180 lines
8.8 KiB
YAML
180 lines
8.8 KiB
YAML
name: AS Talange CI/CD Pipeline - Production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'prod/*'
|
|
|
|
jobs:
|
|
test:
|
|
name: Build & Run Unit Tests
|
|
runs-on: [self-hosted, prod]
|
|
container:
|
|
image: maven:3.9.6-eclipse-temurin-21
|
|
steps:
|
|
- name: Clone repository
|
|
run: |
|
|
if ! command -v git &> /dev/null; then
|
|
apt-get update && apt-get install -y git
|
|
fi
|
|
SERVER_URL="${{ github.server_url }}"
|
|
SERVER_NO_PROTO="${SERVER_URL#http://}"
|
|
SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}"
|
|
git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" .
|
|
git checkout ${{ github.sha }}
|
|
|
|
- name: Run Maven Tests
|
|
run: mvn clean test
|
|
|
|
|
|
|
|
deploy_prod:
|
|
name: Deploy to Prod Environment
|
|
needs: test
|
|
if: startsWith(github.ref, 'refs/heads/prod/')
|
|
runs-on: [self-hosted, prod]
|
|
container:
|
|
image: docker:latest
|
|
steps:
|
|
- name: Clone repository
|
|
run: |
|
|
apk add --no-cache git
|
|
SERVER_URL="${{ github.server_url }}"
|
|
SERVER_NO_PROTO="${SERVER_URL#http://}"
|
|
SERVER_NO_PROTO="${SERVER_NO_PROTO#https://}"
|
|
git clone "https://oauth2:${{ secrets.GITHUB_TOKEN }}@${SERVER_NO_PROTO}/${{ github.repository }}.git" .
|
|
git checkout ${{ github.sha }}
|
|
|
|
- name: Deploy with Docker Compose
|
|
env:
|
|
PROD_DB_USER: ${{ secrets.PROD_DB_USER }}
|
|
PROD_DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
|
|
PROD_DB_NAME: ${{ secrets.PROD_DB_NAME }}
|
|
CAPTCHA_SECRET: ${{ secrets.CAPTCHA_SECRET }}
|
|
CAPTCHA_SITEKEY: ${{ secrets.CAPTCHA_SITEKEY }}
|
|
MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
|
|
MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
|
|
MAIL_FROM: ${{ secrets.MAIL_FROM }}
|
|
BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }}
|
|
NOTIFICATION_EMAIL: ${{ secrets.NOTIFICATION_EMAIL }}
|
|
BACKUP_DIR: ${{ secrets.BACKUP_DIR }}
|
|
RETENTION_DAYS: ${{ secrets.RETENTION_DAYS }}
|
|
ENABLE_REMOTE_COPY: ${{ secrets.ENABLE_REMOTE_COPY }}
|
|
REMOTE_HOST: ${{ secrets.REMOTE_HOST }}
|
|
REMOTE_USER: ${{ secrets.REMOTE_USER }}
|
|
REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
|
|
REMOTE_BACKUP_DIR: ${{ secrets.REMOTE_BACKUP_DIR }}
|
|
SSH_KEY_PATH: ${{ secrets.SSH_KEY_PATH }}
|
|
run: |
|
|
echo "POSTGRES_USER=${PROD_DB_USER:-myuser}" > .env
|
|
echo "POSTGRES_PASSWORD=${PROD_DB_PASSWORD:-mypassword}" >> .env
|
|
[ -n "${PROD_DB_NAME}" ] && echo "POSTGRES_DB=${PROD_DB_NAME}" >> .env
|
|
echo "CAPTCHA_SECRET=${CAPTCHA_SECRET:-1x0000000000000000000000000000000AA}" >> .env
|
|
echo "CAPTCHA_SITEKEY=${CAPTCHA_SITEKEY:-1x00000000000000000000AA}" >> .env
|
|
if [ -n "${MAIL_USERNAME}" ]; then
|
|
echo "SPRING_MAIL_HOST=smtp-relay.brevo.com" >> .env
|
|
echo "SPRING_MAIL_PORT=${MAIL_PORT:-2525}" >> .env
|
|
echo "SPRING_MAIL_USERNAME=${MAIL_USERNAME}" >> .env
|
|
echo "SPRING_MAIL_PASSWORD=${MAIL_PASSWORD}" >> .env
|
|
echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=true" >> .env
|
|
echo "SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=true" >> .env
|
|
if [ -n "${MAIL_FROM}" ]; then
|
|
echo "APP_MAIL_FROM=${MAIL_FROM}" >> .env
|
|
fi
|
|
fi
|
|
# Configuration des sauvegardes de BDD
|
|
[ -n "${BREVO_API_KEY}" ] && echo "BREVO_API_KEY=${BREVO_API_KEY}" >> .env
|
|
[ -n "${NOTIFICATION_EMAIL}" ] && echo "NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL}" >> .env
|
|
[ -n "${BACKUP_DIR}" ] && echo "BACKUP_DIR=${BACKUP_DIR}" >> .env
|
|
[ -n "${RETENTION_DAYS}" ] && echo "RETENTION_DAYS=${RETENTION_DAYS}" >> .env
|
|
if [ "${ENABLE_REMOTE_COPY}" = "true" ]; then
|
|
echo "ENABLE_REMOTE_COPY=true" >> .env
|
|
[ -n "${REMOTE_HOST}" ] && echo "REMOTE_HOST=${REMOTE_HOST}" >> .env
|
|
[ -n "${REMOTE_USER}" ] && echo "REMOTE_USER=${REMOTE_USER}" >> .env
|
|
[ -n "${REMOTE_PORT}" ] && echo "REMOTE_PORT=${REMOTE_PORT}" >> .env
|
|
[ -n "${REMOTE_BACKUP_DIR}" ] && echo "REMOTE_BACKUP_DIR=${REMOTE_BACKUP_DIR}" >> .env
|
|
[ -n "${SSH_KEY_PATH}" ] && echo "SSH_KEY_PATH=${SSH_KEY_PATH}" >> .env
|
|
fi
|
|
docker compose down app || true
|
|
docker compose up -d --build app
|
|
|
|
- name: Verify application startup
|
|
run: |
|
|
echo "Waiting for application to start..."
|
|
COUNT=0
|
|
while [ $COUNT -lt 30 ]; do
|
|
if docker exec astalange_app wget -qO- http://localhost:8080/login | grep -q "Connexion"; then
|
|
echo "Application is up and login page is accessible!"
|
|
exit 0
|
|
fi
|
|
echo "Waiting... ($COUNT/30)"
|
|
sleep 5
|
|
COUNT=$((COUNT+1))
|
|
done
|
|
echo "Application failed to start or login page is not accessible."
|
|
docker logs astalange_app
|
|
exit 1
|
|
|
|
- name: Deploy Backup Script & Config to DB Server (10.8.0.3)
|
|
env:
|
|
DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }}
|
|
DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }}
|
|
REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
|
|
PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }}
|
|
SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }}
|
|
SSH_KEY_SECRET: ${{ secrets.SSH_KEY }}
|
|
run: |
|
|
TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}"
|
|
TARGET_USER="${DB_SERVER_USER:-root}"
|
|
PORT="${REMOTE_PORT:-22}"
|
|
DEST_DIR="/opt/as-talange"
|
|
KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
|
|
|
|
docker run --rm --net=host \
|
|
-v "$(pwd):/workspace" -w /workspace \
|
|
-v "/home/ucef/.ssh:/home/ucef/.ssh:ro" \
|
|
-v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \
|
|
-v "/root/.ssh:/root/.ssh:ro" \
|
|
-e TARGET_HOST="${TARGET_HOST}" \
|
|
-e TARGET_USER="${TARGET_USER}" \
|
|
-e PORT="${PORT}" \
|
|
-e DEST_DIR="${DEST_DIR}" \
|
|
-e KEY_CONTENT="${KEY_CONTENT}" \
|
|
alpine:latest sh -c '
|
|
apk add --no-cache openssh-client rsync && \
|
|
echo "=== DIAGNOSTIC DETAILS ===" && \
|
|
echo "Container User: $(whoami) (UID: $(id -u))" && \
|
|
echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
|
|
echo "Destination Directory: ${DEST_DIR}" && \
|
|
echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \
|
|
echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \
|
|
echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \
|
|
echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \
|
|
FOUND_KEY="" && \
|
|
for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \
|
|
if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \
|
|
done && \
|
|
if [ -n "$FOUND_KEY" ]; then \
|
|
echo "--> SELECTED KEY FILE: $FOUND_KEY" && \
|
|
cp "$FOUND_KEY" /tmp/id_rsa ; \
|
|
elif [ -n "$KEY_CONTENT" ]; then \
|
|
echo "--> SELECTED KEY FROM: Gitea secret" && \
|
|
printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
|
|
else \
|
|
echo "--> ERROR: No SSH key found!" && exit 1 ; \
|
|
fi && \
|
|
chmod 600 /tmp/id_rsa && \
|
|
echo "=== KEY FINGERPRINT ===" && \
|
|
ls -la /tmp/id_rsa && \
|
|
ssh-keygen -l -f /tmp/id_rsa && \
|
|
SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
|
|
echo "=== EXECUTING REMOTE COMMAND ===" && \
|
|
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
|
|
echo "=== RSYNC TRANSFER SCRIPT ===" && \
|
|
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
|
|
echo "=== RSYNC TRANSFER ENV ===" && \
|
|
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
|
|
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
|
|
echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
|
|
'
|