Preview

.env.example

@@ -0,0 +1,34 @@
+## Compose
+COMPOSE_PROJECT_NAME=thesis
+COMPOSE_PROFILES=proxy, stateless, stateful, migrate
+
+## Statefull
+POSTGRES_DB=database
+POSTGRES_USER=username
+POSTGRES_PASSWORD=password
+DATABASE_URL=postgres://username:password@timescaledb:5432/database
+
+## Stateless
+INTERFACE_FQDN=http://localhost
+MICROSOFT_TENANT_ID=    
+MICROSOFT_CLIENT_ID="d03453634..."
+MICROSOFT_CLIENT_SECRET="jcmads...."
+RESEND_CLIENT_SECRET=
+PROD=true
+
+## Monitor
+PORTAINER_FQDN=http://portainer.localhost   
+
+## Cloud
+HCLOUD_TOKEN=
+
+## Nixos
+SERVER_IP=
+SSH_PUBLIC_KEYS="ssh-rsa AAAAB3..."
+PASSWORD_HASH=
+
+## S3 Storage
+S3_ACCESS_KEY_ID=
+S3_SECRET_ACCESS_KEY=
+S3_BUCKET=
+S3_ENDPOINT=

.github/workflows/create-server.yml

@@ -0,0 +1,32 @@
+name: start server
+
+on:
+  workflow_dispatch:
+    inputs:
+      server_name:
+        description: 'Name for the server'
+        required: false
+        default: 'nixos'
+      ssh_key:
+        description: 'Name of the SSH key registered in Hetzner Cloud'
+        required: false
+        default: 'deploy-key'
+
+jobs:
+  provision:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+
+    - name: Setup Hetzner Cloud CLI
+      uses: hetznercloud/setup-hcloud@v1
+      env:
+        HCLOUD_TOKEN: ${{ secrets.HCLOUD_TOKEN }}
+
+    - name: Run NixOS Server Provisioner
+      env:
+        PASSWORD_HASH: ${{ secrets.PASSWORD_HASH }}
+      run: |
+        cd ci-cd/nixos/
+        ./create-server.sh "${{ github.event.inputs.server_name }}" "${{ github.event.inputs.ssh_key }}"

.github/workflows/deploy.yml

@@ -0,0 +1,53 @@
+name: deploy
+on:
+  push:
+    branches:
+      - main
+      - preview
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref_name == 'main' && 'production' || 'preview' }}
+    env:
+      PROD: true
+      COMPOSE_PROJECT_NAME: ${{ github.ref_name }}
+      COMPOSE_PROFILES: stateless, stateful, migrate
+      DOCKER_HOST: ssh://admin@${{ secrets.SERVER_IP }}
+      SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+      INTERFACE_FQDN: ${{ vars.INTERFACE_FQDN }}
+      MICROSOFT_TENANT_ID: ${{ vars.MICROSOFT_TENANT_ID }}
+      MICROSOFT_CLIENT_ID: ${{ secrets.MICROSOFT_CLIENT_ID }}
+      MICROSOFT_CLIENT_SECRET: ${{ secrets.MICROSOFT_CLIENT_SECRET }}
+      POSTGRES_DB: ${{ vars.POSTGRES_DB }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+      DATABASE_URL: postgres://${{ secrets.POSTGRES_USER }}:${{ secrets.POSTGRES_PASSWORD }}@timescaledb:5432/${{ vars.POSTGRES_DB }}
+      RESEND_CLIENT_SECRET: ${{ secrets.RESEND_CLIENT_SECRET }} 
+      PORTAINER_FQDN: ${{ vars.PORTAINER_FQDN }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Which branch?
+        run: echo "${{ github.ref_name }}"
+
+      - name: Set up SSH key
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_PRIVATE_KEY" > ~/.ssh/id_rsa
+          chmod 600 ~/.ssh/id_rsa
+          echo -e "Host *\n\tStrictHostKeyChecking no\n" >> ~/.ssh/config
+
+      - name: Docker prune
+        run: docker system prune --all --force --filter "until=36h"
+
+      - name: Deploy caddy
+        run: docker compose --profile proxy -p proxy up -d
+
+      - name: Deploy docker compose
+        run: docker compose -f compose.yaml --profile stateful --profile stateless --profile migrate up --build -d
+
+      - name: Deploy monitoring
+        run: docker compose --profile monitor -p monitor up -d

.github/workflows/build.yml → .github/workflows/release.yml

@@ -1,22 +1,48 @@
-name: Build and test images
+name: publish
 
-on: [push]
+on:
+  release:
+    types: [created]
 
 permissions:
   packages: write
   contents: read
   id-token: write
 
 env:
-  # Use docker.io for Docker Hub if empty
   REGISTRY: ghcr.io
   FRONTEND_IMAGE_NAME: hansaskov/master-thesis-frontend
   BACKEND_IMAGE_NAME: hansaskov/master-thesis-backend
-  DATABASE_URL: postgresql://myuser:password@localhost:5432/mydatabase
-  PROD: false
   IMAGE_TAG: 1.0
 
 jobs:
+  rust_release:
+    name: Build Release
+    runs-on: windows-latest
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Install Rust toolchain
+      uses: actions-rs/toolchain@v1
+      with:
+        toolchain: stable
+        profile: minimal
+        override: true
+
+    - name: Build release in services/ingest
+      working-directory: ./services/ingest
+      run: cargo build --release
+
+    - name: Create Release Asset
+      uses: softprops/action-gh-release@v2
+      if: startsWith(github.ref, 'refs/tags/')
+      with:
+        files: ./services/ingest/target/release/ingest.exe
+
   build_frontend_docker_image:
     runs-on: ubuntu-latest
     steps: 
@@ -60,7 +86,8 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
-          context: ./services/frontend
+          context: .
+          file: ./services/frontend/dockerfile
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -79,28 +106,12 @@ jobs:
 
   build_backend_docker_image:
     runs-on: ubuntu-latest
+    env: 
+      DATABASE_URL: postgresql://myuser:password@localhost:5432/mydatabase
     steps: 
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install bun
-        uses: oven-sh/setup-bun@v2
-      - name: Install package
-        working-directory: ./services/backend
-        run: bun install
-      - name: Start TimescaleDB
-        run: docker run -d --name timescaledb -p 5432:5432 -e POSTGRES_PASSWORD=password -e POSTGRES_USER=myuser -e POSTGRES_DB=mydatabase timescale/timescaledb:latest-pg17
-      - name: Wait 10 seconds
-        run: sleep 10
-      - name: List Containers
-        run: docker container list
-      - name: Start migrate
-        working-directory: ./services/backend
-        run: bun db:migrate 
-      - name: Run backend tests  
-        working-directory: ./services/backend
-        run: bun test
-
       - name: Install cosign
         if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
@@ -136,7 +147,8 @@ jobs:
         id: build-and-push
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
-          context: ./services/backend
+          context: .
+          file: ./services/backend/dockerfile
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -151,6 +163,4 @@ jobs:
           DIGEST: ${{ steps.build-and-push.outputs.digest }}
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
-  deploy-preview:
-    uses: hansaskov/master-thesis/.github/workflows/deploy-preview.yml@main
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}