as-talange/.gitea/workflows/ci-prod.yml

name: AS Talange CI/CD Pipeline - Production

on:
  push:
    branches:
      - 'prod/*'

jobs:
  test:
    name: Build & Run Unit Tests
    runs-on: [self-hosted, prod]
    container:
      image: maven:3.9.6-eclipse-temurin-21
    steps:
      - name: Clone repository
        run: |
          if ! command -v git &> /dev/null; then
            apt-get update && apt-get install -y git
          fi
          SERVER_URL="${{ github.server_url }}"
          SERVER_NO_PROTO="${SERVER_URL#http://}"
          SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}"
          git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" .
          git checkout ${{ github.sha }}

      - name: Run Maven Tests
        run: mvn clean test



  deploy_prod:
    name: Deploy to Prod Environment
    needs: test
    if: startsWith(github.ref, 'refs/heads/prod/')
    runs-on: [self-hosted, prod]
    container:
      image: docker:latest
    steps:
      - name: Clone repository
        run: |
          apk add --no-cache git
          SERVER_URL="${{ github.server_url }}"
          SERVER_NO_PROTO="${SERVER_URL#http://}"
          SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}"
          git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" .
          git checkout ${{ github.sha }}

      - name: Deploy with Docker Compose
        env:
          PROD_DB_USER: ${{ secrets.PROD_DB_USER }}
          PROD_DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
          PROD_DB_NAME: ${{ secrets.PROD_DB_NAME }}
          CAPTCHA_SECRET: ${{ secrets.CAPTCHA_SECRET }}
          CAPTCHA_SITEKEY: ${{ secrets.CAPTCHA_SITEKEY }}
          MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
          MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
          MAIL_FROM: ${{ secrets.MAIL_FROM }}
          BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }}
          NOTIFICATION_EMAIL: ${{ secrets.NOTIFICATION_EMAIL }}
          BACKUP_DIR: ${{ secrets.BACKUP_DIR }}
          RETENTION_DAYS: ${{ secrets.RETENTION_DAYS }}
          ENABLE_REMOTE_COPY: ${{ secrets.ENABLE_REMOTE_COPY }}
          REMOTE_HOST: ${{ secrets.REMOTE_HOST }}
          REMOTE_USER: ${{ secrets.REMOTE_USER }}
          REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
          REMOTE_BACKUP_DIR: ${{ secrets.REMOTE_BACKUP_DIR }}
          SSH_KEY_PATH: ${{ secrets.SSH_KEY_PATH }}
        run: |
          echo "POSTGRES_USER=${PROD_DB_USER:-myuser}" > .env
          echo "POSTGRES_PASSWORD=${PROD_DB_PASSWORD:-mypassword}" >> .env
          [ -n "${PROD_DB_NAME}" ] && echo "POSTGRES_DB=${PROD_DB_NAME}" >> .env
          echo "CAPTCHA_SECRET=${CAPTCHA_SECRET:-1x0000000000000000000000000000000AA}" >> .env
          echo "CAPTCHA_SITEKEY=${CAPTCHA_SITEKEY:-1x00000000000000000000AA}" >> .env
          if [ -n "${MAIL_USERNAME}" ]; then
            echo "SPRING_MAIL_HOST=smtp-relay.brevo.com" >> .env
            echo "SPRING_MAIL_PORT=${MAIL_PORT:-2525}" >> .env
            echo "SPRING_MAIL_USERNAME=${MAIL_USERNAME}" >> .env
            echo "SPRING_MAIL_PASSWORD=${MAIL_PASSWORD}" >> .env
            echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=true" >> .env
            echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=true" >> .env
            if [ -n "${MAIL_FROM}" ]; then
              echo "APP_MAIL_FROM=${MAIL_FROM}" >> .env
            fi
          fi
          # Configuration des sauvegardes de BDD
          [ -n "${BREVO_API_KEY}" ] && echo "BREVO_API_KEY=${BREVO_API_KEY}" >> .env
          [ -n "${NOTIFICATION_EMAIL}" ] && echo "NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL}" >> .env
          [ -n "${BACKUP_DIR}" ] && echo "BACKUP_DIR=${BACKUP_DIR}" >> .env
          [ -n "${RETENTION_DAYS}" ] && echo "RETENTION_DAYS=${RETENTION_DAYS}" >> .env
          if [ "${ENABLE_REMOTE_COPY}" = "true" ]; then
            echo "ENABLE_REMOTE_COPY=true" >> .env
            [ -n "${REMOTE_HOST}" ] && echo "REMOTE_HOST=${REMOTE_HOST}" >> .env
            [ -n "${REMOTE_USER}" ] && echo "REMOTE_USER=${REMOTE_USER}" >> .env
            [ -n "${REMOTE_PORT}" ] && echo "REMOTE_PORT=${REMOTE_PORT}" >> .env
            [ -n "${REMOTE_BACKUP_DIR}" ] && echo "REMOTE_BACKUP_DIR=${REMOTE_BACKUP_DIR}" >> .env
            [ -n "${SSH_KEY_PATH}" ] && echo "SSH_KEY_PATH=${SSH_KEY_PATH}" >> .env
          fi
          docker compose down app || true
          docker compose up -d --build app

      - name: Verify application startup
        run: |
          echo "Waiting for application to start..."
          COUNT=0
          while [ $COUNT -lt 30 ]; do
            if docker exec astalange_app wget -qO- http://localhost:8080/login | grep -q "Connexion"; then
              echo "Application is up and login page is accessible!"
              exit 0
            fi
            echo "Waiting... ($COUNT/30)"
            sleep 5
            COUNT=$((COUNT+1))
          done
          echo "Application failed to start or login page is not accessible."
          docker logs astalange_app
          exit 1

      - name: Deploy Backup Script & Config to DB Server (10.8.0.3)
        env:
          DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }}
          DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }}
          REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
          PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }}
          SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }}
          SSH_KEY_SECRET: ${{ secrets.SSH_KEY }}
        run: |
          TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}"
          TARGET_USER="${DB_SERVER_USER:-root}"
          PORT="${REMOTE_PORT:-22}"
          DEST_DIR="/opt/as-talange"
          RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"

          rm -f /tmp/gitea_runner_key
          if [ -n "${RAW_KEY}" ]; then
            printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key
          elif [ -f /root/.ssh/gitea_ci_key ]; then
            cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key
          elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
            cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key
          fi

          if [ ! -s /tmp/gitea_runner_key ]; then
            echo "ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!"
            exit 1
          fi
          chmod 600 /tmp/gitea_runner_key

          docker run --rm --net=host \
            -v "$(pwd):/workspace" -w /workspace \
            -v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \
            -e TARGET_HOST="${TARGET_HOST}" \
            -e TARGET_USER="${TARGET_USER}" \
            -e PORT="${PORT}" \
            -e DEST_DIR="${DEST_DIR}" \
            alpine:latest sh -c '
              apk add --no-cache openssh-client rsync && \
              echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
              echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
              echo "Destination Directory: ${DEST_DIR}" && \
              cp /tmp/id_rsa /tmp/working_key && \
              chmod 600 /tmp/working_key && \
              echo "=== 🔑 KEY FINGERPRINT ===" && \
              ssh-keygen -l -f /tmp/working_key && \
              SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
              echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
              $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
              echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
              rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
              echo "=== 📦 RSYNC TRANSFER ENV ===" && \
              rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
              $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
              echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
            '