DONE: pipeline cicd for backend

be/.dockerignore

@@ -0,0 +1,10 @@
+target/
+uploads/
+.git/
+.gitignore
+.idea/
+*.iml
+.vscode/
+*.md
+.env
+.DS_Store

be/.env.example

@@ -0,0 +1,12 @@
+# Host ports (change these if they collide on your single server)
+BACKEND_HOST_PORT=8080
+MYSQL_HOST_PORT=3306
+
+# MySQL
+MYSQL_ROOT_PASSWORD=password
+MYSQL_DATABASE=qms
+
+# App
+JWT_SECRET_KEY=change-me-to-a-long-random-secret
+GOOGLE_CLIENT_ID=dummy-google-client-id
+NOTIFICATIONS_MOCK=true

be/.env.production

@@ -0,0 +1,12 @@
+# Host ports (change these if they collide on your single server)
+BACKEND_HOST_PORT=8080
+MYSQL_HOST_PORT=3306
+
+# MySQL
+MYSQL_ROOT_PASSWORD=R8qjjBJDg9NtL2IwcnoFMkn8pktwAZ;wsl
+MYSQL_DATABASE=qms
+
+# App
+JWT_SECRET_KEY=a68uiaDQ0V3iLjF4DqMuS13GAVwkut55dlFbGCLyXTF
+GOOGLE_CLIENT_ID=dummy-google-client-id
+NOTIFICATIONS_MOCK=true

be/.gitignore

@@ -34,3 +34,6 @@ build/
 
 ### Uploads ###
 uploads/
+
+### Docker / env ###
+.env

be/Dockerfile

@@ -1,3 +1,26 @@
-FROM openjdk:17-jdk-alpine
-COPY target/bbqms-0.0.1-SNAPSHOT.jar ./app.jar
-ENTRYPOINT ["java", "-jar", "/app.jar"]
+# Build stage
+FROM maven:3.9-eclipse-temurin-17-alpine AS build
+WORKDIR /app
+
+COPY pom.xml .
+COPY mvnw .
+COPY .mvn .mvn
+COPY src ./src
+
+RUN ./mvnw -q -DskipTests package
+
+# Runtime stage
+FROM eclipse-temurin:17-jre-alpine
+WORKDIR /app
+
+RUN addgroup -S qms && adduser -S qms -G qms \
+    && mkdir -p /app/uploads/ads \
+    && chown -R qms:qms /app
+
+COPY --from=build /app/target/bbqms-0.0.1-SNAPSHOT.jar app.jar
+
+USER qms
+
+EXPOSE 8080
+
+ENTRYPOINT ["java", "-jar", "app.jar"]

be/README.md

@@ -1,9 +1,38 @@
-## Build instructions
+## Build instructions (local)
 
-- Enter your database details in the **src/main/resources/application.yml** file
-- Through IntelliJ simply click on the run button 
-- Or through console 
-    - ./mvnw dependency:resolve
-    - ./mvnw spring-boot:run
+- Enter your database details in the **src/main/resources/application.yml** file (or use env vars)
+- Through IntelliJ simply click on the run button
+- Or through console
+    - `./mvnw dependency:resolve`
+    - `./mvnw spring-boot:run`
 
 ##### **NOTE:** requires Java 17 and MySQL 8
+
+## Docker deployment (single server)
+
+From the `be/` directory:
+
+```bash
+cp .env.example .env
+# Edit .env if ports 8080 / 3306 are already in use on the server
+
+docker compose up -d --build
+```
+
+Services and default host ports:
+
+| Service  | Container | Host port (configurable) |
+|----------|-----------|---------------------------|
+| Backend  | qms-backend | `BACKEND_HOST_PORT` → **8080** |
+| MySQL    | qms-mysql   | `MYSQL_HOST_PORT` → **3306** |
+
+API base URL on the server: `http://<server-ip>:8080`
+
+Useful commands:
+
+```bash
+docker compose ps
+docker compose logs -f backend
+docker compose down          # stop containers (keeps DB volume)
+docker compose down -v       # stop and delete DB/uploads volumes
+```

be/docker-compose.yml

@@ -2,18 +2,56 @@ services:
   mysql:
     image: mysql:8
     container_name: qms-mysql
+    restart: unless-stopped
     ports:
-      - "3306:3306"
+      # Host port can be changed via MYSQL_HOST_PORT in .env (default 3306)
+      - "${MYSQL_HOST_PORT:-3306}:3306"
     environment:
-      MYSQL_ROOT_PASSWORD: password
-      MYSQL_DATABASE: qms
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-password}
+      MYSQL_DATABASE: ${MYSQL_DATABASE:-qms}
     volumes:
       - qms-mysql-data:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-ppassword"]
+      test: ["CMD", "mysqladmin", "ping", "-h", "localhost", "-p${MYSQL_ROOT_PASSWORD:-password}"]
       interval: 5s
       timeout: 5s
-      retries: 10
+      retries: 20
+      start_period: 20s
+    networks:
+      - qms-net
+
+  backend:
+    image: ${BACKEND_IMAGE:-qms-backend}:${IMAGE_TAG:-local}
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: qms-backend
+    restart: unless-stopped
+    ports:
+      # Host port can be changed via BACKEND_HOST_PORT in .env (default 8080)
+      - "${BACKEND_HOST_PORT:-8080}:8080"
+    environment:
+      SERVER_PORT: 8080
+      # Use Docker service name "mysql", not localhost
+      SPRING_DATASOURCE_URL: jdbc:mysql://mysql:3306/${MYSQL_DATABASE:-qms}?allowPublicKeyRetrieval=true&useSSL=false
+      SPRING_DATASOURCE_USERNAME: root
+      SPRING_DATASOURCE_PASSWORD: ${MYSQL_ROOT_PASSWORD:-password}
+      JWT_SECRET_KEY: ${JWT_SECRET_KEY:-a68uiaDQ0V3iLjF4DqMuS13GAVwkut55dlFbGCLyXTF}
+      ADS_UPLOAD_DIR: /app/uploads/ads
+      NOTIFICATIONS_MOCK: ${NOTIFICATIONS_MOCK:-true}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-dummy-google-client-id}
+    volumes:
+      - qms-uploads:/app/uploads
+    depends_on:
+      mysql:
+        condition: service_healthy
+    networks:
+      - qms-net
 
 volumes:
   qms-mysql-data:
+  qms-uploads:
+
+networks:
+  qms-net:
+    driver: bridge

be/src/main/resources/application.yml

@@ -1,3 +1,6 @@
+server:
+  port: ${SERVER_PORT:8080}
+
 spring:
   application:
     name: qms
@@ -6,9 +9,9 @@ spring:
     hibernate:
       ddl-auto: none
   datasource:
-    url: jdbc:mysql://localhost:3306/qms
-    username: root
-    password: password
+    url: ${SPRING_DATASOURCE_URL:jdbc:mysql://localhost:3306/qms}
+    username: ${SPRING_DATASOURCE_USERNAME}
+    password: ${SPRING_DATASOURCE_PASSWORD}
   servlet:
     multipart:
       max-file-size: 100MB
@@ -18,14 +21,14 @@ spring:
       client:
         registration:
           google:
-            client-id: dummy-google-client-id
+            client-id: ${GOOGLE_CLIENT_ID:dummy-google-client-id}
   flyway:
     schemas: qms
 
 jwt:
   header-title: Authorization
   token-prefix: Bearer
-  secret-key: a68uiaDQ0V3iLjF4DqMuS13GAVwkut55dlFbGCLyXTF
+  secret-key: ${JWT_SECRET_KEY}
   authorities-key: USER_AUTHORITIES
   token-validity-time: PT30M
 tfa:
@@ -35,6 +38,6 @@ tenancy:
   default-code: DFLT
 notifications:
   expo-url: https://exp.host/--/api/v2/push/send
-  mock: true
+  mock: ${NOTIFICATIONS_MOCK:true}
 ads:
-  upload-dir: uploads/ads
+  upload-dir: ${ADS_UPLOAD_DIR:uploads/ads}