Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
131 changes: 0 additions & 131 deletions .github/workflows/cicd.yml

This file was deleted.

62 changes: 62 additions & 0 deletions .github/workflows/deploy.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
name: Deploy to homeserver

on:
push:
branches: [dev]
paths:
- "src/**"
- "build.gradle"
- "settings.gradle"
- "gradle/**"
- "Dockerfile"
- ".github/workflows/deploy.yml"
workflow_dispatch:

concurrency:
group: deploy-homeserver-todaysound
cancel-in-progress: false

jobs:
deploy:
runs-on: [self-hosted, homeserver]
timeout-minutes: 25

env:
REPO_DIR: /Users/parkparkjihyeon/homeserver/services/todaysound/repo
APP_DIR: /Users/parkparkjihyeon/homeserver/services/todaysound

steps:
- name: Sync repo on host
run: |
cd "$REPO_DIR"
git fetch --all --prune
git reset --hard origin/dev

- name: Build backend image
run: |
cd "$APP_DIR"
DOCKER_BUILDKIT=1 docker compose build

- name: Roll out
run: |
cd "$APP_DIR"
docker compose up -d
docker image prune -f

- name: Smoke test (e2e via caddy with correct Host)
run: |
for i in 1 2 3 4 5 6 7 8 9 10; do
code=$(docker exec caddy wget -S -q -O- \
--header "Host: today-sound.com" \
http://localhost/actuator/health 2>&1 \
| awk '/HTTP\//{print $2; exit}')
if [ "$code" = "200" ] || [ "$code" = "401" ] || [ "$code" = "403" ]; then
echo "Backend OK ($code)"
exit 0
fi
echo "Retry $i (code=$code)..."
sleep 6
done
echo "Backend healthcheck failed"
docker logs todaysound-server --tail 100 || true
exit 1
15 changes: 10 additions & 5 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -1,10 +1,15 @@
FROM eclipse-temurin:17-jre

WORKDIR /app
# syntax=docker/dockerfile:1.7

COPY build/libs/*SNAPSHOT*.jar /app/app.jar
FROM eclipse-temurin:17-jdk AS build
WORKDIR /src
COPY . .
RUN --mount=type=cache,target=/root/.gradle \
chmod +x gradlew && \
./gradlew --no-daemon clean bootJar -x test -x asciidoctor

FROM eclipse-temurin:17-jre
WORKDIR /app
COPY --from=build /src/build/libs/*SNAPSHOT*.jar /app/app.jar
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

*SNAPSHOT*.jar 와일드카드는 프로젝트 버전이 SNAPSHOT이 아니게 변경될 경우(예: 정식 릴리스 시) 빌드 실패를 유발합니다. 유지보수성을 위해 *.jar와 같이 더 유연한 패턴을 사용하거나, build.gradle에서 archiveFileName을 고정하여 사용하는 것이 안전합니다. (단, *.jar 사용 시 빌드 결과물 디렉토리에 단일 JAR만 존재해야 합니다.)

COPY --from=build /src/build/libs/*.jar /app/app.jar

ENV SPRING_PROFILES_ACTIVE=prod
EXPOSE 8080

ENTRYPOINT ["java","-jar","/app/app.jar"]
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

보안상 애플리케이션을 root 사용자로 실행하는 것은 권장되지 않습니다. 컨테이너 내부에 비특권 사용자(non-root user)를 생성하고 USER 명령어를 사용하여 실행 권한을 제한함으로써, 잠재적인 보안 위협(컨테이너 탈출 등) 발생 시 피해 범위를 최소화할 수 있습니다.

Loading