feat(deploy): switch to Oracle MySQL, separate CI runner, docker-compose deploy
- Prisma schema: sqlite → mysql provider - Migration SQL rewritten as MySQL DDL (utf8mb4, DATETIME(3), AUTO_INCREMENT) - Add migration_lock.toml for mysql provider - Dockerfile.backend: drop node:22/sqlite deps, use node:20-slim - entrypoint.sh: replace SQLite first-run logic with prisma migrate deploy + db seed - docker-compose.prod.yml: production compose for /opt/webapps/okr on web VPS - reads DB creds from /opt/webapps/webapp-mysql.env - reads app secrets from /opt/webapps/okr/.env.app (written by CI) - port 80 (frontend), no conflict with Gitea 3000/Vault 8200 - ci.yml deploy-okr: moves from ubuntu-latest (web VPS) to ci-runner (161.33.149.243) - builds images on CI runner VPS (no heavy build on web/Gitea VPS) - transfers images via docker save | gzip | ssh | docker load - deploys via SSH + docker compose up on web VPS - scripts/setup-ci-runner.sh: one-time setup script for CI runner VPS Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
thanhnv
co-authored by
Claude Sonnet 4.6
Claude Sonnet 4.6
parent
719f1147d1
commit
9229fee656
+75
-50
@@ -1,13 +1,11 @@
|
||||
name: CASAN CI Gate
|
||||
|
||||
# Runs on every push/PR to catch regressions (H3) and validate security controls (H4/H5).
|
||||
on:
|
||||
push:
|
||||
branches: [main, develop, "feature/**"]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
# Cancel in-flight runs of the same branch when a newer push arrives.
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
@@ -19,6 +17,7 @@ concurrency:
|
||||
jobs:
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
# Job 1 — Frontend unit tests (fast gate, ~1 min)
|
||||
# Runs on: web/Gitea VPS runner (161.33.139.73) — light job, no Docker build
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
frontend-tests:
|
||||
name: "Frontend Tests (H3 gate)"
|
||||
@@ -45,6 +44,8 @@ jobs:
|
||||
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
# Job 2 — CASAN Security Gate + Vault KMS signing (H4/H5/H2/H6/H7)
|
||||
# Runs on: web/Gitea VPS runner (161.33.139.73) — after frontend-tests to
|
||||
# prevent OOM (1 GB RAM VPS, sequential jobs via capacity: 1)
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
security-gate:
|
||||
name: "CASAN Security Gate + Vault KMS (H4/H5)"
|
||||
@@ -116,15 +117,33 @@ jobs:
|
||||
retention-days: 14
|
||||
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
# Job 3 — Deploy OKR web app (main branch only)
|
||||
# Job 3 — Build Docker images + deploy to /opt/webapps/okr (main only)
|
||||
#
|
||||
# okr-backend — NestJS + Prisma + SQLite, port 3001 (internal)
|
||||
# okr-frontend — nginx + React SPA, port 80 (public)
|
||||
# nginx proxies /api/v1/* → okr-backend:3001
|
||||
# Runs on: DEDICATED CI RUNNER (161.33.149.243, label: ci-runner)
|
||||
# Heavy Docker builds do NOT run on the web/Gitea VPS.
|
||||
#
|
||||
# Architecture:
|
||||
# CI runner (161.33.149.243) Web VPS (161.33.139.73)
|
||||
# ───────────────────────── ────────────────────────────────
|
||||
# docker build okr-backend /opt/webapps/okr/
|
||||
# docker build okr-frontend ──► docker-compose.yml
|
||||
# docker save | gzip | ssh ──► docker load
|
||||
# docker compose up -d
|
||||
#
|
||||
# DB: Oracle MySQL HeatWave (10.0.1.254:3306, webapp_db)
|
||||
# Credentials live on web VPS: /opt/webapps/webapp-mysql.env
|
||||
#
|
||||
# Required Gitea secrets:
|
||||
# DEPLOY_SSH_KEY — ed25519 private key for ubuntu@161.33.139.73
|
||||
# JWT_SECRET — app JWT signing secret
|
||||
#
|
||||
# One-time CI runner setup:
|
||||
# ssh ubuntu@161.33.149.243
|
||||
# RUNNER_TOKEN=<from Gitea admin> bash AINative_OKR_CASAN5/scripts/setup-ci-runner.sh
|
||||
# ──────────────────────────────────────────────────────────────────────────
|
||||
deploy-okr:
|
||||
name: "Deploy OKR → port 80 (H3 CI gate)"
|
||||
runs-on: ubuntu-latest
|
||||
name: "Build & Deploy OKR → /opt/webapps/okr"
|
||||
runs-on: [ci-runner]
|
||||
needs: [frontend-tests, security-gate]
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
defaults:
|
||||
@@ -132,20 +151,25 @@ jobs:
|
||||
working-directory: AINative_OKR_CASAN5
|
||||
env:
|
||||
JWT_SECRET: ${{ secrets.JWT_SECRET }}
|
||||
FRONTEND_ORIGIN: "http://161.33.139.73"
|
||||
WEB_VPS: "ubuntu@161.33.139.73"
|
||||
APP_DIR: "/opt/webapps/okr"
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v3
|
||||
|
||||
- name: Build backend image (node:22-slim — required for node:sqlite)
|
||||
- name: Setup SSH for web VPS deploy
|
||||
run: |
|
||||
docker build \
|
||||
-t okr-backend:latest \
|
||||
-f Dockerfile.backend \
|
||||
.
|
||||
mkdir -p ~/.ssh
|
||||
printf '%s' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
ssh-keyscan -H 161.33.139.73 >> ~/.ssh/known_hosts 2>/dev/null
|
||||
echo "SSH ready"
|
||||
|
||||
- name: Build frontend image (nginx + React SPA)
|
||||
- name: Build backend image (node:20-slim + Prisma MySQL)
|
||||
run: docker build -t okr-backend:latest -f Dockerfile.backend .
|
||||
|
||||
- name: Build frontend image (nginx + React SPA, VITE_API_BASE_URL=/api/v1)
|
||||
run: |
|
||||
docker build \
|
||||
--build-arg VITE_API_BASE_URL=/api/v1 \
|
||||
@@ -153,46 +177,47 @@ jobs:
|
||||
-f Dockerfile.frontend \
|
||||
.
|
||||
|
||||
- name: Create network + persistent volume
|
||||
- name: Transfer images to web VPS
|
||||
run: |
|
||||
docker network create okr-net 2>/dev/null || true
|
||||
docker volume create okr-db 2>/dev/null || true
|
||||
echo "Streaming images to web VPS (this may take ~1 min)..."
|
||||
docker save okr-backend:latest okr-frontend:latest | \
|
||||
gzip | \
|
||||
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
||||
'docker load'
|
||||
|
||||
- name: Deploy backend (port 3001, internal only)
|
||||
- name: Prepare app directory + docker-compose on web VPS
|
||||
run: |
|
||||
docker rm -f okr-backend 2>/dev/null || true
|
||||
docker run -d \
|
||||
--name okr-backend \
|
||||
--network okr-net \
|
||||
-e PORT=3001 \
|
||||
-e DATABASE_URL=file:/data/okr.db \
|
||||
-e JWT_SECRET="${JWT_SECRET}" \
|
||||
-e FRONTEND_ORIGIN="${FRONTEND_ORIGIN}" \
|
||||
-e NODE_ENV=production \
|
||||
-v okr-db:/data \
|
||||
--restart unless-stopped \
|
||||
okr-backend:latest
|
||||
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
||||
"mkdir -p $APP_DIR"
|
||||
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
|
||||
docker-compose.prod.yml $WEB_VPS:$APP_DIR/docker-compose.yml
|
||||
|
||||
- name: Deploy frontend (port 80, public)
|
||||
- name: Write app secrets on web VPS
|
||||
run: |
|
||||
docker rm -f okr-frontend 2>/dev/null || true
|
||||
docker run -d \
|
||||
--name okr-frontend \
|
||||
--network okr-net \
|
||||
-p 80:80 \
|
||||
--restart unless-stopped \
|
||||
okr-frontend:latest
|
||||
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
||||
"printf 'JWT_SECRET=%s\nFRONTEND_ORIGIN=http://161.33.139.73\n' '${JWT_SECRET}' \
|
||||
> $APP_DIR/.env.app && chmod 600 $APP_DIR/.env.app"
|
||||
|
||||
- name: Deploy containers on web VPS
|
||||
run: |
|
||||
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
||||
"cd $APP_DIR && docker compose up -d --remove-orphans --pull never"
|
||||
|
||||
- name: Health check
|
||||
run: |
|
||||
echo "Waiting 20 s for containers to initialise..."
|
||||
sleep 20
|
||||
echo "=== Running containers ==="
|
||||
docker ps --filter "name=okr" --format "{{.Names}}\t{{.Status}}\t{{.Ports}}"
|
||||
if docker ps --filter "name=okr-frontend" --filter "status=running" | grep -q okr-frontend; then
|
||||
echo "DEPLOY_OK frontend=http://161.33.139.73"
|
||||
else
|
||||
echo "DEPLOY_WARN containers not fully running — dumping logs"
|
||||
docker logs okr-frontend --tail 30 || true
|
||||
docker logs okr-backend --tail 30 || true
|
||||
fi
|
||||
echo "Waiting 30s for containers to initialise (includes Prisma migrate + seed)..."
|
||||
sleep 30
|
||||
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS '
|
||||
echo "=== Containers ===" &&
|
||||
docker compose -f /opt/webapps/okr/docker-compose.yml ps &&
|
||||
echo "" &&
|
||||
echo "=== HTTP check ===" &&
|
||||
if curl -fsS -o /dev/null -w "HTTP %{http_code}" http://localhost; then
|
||||
echo ""
|
||||
echo "DEPLOY_OK http://161.33.139.73"
|
||||
else
|
||||
echo "DEPLOY_WARN — backend logs:"
|
||||
docker logs okr-backend --tail 30 || true
|
||||
docker logs okr-frontend --tail 20 || true
|
||||
fi
|
||||
'
|
||||
|
||||
Reference in New Issue
Block a user