Ready for NixOS builds
This commit is contained in:
NeilClack
@@ -0,0 +1,37 @@
|
||||
name: Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: self-hosted
|
||||
defaults:
|
||||
run:
|
||||
working-directory: /mnt/volume_nyc3_01/Portal.RhemaWaveTech.com
|
||||
steps:
|
||||
- name: Pull latest changes
|
||||
run: git pull
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Run migrations
|
||||
run: |
|
||||
set -a
|
||||
source .env
|
||||
set +a
|
||||
npx prisma migrate deploy
|
||||
|
||||
- name: Build app
|
||||
run: |
|
||||
export DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy"
|
||||
export BETTER_AUTH_SECRET="build-time-placeholder-not-used"
|
||||
npm run build
|
||||
|
||||
- name: Install production dependencies
|
||||
run: npm ci --omit=dev
|
||||
|
||||
- name: Restart portal
|
||||
run: sudo systemctl restart portal
|
||||
@@ -1,39 +0,0 @@
|
||||
# .github/workflows/deploy.yml
|
||||
name: Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: self-hosted
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
- name: Run migrations
|
||||
run: |
|
||||
set -a
|
||||
source /mnt/volume_nyc3_01/Portal/.env
|
||||
set +a
|
||||
export DO_CA_CERTIFICATE=/etc/ssl/certs/do-ca-certificate.crt
|
||||
npx prisma migrate deploy
|
||||
|
||||
- name: Build image
|
||||
run: podman build -t portal:latest .
|
||||
|
||||
- name: Stop old container
|
||||
run: podman stop portal || true && podman rm portal || true
|
||||
|
||||
- name: Start new container
|
||||
run: |
|
||||
podman run -d --name portal \
|
||||
--replace \
|
||||
--restart=always \
|
||||
--network=host \
|
||||
-v /mnt/volume_nyc3_01/Portal/.env:/app/.env:ro \
|
||||
-v /etc/ssl/certs/do-ca-certificate.crt:/etc/ssl/certs/do-ca-certificate.crt:ro \
|
||||
portal:latest
|
||||
Vendored
-5
@@ -1,5 +0,0 @@
|
||||
{
|
||||
"files.associations": {
|
||||
"*.css": "tailwindcss"
|
||||
}
|
||||
}
|
||||
@@ -71,10 +71,13 @@ Global config: `expect: { requireAssertions: true }`.
|
||||
|
||||
## Deployment
|
||||
|
||||
- Containerized via Dockerfile (multi-stage, Node 22 Alpine)
|
||||
- CI/CD: GitHub Actions on push to `main` → Podman build → deploy with `--network=host`
|
||||
- Hosted on DigitalOcean (managed PostgreSQL with SSL, self-hosted runner)
|
||||
- Production `.env` mounted from `/mnt/volume_nyc3_01/Portal/.env`
|
||||
- **Server infrastructure:** NixOS, configured declaratively in the `Webserver-Infra` repo
|
||||
- **Secrets:** Managed via `sops-nix` (no plaintext `.env` files on the server)
|
||||
- **CI/CD:** Forgejo Actions on push to `main` → `npm ci` → migrate → build → rsync to `/var/lib/portal/current/` → restart
|
||||
- **Hosting:** DigitalOcean droplet (NixOS), managed PostgreSQL with SSL, self-hosted Forgejo runner
|
||||
- **Portal path:** `/var/lib/portal/current` (deployed by CI, owned by `portal` user)
|
||||
- **Reverse proxy:** Caddy with automatic HTTPS at `rhemawavetech.com`
|
||||
- **Logs:** `journalctl -u portal -f`
|
||||
|
||||
## Environment Variables
|
||||
|
||||
|
||||
-32
@@ -1,32 +0,0 @@
|
||||
FROM node:22-alpine AS builder
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Install dependencies first (better layer caching)
|
||||
COPY package.json package-lock.json ./
|
||||
RUN npm ci
|
||||
|
||||
# Copy source and build
|
||||
COPY . .
|
||||
ENV DATABASE_URL="postgresql://dummy:dummy@localhost:5432/dummy"
|
||||
ENV BETTER_AUTH_SECRET="build-time-placeholder-not-used"
|
||||
RUN npm run build
|
||||
|
||||
# Production image
|
||||
FROM node:22-alpine
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Only copy what we need for production
|
||||
COPY --from=builder /app/build ./build
|
||||
COPY --from=builder /app/package.json ./
|
||||
COPY --from=builder /app/package-lock.json ./
|
||||
|
||||
# Install production dependencies only (including dotenv)
|
||||
RUN npm ci --omit=dev
|
||||
|
||||
ENV HOST=0.0.0.0
|
||||
ENV PORT=3001
|
||||
EXPOSE 3001
|
||||
|
||||
CMD ["node", "-r", "dotenv/config", "build"]
|
||||
@@ -0,0 +1,12 @@
|
||||
Initial Setup:
|
||||
1. Add the portal flake input to Webserver-Infra/flake.nix with a Forgejo access token.
|
||||
- Does this need to be in just the inputs, or the outputs as well? I'm still very much learning nix and these things get confusing.
|
||||
2. Add services.portal.enable = true; to Webserver-Infra/configuration.nix
|
||||
3. Remove the existing users.users.portal and groups because they exist in this flake now
|
||||
4. Clone the repo on the server, place the .env, build, then run nixos-rebuild switch. This is mainly to start the service, I presume. The build is just so that the service has something to
|
||||
start.
|
||||
|
||||
To update:
|
||||
1. git pull
|
||||
2. Apply shell-instance environment variables for placeholder values to then run `npm ci && npm run build && npm ci --omit=dev`
|
||||
3. Restart the systemctl service (portal.service) to pickup the changes because the service is in charge of the `node build` command.
|
||||
Generated
+27
@@ -0,0 +1,27 @@
|
||||
{
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1772956932,
|
||||
"narHash": "sha256-M0yS4AafhKxPPmOHGqIV0iKxgNO8bHDWdl1kOwGBwRY=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "608d0cadfed240589a7eea422407a547ad626a14",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
description = "RhemaWave Portal";
|
||||
|
||||
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
||||
|
||||
outputs = { self, nixpkgs }: {
|
||||
nixosModules.default = import ./nixos/module.nix;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.services.portal;
|
||||
in
|
||||
{
|
||||
options.services.portal = {
|
||||
enable = lib.mkEnableOption "RhemaWave Portal";
|
||||
|
||||
directory = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/mnt/volume_nyc3_01/Portal.RhemaWaveTech.com";
|
||||
description = "Path to the Portal git clone.";
|
||||
};
|
||||
|
||||
envFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "${cfg.directory}/.env";
|
||||
defaultText = lib.literalExpression ''"''${cfg.directory}/.env"'';
|
||||
description = "Path to the .env file containing secrets.";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3001;
|
||||
description = "Port the Portal listens on.";
|
||||
};
|
||||
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "0.0.0.0";
|
||||
description = "Host address the Portal binds to.";
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.portal = {
|
||||
isSystemUser = true;
|
||||
group = "portal";
|
||||
home = cfg.directory;
|
||||
};
|
||||
|
||||
users.groups.portal = { };
|
||||
|
||||
systemd.services.portal = {
|
||||
description = "RhemaWave Portal";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = "portal";
|
||||
Group = "portal";
|
||||
WorkingDirectory = cfg.directory;
|
||||
EnvironmentFile = cfg.envFile;
|
||||
ExecStart = "${pkgs.nodejs_22}/bin/node build";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 5;
|
||||
};
|
||||
|
||||
environment = {
|
||||
HOST = cfg.host;
|
||||
PORT = toString cfg.port;
|
||||
DO_CA_CERTIFICATE = "/var/lib/portal/do-ca-certificate.crt";
|
||||
NODE_ENV = "production";
|
||||
};
|
||||
};
|
||||
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "forgejo-runner" ];
|
||||
commands = [
|
||||
{
|
||||
command = "/run/current-system/sw/bin/systemctl restart portal";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user