🔧 ForgeOps Platform

Production-grade CI/CD platform running on Hetzner Cloud (CAX11 ARM)
Powered by Jenkins + Podman (rootless, daemonless) + Nginx

---

🏗️ Architecture Overview

GitHub Repos
│
│ (Webhooks)
▼
Nginx (HTTPS Reverse Proxy)
│
▼
Jenkins LTS (Podman container)
│
├── Shared Pipeline Library (vars/)
│ ├── build.groovy
│ ├── test.groovy
│ ├── security.groovy
│ └── notify.groovy
│
├── CI Pipeline → Install → Lint → Unit Tests
├── CD Pipeline → Build Image → Push → Deploy
└── Test Pipeline → API Tests → k6 Load Tests
│
▼
Podman (rootless) → Running Containers

---

📁 Repository Structure

forgeops/
├── README.md # This file
│
├── jenkins/ # Jenkins setup & configuration
│ ├── setup/
│ │ ├── install-jenkins.sh # Jenkins installation via Podman
│ │ ├── configure-jenkins.sh # Post-install configuration
│ │ └── podman-systemd.service # Systemd unit for Jenkins container
│ ├── casc/
│ │ └── jenkins.yaml # Configuration-as-Code (JCasC)
│ └── plugins.txt # Required Jenkins plugins list
│
├── shared-library/ # Jenkins Shared Pipeline Library
│ ├── vars/
│ │ ├── build.groovy # Build stage logic
│ │ ├── test.groovy # Test stage logic
│ │ ├── security.groovy # Security scanning logic
│ │ └── notify.groovy # Notification logic
│ └── src/
│ └── org/forgeops/
│ ├── PipelineConfig.groovy # Pipeline configuration class
│ └── Utils.groovy # Utility functions
│
├── pipelines/ # Pipeline templates
│ ├── ci-pipeline.groovy # CI pipeline template
│ ├── cd-pipeline.groovy # CD pipeline template
│ └── test-pipeline.groovy # Testing pipeline template
│
├── nginx/ # Nginx reverse proxy configuration
│ ├── nginx.conf # Main Nginx config
│ ├── conf.d/
│ │ └── jenkins.conf # Jenkins site config
│ └── ssl/
│ └── .gitkeep # Placeholder for SSL certs
│
├── deployment/ # Podman-based deployment scripts
│ ├── deploy.sh # Generic deployment script
│ ├── rollback.sh # Rollback to previous image
│ └── health-check.sh # Post-deploy health check
│
├── cleanup/ # Maintenance & cleanup scripts
│ ├── podman-prune.sh # Container/image cleanup
│ └── log-rotate.sh # Log rotation script
│
├── security/ # Security configurations
│ ├── seccomp-profile.json # Podman seccomp security profile
│ └── jenkins-credentials-setup.sh # Credential bootstrapping guide
│
├── observability/ # Logging & metrics stubs
│ ├── prometheus/
│ │ └── prometheus.yml # Prometheus scrape config (future)
│ └── loki/
│ └── loki-config.yaml # Loki log aggregation (future)
│
├── sample-apps/ # Sample Node.js applications
│ ├── node-api/ # Sample REST API
│ │ ├── src/
│ │ │ └── index.js
│ │ ├── tests/
│ │ │ └── index.test.js
│ │ ├── k6/
│ │ │ └── load-test.js
│ │ ├── Containerfile # Podman-compatible (not Dockerfile)
│ │ ├── Jenkinsfile
│ │ └── package.json
│ └── node-worker/ # Sample background worker
│ ├── src/
│ │ └── worker.js
│ ├── tests/
│ │ └── worker.test.js
│ ├── Containerfile
│ ├── Jenkinsfile
│ └── package.json
│
└── docs/ # Documentation
├── webhook-setup.md # GitHub webhook configuration guide
├── adding-new-repo.md # How to onboard a new repository
├── security-hardening.md # Security best practices
└── troubleshooting.md # Common issues & solutions

---

🚀 Quick Start

Prerequisites

• Hetzner Cloud CAX11 server (2 vCPU ARM / 4 GB RAM / 40 GB NVMe — ~€3.29/mo)
• Ubuntu 22.04 LTS (select during Hetzner server creation)
• Domain name (or use IP directly for testing)
• GitHub account with repositories to connect

1. Provision the Server

# On Hetzner Cloud Console (console.hetzner.cloud):# 1. New Project → Add Server# 2. Location: Falkenstein / Nuremberg / Helsinki (pick closest)# 3. OS Image: Ubuntu 22.04# 4. Type: Shared vCPU → ARM64 (Ampere) → CAX11 (2 vCPU / 4 GB / €3.29)# 5. Add your SSH public key# 6. Create & Buy (firewall opens 22/80/443 by default)

2. Install Podman

sudo apt-get update
sudo apt-get install -y podman
podman --version # Verify installation

3. Deploy Jenkins

git clone https://github.com/YOUR_ORG/forgeops.git
cd forgeops
chmod +x jenkins/setup/install-jenkins.sh
./jenkins/setup/install-jenkins.sh

4. Configure Nginx

sudo apt-get install -y nginx certbot python3-certbot-nginx
sudo cp nginx/conf.d/jenkins.conf /etc/nginx/conf.d/
# Edit the server_name in jenkins.conf to your domain
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d your-domain.com

5. Complete Jenkins Setup

Open https://your-domain.com and follow the setup wizard, or use JCasC:

chmod +x jenkins/setup/configure-jenkins.sh
./jenkins/setup/configure-jenkins.sh

6. Register the Shared Library

In Jenkins → Manage Jenkins → Configure System → Global Pipeline Libraries:

• Name: forgeops-shared
• SCM: Git
• URL: https://github.com/YOUR_ORG/forgeops.git
• Credential: your GitHub PAT
• Path: shared-library

---

🔄 Pipeline Modes

Pipeline	Trigger	Stages
CI	Every push	Install → Lint → Unit Tests
CD	main branch / tag	Build Image → Push → Deploy
Test	Post-deploy	API Tests → k6 Load Tests

---

📦 Adding a New Repository

See docs/adding-new-repo.md for the full guide.

TL;DR: Add this minimal Jenkinsfile to your repo:

@Library('forgeops-shared') _
ciPipeline(
appName: 'my-app',
port: 3000
)

---

🔐 Security Highlights

• Jenkins runs as non-root via Podman rootless
• No secrets in code — all credentials via Jenkins Credential Store
• Nginx enforces HTTPS with TLS 1.2+
• Containers run with seccomp profiles
• Automatic container image vulnerability awareness

---

🗺️ Roadmap

• Kubernetes migration support (Helm charts)
• Prometheus + Grafana metrics dashboard
• Loki log aggregation
• Automated SSL renewal
• Multi-node Jenkins agent support
• GitOps workflow (ArgoCD integration)

---

📄 License

MIT — see LICENSE