diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml new file mode 100644 index 0000000..5dd4bee --- /dev/null +++ b/.gitea/workflows/deploy-prod.yml @@ -0,0 +1,68 @@ +name: Deploy to Prod + +# Intentional promotion only: push origin :prod to ship whatever image +# dev already built and published for that commit. This workflow never runs +# `docker compose build` - it only pulls a pre-existing SHA-tagged image from +# the registry, so prod always runs byte-identical artifacts to what dev +# already validated. See docker-compose.deploy.yml and CLAUDE.md. + +on: + push: + branches: [prod] + +jobs: + deploy: + name: Deploy & Smoke Test (prod) + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install SSH client + run: which ssh || (apt-get update -qq && apt-get install -y -qq openssh-client) + + - name: Setup SSH key + run: | + mkdir -p ~/.ssh + echo "${{ secrets.PROD_SSH_KEY }}" > ~/.ssh/deploy_key + chmod 600 ~/.ssh/deploy_key + ssh-keyscan -H ${{ secrets.PROD_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true + + - name: Deploy (pull pre-built image, no rebuild) + run: | + ssh -i ~/.ssh/deploy_key \ + -o StrictHostKeyChecking=no \ + -o ConnectTimeout=10 \ + ${{ secrets.PROD_USER }}@${{ secrets.PROD_HOST }} \ + 'set -e + cd /opt/lisilou-portfolio + git fetch origin + git reset --hard origin/prod + SHA=$(git rev-parse --short HEAD) + echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jerodrigged.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin + export IMAGE_TAG=$SHA + docker compose -f docker-compose.yml -f docker-compose.deploy.yml pull + docker compose -f docker-compose.yml -f docker-compose.deploy.yml up -d + echo "Deployed $SHA (pulled, not built)"' + + - name: Wait for health check + run: | + echo "Waiting for services..." + for i in $(seq 1 24); do + if curl -sf --max-time 4 "http://${{ secrets.PROD_HOST }}:8080/health" > /dev/null 2>&1; then + echo "Services are up (attempt $i)" + exit 0 + fi + echo " Attempt $i/24 — sleeping 5s" + sleep 5 + done + echo "Health check timed out after 2 minutes" + exit 1 + + - name: Smoke tests + run: bash scripts/smoke-test.sh "http://${{ secrets.PROD_HOST }}:8080" + + - name: Cleanup SSH key + if: always() + run: rm -f ~/.ssh/deploy_key diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index d974a5f..7835568 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -34,6 +34,20 @@ jobs: git fetch origin git reset --hard origin/main docker compose build + SHA=$(git rev-parse --short HEAD) + if [ -n "${{ secrets.REGISTRY_TOKEN }}" ]; then + set +e + echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.jerodrigged.com -u "${{ secrets.REGISTRY_USER }}" --password-stdin \ + && docker tag lisilou-portfolio-web:local git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:$SHA \ + && docker tag lisilou-portfolio-api:local git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:$SHA \ + && docker push git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:$SHA \ + && docker push git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:$SHA \ + && echo "Published $SHA to registry" \ + || echo "WARNING: registry publish failed, continuing deploy anyway" + set -e + else + echo "REGISTRY_TOKEN not set - skipping registry publish (prod promotion unavailable until configured)" + fi docker compose up -d echo "Deploy complete"' diff --git a/CLAUDE.md b/CLAUDE.md index dcf9b46..24b8d8e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -144,16 +144,43 @@ Missing images fall back to a styled placeholder — safe to deploy before photo | `.gitea/workflows/deploy.yml` | Push-to-main → SSH deploy → smoke tests | | `scripts/smoke-test.sh` | 6 curl assertions; exits non-zero on failure | -## CI/CD — Trunk-Based Development +## CI/CD — Dev auto-deploys, prod is a deliberate promotion -Every push to `main`: +Both pipelines run on Gitea Actions (git.jerodrigged.com). GitHub is not part +of the deploy story — `main` on the GitHub mirror is unused. + +**Dev (every push to `main`)** — `.gitea/workflows/deploy.yml`: 1. Gitea runner (CT117) SSHes into CT114 (dev LXC at 192.168.1.192) 2. `git fetch origin && git reset --hard origin/main` — robust, never fails on drift -3. `docker compose build && docker compose up -d` -4. Health check loop (24 × 5s attempts) -5. `bash scripts/smoke-test.sh` — 6 tests; pipeline fails if any fail +3. `docker compose build` (tags images `lisilou-portfolio-web:local` / `lisilou-portfolio-api:local`) +4. If `REGISTRY_TOKEN` is set: tag+push both images to + `git.jerodrigged.com/jhodgkin/lisilou-portfolio-{web,api}:` — + best-effort, a publish failure never blocks the dev deploy itself +5. `docker compose up -d` (runs the just-built local image) +6. Health check loop (24 × 5s attempts), then `bash scripts/smoke-test.sh` -**Gitea secrets required:** `DEV_SSH_KEY`, `DEV_HOST`, `DEV_USER` +**Prod (only on `git push origin main:prod`, or `:prod` to pin an older +commit)** — `.gitea/workflows/deploy-prod.yml`: +1. Gitea runner SSHes into CT111 (prod LXC, 192.168.1.246) +2. `git fetch origin && git reset --hard origin/prod`, then computes the same + short SHA dev used to tag its published image +3. `docker compose -f docker-compose.yml -f docker-compose.deploy.yml pull` — + pulls that exact SHA-tagged image from the registry. **No `docker compose + build` ever runs here** — this is what guarantees prod runs the same + artifact dev already validated, not a fresh rebuild that could drift. + Pulling a SHA that dev never published fails loudly instead of silently + rebuilding. +4. `docker compose -f docker-compose.yml -f docker-compose.deploy.yml up -d` +5. Same health check + smoke test pattern, against CT111 + +`docker-compose.deploy.yml` is the override that swaps each service's `image:` +for the registry-tagged one; it's only ever used for the prod pull, never for +local dev (`docker compose up -d` alone still builds from source as before). + +**Gitea secrets required:** `DEV_SSH_KEY`, `DEV_HOST`, `DEV_USER` (dev); +`PROD_SSH_KEY`, `PROD_HOST`, `PROD_USER` (prod); `REGISTRY_USER`, +`REGISTRY_TOKEN` (both pipelines — a Gitea access token scoped +`write:package,read:package`). ## Booking Wizard — Implementation Status diff --git a/docker-compose.deploy.yml b/docker-compose.deploy.yml new file mode 100644 index 0000000..2c79cf5 --- /dev/null +++ b/docker-compose.deploy.yml @@ -0,0 +1,13 @@ +# Prod-only override. Used exclusively by .gitea/workflows/deploy-prod.yml as: +# docker compose -f docker-compose.yml -f docker-compose.deploy.yml pull +# docker compose -f docker-compose.yml -f docker-compose.deploy.yml up -d +# +# Overriding `image:` here means `pull` fetches a specific pre-built tag from +# the registry and `up -d` runs it without ever invoking `build:` — prod can +# only ever run an artifact that dev already built and published under +# IMAGE_TAG (the short commit SHA). See CLAUDE.md CI/CD section. +services: + portfolio: + image: git.jerodrigged.com/jhodgkin/lisilou-portfolio-web:${IMAGE_TAG} + api: + image: git.jerodrigged.com/jhodgkin/lisilou-portfolio-api:${IMAGE_TAG} diff --git a/docker-compose.yml b/docker-compose.yml index 1e08173..daff071 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,6 +5,7 @@ services: build: context: . dockerfile: Dockerfile + image: lisilou-portfolio-web:local container_name: lisilou-portfolio restart: unless-stopped ports: @@ -29,6 +30,7 @@ services: build: context: ./api dockerfile: Dockerfile + image: lisilou-portfolio-api:local container_name: lisilou-api restart: unless-stopped env_file: