optimize pipeline

mrmegatelo · Jan 22, 2025 · c15921a · c15921a
1 parent 70f608d
commit c15921a
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 25 deletions.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -8,15 +8,18 @@ on:
 
 jobs:
   build:
-    name: Build image
+    name: Build docker images
     runs-on: ubuntu-latest
     environment: production
+    strategy:
+      matrix:
+        image_name: ['django', 'frontend', 'nginx']
     steps:
       - uses: actions/checkout@master
       - run: docker login ghcr.io -u $GITHUB_ACTOR -p ${{ secrets.GHCR_TOKEN }}
-      - run: docker build -f ./infra/production/django/Dockerfile -t ghcr.io/$GITHUB_ACTOR/walter:latest -t ghcr.io/$GITHUB_ACTOR/walter:$GITHUB_SHA .
-      - run: docker image push ghcr.io/$GITHUB_ACTOR/walter:$GITHUB_SHA
-      - run: docker image push ghcr.io/$GITHUB_ACTOR/walter:latest
+      - run: docker build -f ./infra/production/${{matrix.image_name}}/Dockerfile -t ghcr.io/$GITHUB_ACTOR/walter-${{matrix.image_name}}:latest -t ghcr.io/$GITHUB_ACTOR/walter-${{matrix.image_name}}:$GITHUB_SHA .
+      - run: docker image push ghcr.io/$GITHUB_ACTOR/walter-${{matrix.image_name}}:$GITHUB_SHA
+      - run: docker image push ghcr.io/$GITHUB_ACTOR/walter-${{matrix.image_name}}:latest
 
   deploy:
     name: Deploy
@@ -59,4 +62,4 @@ jobs:
       - run: scp -o StrictHostKeyChecking=no -i ${{ env.SSH_KEY_PATH }} -r $(pwd)/* ${{ secrets.PRODUCTION_SSH_USERNAME }}@${{ secrets.PRODUCTION_SSH_HOST }}:/home/walter/walter
       - run: scp -o StrictHostKeyChecking=no -i ${{ env.SSH_KEY_PATH }} .env ${{ secrets.PRODUCTION_SSH_USERNAME }}@${{ secrets.PRODUCTION_SSH_HOST }}:/home/walter/walter/.env
       - run: scp -o StrictHostKeyChecking=no -i ${{ env.SSH_KEY_PATH }} docker-compose.prod.yml ${{ secrets.PRODUCTION_SSH_USERNAME }}@${{ secrets.PRODUCTION_SSH_HOST }}:/home/walter/walter/docker-compose.prod.yml
-      - run: ssh -i ${{ env.SSH_KEY_PATH }} ${{ secrets.PRODUCTION_SSH_USERNAME }}@${{ secrets.PRODUCTION_SSH_HOST }} "cd /home/walter/walter && docker login ghcr.io -u $GITHUB_ACTOR -p ${{ secrets.GHCR_TOKEN }} && docker pull ghcr.io/$GITHUB_ACTOR/walter:$GITHUB_SHA && docker compose -f docker-compose.prod.yml up -d --build && docker system prune --all --force"
+      - run: ssh -i ${{ env.SSH_KEY_PATH }} ${{ secrets.PRODUCTION_SSH_USERNAME }}@${{ secrets.PRODUCTION_SSH_HOST }} "cd /home/walter/walter && docker login ghcr.io -u $GITHUB_ACTOR -p ${{ secrets.GHCR_TOKEN }} && docker pull ghcr.io/$GITHUB_ACTOR/walter-django:$GITHUB_SHA && docker pull ghcr.io/$GITHUB_ACTOR/walter-frontend:$GITHUB_SHA && docker compose -f docker-compose.prod.yml up -d && docker system prune --all --force"
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
@@ -3,7 +3,7 @@ version: '3.8'
 services:
 
   nginx:
-    build: ./infra/production/nginx
+    image: ghcr.io/mrmegatelo/walter-nginx:${GITHUB_SHA:-latest}
     volumes:
       - staticfiles:/app/staticfiles
       - mediafiles:/app/mediafiles
@@ -24,11 +24,10 @@ services:
       - ./certbot/conf/:/etc/letsencrypt/:rw
 
   web:
-    build:
-      context: .
-      dockerfile: infra/production/django/Dockerfile
+    image: ghcr.io/mrmegatelo/walter-django:${GITHUB_SHA:-latest}
     command: /start
     volumes:
+      - ./frontend:/app/frontend
       - staticfiles:/app/staticfiles
       - mediafiles:/app/mediafiles
     env_file:
@@ -44,9 +43,7 @@ services:
         condition: service_started
 
   frontend:
-    build:
-      context: .
-      dockerfile: ./infra/local/frontend/Dockerfile
+    image: ghcr.io/mrmegatelo/walter-frontend:${GITHUB_SHA:-latest}
     command: build
     volumes:
       - ./frontend:/app
@@ -65,10 +62,7 @@ services:
     image: redis:7-alpine
 
   celery_worker:
-    build:
-      context: .
-      dockerfile: infra/production/django/Dockerfile
-    image: walter_celery_worker
+    image: ghcr.io/mrmegatelo/walter-django:${GITHUB_SHA:-latest}
     command: /start-celeryworker
     volumes:
       - staticfiles:/app/staticfiles
@@ -80,10 +74,7 @@ services:
       - db
 
   celery_beat:
-    build:
-      context: .
-      dockerfile: infra/production/django/Dockerfile
-    image: walter_celery_beat
+    image: ghcr.io/mrmegatelo/walter-django:${GITHUB_SHA:-latest}
     command: /start-celerybeat
     volumes:
       - staticfiles:/app/staticfiles
@@ -95,10 +86,7 @@ services:
       - db
 
   flower:
-    build:
-      context: .
-      dockerfile: infra/production/django/Dockerfile
-    image: walter_celery_flower
+    image: ghcr.io/mrmegatelo/walter-django:${GITHUB_SHA:-latest}
     command: /start-flower
     volumes:
       - staticfiles:/app/staticfiles

diff --git a/infra/production/frontend/Dockerfile b/infra/production/frontend/Dockerfile
@@ -1,10 +1,15 @@
 FROM node:23-alpine
 
+RUN addgroup --system django \
+    && adduser --system --ingroup django django
+
 WORKDIR /app
 
 COPY ./frontend/package.json ./package.json
 COPY ./frontend/package-lock.json ./package-lock.json
 
 RUN npm i
 
+USER django
+
 ENTRYPOINT ["npm", "run"]
diff --git a/infra/production/nginx/Dockerfile b/infra/production/nginx/Dockerfile
@@ -1,4 +1,4 @@
 FROM nginx:1.25.3-alpine
 
 RUN rm /etc/nginx/conf.d/default.conf
-COPY nginx.conf /etc/nginx/conf.d
+COPY ./infra/production/nginx/nginx.conf /etc/nginx/conf.d