feat: automatic deploy system (poll+deploy docker stack on Unraid)
- deployer container polls git, builds api/worker/web, runs migrations+seed, starts ff-api/ff-worker/ff-web + nginx TLS reverse proxy against external Postgres (10.0.0.15) - Dockerfile.web: drop missing packages/ui package, add NEXT_PUBLIC_API_URL arg - add root .dockerignore (build context cleanup)
This commit is contained in:
Pepe44DEV
@@ -0,0 +1,20 @@
|
||||
# Fleet Forge deployer environment
|
||||
# Werte beim docker run als -e übergeben bzw. bei Unraid im Template setzen.
|
||||
|
||||
# --- Git / Polling ----------------------------------------------------------
|
||||
GIT_REMOTE=https://git.pepe44.dev/Pepe44DEV/fleetforge.git
|
||||
GIT_USER=Pepe44DEV
|
||||
GIT_TOKEN=<gitea-api-token>
|
||||
GIT_BRANCH=master
|
||||
POLL_INTERVAL=300
|
||||
|
||||
# --- Host / Ports -----------------------------------------------------------
|
||||
HOST_IP=10.0.0.15
|
||||
API_PORT=3005 # HTTP-Port, den die Agenten als server_url nutzen
|
||||
HTTPS_PORT=5443 # Web/UI via https://10.0.0.15:5443
|
||||
HTTP_PORT=5080
|
||||
|
||||
# --- App secrets ------------------------------------------------------------
|
||||
# Wird gegen den externen Postgres auf 10.0.0.15 verwendet (DB "FleetForge").
|
||||
DATABASE_URL=postgresql://admin:Start01!@10.0.0.15:5432/FleetForge?schema=public
|
||||
JWT_SECRET=<starkes-secret>
|
||||
Executable
+201
@@ -0,0 +1,201 @@
|
||||
#!/usr/bin/env bash
|
||||
set -uo pipefail
|
||||
|
||||
# ============================================================================
|
||||
# Fleet Forge deployer
|
||||
# Polls the git repo, rebuilds and redeploys the app containers on a single
|
||||
# docker host (tested on Unraid). The deployer only orchectrates: the actual
|
||||
# app containers (api, worker, web, nginx) run on the HOST docker daemon via
|
||||
# the mounted docker socket.
|
||||
#
|
||||
# Required mounts:
|
||||
# /var/run/docker.sock:/var/run/docker.sock
|
||||
# <host>/src:/app/src persistent git checkout + state
|
||||
# <host>/certs:/certs TLS certificates (rw, generated on demand)
|
||||
# <host>/nginx:/cfg rendered nginx config (rw)
|
||||
# ============================================================================
|
||||
|
||||
log() { echo "[deployer] $(date '+%F %T') $*"; }
|
||||
die() { log "ERROR: $*"; exit 1; }
|
||||
|
||||
# --- Environment (with sane defaults) ---------------------------------------
|
||||
GIT_REMOTE="${GIT_REMOTE:-https://git.pepe44.dev/Pepe44DEV/fleetforge.git}"
|
||||
GIT_USER="${GIT_USER:-Pepe44DEV}"
|
||||
GIT_TOKEN="${GIT_TOKEN:-}"
|
||||
GIT_BRANCH="${GIT_BRANCH:-master}"
|
||||
POLL_INTERVAL="${POLL_INTERVAL:-300}"
|
||||
HOST_IP="${HOST_IP:-10.0.0.15}"
|
||||
API_PORT="${API_PORT:-3005}"
|
||||
HTTPS_PORT="${HTTPS_PORT:-5443}"
|
||||
HTTP_PORT="${HTTP_PORT:-5080}"
|
||||
NETWORK="${NETWORK:-fleetforge-net}"
|
||||
|
||||
DATABASE_URL="${DATABASE_URL:-}"
|
||||
JWT_SECRET="${JWT_SECRET:-}"
|
||||
|
||||
SRC=/app/src
|
||||
STATE_FILE="$SRC/.git/ff-deployed-commit"
|
||||
NGINX_SRC=/etc/fleetforge/nginx.conf
|
||||
NGINX_DEST=/cfg/fleetforge.conf
|
||||
CERT_DIR=/certs
|
||||
|
||||
# Basic checks ----------------------------------------------------------------
|
||||
[ -z "$GIT_TOKEN" ] && die "GIT_TOKEN ist nicht gesetzt"
|
||||
[ -z "$DATABASE_URL" ] && die "DATABASE_URL ist nicht gesetzt"
|
||||
[ -z "$JWT_SECRET" ] && die "JWT_SECRET ist nicht gesetzt"
|
||||
command -v docker >/dev/null || die "docker CLI fehlt"
|
||||
docker info >/dev/null 2>&1 || die "docker socket nicht erreichbar"
|
||||
|
||||
AUTH_URL=$(echo "$GIT_REMOTE" | sed "s#https://#https://$GIT_USER:$GIT_TOKEN@#")
|
||||
CORS_ORIGINS="https://$HOST_IP:$HTTPS_PORT,http://$HOST_IP:$API_PORT"
|
||||
|
||||
# --- Git ---------------------------------------------------------------------
|
||||
clone_or_pull() {
|
||||
if [ ! -d "$SRC/.git" ]; then
|
||||
log "initial clone: $GIT_REMOTE ($GIT_BRANCH)"
|
||||
git clone --depth 1 --branch "$GIT_BRANCH" --single-branch "$AUTH_URL" "$SRC"
|
||||
else
|
||||
git -C "$SRC" fetch origin "$GIT_BRANCH"
|
||||
git -C "$SRC" reset --hard "origin/$GIT_BRANCH"
|
||||
git -C "$SRC" clean -fd
|
||||
fi
|
||||
git -C "$SRC" rev-parse "origin/$GIT_BRANCH"
|
||||
}
|
||||
|
||||
# --- Shared docker networking / config ---------------------------------------
|
||||
ensure_network() {
|
||||
docker network inspect "$NETWORK" >/dev/null 2>&1 || docker network create "$NETWORK"
|
||||
}
|
||||
|
||||
ensure_certs() {
|
||||
if [ ! -f "$CERT_DIR/fleetforge.pem" ] || [ ! -f "$CERT_DIR/fleetforge-key.pem" ]; then
|
||||
log "generating self-signed certificate for $HOST_IP"
|
||||
mkdir -p "$CERT_DIR"
|
||||
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 -sha256 \
|
||||
-keyout "$CERT_DIR/fleetforge-key.pem" \
|
||||
-out "$CERT_DIR/fleetforge.pem" \
|
||||
-subj "/CN=fleetforge.local" \
|
||||
-addext "subjectAltName=IP:$HOST_IP,DNS:localhost,DNS:fleetforge.local,DNS:*.local"
|
||||
fi
|
||||
chmod 644 "$CERT_DIR/fleetforge.pem"
|
||||
chmod 600 "$CERT_DIR/fleetforge-key.pem"
|
||||
cp "$NGINX_SRC" "$NGINX_DEST"
|
||||
}
|
||||
|
||||
# --- Build ---------------------------------------------------------------------
|
||||
build_images() {
|
||||
log "building images (api builder + migrations first)"
|
||||
docker build -f "$SRC/infrastructure/docker/Dockerfile.api" --target builder \
|
||||
-t fleetforge/api:builder "$SRC"
|
||||
[ $? -eq 0 ] || die "api builder build failed"
|
||||
|
||||
log "running migrations + seed"
|
||||
docker run --rm -e "DATABASE_URL=$DATABASE_URL" fleetforge/api:builder \
|
||||
sh -c "cd /app/apps/api && pnpm migrate && pnpm seed"
|
||||
[ $? -eq 0 ] || die "migrate/seed failed"
|
||||
|
||||
log "building api runner image"
|
||||
docker build -f "$SRC/infrastructure/docker/Dockerfile.api" --target runner \
|
||||
-t fleetforge/api:latest "$SRC"
|
||||
[ $? -eq 0 ] || die "api build failed"
|
||||
|
||||
log "building worker image"
|
||||
docker build -f "$SRC/infrastructure/docker/Dockerfile.worker" \
|
||||
-t fleetforge/worker:latest "$SRC"
|
||||
[ $? -eq 0 ] || die "worker build failed"
|
||||
|
||||
log "building web image (NEXT_PUBLIC_API_URL=$CORS_ORIGINS)"
|
||||
docker build --build-arg "NEXT_PUBLIC_API_URL=https://$HOST_IP:$HTTPS_PORT/api" \
|
||||
-f "$SRC/infrastructure/docker/Dockerfile.web" \
|
||||
-t fleetforge/web:latest "$SRC"
|
||||
[ $? -eq 0 ] || die "web build failed"
|
||||
}
|
||||
|
||||
# --- Run -----------------------------------------------------------------------
|
||||
run_containers() {
|
||||
log "stopping old containers"
|
||||
for c in ff-api ff-worker ff-web ff-nginx; do
|
||||
docker rm -f "$c" >/dev/null 2>&1 || true
|
||||
done
|
||||
|
||||
log "starting api (http $API_PORT for agents)"
|
||||
docker run -d --name ff-api --restart unless-stopped --network "$NETWORK" \
|
||||
-p "$API_PORT:3000" \
|
||||
-e NODE_ENV=production \
|
||||
-e "DATABASE_URL=$DATABASE_URL" \
|
||||
-e "JWT_SECRET=$JWT_SECRET" \
|
||||
-e "CORS_ORIGINS=$CORS_ORIGINS" \
|
||||
fleetforge/api:latest
|
||||
|
||||
log "starting worker"
|
||||
docker run -d --name ff-worker --restart unless-stopped --network "$NETWORK" \
|
||||
-e NODE_ENV=production \
|
||||
-e "DATABASE_URL=$DATABASE_URL" \
|
||||
fleetforge/worker:latest
|
||||
|
||||
log "starting web"
|
||||
docker run -d --name ff-web --restart unless-stopped --network "$NETWORK" \
|
||||
-e NODE_ENV=production \
|
||||
fleetforge/web:latest
|
||||
|
||||
log "starting nginx reverse proxy (https $HTTPS_PORT, http $HTTP_PORT)"
|
||||
docker run -d --name ff-nginx --restart unless-stopped --network "$NETWORK" \
|
||||
-p "$HTTPS_PORT:443" \
|
||||
-p "$HTTP_PORT:80" \
|
||||
-v "$CERT_DIR:/etc/nginx/certs:ro" \
|
||||
-v "$NGINX_DEST:/etc/nginx/conf.d/fleetforge.conf:ro" \
|
||||
nginx:1.27-alpine
|
||||
}
|
||||
|
||||
# --- Health ---------------------------------------------------------------------
|
||||
wait_for_health() {
|
||||
local tries=${1:-30}
|
||||
for i in $(seq 1 "$tries"); do
|
||||
if curl -fsS "http://$HOST_IP:$API_PORT/api/health" >/dev/null 2>&1; then
|
||||
log "API healthy after ${i} attempts"
|
||||
return 0
|
||||
fi
|
||||
sleep 5
|
||||
done
|
||||
log "WARNING: API health check failed after $tries attempts"
|
||||
return 1
|
||||
}
|
||||
|
||||
# --- Deploy ----------------------------------------------------------------------
|
||||
deploy() {
|
||||
build_images
|
||||
ensure_network
|
||||
ensure_certs
|
||||
run_containers
|
||||
wait_for_health || return 1
|
||||
log "deployment complete: https://$HOST_IP:$HTTPS_PORT"
|
||||
return 0
|
||||
}
|
||||
|
||||
# ---------------------------------------------------------------------------------
|
||||
log "Fleet Forge deployer started (poll every ${POLL_INTERVAL}s, branch $GIT_BRANCH)"
|
||||
mkdir -p "$SRC" "$CERT_DIR" "/cfg"
|
||||
|
||||
while true; do
|
||||
if ! HEAD=$(clone_or_pull 2>>/dev/stderr); then
|
||||
log "git update failed, retrying in ${POLL_INTERVAL}s"
|
||||
sleep "$POLL_INTERVAL"
|
||||
continue
|
||||
fi
|
||||
|
||||
LAST=""
|
||||
[ -f "$STATE_FILE" ] && LAST=$(cat "$STATE_FILE")
|
||||
|
||||
if [ -z "$LAST" ] || [ "$HEAD" != "$LAST" ]; then
|
||||
log "new commit detected: $HEAD (was: ${LAST:-none})"
|
||||
if deploy; then
|
||||
echo "$HEAD" > "$STATE_FILE"
|
||||
else
|
||||
log "deploy FAILED for $HEAD, will retry next poll"
|
||||
fi
|
||||
else
|
||||
log "no changes (HEAD=$HEAD), sleeping ${POLL_INTERVAL}s"
|
||||
fi
|
||||
|
||||
sleep "$POLL_INTERVAL"
|
||||
done
|
||||
@@ -0,0 +1,18 @@
|
||||
FROM alpine:3.21
|
||||
|
||||
RUN apk add --no-cache \
|
||||
docker-cli \
|
||||
git \
|
||||
bash \
|
||||
openssl \
|
||||
curl \
|
||||
coreutils \
|
||||
findutils \
|
||||
ca-certificates \
|
||||
tzdata
|
||||
|
||||
COPY deploy.sh /usr/local/bin/deploy.sh
|
||||
COPY nginx.conf /etc/fleetforge/nginx.conf
|
||||
RUN chmod +x /usr/local/bin/deploy.sh
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/deploy.sh"]
|
||||
@@ -0,0 +1,40 @@
|
||||
server {
|
||||
listen 80;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl;
|
||||
http2 on;
|
||||
|
||||
ssl_certificate /etc/nginx/certs/fleetforge.pem;
|
||||
ssl_certificate_key /etc/nginx/certs/fleetforge-key.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
|
||||
client_max_body_size 200m;
|
||||
proxy_read_timeout 1800s;
|
||||
proxy_send_timeout 1800s;
|
||||
|
||||
location /api/ {
|
||||
proxy_pass http://ff-api:3000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://ff-web:3001;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
proxy_buffering off;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user