CI/CD Pipeline Lab Setup

# Create docker-compose.yml for GitLab
cat > docker-compose.yml << 'EOF'
services:
  gitlab:
    image: gitlab/gitlab-ce:19.5.0-ce.0  # Verify the current supported tag before reuse
    container_name: gitlab
    hostname: gitlab.lab.local
    ports:
      - "127.0.0.1:8929:8929"      # Web UI - nginx listens on the external_url port inside the container
      - "127.0.0.1:2224:22"        # Git SSH
      - "127.0.0.1:5050:5050"      # Container Registry
    volumes:
      - gitlab_config:/etc/gitlab
      - gitlab_logs:/var/log/gitlab
      - gitlab_data:/var/opt/gitlab
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://gitlab.lab.local:8929'
        # Lab-only bootstrap password. Change after first login and never reuse.
        gitlab_rails['initial_root_password'] = 'LAB_ONLY_ChangeMe_123!'
        registry_external_url 'http://gitlab.lab.local:5050'
    shm_size: '256m'
    networks:
      default:
        # Makes gitlab.lab.local resolve inside the Compose network, which is the
        # hostname in external_url / registry_external_url above
        aliases:
          - gitlab.lab.local

  gitlab-runner:
    image: gitlab/gitlab-runner:v19.5.0  # Keep the runner on the same minor as GitLab
    container_name: gitlab-runner
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - runner_config:/etc/gitlab-runner
    depends_on:
      - gitlab

volumes:
  gitlab_config:
  gitlab_logs:
  gitlab_data:
  runner_config:
EOF

# The Docker socket mount above is intentionally dangerous and lab-only.
# Treat this runner as equivalent to host root until the lab is destroyed.

docker compose up -d
# Add "127.0.0.1 gitlab.lab.local" to the host's hosts file
#   (Windows: C:/Windows/System32/drivers/etc/hosts, Linux: /etc/hosts) so the
#   clone and registry URLs GitLab generates resolve from the host
# Wait 2-3 minutes for GitLab to initialize
# Access at http://gitlab.lab.local:8929 (http://localhost:8929 also answers) — root / LAB_ONLY_ChangeMe_123!

# This pipeline has multiple security issues for practice
stages:
  - build
  - test
  - deploy

variables:
  # BAD: Hardcoded secrets in pipeline variables
  AWS_ACCESS_KEY_ID: "AKIAIOSFODNN7EXAMPLE"
  AWS_SECRET_ACCESS_KEY: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  DB_PASSWORD: "LAB_ONLY_seeded_secret_123"

build:
  stage: build
  image: docker:29-cli
  services:
    - docker:29-dind
  script:
    # BAD: Using untrusted base image
    - docker build -t myapp:lab .
    # BAD: Pushing to registry without scanning
    - docker push gitlab.lab.local:5050/myapp:lab

test:
  stage: test
  script:
    # BAD: Executing arbitrary code from dependencies
    - npm install  # No lockfile verification
    - npm test
    # BAD: Printing environment (may leak secrets)
    - printenv

deploy:
  stage: deploy
  script:
    # BAD: SSH key in pipeline
    - echo "$SSH_PRIVATE_KEY" > /tmp/deploy_key
    - chmod 600 /tmp/deploy_key
    - ssh -i /tmp/deploy_key root@lab-deploy-target "docker pull && docker restart app"
  environment:
    name: production

pipeline {
    agent any

    // BAD: Credentials in environment block
    environment {
        DB_CREDS = 'admin:SuperSecret123'
        API_KEY  = 'sk-live-abc123def456'
    }

    stages {
        stage('Build') {
            steps {
                // BAD: Arbitrary Groovy execution enabled
                script {
                    def output = sh(script: 'whoami && id', returnStdout: true)
                    echo "Running as: ${output}"
                }
                sh 'docker build -t app:lab .'
            }
        }

        stage('Test') {
            steps {
                // BAD: No dependency verification
                sh 'pip install -r requirements.txt'
                sh 'python -m pytest'

                // BAD: Dumping credentials for debugging
                sh 'echo $DB_CREDS'
            }
        }

        stage('Deploy') {
            steps {
                // BAD: Remote code execution via SSH with embedded key
                sh """
                    sshpass -p 'root123' ssh root@production \
                    'cd /opt/app && git pull && docker compose up -d'
                """
            }
        }
    }
}

cat > docker-compose.yml << 'EOF'
services:
  gitea:
    image: gitea/gitea:1.28.1   # Verify the current tag before reuse
    container_name: gitea
    ports:
      - "127.0.0.1:3000:3000"    # Web UI
      - "127.0.0.1:2222:22"      # Git SSH
    volumes:
      - gitea_data:/data
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__ROOT_URL=http://localhost:3000

  woodpecker:
    image: woodpeckerci/woodpecker-server:v3.19.0
    container_name: woodpecker
    ports:
      - "127.0.0.1:8000:8000"
    volumes:
      - woodpecker_data:/var/lib/woodpecker
    environment:
      - WOODPECKER_OPEN=true
      - WOODPECKER_GITEA=true
      - WOODPECKER_GITEA_URL=http://gitea:3000
      - WOODPECKER_GITEA_CLIENT=your-client-id      # Gitea > Settings > Applications > OAuth2
      - WOODPECKER_GITEA_SECRET=your-client-secret
      - WOODPECKER_HOST=http://localhost:8000
      # v3 uses AGENT_SECRET to pair server and agent; the old WOODPECKER_SECRET name is gone
      - WOODPECKER_AGENT_SECRET=lab-agent-secret

  woodpecker-agent:
    image: woodpeckerci/woodpecker-agent:v3.19.0   # keep the agent on the server's version
    container_name: woodpecker-agent
    command: agent
    environment:
      - WOODPECKER_SERVER=woodpecker:9000
      - WOODPECKER_AGENT_SECRET=lab-agent-secret
      - WOODPECKER_MAX_WORKFLOWS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock   # lab-only: host-root equivalent
    depends_on:
      - woodpecker

volumes:
  gitea_data:
  woodpecker_data:
EOF

docker compose up -d
# Access Gitea at http://localhost:3000
# Access Woodpecker CI at http://localhost:8000
# The agent only picks up jobs once the server is up - check with:
docker logs woodpecker-agent