#126 - Changes in beta deployment

.github/workflows/deploy-to-beta-by-push.yml

@@ -5,6 +5,7 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
@@ -16,7 +17,11 @@ jobs:
     name: Deploy to beta
     runs-on: ubuntu-22.04
     env:
-      REPO_NAME: keating
+      DOCKER_REGISTRY: registry.blumilk.pl
+      DOCKER_REGISTRY_USER_NAME: robot@blumilkbot-harbor
+      DOCKER_REGISTRY_PROJECT_NAME: internal-public
+      DOCKER_REGISTRY_REPO_NAME: keating
+      TARGET_DIR_ON_SERVER: /blumilk/beta/projects
     steps:
       - name: set branch name
         run: echo "BRANCH_NAME=$GITHUB_REF_NAME" >> $GITHUB_ENV
@@ -42,17 +47,21 @@ jobs:
       - name: login to GitHub Container Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ env.DOCKER_REGISTRY_USER_NAME }}
+          password: ${{ secrets.BLUMILKBOT_HARBOR_TOKEN }}
+
+      - name: set docker image name
+        run: echo "DOCKER_IMAGE_NAME=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REGISTRY_PROJECT_NAME }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}" >> $GITHUB_ENV
 
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         with:
-          images: ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}
-          tags: type=raw,value=beta
-          context: git
+          images: ${{ env.DOCKER_IMAGE_NAME }}
+          tags: |
+            type=raw,value=beta
+          context: workflow
 
       - name: build and push image
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
@@ -61,10 +70,10 @@ jobs:
           file: ./environment/prod/app/Dockerfile
           build-args: DEPLOYMENT_PROJECT_VERSION_ARG=${{ env.DEPLOYMENT_PROJECT_VERSION }}
           labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta.outputs.tags }}
           push: true
-          tags: ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}:beta
-          cache-from: type=gha, ref=ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}-beta-build-cache
-          cache-to: type=gha, ref=ghcr.io/${{ github.repository_owner }}/${{ env.REPO_NAME }}-beta-build-cache, mode=max
+          cache-from: type=gha, ref=${{ env.DOCKER_IMAGE_NAME }}-beta-build-cache
+          cache-to: type=gha, ref=${{ env.DOCKER_IMAGE_NAME }}-beta-build-cache, mode=max
 
       - name: copy files via ssh
         uses: appleboy/scp-action@917f8b81dfc1ccd331fef9e2d61bdc6c8be94634 # v0.1.7
@@ -77,7 +86,7 @@ jobs:
           key: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY }}
           passphrase: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY_PASSPHRASE }}
           source: "./environment/prod/deployment/beta/*,./environment/prod/deployment/scripts/*,./environment/prod/deployment/postgres/*"
-          target: ${{ secrets.KEATING_VPS_BETA_APP_PATH }}
+          target: ${{ env.TARGET_DIR_ON_SERVER }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}
           rm: true
 
       - name: run deployment script over ssh
@@ -92,6 +101,6 @@ jobs:
           passphrase: ${{ secrets.VPS_OVH_BF7EC892_SSH_PRIVATE_KEY_PASSPHRASE }}
           script_stop: true
           script: |
-            cd ${{ secrets.KEATING_VPS_BETA_APP_PATH }}/environment/prod/deployment/beta
-            make beta-deploy BETA_ENV_KEY=${{ secrets.BETA_ENV_KEY }}
-            docker images --filter dangling=true | grep "ghcr.io/blumilksoftware/${{ env.REPO_NAME }}" | awk '{print $3}'| xargs --no-run-if-empty docker rmi
+            cd ${{ env.TARGET_DIR_ON_SERVER }}/${{ env.DOCKER_REGISTRY_REPO_NAME }}/environment/prod/deployment/beta
+            make beta-deploy SOPS_AGE_KEY=${{ secrets.SOPS_AGE_BETA_SECRET_KEY }}
+            docker images --filter dangling=true | grep "${{ env.DOCKER_IMAGE_NAME }}" | awk '{print $3}'| xargs --no-run-if-empty docker rmi

.gitignore

@@ -13,6 +13,7 @@
 .env
 .env.backup
 .env.beta
+.env.beta.secrets.decrypted
 .phpunit.result.cache
 .php-cs-fixer.cache
 .appversion

.sops.yaml

@@ -0,0 +1,6 @@
+creation_rules:
+
+  - name: beta
+    path_regex: \.env\.beta\.secrets.*$
+    age: >-
+      age1vq7sw98g2xk9md2yg9f959k8xkaz8r32pds27jn3nsfcdue3757s0h7hd8

Makefile

@@ -60,32 +60,24 @@ queue:
 create-test-db:
 	@docker compose --file ${DOCKER_COMPOSE_FILE} exec ${DOCKER_COMPOSE_DATABASE_CONTAINER} bash -c 'createdb --username=${DATABASE_USERNAME} ${TEST_DATABASE_NAME} &> /dev/null && echo "Created database for tests (${TEST_DATABASE_NAME})." || echo "Database for tests (${TEST_DATABASE_NAME}) exists."'
 
-encrypt-beta-env:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} run \
-	--rm \
-	--no-deps \
-	--volume ${CURRENT_DIR}/environment/prod/deployment/beta:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	--user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" \
-	${DOCKER_COMPOSE_APP_CONTAINER} \
-	bash -c "cp /envs/.env.beta /application \
-		&& php artisan env:encrypt --env beta --key ${BETA_ENV_KEY} \
-		&& mv .env.beta.encrypted /envs \
-		&& rm .env.beta"
-
-decrypt-beta-env:
-	@docker compose --file ${DOCKER_COMPOSE_FILE} run \
-	--rm \
-	--no-deps \
-	--volume ${CURRENT_DIR}/environment/prod/deployment/beta:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	--user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" \
-	${DOCKER_COMPOSE_APP_CONTAINER} \
-	bash -c "cp /envs/.env.beta.encrypted /application \
-		&& php artisan env:decrypt --env beta --key ${BETA_ENV_KEY} \
-		&& mv .env.beta /envs \
-		&& rm .env.beta.encrypted"
-
-.PHONY: init check-env-file build run stop restart shell shell-root test fix create-test-db queue encrypt-beta-env decrypt-beta-env
+encrypt-beta-secrets:
+	@$(MAKE) encrypt-secrets SECRETS_ENV=beta
+
+decrypt-beta-secrets:
+	@$(MAKE) decrypt-secrets SECRETS_ENV=beta AGE_SECRET_KEY=${SOPS_AGE_BETA_SECRET_KEY}
+
+decrypt-secrets:
+	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" --env SOPS_AGE_KEY=${AGE_SECRET_KEY} ${DOCKER_COMPOSE_APP_CONTAINER} \
+		bash -c "echo 'Decrypting ${SECRETS_ENV} secrets' \
+			&& cd ./environment/prod/deployment/${SECRETS_ENV} \
+			&& sops --decrypt --input-type=dotenv --output-type=dotenv --output .env.${SECRETS_ENV}.secrets.decrypted .env.${SECRETS_ENV}.secrets \
+			&& echo 'Done'"
+
+encrypt-secrets:
+	@docker compose --file ${DOCKER_COMPOSE_FILE} exec --user "${CURRENT_USER_ID}:${CURRENT_USER_GROUP_ID}" ${DOCKER_COMPOSE_APP_CONTAINER} \
+		bash -c "echo 'Encrypting ${SECRETS_ENV} secrets' \
+			&& cd ./environment/prod/deployment/${SECRETS_ENV} \
+			&& sops --encrypt --input-type=dotenv --output-type=dotenv --output .env.${SECRETS_ENV}.secrets .env.${SECRETS_ENV}.secrets.decrypted \
+			&& echo 'Done'"
+
+.PHONY: init check-env-file build run stop restart shell shell-root test fix create-test-db queue encrypt-beta-secrets decrypt-beta-secrets

environment/dev/app/Dockerfile

@@ -1,10 +1,28 @@
+FROM alpine:3.20.2@sha256:0a4eaa0eecf5f8c050e5bba433f58c052be7587ee8af3e8b3910ef9ab5fbe9f5 AS secops-tools
+
+# https://github.com/FiloSottile/age/releases
+ARG AGE_VERSION="1.1.1"
+
+# https://github.com/getsops/sops/releases
+ARG SOPS_VERSION="3.8.1"
+
+RUN wget --output-document age.tar.gz "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz" \
+    && tar --extract --file age.tar.gz \
+    && mv age/age /usr/local/bin \
+    && mv age/age-keygen /usr/local/bin \
+    && wget --output-document /usr/local/bin/sops "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+    && chmod +x /usr/local/bin/sops
+
 FROM composer/composer:2.7.7-bin@sha256:1832641f1ba36c8e748f4b4462f77e7c8836cca7730fdf0540580d703b78f2e7 AS composer-bin
 
 FROM node:21.7.3-bullseye-slim@sha256:50adaf5a166e4e3dc01e77e9bdb4c35e34ef32a1e9e26200019cddb2b154fb34 AS node
 
 FROM php:8.3.10-fpm-bullseye@sha256:857b7cdf42fc4e5b313548e6f6260fce0534439e30915824a5ac3efe9a121dff
 
 COPY --from=composer-bin ./composer /usr/bin/composer
+COPY --from=secops-tools /usr/local/bin/age /usr/local/bin/age
+COPY --from=secops-tools /usr/local/bin/age-keygen /usr/local/bin/age-keygen
+COPY --from=secops-tools /usr/local/bin/sops /usr/local/bin/sops
 
 ARG USER_NAME=host-user
 ARG USER_ID=1000

environment/prod/deployment/beta/.env.beta.secrets

@@ -0,0 +1,30 @@
+APP_KEY=ENC[AES256_GCM,data:fWyxvZYL0efOrHXvrG9vess79jHBiwRL5PXBu4DNqqZTU3jySKIgOyz9vUfLGJdiqcBh,iv:oR0MrlXOn3BF3yBftIgHFsbv83j+Bl8GcGEsHLJDpDI=,tag:N8unSLAgjb5gCKI8kq3A3A==,type:str]
+DOCKER_KEATING_BETA_DB_ROOT_PASSWORD=ENC[AES256_GCM,data:DhcuqzMHYQ==,iv:prgSu/J9Q3FVzyo69Gj9CoGH8BHIrPUFwXbwetJSHGc=,tag:q3cSBVn8FMV2DFBMRYG8zA==,type:str]
+DOCKER_KEATING_BETA_DB_DATABASE=ENC[AES256_GCM,data:u2uwoADz8w==,iv:SaYfIc25URQef+KHECmKJj+nKST6F8lnlUPKDVRXgwE=,tag:paQEaoa7GKLSeunQyCfHOw==,type:str]
+DOCKER_KEATING_BETA_DB_USERNAME=ENC[AES256_GCM,data:rwdbtZ/0aA==,iv:U9+Kz+A+gFQG6Yn4eaukqmVcpvYDa1q7JgiqXyFfqpc=,tag:p0oQ24I3fBNqxWKuJUpChQ==,type:str]
+DOCKER_KEATING_BETA_DB_PASSWORD=ENC[AES256_GCM,data:r6kAtRDIruM=,iv:cI3+rda0fIqv9O2W5/kgwtt+jDSn29TYNIhpaT+SqVg=,tag:H1oavvqHWEoLItEif4E0PQ==,type:str]
+DB_CONNECTION=ENC[AES256_GCM,data:pZEeBAQ=,iv:kt9YsArfWKqI0V6IGahSFirC2jMsqLKNb2mdr6zVFlw=,tag:Y1o3FCrq/ZgGldJf6z6UPA==,type:str]
+DB_HOST=ENC[AES256_GCM,data:3qzHHa9DX5RuLK03OeyWvD9bQws0,iv:08d+Xq3LqoR9iTnclUmmpu6R15EWue076mTVlPYhNFY=,tag:UaUscRO2eIAaOwzp+vnnBg==,type:str]
+DB_PORT=ENC[AES256_GCM,data:COVOOw==,iv:r+3V40sN2cN6IkvuF8OjP8Sko+G1YQtzNw3kJrVhpn8=,tag:LdA7Nj3+4IePzZZ7kW10yg==,type:str]
+DB_DATABASE=ENC[AES256_GCM,data:K5vX1dxsPQ==,iv:mUOf/NxbhwBKZX7wzKwWj8AXK3Tu7bNyuFItGkELpuU=,tag:UK1B0PmSArTumucpup7T/w==,type:str]
+DB_USERNAME=ENC[AES256_GCM,data:/guuobLJiw==,iv:SrjmoQIwpzprwoM+3Qing8NhinNKCZOVMdAuHP3iepI=,tag:cmjrd2e6IgZfJ44DNNKHgA==,type:str]
+DB_PASSWORD=ENC[AES256_GCM,data:rQVriWbnkvA=,iv:ryv5mreUMvBfOM8qczEYSJCtUpViOjNXtJpZ8wJWn0U=,tag:T2p9jjRKOXIyUhS1tuTIPA==,type:str]
+DB_ROOT_PASSWORD=ENC[AES256_GCM,data:6uEP3a4g4Q==,iv:W6VDUUYopVbQNhMDdoHjkK3FV/KoS5WbrJcBEJ7ae3g=,tag:WKls4D3L5UkMyIXMFlFe9A==,type:str]
+REDIS_HOST=ENC[AES256_GCM,data:5QzLEB48t0FG+htDhyR873KO,iv:qeZPEEQIDcIF6GyXZ8U5pjQz/M8UfYRbFxP9fiQvPIk=,tag:bBZjL+3k4lk+nCdke6yXpg==,type:str]
+REDIS_PASSWORD=ENC[AES256_GCM,data:a4C75g==,iv:+pjoZL9Hhd4prOxwO2TneI5hF25wMUXIhAenVD+wkmE=,tag:spDdf1JBuUE59DM5ULf5IQ==,type:str]
+REDIS_PORT=ENC[AES256_GCM,data:Zr6n4w==,iv:+48Umu9sEKju/wwiwgfk/MLnPl2YgBUVWnxMDR0Y7OE=,tag:znM5oPmMCwh6eHTS7tXxXg==,type:str]
+MAIL_USERNAME=ENC[AES256_GCM,data:hSNRHw==,iv:D4p5EAIXTgBDq+/NLS2dzVk/MHdpjzOT87hlozpYD2w=,tag:y5X/Ek2ZcP08OFWQfpvhoQ==,type:str]
+MAIL_PASSWORD=ENC[AES256_GCM,data:4PEoFQ==,iv:Rk8MAw2Do9wOjXeAoqELij0ylbR1pB9oQZqeKJ6hvlY=,tag:53WAKetyIWGReaWSncTTOw==,type:str]
+MAIL_ENCRYPTION=ENC[AES256_GCM,data:dkmJVA==,iv:qCUtDLBIGlx1h14LGysCiI+osPEL7bF/NUpM/jWwUxo=,tag:h0sbwPWtl+mJQWNgrI0/hA==,type:str]
+MAIL_FROM_ADDRESS=ENC[AES256_GCM,data:e5OaCbStNXa8pqiN/xt3/C4h7w==,iv:Mbqv/7vHIn3u9p8QpuX3yn3aURkulbp7oKTgCpEEap4=,tag:i4BHUQOdE75LQAs55i1FQw==,type:str]
+MAIL_FROM_NAME=ENC[AES256_GCM,data:31sVUYN2b9bi9s5IAA==,iv:v0WZC93j0byFOJot2vu82fN/KsXi30N0diIYGuc+9DQ=,tag:7sy9OWWUWFtyCedciVzw2A==,type:str]
+DOCKER_APP_HOST_PORT=ENC[AES256_GCM,data:YcEX7DY=,iv:HARUYmK+PKQeYs2E9xve6JXnittrZ1A56azDYK9Rodg=,tag:HPz2SK35KUOtb/yfew5Xyg==,type:str]
+DOCKER_INSTALL_XDEBUG=ENC[AES256_GCM,data:9UieZ/A=,iv:PZX8Dcuw/xsM56llKkfBj8z/M34YQfUBH84zScp72Vc=,tag:2+pmjAJBOf7LdnsrBBLO0A==,type:str]
+DOCKER_DATABASE_HOST_PORT=ENC[AES256_GCM,data:3Gyrox4=,iv:jBToSRD1IpRsPM9vBd+yTk3Xq4+5xSU7vKoFe+MmdJE=,tag:EUh6QrYfzo61F7/dbPeyYQ==,type:str]
+DOCKER_REDIS_HOST_PORT=ENC[AES256_GCM,data:Xt5KRJw=,iv:n6Om0NbiboFqKjJAw8bDL1AAK7rygJrVwwwdnAm8h+Y=,tag:hQlc1GnCdxVbtsvwOkOf/Q==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyS1hUenFlYXVkTkRlN2lt\nVE9SUExJRG1ETG93WS9MWjd0enprK3J2VWpnCjNUVzRKZmxiZitISTAweHRyQTNZ\nUG5mS3dsbkx0NVhkUjR1RWVSQ1lkQ0EKLS0tIGZkSVpJMWhSUUd0dnhzbmdFWXBB\nU0Y1TjgzNTBrbkl0RTRxWkF2NVgvRjAKg0Y33ISkDHZy6ocNq0PWW/c1aed+7pVJ\nXpm0jpFE9AfB1uqNAQ2cFnas5moCbJ9icujOAU7b+cTu/6lk+VcZhA==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1vq7sw98g2xk9md2yg9f959k8xkaz8r32pds27jn3nsfcdue3757s0h7hd8
+sops_lastmodified=2024-08-21T08:36:57Z
+sops_mac=ENC[AES256_GCM,data:WNAxZ3GiRSUandtgq/JHxW57b1/A5bGFCgzhZ6mdMMECD1LJNxguXfsQ3ONk/UcIj8BwlBkhzkItlfoT+5rBONHf82/waLaSzPCB1vOwYPDUqGcHVciiyjeVhKxZvQj1pabMRnocyxlIYfiV6a6zodqTrDA3WVgMtA/NyPvE9PU=,iv:VzqZUVyynyFuHjubdcczoFvovkpVgyFnV6F8K7J5LZU=,tag:qPd/KhU4f3WTuLc/alBNLg==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.8.1

environment/prod/deployment/beta/Makefile

@@ -1,6 +1,8 @@
 export COMPOSE_DOCKER_CLI_BUILD = 1
 export DOCKER_BUILDKIT = 1
 
+MAKEFLAGS += --no-print-directory
+
 DOCKER_COMPOSE_FILENAME = docker-compose.beta.yml
 DOCKER_COMPOSE_APP_CONTAINER = keating-beta-app
 
@@ -11,23 +13,21 @@ BETA_DOCKER_IMAGE = ghcr.io/blumilksoftware/keating:beta
 
 CURRENT_DIR = $(shell pwd)
 
-beta-deploy: decrypt-beta-env create-deployment-file
+beta-deploy: decrypt-secrets create-deployment-file
 	@docker compose --file ${DOCKER_COMPOSE_FILENAME} pull && \
 	docker compose --file ${DOCKER_COMPOSE_FILENAME} up --detach && \
 	echo "App post deploy actions" && \
 	${DOCKER_EXEC_SCRIPT} post-deploy-actions.sh
 
-decrypt-beta-env:
-	@docker run \
-	--rm \
-	--volume ${CURRENT_DIR}:/envs \
-	--entrypoint "" \
-	--workdir /application \
-	${BETA_DOCKER_IMAGE} \
-	bash -c "cp /envs/.env.beta.encrypted /application \
-		&& php artisan env:decrypt --env beta --key ${BETA_ENV_KEY} \
-		&& cp .env.beta /envs/.env.beta \
-		&& cp .env.beta /envs/.env"
+SOPS_VERSION=3.8.1
+
+decrypt-secrets:
+	@wget --output-document ./sops "https://github.com/getsops/sops/releases/download/v${SOPS_VERSION}/sops-v${SOPS_VERSION}.linux.amd64" \
+    	&& chmod +x ./sops \
+    	&& mv .env.beta .env \
+    	&& echo "Decrypting secrets" \
+    	&& ./sops --decrypt --input-type=dotenv --output-type=dotenv .env.beta.secrets >> .env \
+    	&& echo "Done"
 
 DEPLOYMENT_DATETIME = $(shell TZ=Europe/Warsaw date --rfc-3339=seconds)
 
@@ -36,4 +36,4 @@ create-deployment-file:
 	DEPLOY_DATE='${DEPLOYMENT_DATETIME}'\
 	" > .deployment
 
-.PHONY: beta-deploy decrypt-beta-env create-deployment-file
+.PHONY: beta-deploy decrypt-secrets create-deployment-file

environment/prod/deployment/beta/docker-compose.beta.yml

@@ -14,7 +14,7 @@ volumes:
 
 services:
   keating-beta-app:
-    image: ghcr.io/blumilksoftware/keating:beta
+    image: registry.blumilk.pl/internal-public/keating:beta
     container_name: keating-beta-app
     pull_policy: always
     deploy: