KoPKB/My-KOPKB
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

DONE: add cicd pipeline separate fe and be, test first on gitea

Browse Source
This commit is contained in:
ISMAIL MASSERAN
2026-06-30 10:28:48 +08:00
parent 00ee1b22ff
commit f38cd6810b
14 changed files with 374 additions and 219 deletions
Download Patch File Download Diff File Expand all files Collapse all files
be/docker/common/unified/Dockerfile
+5 -36
View File
@@ -1,33 +1,3 @@
# Stage 0: Build Vue frontend assets with Node.js
FROM node:22 AS frontend-builder
WORKDIR /app/frontend
# Copy frontend package files
COPY fe/package*.json ./
COPY fe/pnpm-lock.yaml* ./
# Install pnpm and frontend dependencies (including dev dependencies for build)
RUN npm install -g pnpm
RUN pnpm install --frozen-lockfile
# Copy frontend source code
COPY fe/ ./
# Build TWO frontend bundles (path-based):
# - Production: served at /
# - Training: served at /training/
#
# This avoids runtime JS injection and allows training/prod UI differences
# while keeping a single backend image.
RUN pnpm run typecheck \
&& pnpm exec vite build --mode=production --base=/ --outDir dist-prod \
&& pnpm exec vite build --mode=training --base=/training/ --outDir dist-training
# Clean up dev dependencies to reduce image size
ENV CI=true
RUN pnpm prune --prod
# Stage 1: Build environment and Composer dependencies
FROM php:8.4-fpm AS builder
@@ -150,12 +120,6 @@ RUN echo '[www]' > /usr/local/etc/php-fpm.d/zzz-status.conf && \
# Copy the application code and dependencies from the build stage first
COPY --from=builder /var/www /var/www
# Copy the built Vue frontends from frontend-builder stage
# - Production frontend at /
COPY --from=frontend-builder /app/frontend/dist-prod /var/www/public/
# - Training frontend at /training/
COPY --from=frontend-builder /app/frontend/dist-training /var/www/public/training/
# Set working directory
WORKDIR /var/www
@@ -173,3 +137,8 @@ EXPOSE 80 9000
# Start supervisor which manages both Nginx and PHP-FPM
CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
# CI: install dev dependencies and run PHPUnit (build fails if tests fail)
FROM builder AS backend-test
RUN composer install --no-interaction --prefer-dist --no-scripts \
&& ./vendor/bin/phpunit --no-coverage
be/docker/production/docker-compose.production.yml
+29 -16
View File
@@ -1,16 +1,10 @@
services:
app:
build:
context: .
dockerfile: ./be/docker/common/unified/Dockerfile
platforms:
- linux/amd64
- linux/arm64
image: git.ismailmasseran.com/topaz/sutera:v3.0.1b
container_name: sutera-app-production
backend:
image: git.koppkb.com/KoPKB/My-KOPKB-be:${IMAGE_TAG:-latest}
container_name: mykopkb-be-production
restart: unless-stopped
ports:
- "${APP_PORT:-80}:80"
- "${API_PORT:-8080}:80"
environment:
- APP_ENV=production
- APP_DEBUG=true
@@ -23,9 +17,9 @@ services:
- app-storage-production:/var/www/storage
- app-logs-production:/var/www/storage/logs
- ./.env.production:/var/www/.env:ro
- ./be/docker/production/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
- ${NGINX_CONF:-./be/docker/production/nginx/nginx.conf}:/etc/nginx/nginx.conf:ro
networks:
- sutera-production-network
- mykopkb-production-network
depends_on:
redis:
condition: service_healthy
@@ -41,17 +35,36 @@ services:
max-size: "10m"
max-file: "3"
# Redis for caching and sessions
frontend:
image: git.koppkb.com/KoPKB/My-KOPKB-fe:${IMAGE_TAG:-latest}
container_name: mykopkb-fe-production
restart: unless-stopped
ports:
- "${FE_PORT:-8081}:80"
networks:
- mykopkb-production-network
healthcheck:
test: ["CMD", "wget", "-q", "--spider", "http://localhost/"]
interval: 30s
timeout: 10s
retries: 3
start_period: 10s
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
redis:
image: redis:8
container_name: sutera-redis-production
container_name: mykopkb-redis-production
restart: unless-stopped
volumes:
- redis-data-production:/data
- ./redis-config/redis.conf:/usr/local/etc/redis/redis.conf:ro
command: redis-server /usr/local/etc/redis/redis.conf
networks:
- sutera-production-network
- mykopkb-production-network
healthcheck:
test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
interval: 10s
@@ -65,7 +78,7 @@ services:
max-file: "3"
networks:
sutera-production-network:
mykopkb-production-network:
driver: bridge
volumes:
be/docker/production/nginx/nginx.conf
+3 -37
View File
@@ -9,74 +9,40 @@ http {
sendfile on;
keepalive_timeout 65;
# Logging
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
# Production HTTP server
# API-only server (api.koppkb.com via host reverse proxy)
server {
listen 80;
server_name _;
root /var/www/public;
index index.php index.html;
index index.php;
# Security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
# API routes - pass directly to Laravel with original REQUEST_URI
location / {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root/index.php;
include fastcgi_params;
fastcgi_param HTTP_PROXY "";
fastcgi_param HTTPS $https if_not_empty;
fastcgi_read_timeout 300;
fastcgi_send_timeout 300;
try_files $uri $uri/ /index.php?$query_string;
}
# PRODUCTION: /training/ path is disabled - return 404
location ^~ /training/ {
return 404;
}
# Serve frontend assets
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
expires 1y;
add_header Cache-Control "public, immutable";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
try_files $uri =404;
}
# Handle all other routes - serve Vue app or Laravel
location / {
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
try_files $uri $uri/ /index.html /index.php?$query_string;
}
# Handle PHP files - connect to localhost PHP-FPM
location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
# Additional FastCGI parameters
fastcgi_param HTTP_PROXY "";
fastcgi_param HTTPS $https if_not_empty;
fastcgi_read_timeout 300;
fastcgi_send_timeout 300;
}
# Deny access to hidden files
location ~ /\. {
deny all;
}
# Health check endpoint for Docker
location = /health {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
be/docker/staging/docker-compose.staging.yml
+2 -2
View File
@@ -30,8 +30,8 @@ services:
volumes:
- app-storage-staging:/var/www/storage
- app-logs-staging:/var/www/storage/logs
- /etc/letsencrypt/live/sutera.ismailmasseran.com/fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
- /etc/letsencrypt/live/sutera.ismailmasseran.com/privkey.pem:/etc/nginx/ssl/privkey.pem:ro
- /etc/letsencrypt/live/sutera.koppkb.com/fullchain.pem:/etc/nginx/ssl/fullchain.pem:ro
- /etc/letsencrypt/live/sutera.koppkb.com/privkey.pem:/etc/nginx/ssl/privkey.pem:ro
networks:
- sutera-staging-network
depends_on:
be/docker/training/docker-compose.training.yml
+1 -1
View File
@@ -6,7 +6,7 @@ services:
platforms:
- linux/amd64
- linux/arm64
image: git.ismailmasseran.com/topaz/sutera:33a53e08a641152f255f5c3fa27765200add4f45
image: git.koppkb.com/topaz/sutera:33a53e08a641152f255f5c3fa27765200add4f45
container_name: sutera-app-training
restart: unless-stopped
ports: