mirror of
http://172.20.10.11:3000/gitadmin/INSIGHT-MVP.git
synced 2026-06-25 00:36:39 +02:00
10f291cdda
Docker Infrastructure:
- docker-compose.yml with Traefik 3, PostgreSQL 16, PgBouncer, Redis 7, step-ca
- docker-compose.observability.yml with Prometheus, Grafana, Loki, Tempo, Promtail
- Traefik dynamic config (TLS, security headers, CORS, compression)
- PostgreSQL init script (uuid-ossp, pgcrypto, pg_trgm extensions)
- Grafana auto-provisioned datasources (Prometheus, Loki, Tempo)
NestJS Core-Service:
- Auth module: Login (email/password), TOTP 2FA, JWT RS256, token refresh/revocation
- Users module: CRUD, bcrypt cost 12, pagination, role-based access
- Tenants module: CRUD, member management, slug validation
- Prisma schemas: core (Users, AuthProviders, Tenants, Modules, AuditLog)
tenant (Contacts, Activities - CRM reference for Sprint 2)
- TenantPrismaService: Dynamic per-tenant DB connections with caching
- RedisService: Token blocklist, refresh token families, generic cache
- Global JwtAuthGuard with @Public() decorator, RolesGuard, GlobalExceptionFilter
- Health endpoint with DB + Redis status checks
- Swagger API documentation (dev only)
- Multi-stage Dockerfile (dev + production)
React Frontend:
- Vite 6 + React 18 + TypeScript strict
- AuthContext with silent refresh (access token in memory, NOT localStorage)
- Login page with TOTP 2FA support
- App shell with sidebar navigation
- Admin pages: Users + Tenants management tables
- API client with automatic token refresh interceptor
- Multi-stage Dockerfile (dev + nginx production)
CI/CD Pipelines:
- ci.yml: Lint, type-check, test, build on all branches
- deploy.yml: Docker build, push to Forgejo registry, SSH deploy
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
108 lines
3.5 KiB
YAML
108 lines
3.5 KiB
YAML
# ============================================================
|
|
# INSIGHT MVP - Deploy Pipeline
|
|
# ============================================================
|
|
# Baut Docker-Images, pusht sie in die Forgejo Registry
|
|
# und deployed auf den insight-dev-01 Server.
|
|
#
|
|
# Wird nur bei Push auf 'main' oder 'develop' ausgefuehrt.
|
|
# ============================================================
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
|
|
jobs:
|
|
# --------------------------------------------------------
|
|
# Docker Images bauen und in Registry pushen
|
|
# --------------------------------------------------------
|
|
build-and-push:
|
|
name: Build & Push Images
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Determine Tag
|
|
id: tag
|
|
run: |
|
|
if [ "${{ github.ref_name }}" = "main" ]; then
|
|
echo "tag=latest" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "tag=develop" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Login to Container Registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login git.xinion.lan -u ${{ secrets.REGISTRY_USER }} --password-stdin
|
|
|
|
# Core-Service Image
|
|
- name: Build Core-Service
|
|
run: |
|
|
docker build \
|
|
-t git.xinion.lan/gitadmin/insight-core:${{ steps.tag.outputs.tag }} \
|
|
-f packages/core-service/Dockerfile \
|
|
--target production \
|
|
packages/core-service
|
|
|
|
- name: Push Core-Service
|
|
run: docker push git.xinion.lan/gitadmin/insight-core:${{ steps.tag.outputs.tag }}
|
|
|
|
# Frontend Image
|
|
- name: Build Frontend
|
|
run: |
|
|
docker build \
|
|
-t git.xinion.lan/gitadmin/insight-frontend:${{ steps.tag.outputs.tag }} \
|
|
-f packages/frontend/Dockerfile \
|
|
--target production \
|
|
packages/frontend
|
|
|
|
- name: Push Frontend
|
|
run: docker push git.xinion.lan/gitadmin/insight-frontend:${{ steps.tag.outputs.tag }}
|
|
|
|
# --------------------------------------------------------
|
|
# Auf Server deployen
|
|
# --------------------------------------------------------
|
|
deploy:
|
|
name: Deploy to Server
|
|
runs-on: ubuntu-latest
|
|
needs: build-and-push
|
|
|
|
steps:
|
|
- name: Deploy via SSH
|
|
run: |
|
|
# SSH-Key vorbereiten
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.SSH_DEPLOY_KEY }}" > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
ssh-keyscan -H ${{ secrets.DEPLOY_HOST }} >> ~/.ssh/known_hosts
|
|
|
|
# Deploy-Befehle auf dem Server ausfuehren
|
|
ssh -i ~/.ssh/deploy_key ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} << 'DEPLOY'
|
|
cd ~/insight
|
|
|
|
# Registry Login
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login git.xinion.lan -u ${{ secrets.REGISTRY_USER }} --password-stdin
|
|
|
|
# Neue Images pullen
|
|
docker compose pull core frontend
|
|
|
|
# Services mit neuem Image starten
|
|
docker compose up -d core frontend
|
|
|
|
# Health-Check warten
|
|
sleep 10
|
|
curl -f http://localhost:3000/health || echo "WARNUNG: Health-Check fehlgeschlagen"
|
|
|
|
# Alte Images aufraeumen
|
|
docker image prune -f
|
|
DEPLOY
|
|
|
|
- name: Verify Deployment
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key ${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }} \
|
|
"docker compose ps && echo '--- Deployment erfolgreich ---'"
|