cbe6326284
Some checks failed
Auto Tag Develop / tag (push) Has been cancelled
- infra/prod/nginx-proxy.conf: reverse proxy with maintenance file check - Updated deployment doc with maintenance mode instructions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
315 lines
7.4 KiB
Markdown
315 lines
7.4 KiB
Markdown
# Deploiement Docker — Coltura
|
|
|
|
## Pre-requis
|
|
|
|
### Docker
|
|
|
|
```bash
|
|
# Ubuntu
|
|
sudo apt update
|
|
sudo apt install -y ca-certificates curl gnupg
|
|
sudo install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
|
|
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
|
|
sudo apt update
|
|
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin
|
|
sudo usermod -aG docker $USER
|
|
```
|
|
|
|
Se deconnecter/reconnecter pour que le groupe `docker` prenne effet.
|
|
|
|
### Nginx
|
|
|
|
```bash
|
|
sudo apt install -y nginx
|
|
sudo systemctl enable nginx
|
|
sudo systemctl start nginx
|
|
```
|
|
|
|
### PostgreSQL
|
|
|
|
PostgreSQL tourne dans un conteneur Docker separe (voir le repo `infra-postgres`).
|
|
Il doit etre installe et accessible avant de deployer Coltura.
|
|
|
|
Creer la base de donnees pour Coltura :
|
|
|
|
```bash
|
|
cd /var/www/postgres
|
|
docker compose exec postgres psql -U admin
|
|
```
|
|
|
|
```sql
|
|
-- Si le user n'existe pas encore
|
|
CREATE USER malio WITH PASSWORD 'motdepasse';
|
|
|
|
-- Creer la base
|
|
CREATE DATABASE coltura_prod OWNER malio;
|
|
\q
|
|
```
|
|
|
|
---
|
|
|
|
## Premiere installation (nouvelle machine)
|
|
|
|
Guide complet pour mettre en ligne Coltura sur une machine vierge. Inclut les pre-requis, la BDD et l'app.
|
|
|
|
### 1. Installer les pre-requis
|
|
|
|
Installer Docker, Nginx et PostgreSQL (voir section Pre-requis ci-dessus).
|
|
|
|
### 2. Creer le dossier de deploiement
|
|
|
|
```bash
|
|
sudo mkdir -p /var/www/coltura
|
|
sudo chown -R $(whoami):$(whoami) /var/www/coltura
|
|
cd /var/www/coltura
|
|
```
|
|
|
|
### 3. Se connecter au registry Docker de Gitea
|
|
|
|
```bash
|
|
docker login gitea.malio.fr
|
|
```
|
|
|
|
- **Username** : le nom d'utilisateur du compte organisation Gitea `MALIO`
|
|
- **Password** : le token REGISTRY_TOKEN dispo dans le bitwarden
|
|
|
|
Le login est sauvegarde dans `~/.docker/config.json`, pas besoin de le refaire a chaque deploiement.
|
|
|
|
### 4. Creer les fichiers de deploiement
|
|
|
|
Creer `docker-compose.yml` :
|
|
|
|
```yaml
|
|
services:
|
|
app:
|
|
image: gitea.malio.fr/malio-dev/coltura:${COLTURA_IMAGE_TAG:-latest}
|
|
container_name: coltura-app
|
|
env_file: .env
|
|
ports:
|
|
- "8083:80"
|
|
volumes:
|
|
- ./config/jwt:/var/www/html/config/jwt:ro
|
|
- ./uploads:/var/www/html/var/uploads
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
restart: unless-stopped
|
|
```
|
|
|
|
Creer `deploy.sh` :
|
|
|
|
```bash
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
|
|
TAG="${1:-latest}"
|
|
export COLTURA_IMAGE_TAG="$TAG"
|
|
|
|
echo "==> Deploying coltura:${TAG}..."
|
|
|
|
echo "==> Pulling image..."
|
|
docker compose pull
|
|
|
|
echo "==> Starting container..."
|
|
docker compose up -d
|
|
|
|
echo "==> Waiting for container to be ready..."
|
|
sleep 3
|
|
|
|
echo "==> Running migrations..."
|
|
docker compose exec -T -u www-data app php bin/console doctrine:migrations:migrate --no-interaction
|
|
|
|
echo "==> Clearing cache..."
|
|
docker compose exec -T -u www-data app php bin/console cache:clear --env=prod
|
|
docker compose exec -T -u www-data app php bin/console cache:warmup --env=prod
|
|
|
|
VERSION=$(docker compose exec -T app cat config/version.yaml | grep 'app.version' | awk -F"'" '{print $2}')
|
|
echo "==> Deployed v${VERSION}"
|
|
```
|
|
|
|
Rendre executable :
|
|
|
|
```bash
|
|
chmod +x deploy.sh
|
|
```
|
|
|
|
### 5. Configurer l'environnement
|
|
|
|
Creer `.env` avec les variables suivantes :
|
|
|
|
```env
|
|
# Symfony
|
|
APP_ENV=prod
|
|
APP_DEBUG=0
|
|
APP_SECRET=<generer avec: openssl rand -hex 32>
|
|
|
|
# Database (host.docker.internal = la machine hote, ou le PG tourne en Docker)
|
|
DATABASE_URL="postgresql://malio:password@host.docker.internal:5432/coltura_prod?serverVersion=16&charset=utf8"
|
|
|
|
# JWT
|
|
JWT_SECRET_KEY=%kernel.project_dir%/config/jwt/private.pem
|
|
JWT_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.pem
|
|
JWT_PASSPHRASE=<generer avec: openssl rand -hex 32>
|
|
JWT_COOKIE_SECURE=1
|
|
JWT_COOKIE_SAMESITE=lax
|
|
JWT_TOKEN_TTL=86400
|
|
JWT_COOKIE_TTL=86400
|
|
|
|
# CORS
|
|
CORS_ALLOW_ORIGIN='^https?://coltura\.malio-dev\.fr$'
|
|
|
|
# App
|
|
DEFAULT_URI=https://coltura.malio-dev.fr
|
|
```
|
|
|
|
### 6. Generer les cles JWT
|
|
|
|
```bash
|
|
mkdir -p config/jwt
|
|
openssl genpkey -algorithm RSA -out config/jwt/private.pem -pkeyopt rsa_keygen_bits:4096
|
|
openssl rsa -pubout -in config/jwt/private.pem -out config/jwt/public.pem
|
|
```
|
|
|
|
Rendre les cles lisibles par le conteneur (www-data = uid 33) :
|
|
|
|
```bash
|
|
sudo chown 33:33 config/jwt/private.pem config/jwt/public.pem
|
|
sudo chmod 644 config/jwt/private.pem config/jwt/public.pem
|
|
```
|
|
|
|
### 7. Creer le dossier uploads
|
|
|
|
```bash
|
|
mkdir -p uploads
|
|
```
|
|
|
|
### 8. Configurer Nginx systeme (reverse proxy + maintenance)
|
|
|
|
Copier la config reverse proxy depuis le repo :
|
|
|
|
```bash
|
|
sudo cp infra/prod/nginx-proxy.conf /etc/nginx/sites-available/coltura.conf
|
|
```
|
|
|
|
Ou creer `/etc/nginx/sites-available/coltura.conf` manuellement (voir `infra/prod/nginx-proxy.conf`).
|
|
|
|
La config inclut le **mode maintenance** : si le fichier `/var/www/coltura/maintenance.on` existe, Nginx renvoie une 503 avec `maintenance.html`.
|
|
|
|
Activer le site :
|
|
|
|
```bash
|
|
sudo ln -sf /etc/nginx/sites-available/coltura.conf /etc/nginx/sites-enabled/coltura.conf
|
|
sudo nginx -t && sudo systemctl reload nginx
|
|
```
|
|
|
|
### Mode maintenance
|
|
|
|
```bash
|
|
# Activer la maintenance
|
|
touch /var/www/coltura/maintenance.on
|
|
|
|
# Desactiver la maintenance
|
|
rm /var/www/coltura/maintenance.on
|
|
```
|
|
|
|
Optionnel : creer une page `/var/www/coltura/public/maintenance.html` personnalisee.
|
|
|
|
### 9. Deployer
|
|
|
|
```bash
|
|
./deploy.sh
|
|
```
|
|
|
|
### 10. Creer le premier user admin
|
|
|
|
```bash
|
|
docker compose exec -T -u www-data app php bin/console security:hash-password --env=prod
|
|
```
|
|
|
|
Choisir `App\Entity\User`, taper le mdp, copier le hash. Puis :
|
|
|
|
```bash
|
|
cd /var/www/postgres
|
|
docker compose exec -T postgres psql -U malio coltura_prod -c "INSERT INTO \"user\" (username, roles, password, created_at) VALUES ('admin', '[\"ROLE_ADMIN\"]', '<le-hash>', NOW());"
|
|
```
|
|
|
|
Ou charger les fixtures (dev uniquement) :
|
|
|
|
```bash
|
|
docker compose exec -T -u www-data app php bin/console doctrine:fixtures:load --no-interaction --env=prod
|
|
```
|
|
|
|
### Structure finale du dossier
|
|
|
|
```
|
|
/var/www/coltura/
|
|
├── docker-compose.yml
|
|
├── deploy.sh
|
|
├── .env
|
|
├── config/jwt/
|
|
│ ├── private.pem
|
|
│ └── public.pem
|
|
└── uploads/
|
|
```
|
|
|
|
---
|
|
|
|
## Deployer une nouvelle version
|
|
|
|
Quand l'app est deja installee, deployer une mise a jour :
|
|
|
|
```bash
|
|
cd /var/www/coltura
|
|
./deploy.sh # deploie la derniere version (latest)
|
|
./deploy.sh v0.2.0 # deploie une version specifique
|
|
```
|
|
|
|
C'est tout. Le script pull l'image, redemarre le conteneur, lance les migrations et vide le cache.
|
|
|
|
---
|
|
|
|
## Rollback
|
|
|
|
### Image seule (pas de changement de schema BDD)
|
|
|
|
```bash
|
|
./deploy.sh v0.1.9
|
|
```
|
|
|
|
### Avec rollback de migration
|
|
|
|
```bash
|
|
# 1. Rollback schema (pendant que la version actuelle tourne encore)
|
|
docker compose exec -T -u www-data app php bin/console doctrine:migrations:migrate prev --no-interaction
|
|
# 2. Deployer l'ancienne version
|
|
./deploy.sh v0.1.9
|
|
```
|
|
|
|
---
|
|
|
|
## CI/CD
|
|
|
|
Le workflow `.gitea/workflows/build-docker.yml` se declenche automatiquement sur push de tag `v*` :
|
|
1. Build l'image multi-stage
|
|
2. Push vers `gitea.malio.fr/malio-dev/coltura:<tag>` et `:latest`
|
|
|
|
Combine avec `auto-tag-develop.yml`, chaque push sur `develop` cree automatiquement un tag → build → image disponible.
|
|
|
|
---
|
|
|
|
## Voir les logs
|
|
|
|
```bash
|
|
cd /var/www/coltura
|
|
docker compose logs -f # tous les logs
|
|
docker compose logs -f --tail=100 # 100 dernieres lignes
|
|
```
|
|
|
|
Logs Symfony :
|
|
|
|
```bash
|
|
docker compose exec app cat var/log/prod.log
|
|
```
|