---
apiVersion: v1
kind: ConfigMap
metadata:
  name: jenkins-default-configuration
data:
  01-basic-settings.yaml: |
    groovy:
      - script: >
          import jenkins.model.Jenkins;
          import jenkins.model.JenkinsLocationConfiguration;
          import hudson.model.Node.Mode;

          def jenkins = Jenkins.instance;
          //Number of jobs that run simultaneously on master.
          jenkins.setNumExecutors(6);
          //Jobs must specify that they want to run on master
          jenkins.setMode(Mode.EXCLUSIVE);
          jenkins.save();
  02-enable-csrf.yaml: |
    groovy:
      - script: >
          import hudson.security.csrf.DefaultCrumbIssuer;
          import jenkins.model.Jenkins;

          def jenkins = Jenkins.instance;

          if (jenkins.getCrumbIssuer() == null) {
            jenkins.setCrumbIssuer(new DefaultCrumbIssuer(true));
            jenkins.save();
            println('CSRF Protection enabled.');
          } else {
              println('CSRF Protection already configured.');
          }
  03-disable-stats.yaml: |
    groovy:
      - script: >
          import jenkins.model.Jenkins;

          def jenkins = Jenkins.instance;

          if (jenkins.isUsageStatisticsCollected()) {
              jenkins.setNoUsageStatistics(true);
              jenkins.save();
              println('Jenkins usage stats submitting disabled.');
          } else {
              println('Nothing changed.  Usage stats are not submitted to the Jenkins project.');
          }
  04-enable-master-control.yaml: |
    groovy:
      - script: >
          import jenkins.security.s2m.AdminWhitelistRule;
          import jenkins.model.Jenkins;

          // see https://wiki.jenkins-ci.org/display/JENKINS/Slave+To+Master+Access+Control
          def jenkins = Jenkins.instance;
          jenkins.getInjector().getInstance(AdminWhitelistRule.class).setMasterKillSwitch(false); // for real though, false equals enabled..........
          jenkins.save();
  05-disable-insecure.yaml: |
    groovy:
      - script: >
          import jenkins.*;
          import jenkins.model.*;
          import hudson.model.*;
          import jenkins.security.s2m.*;

          def jenkins = Jenkins.instance;

          println("Disabling insecure Jenkins features...");

          println("Disabling insecure protocols...");
          println("Old protocols: [" + jenkins.getAgentProtocols().join(", ") + "]");
          HashSet<String> newProtocols = new HashSet<>(jenkins.getAgentProtocols());
          newProtocols.removeAll(Arrays.asList("JNLP3-connect", "JNLP2-connect", "JNLP-connect", "CLI-connect"));
          println("New protocols: [" + newProtocols.join(", ") + "]");
          jenkins.setAgentProtocols(newProtocols);

          println("Disabling CLI access of /cli URL...");
          def remove = { list ->
              list.each { item ->
                  if (item.getClass().name.contains("CLIAction")) {
                      println("Removing extension ${item.getClass().name}")
                      list.remove(item)
                  }
              }
          };
          remove(jenkins.getExtensionList(RootAction.class));
          remove(jenkins.actions);

          if (jenkins.getDescriptor("jenkins.CLI") != null) {
              jenkins.getDescriptor("jenkins.CLI").get().setEnabled(false);
          }

          jenkins.save();
  06-configure-views.yaml: |
    groovy:
      - script: >
          import hudson.model.ListView;
          import jenkins.model.Jenkins;

          def Jenkins jenkins = Jenkins.getInstance();

          def seedViewName = 'seed-jobs';
          def nonSeedViewName = 'non-seed-jobs';

          if (jenkins.getView(seedViewName) == null) {
              def seedView = new ListView(seedViewName);
              seedView.setIncludeRegex('.*job-dsl-seed.*');
              jenkins.addView(seedView);
          }

          if (jenkins.getView(nonSeedViewName) == null) {
              def nonSeedView = new ListView(nonSeedViewName);
              nonSeedView.setIncludeRegex('((?!seed)(?!jenkins).)*');
              jenkins.addView(nonSeedView);
          }

          jenkins.save();
  07-disable-dsl-approval.yaml: |
    groovy:
      - script: >
          import jenkins.model.Jenkins;
          import javaposse.jobdsl.plugin.GlobalJobDslSecurityConfiguration;
          import jenkins.model.GlobalConfiguration;

          // disable Job DSL script approval
          GlobalConfiguration.all().get(GlobalJobDslSecurityConfiguration.class).useScriptSecurity=false;
          GlobalConfiguration.all().get(GlobalJobDslSecurityConfiguration.class).save();
  
