: grimoirelab_shared + external: true \ No newline at end of file From d5d2e26a1360bac19bc200b9d770b3fed1d77c60 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Wed, 14 Oct 2026 23:12:15 +0530 Subject: [PATCH 6/9] docs: add instruction on PurlDB and SCIO integration Signed-off-by: Keshav Priyadarshi --- README.md | 82 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 80 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index be70d31..8c74cd9 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ These are the requirements: ### The max_map_count for OpenSearch -Before we start the OpenSearch container, make sure the Linux setting +Before we start the OpenSearch container, make sure the Linux setting `vm.max_map_count` is set to at least 262144. Set this value on the host machine. To check the current value, run this command: @@ -85,4 +85,82 @@ If you are reaching this point, everything is ready to launch the containers. Ex ``` cd docker-compose/ docker compose -f docker-compose-grimoirelab2.yml up -d -``` \ No newline at end of file +``` + +# Integration with PurlDB and ScanCode.io + +- Setup PurlDB https://github.com/aboutcode-org/purldb-deploy +- Setup ScanCode.io as PurlDB scan worker https://github.com/aboutcode-org/scancode.io-deploy + +### 1. Add shared GrimoireLab docker network for ScanCode.io + +``` +cd healthycode-deploy/ +sudo cp ./etc/scancodeio/network.yml /etc/scancodeio/network.yml +``` + +### 2. Edit ScanCode.io systemctl config to run with healthycode profile + +``` +sudo vi /etc/systemd/system/scancodeio.service +``` + +Update ExecStart as below: +``` +ExecStart=/usr/bin/docker compose -f /opt/scancodeio/docker-compose.purldb-scan-worker.yml -f /etc/scancodeio/networks.yml --profile healthycode up --scale worker=${NUM_WORKERS} +``` + +``` +sudo systemctl daemon-reload +``` +### 3. Add PurlDB URL and API key in ScanCode.io + +Get an PurlDB scanworker API key +``` +# on purldb +docker compose -f /opt/purldb/docker-compose.production.yml exec web python manage_purldb.py create-scan-queue-worker-user +``` + +``` +sudo vi /etc/scancodeio/.env +``` +Populate with below config +``` +PURLDB_URL= +PURLDB_API_KEY="scanworker-api-key" +``` + +### 4. Configure GrimoireLab env in ScanCode.io + +``` +sudo vi /etc/scancodeio/.env +``` +Populate with below config as is: +``` +GRIMOIRELAB_URL="http://grimoirelab-nginx:8000/" +GRIMOIRELAB_OPENSEARCH_URL="https://grimoirelab-opensearch:9200/" +GRIMOIRELAB_ECOSYSTEM="npmlargerecosystem" +GRIMOIRELAB_PROJECT="NPMMostUsed" +``` + +Populate below field based on secret set in ``./docker-compose/docker-compose-grimoirelab2.yml`` +``` +GRIMOIRELAB_USERNAME="" +GRIMOIRELAB_PASSWORD="" +GRIMOIRELAB_OPENSEARCH_INDEX="" +GRIMOIRELAB_OPENSEARCH_USERNAME="" +GRIMOIRELAB_OPENSEARCH_PASSWORD="" +``` + +### 5. Expose ScanCode.io on port 8443 +``` +sudo vi /opt/scancodeio/.env +``` + +Add the below env variables: +``` +NGINX_PUBLISHED_HTTP_PORT=8081 +NGINX_PUBLISHED_HTTPS_PORT=8443 +``` + +### 6. Restart ScanCode.io From c9fbbe265c25329bec077ec2a165619c90e293b6 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Tue, 3 Nov 2026 15:49:26 +0530 Subject: [PATCH 7/9] Add scio restart command Signed-off-by: Keshav Priyadarshi --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 8c74cd9..f677bad 100644 --- a/README.md +++ b/README.md @@ -164,3 +164,7 @@ NGINX_PUBLISHED_HTTPS_PORT=8443 ``` ### 6. Restart ScanCode.io +``` +# cd into scancode.io-deploy/ +make restart +``` From c8e8ba479f7390615b21da02e96fa6dd1c7d2790 Mon Sep 17 00:00:00 2001 From: Philippe Ombredanne Date: Tue, 3 Nov 2026 12:29:46 +0100 Subject: [PATCH 8/9] Improve installation documentation Signed-off-by: Philippe Ombredanne --- README.md | 187 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 131 insertions(+), 56 deletions(-) diff --git a/README.md b/README.md index f677bad..7b95baa 100644 --- a/README.md +++ b/README.md @@ -1,105 +1,158 @@ -# GrimoireLab +# HealthyCode Deployment documentation +This is the installation documentation for HealthyCode. -Welcome, +It explains how to deploy HealthyCode four components: +- PurlDB frontend +- ScanCode.io worker with its health pipeline and HealthyCode +- GrimoireLab backend -this how-to explains how to deploy the GrimoireLab 2 components. +The sequence is to install GrimoireLab, then ScanCode.io and then PurlDB. +The installation assume that we have a Linux installation (Ubuntu or Debian) +with these packages: + - git + - docker and docker compose + - build essentials + +The machine should have at least 32GB RAM (more is better), and about 500GB +for the base installation. For on-going production, more disk space is required +in order to keep git clones of all the tracked open source projects. -## Let's get ready -### Requirements +## GrimoireLab installation -These are the requirements: +This is deployed using the docker compose at: +docker-compose/docker-compose-grimoirelab2.yml - - A Git client - - Docker Engine and Docker Compose - - A machine with >= 32GB RAM is recommended -### The max_map_count for OpenSearch +### Set the max_map_count on the server to support OpenSearch needs -Before we start the OpenSearch container, make sure the Linux setting -`vm.max_map_count` is set to at least 262144. Set this value on the host machine. +GrimoireLab runs a combo of MariaDB, OpenSearch and Valkey(Redis). OpenSearch +needs some specific memory config on the server that runs these containers. -To check the current value, run this command: +Hence, before we start the OpenSearch container, there is a one time operation +to make sure the Linux server host setting `vm.max_map_count` is set to at least +262144 (instead of the default 65530). Set this value on the host machine as +explained below: + +- Check the current value, with this command: ``` cat /proc/sys/vm/max_map_count ``` -To increase the value, add the following line to /etc/sysctl.conf: +- To increase the value, add (or edit) the following line to /etc/sysctl.conf +(using sudo): ``` vm.max_map_count=262144 ``` -Then run `sudo sysctl -p` to reload. +Then run `sudo sysctl -p` to reload the kernel runtime parameters configuration. ### Ports and networks -The main services needed from outside (other docker compose environments) -are grimoirelab_core, served by nginx in the port 8000 by default and opensearch -served by default in the port 9200. Both services are included in a docker network -named `grimoirelab_shared`, they will be reachable using these endpoints +The main GrimoireLab services needed from outside its docker compose network +are `grimoirelab_core`, served by `nginx` on port 8000` by default and `opensearch` +served on port `9200` by default. Both of the two services are included in a +docker network named `grimoirelab_shared`, and they will be reachable using +these endpoints from inside the docker network: - - web server for the GrimoireLab API: http://grimoirelab-nginx:8000/ + - Web server for the GrimoireLab API: http://grimoirelab-nginx:8000/ - OpenSearch endpoint: https://grimoirelab-opensearch:9200/ +### GrimoireLab credentials and authentication + +By default healthycode installation does not expose the bulk of GrimoireLab +services outside of the docker network, and therefore we need limited password +on each instance including OpenSearch. ScanCode.io access these through the +private docker network. + +There are provisions to set passwords on the various services if needed but +are minimally documented here. + +This various values for credentials are configured using environment variables +and defaults in docker compose file at: +docker-compose/docker-compose-grimoirelab2.yml -### Credentials +You can update that file as needed. -Where are the credentials you need to connect to the GrimoireLab scheduler and the -data? +#### OpenSearch (aka. archivist) -The events used by grimoirelab-metrics are stored in an opensearch cluster. The -credentials for the `admin` user are set with the password variable `OPENSEARCH_INITIAL_ADMIN_PASSWORD`. -Be careful, OpenSearch does not like weak passwords and will not start up unless the -password is strong. These OpenSearch credentials are the ones needed by the -`grimoirelab_core_archivists` component. The user should be `admin` and the password, -the same you set for OpenSearch: +The GrimoireLab events are stored in OpenSearch cluster. + +The credentials for the `admin` user are set with the password variable +`OPENSEARCH_INITIAL_ADMIN_PASSWORD`. + +Note that OpenSearch demands a string passwords and will not start up unless +the password is strong. These OpenSearch credentials are the ones needed by the +`grimoirelab_core_archivists` component. The user is `admin` and the password +is the same you set for OpenSearch: - `GRIMOIRELAB_ARCHIVIST_STORAGE_USERNAME` - `GRIMOIRELAB_ARCHIVIST_STORAGE_PASSWORD` -Set the credentials for the scheduler and its API. This component is used by grimoirelab-metrics -to schedule the data collection. Set the following variables for the scheduler: +#### Scheduler + +Set the credentials for the GrimoireLab scheduler and its API. This component is +used by healthycode to schedule the data collection. Set the following + variables for the scheduler: - `GRIMOIRELAB_SUPERUSER_USERNAME` - `GRIMOIRELAB_SUPERUSER_PASSWORD` -There are two containers (`valkey` and `maria_db`) that are accessed with empty credentials. -This is not a good practice for production services, but only containers inside this compose -project can reach them. In any case, as a good practice the following variables should be -set for a production enviroment: +This uses two containers (`valkey` and `maria_db`) that are accessed with +empty credentials through the docker network only. - - For mariadb, the ones ending in: +NOTE that this is not a good practice for production services, yet only +containers inside this compose project can reach them. + +The good practice is to set passwords using the following variables for a +production enviroment: + + - For mariadb, set enviroment variables ending in: - `*_DB_USER` - `*_DB_PASSWORD` - - For Valkey, the ones ending in: + - For Valkey, set enviroment variables ending in: - `*_REDIS_PASSWORD` -## Deploy +## GrimoireLab Startup -If you are reaching this point, everything is ready to launch the containers. Execute +Once the initial configutaion above is completed, the next step if launch the +containers with these commands, from a clone of this repository: ``` cd docker-compose/ docker compose -f docker-compose-grimoirelab2.yml up -d ``` -# Integration with PurlDB and ScanCode.io +## Installation of with PurlDB and ScanCode.io + +### Base installation + +The first step is to install PurlDB and ScanCode.io using their standard +documentation. + +- Setup PurlDB using code and documentation at https://github.com/aboutcode-org/purldb + +Once completed, make sure that PurlDB is up and running. -- Setup PurlDB https://github.com/aboutcode-org/purldb-deploy -- Setup ScanCode.io as PurlDB scan worker https://github.com/aboutcode-org/scancode.io-deploy -### 1. Add shared GrimoireLab docker network for ScanCode.io +- Setup ScanCode.io as a PurlDB scan worker using code and documentation at +https://github.com/aboutcode-org/scancode.io + +### Add shared GrimoireLab docker network to ScanCode.io + +There is a temaplte for this docker network configuration in: +etc/scancodeio/network.yml. We copy that to the host: ``` cd healthycode-deploy/ sudo cp ./etc/scancodeio/network.yml /etc/scancodeio/network.yml ``` -### 2. Edit ScanCode.io systemctl config to run with healthycode profile +### Edit ScanCode.io systemctl config to run with healthycode profile ``` sudo vi /etc/systemd/system/scancodeio.service @@ -107,35 +160,44 @@ sudo vi /etc/systemd/system/scancodeio.service Update ExecStart as below: ``` -ExecStart=/usr/bin/docker compose -f /opt/scancodeio/docker-compose.purldb-scan-worker.yml -f /etc/scancodeio/networks.yml --profile healthycode up --scale worker=${NUM_WORKERS} +ExecStart=/usr/bin/docker compose \ + -f /opt/scancodeio/docker-compose.purldb-scan-worker.yml \ + -f /etc/scancodeio/networks.yml \ + --profile healthycode \ + up --scale worker=${NUM_WORKERS} ``` ``` sudo systemctl daemon-reload ``` -### 3. Add PurlDB URL and API key in ScanCode.io -Get an PurlDB scanworker API key +### Add PurlDB base URL and API key to ScanCode.io + +Get or create a PurlDB API key for the scanworker: ``` # on purldb -docker compose -f /opt/purldb/docker-compose.production.yml exec web python manage_purldb.py create-scan-queue-worker-user +docker compose -f /opt/purldb/docker-compose.production.yml exec web python \ + manage_purldb.py create-scan-queue-worker-user ``` ``` sudo vi /etc/scancodeio/.env ``` -Populate with below config + +Populate with this config, using localhost assuming eveything is co-located on +one server: ``` PURLDB_URL= PURLDB_API_KEY="scanworker-api-key" ``` -### 4. Configure GrimoireLab env in ScanCode.io +### Configure GrimoireLab environment in ScanCode.io ``` sudo vi /etc/scancodeio/.env ``` -Populate with below config as is: + +Populate with this config: ``` GRIMOIRELAB_URL="http://grimoirelab-nginx:8000/" GRIMOIRELAB_OPENSEARCH_URL="https://grimoirelab-opensearch:9200/" @@ -143,7 +205,9 @@ GRIMOIRELAB_ECOSYSTEM="npmlargerecosystem" GRIMOIRELAB_PROJECT="NPMMostUsed" ``` -Populate below field based on secret set in ``./docker-compose/docker-compose-grimoirelab2.yml`` +Populate these fields based on the same secret that may have been set in +`./docker-compose/docker-compose-grimoirelab2.yml` + ``` GRIMOIRELAB_USERNAME="" GRIMOIRELAB_PASSWORD="" @@ -152,7 +216,11 @@ GRIMOIRELAB_OPENSEARCH_USERNAME="" GRIMOIRELAB_OPENSEARCH_PASSWORD="" ``` -### 5. Expose ScanCode.io on port 8443 +### Expose ScanCode.io on port 8443 + +This is optional, and enables access to the ScanCode.io scan worker. +If using this, make sure you configure authentication in ScanCode.io first. + ``` sudo vi /opt/scancodeio/.env ``` @@ -163,8 +231,15 @@ NGINX_PUBLISHED_HTTP_PORT=8081 NGINX_PUBLISHED_HTTPS_PORT=8443 ``` -### 6. Restart ScanCode.io +### Restart ScanCode.io ``` -# cd into scancode.io-deploy/ -make restart +sudo systemctl restart scancodeio ``` + +## Verify everything is working end to end + + +Visit the PurlDB health API at: https:///api/health/ + +Make a test request with https:///api/health/?purl=pkg:npm/lodash&format=json + From 97e19b98f2d1f2a3f43a120de762171d6a6ef9ea Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Tue, 3 Nov 2026 17:50:08 +0530 Subject: [PATCH 9/9] chore: move HealthyCode deployment docs Signed-off-by: Keshav Priyadarshi --- README.md => deploy/README.md | 0 .../default-grimoirelab-settings/nginx.conf.template | 0 .../docker-compose}/default-grimoirelab-settings/uwsgi_params | 0 .../docker-compose}/docker-compose-grimoirelab2.yml | 0 {etc => deploy/etc}/scancodeio/network.yml | 0 5 files changed, 0 insertions(+), 0 deletions(-) rename README.md => deploy/README.md (100%) rename {docker-compose => deploy/docker-compose}/default-grimoirelab-settings/nginx.conf.template (100%) rename {docker-compose => deploy/docker-compose}/default-grimoirelab-settings/uwsgi_params (100%) rename {docker-compose => deploy/docker-compose}/docker-compose-grimoirelab2.yml (100%) rename {etc => deploy/etc}/scancodeio/network.yml (100%) diff --git a/README.md b/deploy/README.md similarity index 100% rename from README.md rename to deploy/README.md diff --git a/docker-compose/default-grimoirelab-settings/nginx.conf.template b/deploy/docker-compose/default-grimoirelab-settings/nginx.conf.template similarity index 100% rename from docker-compose/default-grimoirelab-settings/nginx.conf.template rename to deploy/docker-compose/default-grimoirelab-settings/nginx.conf.template diff --git a/docker-compose/default-grimoirelab-settings/uwsgi_params b/deploy/docker-compose/default-grimoirelab-settings/uwsgi_params similarity index 100% rename from docker-compose/default-grimoirelab-settings/uwsgi_params rename to deploy/docker-compose/default-grimoirelab-settings/uwsgi_params diff --git a/docker-compose/docker-compose-grimoirelab2.yml b/deploy/docker-compose/docker-compose-grimoirelab2.yml similarity index 100% rename from docker-compose/docker-compose-grimoirelab2.yml rename to deploy/docker-compose/docker-compose-grimoirelab2.yml diff --git a/etc/scancodeio/network.yml b/deploy/etc/scancodeio/network.yml similarity index 100% rename from etc/scancodeio/network.yml rename to deploy/etc/scancodeio/network.yml