Change deployment

.github/workflows/main.yaml

@@ -8,24 +8,6 @@ env:
   DOMAIN: decla.red
 
 jobs:
-  build-ingress:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout current branch with lfs
-        uses: actions/checkout@main
-        with:
-          lfs: true
-
-      - name: Setup auth tokens
-        run: |
-          docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Build and push ingress
-        run: |
-          docker build . -t $CONTAINER_REGISTRY/declared-ingress
-          docker push $CONTAINER_REGISTRY/declared-ingress
-        working-directory: ingress
-
   build-frontend:
     runs-on: ubuntu-latest
     steps:
@@ -48,7 +30,6 @@ jobs:
     runs-on: ubuntu-latest
     needs:
       - build-frontend
-      - build-ingress
     steps:
       - name: Checkout current branch with lfs
         uses: actions/checkout@main
@@ -63,8 +44,7 @@ jobs:
           chmod 400 ~/.ssh/id_ed25519
           ssh -o StrictHostKeyChecking=no root@$DOMAIN uptime
 
-      - name: Stack up
+      - name: Stack deploy
         run: |
-          DOCKER_HOST=ssh://root@$DOMAIN docker login -u ${{ secrets.DOCKER_TOKEN }} -p ${{ secrets.DOCKER_TOKEN }} $CONTAINER_REGISTRY
+          DOCKER_HOST=ssh://root@$DOMAIN docker login -u ${{ secrets.DOCKER_TOKEN }} -p ${{ secrets.DOCKER_TOKEN }}
-          DOCKER_HOST=ssh://root@$DOMAIN docker stack up declared -c docker-compose.yml --with-registry-auth
+          DOCKER_HOST=ssh://root@$DOMAIN docker stack deploy declared -c docker-compose.yml --with-registry-auth
-        working-directory: infrastructure

docker-compose.yml

@@ -0,0 +1,31 @@
+version: "3.8"
+
+services:
+  declared-frontend:
+    init: true
+    image: schmelczera/declared-frontend
+    ports:
+      - "80"
+    networks:
+      - network
+    deploy:
+      replicas: 2
+      resources:
+        limits:
+          cpus: "0.1"
+          memory: 16M
+        reservations:
+          cpus: "0.1"
+          memory: 16M
+      update_config:
+        parallelism: 1
+        failure_action: rollback
+        delay: 10s
+        monitor: 10s
+      restart_policy:
+        condition: on-failure
+        window: 30s
+
+networks:
+  network:
+    driver: overlay

infrastructure/.env

@@ -1 +0,0 @@
-CONTAINER_REGISTRY=registry.digitalocean.com/declared

infrastructure/add-swarmpit.sh

@@ -1,7 +0,0 @@
-#!/bin/bash
-
-DOMAIN=swarmpit.decla.red
-NODE_ID=$(docker info -f '{{.Swarm.NodeID}}')
-docker node update --label-add swarmpit.db-data=true $NODE_ID
-docker node update --label-add swarmpit.influx-data=true $NODE_ID
-docker stack deploy -c docker-compose.swarmpit.yml swarmpit

infrastructure/docker-compose.swarmpit.yml

@@ -1,93 +0,0 @@
-version: "3.3"
-
-# source: https://raw.githubusercontent.com/swarmpit/swarmpit/master/docker-compose.yml
-
-services:
-  app:
-    image: swarmpit/swarmpit:latest
-    environment:
-      - SWARMPIT_DB=http://db:5984
-      - SWARMPIT_INFLUXDB=http://influxdb:8086
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    ports:
-      - "8080"
-    networks:
-      - network
-    deploy:
-      resources:
-        limits:
-          cpus: "0.15"
-          memory: 256M
-        reservations:
-          cpus: "0.15"
-          memory: 256M
-      placement:
-        constraints:
-          - node.role == manager
-
-  db:
-    image: couchdb:2.3.0
-    volumes:
-      - db-data:/opt/couchdb/data
-    networks:
-      - network
-    deploy:
-      resources:
-        limits:
-          cpus: "0.05"
-          memory: 64M
-        reservations:
-          cpus: "0.05"
-          memory: 64M
-      placement:
-        constraints:
-          - node.labels.swarmpit.db-data == true
-
-  influxdb:
-    image: influxdb:1.7
-    volumes:
-      - influx-data:/var/lib/influxdb
-    networks:
-      - network
-    deploy:
-      resources:
-        limits:
-          cpus: "0.05"
-          memory: 64M
-        reservations:
-          cpus: "0.05"
-          memory: 64M
-      placement:
-        constraints:
-          - node.labels.swarmpit.influx-data == true
-
-  agent:
-    image: swarmpit/agent:latest
-    environment:
-      - DOCKER_API_VERSION=1.35
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - network
-    deploy:
-      mode: global
-      labels:
-        swarmpit.agent: "true"
-      resources:
-        limits:
-          cpus: "0.10"
-          memory: 64M
-        reservations:
-          cpus: "0.05"
-          memory: 32M
-
-networks:
-  network:
-    driver: overlay
-
-volumes:
-  db-data:
-    driver: local
-  influx-data:
-    driver: local

infrastructure/docker-compose.yml

@@ -1,66 +0,0 @@
-version: "3.8"
-
-services:
-  ingress:
-    init: true
-    image: ${CONTAINER_REGISTRY}/declared-ingress
-    depends_on:
-      - frontend
-    networks:
-      - swarmpit_network
-      - network
-    deploy:
-      replicas: 2
-      resources:
-        limits:
-          cpus: "0.6"
-          memory: 32M
-        reservations:
-          cpus: "0.2"
-          memory: 32M
-      update_config:
-        parallelism: 1
-        failure_action: rollback
-        delay: 10s
-        monitor: 10s
-      restart_policy:
-        condition: on-failure
-        window: 30s
-    ports:
-      - "80:80"
-      - "443:443"
-    command: '/bin/sh -c ''while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"'''
-    volumes:
-      - /etc/letsencrypt:/etc/letsencrypt
-
-  frontend:
-    init: true
-    image: ${CONTAINER_REGISTRY}/declared-frontend
-    ports:
-      - "80"
-    networks:
-      - network
-    deploy:
-      replicas: 2
-      resources:
-        limits:
-          cpus: "0.1"
-          memory: 32M
-        reservations:
-          cpus: "0.1"
-          memory: 32M
-      update_config:
-        parallelism: 1
-        failure_action: rollback
-        delay: 10s
-        monitor: 10s
-      restart_policy:
-        condition: on-failure
-        window: 30s
-
-networks:
-  network:
-    driver: overlay
-
-  swarmpit_network:
-    external: true

infrastructure/init-letsencrypt.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-
-sudo apt-get install certbot python3-certbot-dns-digitalocean -y
-
-certbot certonly \
-  --dns-digitalocean \
-  --dns-digitalocean-credentials ~/digitalocean.api.key \
-  --dns-digitalocean-propagation-seconds 120 \
-  -m "schmelczerandras@gmail.com" \
-  -d "decla.red" -d "*.decla.red" \
-  --agree-tos --non-interactive
-
-curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "/etc/letsencrypt/options-ssl-nginx.conf"
-curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "/etc/letsencrypt/ssl-dhparams.pem"

infrastructure/init-remote-shared.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-
-echo Configuring iptables
-echo Start state
-iptables -L ufw-user-input
-
-iptables -D ufw-user-input 4
-iptables -D ufw-user-input 4
-iptables -I ufw-user-input -p tcp --dport 22 -j ACCEPT
-iptables -I ufw-user-input -p tcp --dport 80 -j ACCEPT
-iptables -I ufw-user-input -p tcp --dport 443 -j ACCEPT
-
-echo End state
-iptables -L ufw-user-input
-
-echo Updating system
-apt update              &&\
-apt upgrade -y          &&\
-apt install zsh         &&\
-sh -c "$(CHSH=yes curl -fsSL https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"
-
-docker login -u $DOCKER_TOKEN -p $DOCKER_TOKEN registry.digitalocean.com/declared
-
-echo Removing banner
-rm -rf /etc/update-motd.d/99-one-click
-
-docker swarm init --advertise-addr eth0
-
-./init-letsencrypt.sh
-curl https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bash
-docker-compose down

ingress/Dockerfile

@@ -1,14 +0,0 @@
-FROM schmelczera/error-pages as build-error-pages
-RUN python build.py 502
-
-FROM nginx:alpine
-
-WORKDIR /usr/share/nginx/html
-
-RUN rm -rf *
-
-COPY --from=build-error-pages /home/python/built errors
-RUN find . -type f | xargs gzip -k9     &&\
-  chmod -R 555 .
-
-COPY nginx-config /etc/nginx/

ingress/nginx-config/nginx.conf

@@ -1,58 +0,0 @@
-user  nginx;
-worker_processes  auto;
-
-error_log  /var/log/nginx/error.log warn;
-pid        /var/run/nginx.pid;
-
-events {
-    worker_connections  1024;
-}
-
-http {
-    include       /etc/nginx/mime.types;
-    default_type  application/octet-stream;
-
-    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
-                      '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
-
-    access_log  /var/log/nginx/access.log  main;
-
-    keepalive_timeout  65;
-
-    server {
-        listen 80;
-        server_name *.decla.red decla.red;
-        server_tokens off;
-
-        location / {
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    server {
-        server_name decla.red default_server;
-        
-        include /etc/nginx/ssl-server.conf;
-
-        location / {
-            proxy_pass  http://frontend;
-            proxy_set_header    Host                $http_host;
-            proxy_set_header    X-Real-IP           $remote_addr;
-            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
-        }
-    }
-
-    server {
-        server_name swarmpit.decla.red;
-        
-        include /etc/nginx/ssl-server.conf;
-
-        location / {
-            proxy_pass  http://app:8080;
-            proxy_set_header    Host                $http_host;
-            proxy_set_header    X-Real-IP           $remote_addr;
-            proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
-        }
-    }
-}

ingress/nginx-config/ssl-server.conf

@@ -1,17 +0,0 @@
-listen 443 ssl;
-
-server_tokens off;
-
-add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-
-ssl_certificate /etc/letsencrypt/live/decla.red/fullchain.pem;
-ssl_certificate_key /etc/letsencrypt/live/decla.red/privkey.pem;
-include /etc/letsencrypt/options-ssl-nginx.conf;
-ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
-
-location ~* ^/(502).html$ {
-    root /usr/share/nginx/html/errors;
-    internal;
-}
-
-error_page 502 /502.html;