CI now only builds + pushes images to GitLab Container Registry.
Deploy is done manually via deploy.sh with specific SHA tag support.
Usage: ./deploy.sh [sha] # default: latest
Deploy now pulls images pinned to $CI_COMMIT_SHA instead of :latest,
eliminating race-condition deployments where a concurrent pipeline
overwrites the mutable latest tag before deploy runs.
Changes:
- docker-compose.yml: image tags use ${IMAGE_TAG:-latest} env var
- deploy step: IMAGE_TAG=$CI_COMMIT_SHA docker compose pull + up
- scp docker-compose.yml to VPS before running deploy commands
- Replace upstream blocks with variable-based proxy_pass + Docker DNS
resolver (127.0.0.11) so nginx resolves hostnames dynamically on
each request instead of caching at startup only.
- Add explicit 'docker compose restart proxy' in CI deploy step
(belt-and-suspenders: also forces nginx restart after deploy).
- Remove no-op sed commands from CI (docker-compose.yml already uses
GitLab registry, no ghcr.io replacements needed).
Root cause: docker compose up -d only recreates containers whose image
changed. When backend container is recreated (new Docker IP), nginx
still caches the old IP → 502 Bad Gateway on /api/*
Remove Docker-in-Docker, registry push/pull, SCP complexity.
Pipeline now just SSHs into VPS and rebuilds from source.
Secrets configured:
VPS_HOST, VPS_USERNAME, VPS_SSH_KEY (file type)
asepharyana