name: AS Talange CI/CD Pipeline - Production on: push: branches: - 'prod/*' jobs: test: name: Build & Run Unit Tests runs-on: [self-hosted, prod] container: image: maven:3.9.6-eclipse-temurin-21 steps: - name: Clone repository run: | if ! command -v git &> /dev/null; then apt-get update && apt-get install -y git fi SERVER_URL="${{ github.server_url }}" SERVER_NO_PROTO="${SERVER_URL#http://}" SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}" git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" . git checkout ${{ github.sha }} - name: Run Maven Tests run: mvn clean test deploy_prod: name: Deploy to Prod Environment needs: test if: startsWith(github.ref, 'refs/heads/prod/') runs-on: [self-hosted, prod] container: image: docker:latest steps: - name: Clone repository run: | apk add --no-cache git SERVER_URL="${{ github.server_url }}" SERVER_NO_PROTO="${SERVER_URL#http://}" SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}" git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" . git checkout ${{ github.sha }} - name: Deploy with Docker Compose env: PROD_DB_USER: ${{ secrets.PROD_DB_USER }} PROD_DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }} PROD_DB_NAME: ${{ secrets.PROD_DB_NAME }} CAPTCHA_SECRET: ${{ secrets.CAPTCHA_SECRET }} CAPTCHA_SITEKEY: ${{ secrets.CAPTCHA_SITEKEY }} MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }} MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }} MAIL_FROM: ${{ secrets.MAIL_FROM }} BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }} NOTIFICATION_EMAIL: ${{ secrets.NOTIFICATION_EMAIL }} BACKUP_DIR: ${{ secrets.BACKUP_DIR }} RETENTION_DAYS: ${{ secrets.RETENTION_DAYS }} ENABLE_REMOTE_COPY: ${{ secrets.ENABLE_REMOTE_COPY }} REMOTE_HOST: ${{ secrets.REMOTE_HOST }} REMOTE_USER: ${{ secrets.REMOTE_USER }} REMOTE_PORT: ${{ secrets.REMOTE_PORT }} REMOTE_BACKUP_DIR: ${{ secrets.REMOTE_BACKUP_DIR }} SSH_KEY_PATH: ${{ secrets.SSH_KEY_PATH }} run: | echo "POSTGRES_USER=${PROD_DB_USER:-myuser}" > .env echo "POSTGRES_PASSWORD=${PROD_DB_PASSWORD:-mypassword}" >> .env [ -n "${PROD_DB_NAME}" ] && echo "POSTGRES_DB=${PROD_DB_NAME}" >> .env echo "CAPTCHA_SECRET=${CAPTCHA_SECRET:-1x0000000000000000000000000000000AA}" >> .env echo "CAPTCHA_SITEKEY=${CAPTCHA_SITEKEY:-1x00000000000000000000AA}" >> .env if [ -n "${MAIL_USERNAME}" ]; then echo "SPRING_MAIL_HOST=smtp-relay.brevo.com" >> .env echo "SPRING_MAIL_PORT=${MAIL_PORT:-2525}" >> .env echo "SPRING_MAIL_USERNAME=${MAIL_USERNAME}" >> .env echo "SPRING_MAIL_PASSWORD=${MAIL_PASSWORD}" >> .env echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=true" >> .env echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=true" >> .env if [ -n "${MAIL_FROM}" ]; then echo "APP_MAIL_FROM=${MAIL_FROM}" >> .env fi fi # Configuration des sauvegardes de BDD [ -n "${BREVO_API_KEY}" ] && echo "BREVO_API_KEY=${BREVO_API_KEY}" >> .env [ -n "${NOTIFICATION_EMAIL}" ] && echo "NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL}" >> .env [ -n "${BACKUP_DIR}" ] && echo "BACKUP_DIR=${BACKUP_DIR}" >> .env [ -n "${RETENTION_DAYS}" ] && echo "RETENTION_DAYS=${RETENTION_DAYS}" >> .env if [ "${ENABLE_REMOTE_COPY}" = "true" ]; then echo "ENABLE_REMOTE_COPY=true" >> .env [ -n "${REMOTE_HOST}" ] && echo "REMOTE_HOST=${REMOTE_HOST}" >> .env [ -n "${REMOTE_USER}" ] && echo "REMOTE_USER=${REMOTE_USER}" >> .env [ -n "${REMOTE_PORT}" ] && echo "REMOTE_PORT=${REMOTE_PORT}" >> .env [ -n "${REMOTE_BACKUP_DIR}" ] && echo "REMOTE_BACKUP_DIR=${REMOTE_BACKUP_DIR}" >> .env [ -n "${SSH_KEY_PATH}" ] && echo "SSH_KEY_PATH=${SSH_KEY_PATH}" >> .env fi docker compose down app || true docker compose up -d --build app - name: Verify application startup run: | echo "Waiting for application to start..." COUNT=0 while [ $COUNT -lt 30 ]; do if docker exec astalange_app wget -qO- http://localhost:8080/login | grep -q "Connexion"; then echo "Application is up and login page is accessible!" exit 0 fi echo "Waiting... ($COUNT/30)" sleep 5 COUNT=$((COUNT+1)) done echo "Application failed to start or login page is not accessible." docker logs astalange_app exit 1 - name: Deploy Backup Script & Config to DB Server (10.8.0.3) env: DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }} DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }} REMOTE_PORT: ${{ secrets.REMOTE_PORT }} PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }} SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }} SSH_KEY_SECRET: ${{ secrets.SSH_KEY }} run: | TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}" TARGET_USER="${DB_SERVER_USER:-root}" PORT="${REMOTE_PORT:-22}" DEST_DIR="/opt/as-talange" RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then RAW_KEY=$(cat "${RAW_KEY}") fi if [ -z "${RAW_KEY}" ]; then if [ -f /root/.ssh/gitea_ci_key ]; then RAW_KEY=$(cat /root/.ssh/gitea_ci_key) elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key) fi fi if [ -z "${RAW_KEY}" ]; then echo "=========================================================================" echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !" echo "=========================================================================" exit 1 fi KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n') docker run --rm --net=host \ -v "$(pwd):/workspace" -w /workspace \ -e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_USER="${TARGET_USER}" \ -e PORT="${PORT}" \ -e DEST_DIR="${DEST_DIR}" \ -e KEY_B64="${KEY_B64}" \ alpine:latest sh -c ' apk add --no-cache openssh-client rsync coreutils && \ (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \ HEADER=$(grep "BEGIN" /tmp/raw_key) && \ FOOTER=$(grep "END" /tmp/raw_key) && \ BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \ printf "%s\n" "$HEADER" > /tmp/working_key && \ printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \ printf "%s\n" "$FOOTER" >> /tmp/working_key && \ echo "" >> /tmp/working_key && \ chmod 600 /tmp/working_key && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Destination Directory: ${DEST_DIR}" && \ echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \ echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \ echo "=== 🔑 KEY FINGERPRINT ===" && \ ssh-keygen -l -f /tmp/working_key && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \ echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \ rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \ echo "=== 📦 RSYNC TRANSFER ENV ===" && \ rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \ $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \ echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!" '