CI/CD Pipeline Lab Setup

# Create docker-compose.yml for GitLab
cat > docker-compose.yml << 'EOF'
services:
  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab
    hostname: gitlab.lab.local
    ports:
      - "8929:80"        # Web UI
      - "2224:22"        # Git SSH
      - "5050:5050"      # Container Registry
    volumes:
      - gitlab_config:/etc/gitlab
      - gitlab_logs:/var/log/gitlab
      - gitlab_data:/var/opt/gitlab
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://gitlab.lab.local:8929'
        gitlab_rails['initial_root_password'] = 'LabPassword123!'
        registry_external_url 'http://gitlab.lab.local:5050'
    shm_size: '256m'

  gitlab-runner:
    image: gitlab/gitlab-runner:latest
    container_name: gitlab-runner
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - runner_config:/etc/gitlab-runner
    depends_on:
      - gitlab

volumes:
  gitlab_config:
  gitlab_logs:
  gitlab_data:
  runner_config:
EOF

docker compose up -d
# Wait 2-3 minutes for GitLab to initialize
# Access at http://localhost:8929 — root / LabPassword123!

# Get registration token from GitLab:
# Admin Area > CI/CD > Runners > Register runner

# Register the runner
docker exec -it gitlab-runner gitlab-runner register \
  --non-interactive \
  --url "http://gitlab:80" \
  --token "YOUR_REGISTRATION_TOKEN" \
  --executor "docker" \
  --docker-image "alpine:latest" \
  --description "lab-runner" \
  --docker-privileged  # Needed for Docker-in-Docker builds

# This pipeline has multiple security issues for practice
stages:
  - build
  - test
  - deploy

variables:
  # BAD: Hardcoded secrets in pipeline variables
  AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE"
  AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  DB_PASSWORD: "production_password_123"

build:
  stage: build
  image: docker:latest
  services:
    - docker:dind
  script:
    # BAD: Using untrusted base image
    - docker build -t myapp:latest .
    # BAD: Pushing to registry without scanning
    - docker push registry.lab.local:5050/myapp:latest

test:
  stage: test
  script:
    # BAD: Executing arbitrary code from dependencies
    - npm install  # No lockfile verification
    - npm test
    # BAD: Printing environment (may leak secrets)
    - printenv

deploy:
  stage: deploy
  script:
    # BAD: SSH key in pipeline
    - echo "$SSH_PRIVATE_KEY" > /tmp/deploy_key
    - chmod 600 /tmp/deploy_key
    - ssh -i /tmp/deploy_key root@prod-server "docker pull && docker restart app"
  environment:
    name: production

# Run Jenkins with Docker socket access
docker run -d \
  --name jenkins \
  -p 8080:8080 \
  -p 50000:50000 \
  -v jenkins_home:/var/jenkins_home \
  -v /var/run/docker.sock:/var/run/docker.sock \
  jenkins/jenkins:lts

# Get initial admin password
docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

# Access at http://localhost:8080
# Install suggested plugins during setup

pipeline {
    agent any

    // BAD: Credentials in environment block
    environment {
        DB_CREDS = 'admin:SuperSecret123'
        API_KEY  = 'sk-live-abc123def456'
    }

    stages {
        stage('Build') {
            steps {
                // BAD: Arbitrary Groovy execution enabled
                script {
                    def output = sh(script: 'whoami && id', returnStdout: true)
                    echo "Running as: ${output}"
                }
                sh 'docker build -t app:latest .'
            }
        }

        stage('Test') {
            steps {
                // BAD: No dependency verification
                sh 'pip install -r requirements.txt'
                sh 'python -m pytest'

                // BAD: Dumping credentials for debugging
                sh 'echo $DB_CREDS'
            }
        }

        stage('Deploy') {
            steps {
                // BAD: Remote code execution via SSH with embedded key
                sh """
                    sshpass -p 'root123' ssh root@production \
                    'cd /opt/app && git pull && docker compose up -d'
                """
            }
        }
    }
}

cat > docker-compose.yml << 'EOF'
services:
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    ports:
      - "3000:3000"    # Web UI
      - "2222:22"      # Git SSH
    volumes:
      - gitea_data:/data
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__ROOT_URL=http://localhost:3000

  woodpecker:
    image: woodpeckerci/woodpecker-server:latest
    container_name: woodpecker
    ports:
      - "8000:8000"
    volumes:
      - woodpecker_data:/var/lib/woodpecker
    environment:
      - WOODPECKER_OPEN=true
      - WOODPECKER_GITEA=true
      - WOODPECKER_GITEA_URL=http://gitea:3000
      - WOODPECKER_GITEA_CLIENT=your-client-id
      - WOODPECKER_GITEA_SECRET=your-client-secret
      - WOODPECKER_HOST=http://localhost:8000
      - WOODPECKER_SECRET=woodpecker-secret-key

volumes:
  gitea_data:
  woodpecker_data:
EOF

docker compose up -d
# Access Gitea at http://localhost:3000
# Access Woodpecker CI at http://localhost:8000