asepharyana
b5d4e46b79
Deploy now pulls images pinned to $CI_COMMIT_SHA instead of :latest,
eliminating race-condition deployments where a concurrent pipeline
overwrites the mutable latest tag before deploy runs.
Changes:
- docker-compose.yml: image tags use ${IMAGE_TAG:-latest} env var
- deploy step: IMAGE_TAG=$CI_COMMIT_SHA docker compose pull + up
- scp docker-compose.yml to VPS before running deploy commands
123 lines
4.5 KiB
YAML
123 lines
4.5 KiB
YAML
# ─── BETE GitLab CI/CD Pipeline ───────────────────────────────────────────────
|
|
# 1. Build 3 Docker images (backend, discord-gateway, proxy — proxy includes frontend WASM)
|
|
# 2. Push to GitLab Container Registry
|
|
# 3. Deploy to VPS — pull images, docker compose up
|
|
#
|
|
# Required CI/CD Variables (set in GitLab → Settings → CI/CD → Variables):
|
|
#
|
|
# VPS_HOST - VPS IP/hostname
|
|
# VPS_USERNAME - SSH user
|
|
# VPS_SSH_KEY - SSH private key (type: file)
|
|
# ENV_FILE - Full .env file content (type: env_var) — optional if .env already on VPS
|
|
#
|
|
# ──────────────────────────────────────────────────────────────────────────────
|
|
|
|
stages:
|
|
- build
|
|
- deploy
|
|
|
|
variables:
|
|
# Submodules — discord.js-selfbot-v13 and discord-video-stream
|
|
GIT_SUBMODULE_STRATEGY: recursive
|
|
|
|
REGISTRY: $CI_REGISTRY
|
|
REGISTRY_PROJECT: $CI_REGISTRY/$CI_PROJECT_PATH
|
|
IMAGE_TAG_COMMIT: $CI_COMMIT_SHA
|
|
IMAGE_TAG_LATEST: latest
|
|
|
|
# Deploy target
|
|
SSH_HOST: "${VPS_USERNAME}@${VPS_HOST}"
|
|
APP_DIR: /opt/imphenbot
|
|
|
|
# ── Build stage ───────────────────────────────────────────────────────────────
|
|
.docker-build:
|
|
stage: build
|
|
image: docker:27-cli
|
|
services:
|
|
- name: docker:27-dind
|
|
command: ["--mtu=1400"]
|
|
before_script:
|
|
- echo "$CI_JOB_TOKEN" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
|
|
script:
|
|
# Build image
|
|
- |
|
|
docker build \
|
|
--file infra/docker/Dockerfile.$SERVICE_NAME \
|
|
--tag $REGISTRY_PROJECT/bete-$SERVICE_NAME:$IMAGE_TAG_COMMIT \
|
|
--tag $REGISTRY_PROJECT/bete-$SERVICE_NAME:$IMAGE_TAG_LATEST \
|
|
--build-arg BUILDKIT_INLINE_CACHE=1 \
|
|
--cache-from $REGISTRY_PROJECT/bete-$SERVICE_NAME:latest \
|
|
.
|
|
# Push to GitLab Container Registry
|
|
- docker push $REGISTRY_PROJECT/bete-$SERVICE_NAME:$IMAGE_TAG_COMMIT
|
|
- docker push $REGISTRY_PROJECT/bete-$SERVICE_NAME:$IMAGE_TAG_LATEST
|
|
|
|
build-backend:
|
|
extends: .docker-build
|
|
variables:
|
|
SERVICE_NAME: backend
|
|
only:
|
|
- master
|
|
|
|
build-discord-gateway:
|
|
extends: .docker-build
|
|
variables:
|
|
SERVICE_NAME: discord-gateway
|
|
only:
|
|
- master
|
|
|
|
build-proxy:
|
|
extends: .docker-build
|
|
variables:
|
|
SERVICE_NAME: proxy
|
|
only:
|
|
- master
|
|
|
|
# ── Deploy stage ──────────────────────────────────────────────────────────────
|
|
deploy-vps:
|
|
stage: deploy
|
|
image: debian:stable-slim
|
|
only:
|
|
- master
|
|
needs:
|
|
- build-backend
|
|
- build-discord-gateway
|
|
- build-proxy
|
|
before_script:
|
|
- apt-get update -qq && apt-get install -y -qq openssh-client
|
|
- mkdir -p ~/.ssh
|
|
- cp "$VPS_SSH_KEY" ~/.ssh/id_rsa
|
|
- chmod 600 ~/.ssh/id_rsa
|
|
- ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
script:
|
|
# Login to GitLab Container Registry, pull images, update docker-compose, restart
|
|
- scp infra/docker/docker-compose.yml "$SSH_HOST:$APP_DIR/infra/docker/docker-compose.yml"
|
|
- |
|
|
ssh "$SSH_HOST" "
|
|
set -eu
|
|
|
|
cd $APP_DIR
|
|
|
|
echo '→ Logging in to GitLab Container Registry...'
|
|
echo '$CI_JOB_TOKEN' | docker login $CI_REGISTRY -u '$CI_REGISTRY_USER' --password-stdin
|
|
|
|
echo '→ Pulling SHA-pinned images...'
|
|
IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml pull
|
|
|
|
echo '→ Restarting containers (recreates if image changed)...'
|
|
IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml up -d --remove-orphans
|
|
|
|
# Force restart proxy to pick up new upstream DNS IPs.
|
|
# Docker's DNS changes when backend containers are recreated,
|
|
# but nginx only resolves upstream hostnames at startup. Without this,
|
|
# nginx keeps pointing to stale container IPs → 502 Bad Gateway.
|
|
echo '→ Ensuring proxy container is restarted (nginx upstream DNS refresh)...'
|
|
IMAGE_TAG=$CI_COMMIT_SHA docker compose -f infra/docker/docker-compose.yml restart proxy
|
|
|
|
echo '→ Cleaning up...'
|
|
docker image prune -f
|
|
echo '✓ Deploy complete'
|
|
"
|
|
after_script:
|
|
- rm -f ~/.ssh/id_rsa
|