diff --git a/.github/workflows/cd-main.yml b/.github/workflows/cd-main.yml index 5633e39..4b57d54 100644 --- a/.github/workflows/cd-main.yml +++ b/.github/workflows/cd-main.yml @@ -1,40 +1,52 @@ name: CD Production -# Production pipeline — Hetzner k3s. +# Pipeline de production — Hetzner k3s (infra/prod/). # -# SECURITY: Two mandatory gates before any production deployment: -# 1. quality-gate — lint + unit tests on the exact commit being deployed -# 2. verify-image — confirms preprod-SHA image EXISTS in registry, -# which proves this commit passed the full preprod -# pipeline (lint + unit + integration + docker build). -# If someone merges to main without going through preprod, -# this step fails and the deployment is blocked. +# Enchaînement : qualité → vérification → promotion/rebuild → déploiement → contrôle # -# Flow: quality-gate → verify-image → promote → deploy → notify +# TROIS RÈGLES STRUCTURANTES # -# Secrets required: -# REGISTRY_TOKEN — Scaleway registry (read/write) -# HETZNER_KUBECONFIG — base64: cat ~/.kube/kubeconfig-xpeditis-prod | base64 -w 0 -# PROD_BACKEND_URL — https://api.xpeditis.com -# PROD_FRONTEND_URL — https://app.xpeditis.com -# DISCORD_WEBHOOK_URL +# 1. Le BACKEND est PROMU depuis la preprod, jamais reconstruit. +# Promouvoir garantit que le binaire déployé en production est exactement +# celui qui a passé la chaîne de preprod (lint, tests unitaires, tests +# d'intégration, build). Un rebuild casserait cette garantie. +# +# 2. Le FRONTEND est RECONSTRUIT pour la production. +# next.config.js fige NEXT_PUBLIC_API_URL au moment du build. Promouvoir +# l'image de preprod livrerait une application qui appelle +# api.preprod.xpeditis.com en production. C'est la raison pour laquelle ce +# workflow ne peut pas se contenter de re-taguer. +# +# 3. Le déploiement passe par SSH, pas par l'API Kubernetes. +# L'API k3s (6443) n'est ouverte qu'aux IP d'administration. Les runners +# GitHub n'ont pas d'IP fixe : le job ouvre le port 22 pour la seule IP du +# runner via un firewall Hetzner dédié, puis le referme systématiquement. +# +# Secrets et variables : voir infra/prod/env/github-secrets.md on: push: branches: [main] + workflow_dispatch: + inputs: + tag: + description: "SHA court à déployer (laisser vide = HEAD de main)" + required: false concurrency: group: cd-production cancel-in-progress: false +permissions: + contents: read + env: REGISTRY: rg.fr-par.scw.cloud/weworkstudio NODE_VERSION: '20' K8S_NAMESPACE: xpeditis-prod jobs: - # ── 1. Quality Gate ────────────────────────────────────────────────── - # Runs on every prod deployment regardless of what happened in preprod. + # ═══ 1. Qualité ══════════════════════════════════════════════════════════ backend-quality: name: Backend — Lint runs-on: ubuntu-latest @@ -69,7 +81,7 @@ jobs: - run: npm run type-check backend-tests: - name: Backend — Unit Tests + name: Backend — Tests unitaires runs-on: ubuntu-latest needs: backend-quality defaults: @@ -86,7 +98,7 @@ jobs: - run: npm test -- --passWithNoTests frontend-tests: - name: Frontend — Unit Tests + name: Frontend — Tests unitaires runs-on: ubuntu-latest needs: frontend-quality defaults: @@ -102,175 +114,248 @@ jobs: - run: npm ci --legacy-peer-deps - run: npm test -- --passWithNoTests - # ── 2. Image Verification ──────────────────────────────────────────── - # Checks that preprod-SHA tags exist for this EXACT commit. - # This is the security gate: if the preprod pipeline never ran for this - # commit (or failed before the docker build step), this job fails and - # the deployment is fully blocked. + # ═══ 2. Vérification de la provenance ════════════════════════════════════ + # Si l'image preprod-SHA n'existe pas, c'est que ce commit n'est jamais passé + # par la chaîne de preprod. Le déploiement est alors bloqué net. verify-image: - name: Verify Preprod Image Exists + name: Vérifier l'image de preprod runs-on: ubuntu-latest needs: [backend-tests, frontend-tests] outputs: sha: ${{ steps.sha.outputs.short }} steps: - - name: Short SHA + - name: SHA court id: sha - run: echo "short=$(echo ${{ github.sha }} | cut -c1-7)" >> $GITHUB_OUTPUT + run: | + RAW="${{ github.event.inputs.tag }}" + [ -n "$RAW" ] || RAW="${{ github.sha }}" + echo "short=$(echo "$RAW" | cut -c1-7)" >> $GITHUB_OUTPUT - uses: docker/setup-buildx-action@v3 - - uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: nologin password: ${{ secrets.REGISTRY_TOKEN }} - - name: Check backend image preprod-SHA + - name: Image backend preprod-SHA présente run: | TAG="${{ env.REGISTRY }}/xpeditis-backend:preprod-${{ steps.sha.outputs.short }}" - echo "Verifying: $TAG" docker buildx imagetools inspect "$TAG" || { - echo "" - echo "BLOCKED: Image $TAG not found in registry." - echo "This commit was not built by the preprod pipeline." - echo "Merge to preprod first and wait for the full pipeline to succeed." + echo "::error::$TAG introuvable. Ce commit n'a pas été construit par la chaîne de preprod." + echo "Fusionnez d'abord sur preprod et attendez que le pipeline passe au vert." exit 1 } - - name: Check frontend image preprod-SHA + - name: Image log-exporter preprod-SHA présente run: | - TAG="${{ env.REGISTRY }}/xpeditis-frontend:preprod-${{ steps.sha.outputs.short }}" - echo "Verifying: $TAG" + TAG="${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${{ steps.sha.outputs.short }}" docker buildx imagetools inspect "$TAG" || { - echo "" - echo "BLOCKED: Image $TAG not found in registry." - echo "This commit was not built by the preprod pipeline." - echo "Merge to preprod first and wait for the full pipeline to succeed." + echo "::error::$TAG introuvable." exit 1 } - # ── 3. Promote Images ──────────────────────────────────────────────── - # Re-tags preprod-SHA → latest + prod-SHA within Scaleway. - # No rebuild. No layer transfer. Manifest-level operation only. - promote-images: - name: Promote Images (preprod-SHA → prod) + # ═══ 3a. Promotion du backend (aucun rebuild) ════════════════════════════ + promote-backend: + name: Promouvoir le backend runs-on: ubuntu-latest needs: verify-image steps: - uses: docker/setup-buildx-action@v3 - - uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: nologin password: ${{ secrets.REGISTRY_TOKEN }} - - - name: Promote backend + - name: preprod-SHA → prod-SHA run: | SHA="${{ needs.verify-image.outputs.sha }}" + # Opération au niveau du manifeste : aucune couche n'est retransférée, + # le condensat de l'image reste identique à celui validé en preprod. docker buildx imagetools create \ - --tag ${{ env.REGISTRY }}/xpeditis-backend:latest \ --tag ${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA} \ + --tag ${{ env.REGISTRY }}/xpeditis-backend:latest \ ${{ env.REGISTRY }}/xpeditis-backend:preprod-${SHA} - echo "Backend promoted: preprod-${SHA} → latest + prod-${SHA}" - - - name: Promote frontend - run: | - SHA="${{ needs.verify-image.outputs.sha }}" docker buildx imagetools create \ - --tag ${{ env.REGISTRY }}/xpeditis-frontend:latest \ - --tag ${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA} \ - ${{ env.REGISTRY }}/xpeditis-frontend:preprod-${SHA} - echo "Frontend promoted: preprod-${SHA} → latest + prod-${SHA}" + --tag ${{ env.REGISTRY }}/xpeditis-log-exporter:prod-${SHA} \ + --tag ${{ env.REGISTRY }}/xpeditis-log-exporter:latest \ + ${{ env.REGISTRY }}/xpeditis-log-exporter:preprod-${SHA} - # ── 4. Deploy to k3s ───────────────────────────────────────────────── - deploy: - name: Deploy to Production (k3s) + # ═══ 3b. Reconstruction du frontend avec les URLs de production ══════════ + build-frontend: + name: Reconstruire le frontend (URLs de production) runs-on: ubuntu-latest - needs: [verify-image, promote-images] + needs: verify-image + steps: + - uses: actions/checkout@v4 + with: + # On construit EXACTEMENT le commit vérifié, pas HEAD. + ref: ${{ github.sha }} + - uses: docker/setup-buildx-action@v3 + - uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: nologin + password: ${{ secrets.REGISTRY_TOKEN }} + - uses: docker/build-push-action@v5 + with: + context: ./apps/frontend + file: ./apps/frontend/Dockerfile + push: true + platforms: linux/amd64 + tags: | + ${{ env.REGISTRY }}/xpeditis-frontend:prod-${{ needs.verify-image.outputs.sha }} + ${{ env.REGISTRY }}/xpeditis-frontend:latest + cache-from: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod + cache-to: type=registry,ref=${{ env.REGISTRY }}/xpeditis-frontend:buildcache-prod,mode=max + build-args: | + NEXT_PUBLIC_API_URL=${{ secrets.NEXT_PUBLIC_API_URL_PROD }} + NEXT_PUBLIC_APP_URL=${{ secrets.NEXT_PUBLIC_APP_URL_PROD }} + + - name: Contrôle — l'URL de preprod ne doit pas figurer dans le bundle + run: | + IMAGE="${{ env.REGISTRY }}/xpeditis-frontend:prod-${{ needs.verify-image.outputs.sha }}" + CID=$(docker create "$IMAGE") + docker cp "$CID:/app/.next" /tmp/next-check 2>/dev/null || true + docker rm "$CID" >/dev/null + if grep -rq "api.preprod.xpeditis.com" /tmp/next-check 2>/dev/null; then + echo "::error::L'URL de preprod est figée dans le bundle de production." + echo "Vérifiez le secret NEXT_PUBLIC_API_URL_PROD." + exit 1 + fi + echo "Aucune URL de preprod dans le bundle." + + # ═══ 4. Déploiement ══════════════════════════════════════════════════════ + deploy: + name: Déployer en production + runs-on: ubuntu-latest + needs: [verify-image, promote-backend, build-frontend] + # Environnement protégé : activez « Required reviewers » pour exiger une + # validation humaine avant toute mise en production. environment: name: production url: https://app.xpeditis.com steps: - - name: Configure kubectl - run: | - mkdir -p ~/.kube - echo "${{ secrets.HETZNER_KUBECONFIG }}" | base64 -d > ~/.kube/config - chmod 600 ~/.kube/config - kubectl cluster-info - kubectl get nodes -o wide + - uses: actions/checkout@v4 - - name: Deploy backend - id: deploy-backend + - name: Installer le client Hetzner + run: | + curl -fsSL https://github.com/hetznercloud/cli/releases/download/v1.49.0/hcloud-linux-amd64.tar.gz \ + | tar -xz -C /tmp hcloud + sudo install -m 0755 /tmp/hcloud /usr/local/bin/hcloud + hcloud version + + - name: Ouvrir le port 22 pour l'IP de ce runner + env: + HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }} + run: | + RUNNER_IP="$(curl -fsS --max-time 10 https://ifconfig.me)" + echo "IP du runner : ${RUNNER_IP}" + cat > /tmp/fw-open.json < ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + # Empreinte épinglée : un détournement DNS ou BGP ne peut pas + # rediriger le déploiement vers une machine tierce. + echo "${{ secrets.PROD_SSH_KNOWN_HOSTS }}" > ~/.ssh/known_hosts + chmod 600 ~/.ssh/known_hosts + + - name: Synchroniser infra/prod sur le serveur + run: | + rsync -az --delete \ + --exclude '.terraform' --exclude '*.tfstate*' --exclude '*.tfvars' \ + -e "ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519" \ + infra/prod/ \ + "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}:/opt/xpeditis/infra-prod/" + + - name: Déployer + id: deploy run: | SHA="${{ needs.verify-image.outputs.sha }}" - IMAGE="${{ env.REGISTRY }}/xpeditis-backend:prod-${SHA}" - echo "Deploying: $IMAGE" - kubectl set image deployment/xpeditis-backend backend="$IMAGE" -n ${{ env.K8S_NAMESPACE }} - kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=300s - echo "Backend rollout complete." + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519 \ + "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \ + "deploy prod-${SHA}" - - name: Deploy frontend - id: deploy-frontend + - name: Tests de fumée depuis l'extérieur + env: + PROD_API_URL: ${{ vars.PROD_API_URL }} + PROD_APP_URL: ${{ vars.PROD_APP_URL }} + run: bash infra/prod/scripts/smoke-test.sh + + - name: Retour arrière si le déploiement a échoué + if: failure() && steps.deploy.conclusion == 'failure' run: | - SHA="${{ needs.verify-image.outputs.sha }}" - IMAGE="${{ env.REGISTRY }}/xpeditis-frontend:prod-${SHA}" - echo "Deploying: $IMAGE" - kubectl set image deployment/xpeditis-frontend frontend="$IMAGE" -n ${{ env.K8S_NAMESPACE }} - kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=300s - echo "Frontend rollout complete." + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/id_ed25519 \ + "${{ secrets.PROD_SSH_USER }}@${{ secrets.PROD_SSH_HOST }}" \ + "rollback" || true - - name: Auto-rollback on deployment failure - if: failure() + - name: Refermer le firewall + # `always()` : la fenêtre d'exposition se referme même si le + # déploiement a échoué, si le job a été annulé ou s'il a expiré. + if: always() + env: + HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN_CICD }} run: | - echo "Deployment failed — initiating rollback..." - kubectl rollout undo deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} - kubectl rollout undo deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} - kubectl rollout status deployment/xpeditis-backend -n ${{ env.K8S_NAMESPACE }} --timeout=120s - kubectl rollout status deployment/xpeditis-frontend -n ${{ env.K8S_NAMESPACE }} --timeout=120s - echo "Rollback complete. Previous version is live." + echo '[]' > /tmp/fw-close.json + hcloud firewall replace-rules "${{ vars.HCLOUD_CICD_FIREWALL }}" --rules-file /tmp/fw-close.json + echo "Firewall CI refermé." - # ── Notifications ──────────────────────────────────────────────────── + - name: Effacer la clé SSH + if: always() + run: shred -u ~/.ssh/id_ed25519 2>/dev/null || rm -f ~/.ssh/id_ed25519 + + # ═══ 5. Notifications ════════════════════════════════════════════════════ notify-success: - name: Notify Success + name: Notifier le succès runs-on: ubuntu-latest needs: [verify-image, deploy] if: success() steps: - run: | - curl -s -H "Content-Type: application/json" -d '{ + curl -sf -H "Content-Type: application/json" -d '{ "embeds": [{ - "title": "🚀 Production Deployed & Healthy", + "title": "Production déployée et saine", "color": 3066993, "fields": [ - {"name": "Author", "value": "${{ github.actor }}", "inline": true}, + {"name": "Auteur", "value": "${{ github.actor }}", "inline": true}, {"name": "Version", "value": "`prod-${{ needs.verify-image.outputs.sha }}`", "inline": true}, - {"name": "Cluster", "value": "Hetzner k3s — `xpeditis-prod`", "inline": false}, + {"name": "Cible", "value": "Hetzner k3s — xpeditis-prod", "inline": false}, {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false} ], - "footer": {"text": "Xpeditis CI/CD • Production"} + "footer": {"text": "Xpeditis CI/CD - Production"} }] }' ${{ secrets.DISCORD_WEBHOOK_URL }} notify-failure: - name: Notify Failure + name: Notifier l'échec runs-on: ubuntu-latest - needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, promote-images, deploy] + needs: [backend-quality, frontend-quality, backend-tests, frontend-tests, verify-image, promote-backend, build-frontend, deploy] if: failure() steps: - run: | - curl -s -H "Content-Type: application/json" -d '{ - "content": "@here PRODUCTION PIPELINE FAILED", + curl -sf -H "Content-Type: application/json" -d '{ + "content": "@here ECHEC DU PIPELINE DE PRODUCTION", "embeds": [{ - "title": "🔴 Production Pipeline Failed", - "description": "Check the workflow for details. Auto-rollback was triggered if the failure was during deploy.", + "title": "Pipeline de production en échec", + "description": "Un retour arrière a été tenté si l échec est survenu pendant le déploiement. Vérifiez l état réel avant toute nouvelle tentative.", "color": 15158332, "fields": [ - {"name": "Author", "value": "${{ github.actor }}", "inline": true}, + {"name": "Auteur", "value": "${{ github.actor }}", "inline": true}, {"name": "Workflow", "value": "[${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})", "inline": false}, - {"name": "Rollback", "value": "[Run rollback workflow](${{ github.server_url }}/${{ github.repository }}/actions/workflows/rollback.yml)", "inline": false} + {"name": "A vérifier", "value": "Le firewall CI est-il bien refermé ? `hcloud firewall describe xpeditis-prod-fw-cicd`", "inline": false} ], - "footer": {"text": "Xpeditis CI/CD • Production"} + "footer": {"text": "Xpeditis CI/CD - Production"} }] }' ${{ secrets.DISCORD_WEBHOOK_URL }} diff --git a/docker/docker-compose.full.yml b/docker/docker-compose.full.yml index 5ba5a92..b031e76 100644 --- a/docker/docker-compose.full.yml +++ b/docker/docker-compose.full.yml @@ -2,7 +2,8 @@ # Xpeditis — Full Dev Stack (infrastructure + app + logging) # # Usage: -# docker-compose -f docker-compose.full.yml up -d +# docker network inspect xpeditis-network >/dev/null 2>&1 || docker network create xpeditis-network +# docker compose -f docker/docker-compose.full.yml up -d --build # # Exposed ports: # - Frontend: http://localhost:3000 @@ -28,7 +29,7 @@ services: POSTGRES_USER: xpeditis POSTGRES_PASSWORD: xpeditis_dev_password healthcheck: - test: ["CMD-SHELL", "pg_isready -U xpeditis"] + test: ["CMD-SHELL", "pg_isready -U xpeditis -d xpeditis_dev"] interval: 10s timeout: 5s retries: 5 @@ -252,3 +253,4 @@ volumes: networks: xpeditis-network: name: xpeditis-network + external: true