130 lines
3.9 KiB
Markdown
130 lines
3.9 KiB
Markdown
# THECR3W-DEV — STRATEGIA I PROCEDURA WDROŻENIA PRODUKCYJNEGO
|
|
## Wersja: 1.0.0 | Data: 2026-10-31
|
|
|
|
---
|
|
|
|
## 1. Środowisko Docelowe (Potwierdzone w Audycie Stage 0)
|
|
|
|
- **Host:** Netcup VPS (Ubuntu 24.04.5 LTS, 15 GiB RAM, 476 GiB wolnego dysku NVMe).
|
|
- **Docker Network:** Zewnętrzna sieć `proxy` (wykorzystywana przez istniejący kontener `caddy:2`).
|
|
- **Lokalizacja Caddyfile:** `/opt/proxy/Caddyfile`.
|
|
- **Domeny wdrożeniowe:**
|
|
- `app.thecr3wnet.com` -> Native Update API (.NET Core)
|
|
- `download.thecr3wnet.com` -> The Cr3w Download Center (React + Nginx)
|
|
- `thecr3wnet.com` -> **POZOSTAJE NIENARUSZONA** (obsługiwana przez `app-app-1`). Zakaz tworzenia strony WWW.
|
|
|
|
---
|
|
|
|
## 2. Architektura Docker Compose (`infrastructure/docker/docker-compose.prod.yml`)
|
|
|
|
Usługi TheCr3w-dev zostaną zgrupowane w dedykowanym projekcie Docker Compose:
|
|
- `thecr3w-postgres` (Postgres 16 Alpine, sieć `thecr3w_internal`).
|
|
- `thecr3w-backend` (Native Update API & Deployment Control API, sieci `proxy` + `thecr3w_internal`).
|
|
- `thecr3w-download-center` (The Cr3w Download Center Frontend, sieć `proxy`).
|
|
- `thecr3w-agent` (Deployment Agent, kontrolowany dostęp do Docker engine).
|
|
|
|
```yaml
|
|
version: '3.8'
|
|
|
|
networks:
|
|
proxy:
|
|
external: true
|
|
thecr3w_internal:
|
|
driver: bridge
|
|
internal: true
|
|
|
|
volumes:
|
|
thecr3w_postgres_data:
|
|
driver: local
|
|
|
|
services:
|
|
thecr3w-postgres:
|
|
image: postgres:16-alpine
|
|
container_name: thecr3w-postgres
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_DB: thecr3w_db
|
|
POSTGRES_USER: thecr3w_user
|
|
POSTGRES_PASSWORD_FILE: /run/secrets/db_password
|
|
volumes:
|
|
- thecr3w_postgres_data:/var/lib/postgresql/data
|
|
- ../postgres/init:/docker-entrypoint-initdb.d:ro
|
|
networks:
|
|
- thecr3w_internal
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U thecr3w_user -d thecr3w_db"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
|
|
thecr3w-backend:
|
|
image: git.thecr3wnet.com/thecr3w/backend:latest # Docelowo @sha256:...
|
|
container_name: thecr3w-backend
|
|
restart: unless-stopped
|
|
depends_on:
|
|
thecr3w-postgres:
|
|
condition: service_healthy
|
|
environment:
|
|
ASPNETCORE_ENVIRONMENT: Production
|
|
ConnectionStrings__DefaultConnection: Host=thecr3w-postgres;Port=5432;Database=thecr3w_db;Username=thecr3w_user;PasswordFile=/run/secrets/db_password
|
|
Keycloak__Authority: https://login.thecr3wnet.com/realms/master
|
|
Keycloak__Audience: thecr3w-backend
|
|
R2__Endpoint: https://bf705752e38169fedb83efd5b747390e.r2.cloudflarestorage.com
|
|
R2__Bucket: thecr3w-app
|
|
R2__Region: auto
|
|
networks:
|
|
- proxy
|
|
- thecr3w_internal
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
|
|
thecr3w-download-center:
|
|
image: git.thecr3wnet.com/thecr3w/download-center:latest
|
|
container_name: thecr3w-download-center
|
|
restart: unless-stopped
|
|
networks:
|
|
- proxy
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:80/"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 3
|
|
```
|
|
|
|
---
|
|
|
|
## 3. Integracja z Caddyfile (`/opt/proxy/Caddyfile`)
|
|
|
|
Po uruchomieniu kontenerów do pliku `/opt/proxy/Caddyfile` dopisywane są wyłącznie nowe bloki domenowe:
|
|
|
|
```caddy
|
|
app.thecr3wnet.com {
|
|
reverse_proxy thecr3w-backend:5000 {
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Real-IP {remote_host}
|
|
}
|
|
}
|
|
|
|
download.thecr3wnet.com {
|
|
reverse_proxy thecr3w-download-center:80 {
|
|
header_up X-Forwarded-Proto {scheme}
|
|
header_up X-Real-IP {remote_host}
|
|
}
|
|
}
|
|
```
|
|
|
|
Procedura bezpiecznego załadowania Caddy:
|
|
```bash
|
|
# 1. Kopia zapasowa
|
|
cp /opt/proxy/Caddyfile /opt/proxy/Caddyfile.bak_$(date +%Y%m%d_%H%M%S)
|
|
|
|
# 2. Walidacja składni wewnątrz kontenera caddy
|
|
docker exec caddy caddy validate --config /etc/caddy/Caddyfile
|
|
|
|
# 3. Przeładowanie bez przestojów (Zero-downtime reload)
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
|
|
```
|
|
|