family life gift card app

.env

@@ -0,0 +1,9 @@
+RAILS_SERVE_STATIC_FILES=true
+SITE_URL=https://familylife-gift-cards-stage.cru.org
+SESSION_REDIS_DB_INDEX=1
+SESSION_REDIS_HOST=localhost
+SESSION_REDIS_PORT=6379
+STORAGE_REDIS_DB_INDEX=1
+STORAGE_REDIS_HOST=localhost
+STORAGE_REDIS_PORT=6379
+

.github/workflows/build-deploy-ecs.yml

@@ -0,0 +1,37 @@
+name: Build & Deploy ECS
+
+on:
+  push:
+    branches:
+      # Automatically build and deploy master and staging. Additional branches may be added.
+      # - main
+      - staging
+  workflow_dispatch:
+    # Allows manual build and deploy of any branch/ref
+    inputs:
+      auto-deploy:
+        type: boolean
+        description: Deploy image after building?
+        required: true
+        default: 'false'
+
+jobs:
+  # Build and push container image to ECR. Builds occur in the project repository.
+  build:
+    name: Build
+    uses: CruGlobal/.github/.github/workflows/build-ecs.yml@v1
+
+  # Triggers an ECS deployment in https://github.com/CruGlobal/cru-deploy/actions.
+  # All deployments happen in the cru-deploy repo.
+  deploy:
+    name: Deploy
+    runs-on: ubuntu-latest
+    needs: build
+    if: github.event_name != 'workflow_dispatch' || github.event.inputs.auto-deploy == 'true'
+    steps:
+      - uses: CruGlobal/.github/actions/trigger-deploy@v1
+        with:
+          github-token: ${{ secrets.CRU_DEPLOY_GITHUB_TOKEN }}
+          project-name: ${{ needs.build.outputs.project-name }}
+          environment: ${{ needs.build.outputs.environment }}
+          build-number: ${{ needs.build.outputs.build-number }}

.gitignore

@@ -57,3 +57,7 @@ bin/deploy/erd-service-account.json
 !/app/assets/builds/.keep
 
 /node_modules
+
+.byebug_history
+*.zip
+*.csv

.ruby-version

@@ -1 +1 @@
-ruby-3.3.6
+3.3.6

Dockerfile

@@ -1,69 +1,60 @@
-# syntax = docker/dockerfile:1
+# RUBY_VERSION set by build.sh based on .ruby-version file
+ARG RUBY_VERSION
+FROM public.ecr.aws/docker/library/ruby:${RUBY_VERSION}-alpine
 
-# This Dockerfile is designed for production, not development. Use with Kamal or build'n'run by hand:
-# docker build -t my-app .
-# docker run -d -p 80:80 -p 443:443 --name my-app -e RAILS_MASTER_KEY=<value from config/master.key> my-app
+# DataDog logs source
+LABEL com.datadoghq.ad.logs='[{"source": "ruby"}]'
 
-# Make sure RUBY_VERSION matches the Ruby version in .ruby-version
-ARG RUBY_VERSION=3.3.6
-FROM docker.io/library/ruby:$RUBY_VERSION-slim AS base
+# Create web application user to run as non-root
+RUN addgroup -g 1000 webapp \
+    && adduser -u 1000 -G webapp -s /bin/sh -D webapp \
+    && mkdir -p /home/webapp/app
+WORKDIR /home/webapp/app
 
-# Rails app lives here
-WORKDIR /rails
+# Upgrade alpine packages (useful for security fixes)
+RUN apk upgrade --no-cache
 
-# Install base packages
-RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y curl libjemalloc2 libvips sqlite3 && \
-    rm -rf /var/lib/apt/lists /var/cache/apt/archives
+# Install rails/app dependencies
+RUN apk --no-cache add libc6-compat git postgresql-libs tzdata
 
-# Set production environment
-ENV RAILS_ENV="production" \
-    BUNDLE_DEPLOYMENT="1" \
-    BUNDLE_PATH="/usr/local/bundle" \
-    BUNDLE_WITHOUT="development"
-
-# Throw-away build stage to reduce size of final image
-FROM base AS build
-
-# Install packages needed to build gems
-RUN apt-get update -qq && \
-    apt-get install --no-install-recommends -y build-essential git pkg-config && \
-    rm -rf /var/lib/apt/lists /var/cache/apt/archives
-
-# Install application gems
+# Copy dependency definitions and lock files
 COPY Gemfile Gemfile.lock ./
-RUN bundle install && \
-    rm -rf ~/.bundle/ "${BUNDLE_PATH}"/ruby/*/cache "${BUNDLE_PATH}"/ruby/*/bundler/gems/*/.git && \
-    bundle exec bootsnap precompile --gemfile
-
-# Copy application code
-COPY . .
-
-# Precompile bootsnap code for faster boot times
-RUN bundle exec bootsnap precompile app/ lib/
 
-# Precompiling assets for production without requiring secret RAILS_MASTER_KEY
-RUN SECRET_KEY_BASE_DUMMY=1 ./bin/rails assets:precompile
+# Install bundler version which created the lock file and configure it
+ARG SIDEKIQ_CREDS
+ENV LD_LIBRARY_PATH /usr/lib/instantclient
+RUN gem install bundler -v $(awk '/^BUNDLED WITH/ { getline; print $1; exit }' Gemfile.lock) \
+    && bundle config --global gems.contribsys.com $SIDEKIQ_CREDS
 
+# Install build-dependencies, then install gems, subsequently removing build-dependencies
+RUN apk --no-cache add --virtual build-deps build-base postgresql-dev \
+    && bundle install --jobs 20 --retry 2 \
+    && apk del build-deps
 
+# Copy the application
+COPY . .
 
-
-# Final stage for app image
-FROM base
-
-# Copy built artifacts: gems, application
-COPY --from=build "${BUNDLE_PATH}" "${BUNDLE_PATH}"
-COPY --from=build /rails /rails
-
-# Run and own only the runtime files as a non-root user for security
-RUN groupadd --system --gid 1000 rails && \
-    useradd rails --uid 1000 --gid 1000 --create-home --shell /bin/bash && \
-    chown -R rails:rails db log storage tmp
-USER 1000:1000
-
-# Entrypoint prepares the database.
-ENTRYPOINT ["/rails/bin/docker-entrypoint"]
-
-# Start the server by default, this can be overwritten at runtime
-EXPOSE 3000
-CMD ["./bin/rails", "server"]
+# Environment required to build the application
+ARG RAILS_ENV=production
+ARG RAILS_ENV=production
+ARG SESSION_REDIS_DB_INDEX=1
+ARG SESSION_REDIS_HOST=localhost
+ARG SESSION_REDIS_PORT=6379
+ARG STORAGE_REDIS_DB_INDEX=1
+ARG STORAGE_REDIS_HOST=localhost
+ARG STORAGE_REDIS_PORT=6379
+ARG SECRET_KEY_BASE=asdf
+
+# Compile assets
+RUN RAILS_ENV=production bundle exec rake assets:clobber assets:precompile \
+    && chown -R webapp:webapp /home/webapp/
+
+# Define volumes used by ECS to share public html and extra nginx config with nginx container
+VOLUME /home/webapp/app/public
+VOLUME /home/webapp/app/nginx-conf
+
+# Run container process as non-root user
+USER webapp
+
+# Command to start rails
+CMD ["bundle", "exec", "puma", "-C", "config/puma.rb"]

Gemfile

@@ -9,6 +9,14 @@ gem "sassc-rails"
 gem "pg"
 gem "dotenv"
 
+gem "sidekiq", "~> 6.5"
+source "https://gems.contribsys.com/" do
+  gem "sidekiq-pro"
+end
+gem "sidekiq-cron"
+gem "sidekiq-failures"
+gem "sidekiq-unique-jobs"
+
 # Use the Puma web server [https://github.com/puma/puma]
 gem "puma", ">= 5.0"
 # Use JavaScript with ESM import maps [https://github.com/rails/importmap-rails]
@@ -18,7 +26,8 @@ gem "stimulus-rails"
 # Build JSON APIs with ease [https://github.com/rails/jbuilder]
 gem "jbuilder"
 # Use Redis adapter to run Action Cable in production
-# gem "redis", ">= 4.0.1"
+gem "redis", "~> 4.0"
+gem "redis-actionpack"
 
 # Use Kredis to get higher-level data types in Redis [https://github.com/rails/kredis]
 # gem "kredis"
@@ -66,3 +75,10 @@ group :test do
 end
 
 gem "activeadmin", "~> 3.2"
+gem "activeadmin_addons"
+
+gem "aasm"
+
+gem "activerecord-import"
+
+gem "dogstatsd-ruby", "~> 5.3"