chore(deploy): gcp

2024-01-01 02:49:38 +08:00 · 2024-01-01 02:49:38 +08:00 · 056268fa9d
parent 8b8135c222
commit 056268fa9d
6 changed files with 49 additions and 225 deletions
--- a/.github/workflows/docker-build-push-dev.yml
+++ b/.github/workflows/docker-build-push-dev.yml
@ -25,9 +25,10 @@ jobs:
        id: meta
        uses: docker/metadata-action@v5
        with:
-          images: ${{ env.IMAGE_NAME }}
+          images: rss3/xlog
          tags: |
            type=sha,prefix={{branch}}-
+            type=sha,format=long,prefix={{branch}}-
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to DockerHub
@ -53,25 +54,32 @@ jobs:
            "NEXT_PUBLIC_IPFS_GATEWAY=${{ vars.NEXT_PUBLIC_IPFS_GATEWAY }}"

  deploy-dev:
-    runs-on: ubuntu-latest
-    environment: Preview
-    needs: build
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Set K8s context
-        uses: aliyun/ack-set-context@v1
-        with:
-          access-key-id: "${{ secrets.ACCESS_KEY_ID }}"
-          access-key-secret: "${{ secrets.ACCESS_KEY_SECRET }}"
-          cluster-id: "${{ env.ACK_CLUSTER_ID }}"
-      - run: |
-          wget https://github.com/mikefarah/yq/releases/download/v4.25.1/yq_linux_amd64.tar.gz -O - | tar xz && mv yq_linux_amd64 /usr/local/bin/yq
-          curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.22.10/bin/linux/amd64/kubectl && chmod +x kubectl && mv kubectl /usr/local/bin/kubectl
-      - uses: sljeff/secrets2env@main
-        with:
-          secrets-json: ${{ toJson(secrets) }}
-      - env:
-          IMAGE_TAG_RELEASE: ${{ env.IMAGE_NAME }}:${{ needs.build.outputs.version }}
-        run: |
-          sh apply.sh deploy/dev/*
+    if: github.ref == 'refs/heads/dev'
+    uses: NaturalSelectionLabs/Daedalus/.github/workflows/deploy-v3-tpl.yaml@main
+    needs:
+      - build
+    with:
+      images: rss3/xlog
+      tag: dev-${{ github.sha }}
+      cluster: dev
+      namespace: crossbell
+      releaseName: xlog
+      revision: main
+      dir: deploy/dev
+    secrets:
+      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
+  deploy-prod:
+    if: github.ref == 'refs/heads/main'
+    uses: NaturalSelectionLabs/Daedalus/.github/workflows/deploy-v3-tpl.yaml@main
+    needs:
+      - build
+    with:
+      images: rss3/xlog
+      tag: main-${{ github.sha }}
+      cluster: prod
+      namespace: crossbell
+      releaseName: xlog
+      revision: main
+      dir: deploy/prod
+    secrets:
+      GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
--- a/deploy/dev/cm.yaml
+++ b/deploy/dev/cm.yaml
@ -1,90 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: xlog-caddy
-  namespace: crossbell
-data:
-  Caddyfile: |
-    {
-      storage redis {
-      }
-
-      on_demand_tls {
-        ask http://localhost:5000/
-      }
-    }
-
-    xlog.page, *.xlog.page {
-      tls jeff@rss3.io {
-        dns cloudflare {env.CF_API_TOKEN}
-      }
-
-      reverse_proxy xlog-internal.crossbell.svc:3000 {
-        header_up x-forwarded-proto http
-        header_up X-Real-IP {remote_host}
-        header_up X-Forwarded-For {remote_host}
-      }
-    }
-
-    :8080 {
-      metrics
-    }
-
-    :80, :443 {
-      tls jeff@rss3.io {
-        on_demand
-      }
-
-      reverse_proxy xlog-internal.crossbell.svc:3000 {
-        header_up x-forwarded-proto http
-        header_up X-Real-IP {remote_host}
-        header_up X-Forwarded-For {remote_host}
-      }
-    }
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: xlog-caddy-validator
-  namespace: crossbell
-data:
-  app.py: |
-    import requests
-    from flask import Flask, request, Response
-
-    app = Flask(__name__)
-
-
-    @app.route("/")
-    def check_domain():
-        domain = request.args.get("domain")
-        if not domain:
-            return Response(status=404)
-        if domain.endswith('.xlog.page') or domain == "xlog.page":
-            return Response(status=200)
-
-        # get TXT
-        res = requests.get("https://cloudflare-dns.com/dns-query", params={
-            "name": f"_xlog-challenge.{domain}",
-            "type": "TXT",
-        }, headers={"Accept": "application/dns-json"})
-        if res.status_code != 200:
-            return Response(status=res.status_code)
-        answer = res.json().get("Answer") or [{}]
-        tenant = answer[0].get("data", "").replace('"', "")
-        if not tenant:
-            return Response(status=404)
-
-        # check crossbell
-        res = requests.get(f"https://indexer.crossbell.io/v1/handles/{tenant}/character")
-        if res.status_code != 200:
-            return Response(status=404)
-        attributes = res.json().get("metadata", {}).get("content", {}).get("attributes", [])
-        for d in attributes:
-            if d.get("trait_type") == "xlog_custom_domain":
-                print(d)
-                xlog_custom_domain = d.get("value", "").lower()
-                if xlog_custom_domain == domain:
-                    return Response(status=200)
-
-        return Response(status=404)
--- a/deploy/dev/deploy.yaml
+++ b/deploy/dev/deploy.yaml
@ -26,7 +26,7 @@ spec:
    spec:
      enableServiceLinks: false
      initContainers:
-        - image: $IMAGE_TAG_RELEASE
+        - image: rss3/xlog
          envFrom:
            - secretRef:
                name: xlog
@ -35,7 +35,7 @@ spec:
          command: ["/bin/sh", "-c"]
          args: ["npm install -g prisma; npm run prisma:migrate:deploy"]
      containers:
-        - image: $IMAGE_TAG_RELEASE
+        - image: rss3/xlog
          imagePullPolicy: Always
          name: xlog
          args:
@ -74,66 +74,3 @@ spec:
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: xlog-caddy
-  namespace: crossbell
-spec:
-  selector:
-    matchLabels:
-      app: xlog-caddy
-  template:
-    metadata:
-      labels:
-        app: xlog-caddy
-    spec:
-      containers:
-        - name: caddy
-          image: kindjeff/caddy-tlsredis-docker
-          imagePullPolicy: Always
-          command: ["caddy", "run", "-config", "/app/Caddyfile"]
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 100m
-              memory: 128Mi
-          envFrom:
-            - secretRef:
-                name: xlog-caddy
-          ports:
-            - containerPort: 80
-              name: http
-            - containerPort: 443
-              name: https
-          volumeMounts:
-            - name: caddyfile
-              mountPath: /app
-        - name: caddy-validator
-          image: python
-          command: ["/bin/sh", "-c"]
-          args: ["pip install flask requests; flask --app=app run"]
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 100m
-              memory: 128Mi
-          ports:
-            - containerPort: 5000
-              name: http
-          volumeMounts:
-            - name: validator
-              mountPath: /app.py
-              subPath: app.py
-      volumes:
-        - name: caddyfile
-          configMap:
-            name: xlog-caddy
-        - name: validator
-          configMap:
-            name: xlog-caddy-validator
--- a/deploy/dev/kustomization.yaml
+++ b/deploy/dev/kustomization.yaml
@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deploy.yaml
+  - secret.yaml
+  - svc.yaml
--- a/deploy/dev/secrets.yaml
+++ b/deploy/dev/secrets.yaml
@ -1,28 +1,16 @@
 # Remember to add it in env.production because it is the nextjs project
 apiVersion: v1
 stringData:
-  REDIS_URL: ${REDIS_URL_DEV}
-  DATABASE_URL: ${PG_CONN_STRING_DEV}
-  SIMPLEHASH_API_KEY: ${SIMPLEHASH_API_KEY}
-  OPENAI_API_KEY: ${OPENAI_API_KEY}
-  ANONYMOUS_ACCOUNT_PRIVATEKEY: ${ANONYMOUS_ACCOUNT_PRIVATEKEY}
-  PORTFOLIO_GITHUB_TOKEN: ${PORTFOLIO_GITHUB_TOKEN}
+  REDIS_URL: <REDIS_URL>
+  DATABASE_URL: <DATABASE_URL>
+  SIMPLEHASH_API_KEY: <SIMPLEHASH_API_KEY>
+  OPENAI_API_KEY: <OPENAI_API_KEY>
+  ANONYMOUS_ACCOUNT_PRIVATEKEY: <ANONYMOUS_ACCOUNT_PRIVATEKEY>
+  PORTFOLIO_GITHUB_TOKEN: <PORTFOLIO_GITHUB_TOKEN>
 kind: Secret
 metadata:
  name: xlog
  namespace: crossbell
-type: Opaque
---
-apiVersion: v1
-stringData:
-  CADDY_CLUSTERING_REDIS_HOST: ${CADDY_CLUSTERING_REDIS_HOST_DEV}
-  CADDY_CLUSTERING_REDIS_PORT: "6379"
-  CADDY_CLUSTERING_REDIS_USERNAME: ""
-  CADDY_CLUSTERING_REDIS_PASSWORD: ${CADDY_CLUSTERING_REDIS_PASSWORD_DEV}
-  CADDY_CLUSTERING_REDIS_DB: "6"
-  CF_API_TOKEN: ${CF_API_TOKEN}
-kind: Secret
-metadata:
-  name: xlog-caddy
-  namespace: crossbell
+  annotations:
+    avp.kubernetes.io/path: "kv/data/crossbell/xlog-caddy"
 type: Opaque
--- a/deploy/dev/svc.yaml
+++ b/deploy/dev/svc.yaml
@ -1,31 +1,5 @@
 apiVersion: v1
 kind: Service
-metadata:
-  name: xlog-lb
-  namespace: crossbell
-  annotations:
-    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-name: "xlog-dev"
-    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec: "slb.s1.small"
-    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-id: acl-7go649a51gt3cw7qgsvls
-    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-status: "on"
-    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-acl-type: black
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: Local
-  selector:
-    app: xlog-caddy
-  ports:
-    - name: http
-      protocol: TCP
-      port: 80
-      targetPort: 80
-    - name: https
-      protocol: TCP
-      port: 443
-      targetPort: 443
---
-apiVersion: v1
-kind: Service
 metadata:
  name: xlog-internal
  namespace: crossbell
@ -36,5 +10,5 @@ spec:
  ports:
    - name: http
      protocol: TCP
-      port: 3000
+      port: 80
      targetPort: 3000