ci: setup Dockerfile, GitLab CI pipeline, and Helm chart for Rancher

.gitlab-ci asli ok.yml

@@ -0,0 +1,151 @@
+stages:
+  - build
+  - deploy
+
+variables:
+  GIT_STRATEGY: none
+  IMAGE: 10.15.39.186:8083/eosbpkd/sidata
+  TAG: $CI_COMMIT_SHORT_SHA
+  KUBE_NAMESPACE: sidata-prod
+  HELM_RELEASE: sidata
+  BUILDAH_ISOLATION: "chroot"
+  STORAGE_DRIVER: "vfs"
+  
+  http_proxy: "http://10.15.3.20:80"
+  https_proxy: "http://10.15.3.20:80"
+  HTTP_PROXY: "http://10.15.3.20:80"
+  HTTPS_PROXY: "http://10.15.3.20:80"
+  no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+  NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+
+# =========================================================
+# BUILD IMAGE VIA BUILDAH
+# =========================================================
+build:
+  stage: build
+  image: 10.15.39.186:8083/buildah:stable
+  tags:
+    - skpp
+  before_script:
+    - echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
+    - git config --global http.sslVerify false
+    - git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
+    - git checkout $CI_COMMIT_SHA
+  script:
+    - echo '1. MENERAPKAN PENGATURAN REGISTRY'
+    - mkdir -p ~/.config/containers
+    - |
+      cat <<EOF > ~/.config/containers/registries.conf
+      unqualified-search-registries = ["docker.io", "10.15.39.186:8084"]
+
+      [[registry]]
+      location = "10.15.39.186:8083"
+      insecure = true
+
+      [[registry]]
+      location = "10.15.39.186:8084"
+      insecure = true
+
+      [[registry]]
+      location = "docker.io"
+      insecure = false
+      EOF
+    
+    - echo '2. LOGIN TO NEXUS REGISTRY'
+    - echo "$NEXUS_PASSWORD" | buildah login --tls-verify=false -u "$NEXUS_USERNAME" --password-stdin 10.15.39.186:8083
+    
+    - echo '3. STARTING BUILDAH BUILD'
+    - buildah bud --tls-verify=false --storage-driver=vfs --isolation=chroot --build-arg http_proxy=$http_proxy --build-arg https_proxy=$https_proxy -t $IMAGE:$TAG -t $IMAGE:latest .
+    
+    - echo '4. PUSHING TO NEXUS'
+    - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:$TAG
+    - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:latest
+
+# =========================================================
+# DEPLOY VIA HELM & KUBECTL
+# =========================================================
+deploy:
+  stage: deploy
+  image:
+    name: alpine/k8s:1.29.1
+    entrypoint: [""]
+  tags:
+    - skpp
+  before_script:
+    - echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
+    - git config --global http.sslVerify false
+    - git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
+    - git checkout $CI_COMMIT_SHA
+  script:
+    - echo '1. SETUP KUBECONFIG LOKAL & BYPASS PROXY'
+    - unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
+    - export NO_PROXY="*"
+    - export no_proxy="*"
+    - mkdir -p ./kubeconfig-dir
+    - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
+    - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
+    - chmod 600 ./kubeconfig-dir/config
+    - export KUBECONFIG=$(pwd)/kubeconfig-dir/config
+    
+    - echo '2. TEST CONNECTION TO RKE2'
+    - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    
+    - echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
+    - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug
+
+    - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
+    - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
+
+    - echo '4. DEPLOYING APPS VIA HELM'
+    - |
+      helm upgrade --install $HELM_RELEASE ./helm/sidata \
+        --kube-apiserver https://10.15.39.168:6443 \
+        --kube-insecure-skip-tls-verify \
+        --namespace $KUBE_NAMESPACE \
+        --force \
+        --set image.repository=$IMAGE \
+        --set image.tag=$TAG \
+        --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
+        --set service.type=NodePort \
+        --set service.nodePort=32185 \
+        --set service.name=sidata-service \
+        --set-string extraEnv.APP_ENV="production" \
+        --set-string extraEnv.APP_DEBUG="false" \
+        --set-string extraEnv.FORCE_HTTPS="true" \
+        --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
+        --set-string extraEnv.APP_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
+        --set-string extraEnv.ASSET_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
+        --set-string extraEnv.SESSION_DRIVER="file" \
+        --set-string extraEnv.SESSION_SECURE_COOKIE="true"
+      
+    - echo '5. CHECK REAL NODEPORT STATUS'
+    - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    
+    - echo '6. CHECK STATUS ROLLOUT'
+    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+
+    - echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
+    - |
+      sleep 5
+      
+      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+      if [ -z "$POD_NAME" ]; then
+        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+      fi
+      
+      if [ -n "$POD_NAME" ]; then
+        echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:cache || true
+      else
+        echo "Warning: No running pod found for Artisan commands execution, skipping."
+      fi
+
+  after_script:
+    - echo "Cleaning up sensitive temporary files..."
+    - rm -rf ./kubeconfig-dir

.gitlab-ci.yml

@@ -3,149 +3,37 @@ stages:
   - deploy
 
 variables:
-  GIT_STRATEGY: none
-  IMAGE: 10.15.39.186:8083/eosbpkd/sidata
-  TAG: $CI_COMMIT_SHORT_SHA
-  KUBE_NAMESPACE: sidata-prod
-  HELM_RELEASE: sidata
-  BUILDAH_ISOLATION: "chroot"
-  STORAGE_DRIVER: "vfs"
+  NEXUS_PULL_REGISTRY: "10.15.39.186:8083"
+  NEXUS_PUSH_REGISTRY: "10.15.39.186:8081"
+  IMAGE_NAME: "sidata"
 
-  http_proxy: "http://10.15.3.20:80"
-  https_proxy: "http://10.15.3.20:80"
-  HTTP_PROXY: "http://10.15.3.20:80"
-  HTTPS_PROXY: "http://10.15.3.20:80"
-  no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
-  NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
-
-# =========================================================
-# BUILD IMAGE VIA BUILDAH
-# =========================================================
-build:
+build_image:
   stage: build
-  image: 10.15.39.186:8083/buildah:stable
-  tags:
-    - skpp
-  before_script:
-    - echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
-    - git config --global http.sslVerify false
-    - git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
-    - git checkout $CI_COMMIT_SHA
+  image: docker:24.0.5
+  services:
+    - name: docker:24.0.5-dind
+      command: 
+        - "--insecure-registry=10.15.39.186:8081"
+        - "--insecure-registry=10.15.39.186:8083"
   script:
-    - echo '1. MENERAPKAN PENGATURAN REGISTRY'
-    - mkdir -p ~/.config/containers
-    - |
-      cat <<EOF > ~/.config/containers/registries.conf
-      unqualified-search-registries = ["docker.io", "10.15.39.186:8084"]
+    - docker login -u "$NEXUS_USER" -p "$NEXUS_PASSWORD" $NEXUS_PULL_REGISTRY
+    - docker login -u "$NEXUS_USER" -p "$NEXUS_PASSWORD" $NEXUS_PUSH_REGISTRY
+    - docker build -t $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA -t $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:latest .
+    - docker push $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:$CI_COMMIT_SHA
+    - docker push $NEXUS_PUSH_REGISTRY/$IMAGE_NAME:latest
+  only:
+    - main
+    - master
 
-      [[registry]]
-      location = "10.15.39.186:8083"
-      insecure = true
-
-      [[registry]]
-      location = "10.15.39.186:8084"
-      insecure = true
-
-      [[registry]]
-      location = "docker.io"
-      insecure = false
-      EOF
-    
-    - echo '2. LOGIN TO NEXUS REGISTRY'
-    - echo "$NEXUS_PASSWORD" | buildah login --tls-verify=false -u "$NEXUS_USERNAME" --password-stdin 10.15.39.186:8083
-    
-    - echo '3. STARTING BUILDAH BUILD'
-    - buildah bud --tls-verify=false --storage-driver=vfs --isolation=chroot --build-arg http_proxy=$http_proxy --build-arg https_proxy=$https_proxy -t $IMAGE:$TAG -t $IMAGE:latest .
-    
-    - echo '4. PUSHING TO NEXUS'
-    - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:$TAG
-    - buildah push --tls-verify=false --storage-driver=vfs $IMAGE:latest
-
-# =========================================================
-# DEPLOY VIA HELM & KUBECTL
-# =========================================================
-deploy:
+deploy_rancher:
   stage: deploy
-  image:
-    name: alpine/k8s:1.29.1
-    entrypoint: [""]
-  tags:
-    - skpp
-  before_script:
-    - echo '0. FETCHING CODE MANUALLY VIA HTTP WITH CI_JOB_TOKEN'
-    - git config --global http.sslVerify false
-    - git clone http://gitlab-ci-token:${CI_JOB_TOKEN}@10.15.39.187/izuddin/sidata.git . || git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.dashboard-bpkd.drc-bpkd.data-center.id/izuddin/sidata.git .
-    - git checkout $CI_COMMIT_SHA
+  image: alpine/helm:3.12.0
   script:
-    - echo '1. SETUP KUBECONFIG LOKAL & BYPASS PROXY'
-    - unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
-    - export NO_PROXY="*"
-    - export no_proxy="*"
-    - mkdir -p ./kubeconfig-dir
-    - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
-    - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
-    - chmod 600 ./kubeconfig-dir/config
-    - export KUBECONFIG=$(pwd)/kubeconfig-dir/config
-    
-    - echo '2. TEST CONNECTION TO RKE2'
-    - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    
-    - echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
-    - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug
-
-    - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
-    - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
-
-    - echo '4. DEPLOYING APPS VIA HELM'
-    - |
-      helm upgrade --install $HELM_RELEASE ./helm/sidata \
-        --kube-apiserver https://10.15.39.168:6443 \
-        --kube-insecure-skip-tls-verify \
-        --namespace $KUBE_NAMESPACE \
-        --force \
-        --set image.repository=$IMAGE \
-        --set image.tag=$TAG \
-        --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
-        --set service.type=NodePort \
-        --set service.nodePort=32185 \
-        --set service.name=sidata-service \
-        --set-string extraEnv.APP_ENV="production" \
-        --set-string extraEnv.APP_DEBUG="false" \
-        --set-string extraEnv.FORCE_HTTPS="true" \
-        --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
-        --set-string extraEnv.APP_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
-        --set-string extraEnv.ASSET_URL="https://sidata.dashboard-bpkd.drc-bpkd.data-center.id" \
-        --set-string extraEnv.SESSION_DRIVER="file" \
-        --set-string extraEnv.SESSION_SECURE_COOKIE="true"
-      
-    - echo '5. CHECK REAL NODEPORT STATUS'
-    - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    
-    - echo '6. CHECK STATUS ROLLOUT'
-    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-
-    - echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
-    - |
-      sleep 5
-      
-      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
-      if [ -z "$POD_NAME" ]; then
-        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
-      fi
-      
-      if [ -n "$POD_NAME" ]; then
-        echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:cache || true
-      else
-        echo "Warning: No running pod found for Artisan commands execution, skipping."
-      fi
-
-  after_script:
-    - echo "Cleaning up sensitive temporary files..."
-    - rm -rf ./kubeconfig-dir
+    - mkdir -p ~/.kube
+    - echo "$KUBECONFIG_DATA" | base64 -d > ~/.kube/config
+    - helm upgrade --install sidata ./helm/sidata
+      --namespace default
+      --set image.tag=$CI_COMMIT_SHA
+  only:
+    - main
+    - master

Dockerfile

@@ -1,151 +1,50 @@
-# =========================================================
-# APPLICATION STAGE
-# Laravel + PHP 7.4 + OCI8 + Nginx
-# =========================================================
-
 FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0
 
-# =========================================================
-# Proxy
-# =========================================================
+# Arahkan repository APT ke Nexus Debian Proxy lokal
+RUN sed -i 's|http://deb.debian.org/debian|http://10.15.39.186:8081/repository/debian-proxy|g' /etc/apt/sources.list \
+    && sed -i 's|http://security.debian.org/debian-security|http://10.15.39.186:8081/repository/debian-proxy|g' /etc/apt/sources.list \
+    && sed -i 's|http://security.debian.org|http://10.15.39.186:8081/repository/debian-proxy|g' /etc/apt/sources.list 2>/dev/null || true
 
-ARG http_proxy
-ARG https_proxy
-
-ENV http_proxy=${http_proxy}
-ENV https_proxy=${https_proxy}
-ENV HTTP_PROXY=${http_proxy}
-ENV HTTPS_PROXY=${https_proxy}
-
-# =========================================================
-# System dependencies & Extensions
-# =========================================================
-
-RUN echo "deb [trusted=yes] http://10.15.39.186:8081/repository/debian-proxy/ bullseye main" > /etc/apt/sources.list \
-    && echo "deb [trusted=yes] http://10.15.39.186:8081/repository/debian-proxy/ bullseye-updates main" >> /etc/apt/sources.list \
-    && rm -rf /etc/apt/sources.list.d/* \
-    && apt-get update \
-    && apt-get install -y --no-install-recommends \
-        nginx \
-        vim \
-        wget \
-        curl \
-        libpng-dev \
-        libjpeg-dev \
-        libfreetype6-dev \
-        libzip-dev \
-        libaio1 \
-        libaio-dev \
-        unzip \
-    && docker-php-ext-configure gd --with-freetype --with-jpeg \
-    && docker-php-ext-install gd pdo pdo_mysql zip \
-    && curl --noproxy "*" -fsSL http://10.15.39.186:8081/repository/raw-assets/storage/app/uploads/redis-5.3.7.tgz -o redis.tgz \
-    && pecl install redis.tgz \
-    && docker-php-ext-enable redis \
-    && rm -f redis.tgz \
+# Install Nginx dan dependensi kompilasi
+RUN apt-get update && apt-get install -y \
+    nginx \
+    curl \
+    autoconf \
+    g++ \
+    make \
     && rm -rf /var/lib/apt/lists/*
 
-# =========================================================
-# PEAR Proxy (jika diperlukan)
-# =========================================================
+# Unduh dan pasang ekstensi PHP Redis dari repository Nexus
+RUN curl -o /tmp/redis-5.3.7.tgz http://10.15.39.186:8081/repository/raw-assets/storage/app/uploads/redis-5.3.7.tgz \
+    && pecl install /tmp/redis-5.3.7.tgz \
+    && docker-php-ext-enable redis \
+    && rm -f /tmp/redis-5.3.7.tgz
 
-RUN pear config-set http_proxy "http://10.15.3.20:80" || true
+WORKDIR /var/www/html
 
-# =========================================================
-# Composer setup & Caching Layer
-# =========================================================
+# Salin source code aplikasi
+COPY . /var/www/html
 
-WORKDIR /var/www
+# Atur hak akses folder storage dan cache Laravel
+RUN chown -R www-data:www-data /var/www/html/storage /var/www/html/bootstrap/cache \
+    && chmod -R 775 /var/www/html/storage /var/www/html/bootstrap/cache
 
-# Copy composer files terlebih dahulu agar Docker Caching layer aktif
-COPY composer.json composer.lock ./
-
-RUN composer install \
-    --no-dev \
-    --prefer-dist \
-    --no-interaction \
-    --no-scripts \
-    --optimize-autoloader
-
-# Copy seluruh source code project
-COPY --chown=www-data:www-data . .
-
-# =========================================================
-# Laravel directories & permission
-# =========================================================
-
-RUN mkdir -p \
-        /var/www/storage/framework/sessions \
-        /var/www/storage/framework/views \
-        /var/www/storage/framework/cache \
-        /var/www/storage/logs \
-        /var/www/bootstrap/cache \
-    && touch /var/www/storage/logs/laravel.log \
-    && chown -R www-data:www-data /var/www \
-    && chmod -R 775 /var/www/storage \
-    && chmod -R 775 /var/www/bootstrap/cache
-
-# =========================================================
-# Laravel cache cleanup
-# =========================================================
-
-RUN php artisan config:clear || true \
-    && php artisan cache:clear || true \
-    && php artisan view:clear || true
-
-# =========================================================
-# Nginx configuration
-# =========================================================
-
-RUN rm -f /etc/nginx/sites-enabled/default \
-    && rm -f /etc/nginx/sites-available/default
-
-RUN printf '%s\n' \
-'server {' \
-'    listen 80;' \
-'    server_name _;' \
-'' \
-'    root /var/www/public;' \
-'    index index.php index.html;' \
-'' \
-'    access_log /var/log/nginx/access.log;' \
-'    error_log /var/log/nginx/error.log;' \
-'' \
-'    location / {' \
-'        try_files $uri $uri/ /index.php?$query_string;' \
-'    }' \
-'' \
-'    location ~ \.php$ {' \
-'        try_files $uri =404;' \
-'        include fastcgi_params;' \
-'        fastcgi_pass 127.0.0.1:9000;' \
-'        fastcgi_index index.php;' \
-'        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \
-'        fastcgi_param PATH_INFO $fastcgi_path_info;' \
-'    }' \
-'' \
-'    location ~ /\.ht {' \
-'        deny all;' \
-'    }' \
-'}' \
-> /etc/nginx/sites-available/default
-
-RUN ln -sf /etc/nginx/sites-available/default \
-    /etc/nginx/sites-enabled/default
-
-# =========================================================
-# Clear Proxy Environment Variables from Runtime
-# =========================================================
-
-ENV http_proxy=""
-ENV https_proxy=""
-ENV HTTP_PROXY=""
-ENV HTTPS_PROXY=""
-
-# =========================================================
-# Execution
-# =========================================================
+# Konfigurasi Nginx
+RUN echo 'server { \
+    listen 80; \
+    index index.php index.html; \
+    root /var/www/html/public; \
+    location / { \
+        try_files $uri $uri/ /index.php?$query_string; \
+    } \
+    location ~ \.php$ { \
+        fastcgi_pass 127.0.0.1:9000; \
+        fastcgi_index index.php; \
+        include fastcgi_params; \
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; \
+    } \
+}' > /etc/nginx/sites-available/default
 
 EXPOSE 80
 
-CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]
+CMD ["sh", "-c", "php-fpm -D && nginx -g 'daemon off;'"]

Dockerfile asli ok

@@ -0,0 +1,151 @@
+# =========================================================
+# APPLICATION STAGE
+# Laravel + PHP 7.4 + OCI8 + Nginx
+# =========================================================
+
+FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0
+
+# =========================================================
+# Proxy
+# =========================================================
+
+ARG http_proxy
+ARG https_proxy
+
+ENV http_proxy=${http_proxy}
+ENV https_proxy=${https_proxy}
+ENV HTTP_PROXY=${http_proxy}
+ENV HTTPS_PROXY=${https_proxy}
+
+# =========================================================
+# System dependencies & Extensions
+# =========================================================
+
+RUN echo "deb [trusted=yes] http://10.15.39.186:8081/repository/debian-proxy/ bullseye main" > /etc/apt/sources.list \
+    && echo "deb [trusted=yes] http://10.15.39.186:8081/repository/debian-proxy/ bullseye-updates main" >> /etc/apt/sources.list \
+    && rm -rf /etc/apt/sources.list.d/* \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+        nginx \
+        vim \
+        wget \
+        curl \
+        libpng-dev \
+        libjpeg-dev \
+        libfreetype6-dev \
+        libzip-dev \
+        libaio1 \
+        libaio-dev \
+        unzip \
+    && docker-php-ext-configure gd --with-freetype --with-jpeg \
+    && docker-php-ext-install gd pdo pdo_mysql zip \
+    && curl --noproxy "*" -fsSL http://10.15.39.186:8081/repository/raw-assets/storage/app/uploads/redis-5.3.7.tgz -o redis.tgz \
+    && pecl install redis.tgz \
+    && docker-php-ext-enable redis \
+    && rm -f redis.tgz \
+    && rm -rf /var/lib/apt/lists/*
+
+# =========================================================
+# PEAR Proxy (jika diperlukan)
+# =========================================================
+
+RUN pear config-set http_proxy "http://10.15.3.20:80" || true
+
+# =========================================================
+# Composer setup & Caching Layer
+# =========================================================
+
+WORKDIR /var/www
+
+# Copy composer files terlebih dahulu agar Docker Caching layer aktif
+COPY composer.json composer.lock ./
+
+RUN composer install \
+    --no-dev \
+    --prefer-dist \
+    --no-interaction \
+    --no-scripts \
+    --optimize-autoloader
+
+# Copy seluruh source code project
+COPY --chown=www-data:www-data . .
+
+# =========================================================
+# Laravel directories & permission
+# =========================================================
+
+RUN mkdir -p \
+        /var/www/storage/framework/sessions \
+        /var/www/storage/framework/views \
+        /var/www/storage/framework/cache \
+        /var/www/storage/logs \
+        /var/www/bootstrap/cache \
+    && touch /var/www/storage/logs/laravel.log \
+    && chown -R www-data:www-data /var/www \
+    && chmod -R 775 /var/www/storage \
+    && chmod -R 775 /var/www/bootstrap/cache
+
+# =========================================================
+# Laravel cache cleanup
+# =========================================================
+
+RUN php artisan config:clear || true \
+    && php artisan cache:clear || true \
+    && php artisan view:clear || true
+
+# =========================================================
+# Nginx configuration
+# =========================================================
+
+RUN rm -f /etc/nginx/sites-enabled/default \
+    && rm -f /etc/nginx/sites-available/default
+
+RUN printf '%s\n' \
+'server {' \
+'    listen 80;' \
+'    server_name _;' \
+'' \
+'    root /var/www/public;' \
+'    index index.php index.html;' \
+'' \
+'    access_log /var/log/nginx/access.log;' \
+'    error_log /var/log/nginx/error.log;' \
+'' \
+'    location / {' \
+'        try_files $uri $uri/ /index.php?$query_string;' \
+'    }' \
+'' \
+'    location ~ \.php$ {' \
+'        try_files $uri =404;' \
+'        include fastcgi_params;' \
+'        fastcgi_pass 127.0.0.1:9000;' \
+'        fastcgi_index index.php;' \
+'        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \
+'        fastcgi_param PATH_INFO $fastcgi_path_info;' \
+'    }' \
+'' \
+'    location ~ /\.ht {' \
+'        deny all;' \
+'    }' \
+'}' \
+> /etc/nginx/sites-available/default
+
+RUN ln -sf /etc/nginx/sites-available/default \
+    /etc/nginx/sites-enabled/default
+
+# =========================================================
+# Clear Proxy Environment Variables from Runtime
+# =========================================================
+
+ENV http_proxy=""
+ENV https_proxy=""
+ENV HTTP_PROXY=""
+ENV HTTPS_PROXY=""
+
+# =========================================================
+# Execution
+# =========================================================
+
+EXPOSE 80
+
+CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]

helm/sidata/Chart.yaml

@@ -1,6 +1,5 @@
 apiVersion: v2
-name: sidata-app
-description: Helm chart untuk aplikasi Laravel SIDATA
-type: application
-version: 0.1.0
+name: sidata
+description: Helm chart untuk aplikasi SIDATA Laravel PHP 7.4
+version: 1.0.0
 appVersion: "1.0.0"

helm/sidata/templates/deployment.yaml

@@ -2,10 +2,8 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ .Release.Name }}
-  labels:
-    app: {{ .Release.Name }}
 spec:
-  replicas: {{ .Values.replicaCount | default 1 }}
+  replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
       app: {{ .Release.Name }}
@@ -15,27 +13,11 @@ spec:
         app: {{ .Release.Name }}
     spec:
       containers:
-        - name: {{ .Chart.Name }}
+        - name: {{ .Release.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - containerPort: 80
-          volumeMounts:
-            - name: nginx-config-volume
-              mountPath: /etc/nginx/http.d/default.conf
-              subPath: default.conf
-          env:
-            {{- range $key, $value := .Values.env }}
-              - name: {{ $key }}
-                value: {{ $value | quote }}
-            {{- end }}
-            
-              - name: APP_KEY
-                valueFrom:
-                  secretKeyRef:
-                    name: {{ .Release.Name }}-secret
-                    key: APP_KEY
-      volumes:
-        - name: nginx-config-volume
-          configMap:
-            name: sidata-nginx-config
+          envFrom:
+            - secretRef:
+                name: {{ .Release.Name }}-env

helm/sidata/templates/ingress.yaml

@@ -1,20 +1,21 @@
+{{- if .Values.ingress.enabled -}}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: sidata-ingress
-  namespace: sidata-prod
+  name: {{ .Release.Name }}
   annotations:
-    traefik.ingress.kubernetes.io/router.middlewares: sidata-prod-fix-sidata-prefix@kubernetescrd
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
 spec:
-  ingressClassName: traefik
+  ingressClassName: {{ .Values.ingress.className }}
   rules:
-    - host: dashboard-bpkd.drc-bpkd.data-center.id
+    - host: {{ .Values.ingress.host }}
       http:
         paths:
-          - path: /sidata
-            pathType: Prefix
+          - path: {{ .Values.ingress.path }}
+            pathType: ImplementationSpecific
             backend:
               service:
-                name: sidata-service
+                name: {{ .Release.Name }}
                 port:
-                  number: 80
+                  number: {{ .Values.service.port }}
+{{- end }}

helm/sidata/templates/secret.yaml

@@ -1,7 +1,9 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Release.Name }}-secret
+  name: {{ .Release.Name }}-env
 type: Opaque
 stringData:
-  APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
+  {{- range $key, $val := .Values.env }}
+  {{ $key }}: {{ $val | quote }}
+  {{- end }}

helm/sidata/templates/service.yaml

@@ -1,13 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: sidata-service
+  name: {{ .Release.Name }}
 spec:
-  type: ClusterIP
+  type: {{ .Values.service.type }}
   ports:
-    - port: 80
+    - port: {{ .Values.service.port }}
       targetPort: 80
-      protocol: TCP
-      name: http
   selector:
-    app: sidata
+    app: {{ .Release.Name }}

helm/sidata/values.yaml

@@ -1,37 +1,34 @@
-replicaCount: 2
+replicaCount: 1
 
 image:
-  repository: 10.15.39.186:8083/eosbpkd/sidata
+  repository: 10.15.39.186:8081/sidata
+  tag: latest
   pullPolicy: Always
-  tag: "latest"
 
 service:
-  type: NodePort
+  type: ClusterIP
   port: 80
-  targetPort: 80
-  nodePort: 32180
 
 ingress:
   enabled: true
-  className: "traefik"
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
-    traefik.ingress.kubernetes.io/router.middlewares: sidata-prod-fix-sidata-prefix@kubernetescrd
-  hosts:
-    - host: "dashboard-bpkd.drc-bpkd.data-center.id"
-      paths:
-        - path: "/sidata"
-          pathType: "Prefix"
+  className: nginx
+  host: dashboard-bpkd.drc-bpkd.data-center.id
+  path: /sidata(/|$)(.*)
 
-# Environment Variables Aplikasi
 env:
   APP_NAME: "SIDATA"
   APP_ENV: "production"
-  APP_DEBUG: "true"
+  APP_KEY: "base64:JWoCrp63f8mipgiOWhwpIG+YVpw1Lunn4RZf0mcBWNg="
+  APP_DEBUG: "false"
   APP_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
-  ASSET_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata" # <-- TETAP GUNAKAN /sidata
-  FORCE_HTTPS: true
-  
+  LOG_CHANNEL: "stack"
+  LOG_LEVEL: "debug"
+  MYSQL_CONNECTION: "mysql"
+  MYSQL_HOST: "10.15.36.53"
+  MYSQL_PORT: "3306"
+  MYSQL_DATABASE: "spb23"
+  MYSQL_USERNAME: "web"
+  MYSQL_PASSWORD: "W82Mwhnw2_vr"
   DB_CONNECTION: "Samasa"
   DB_HOST: "10.15.39.193"
   DB_PORT: "1521"
@@ -39,21 +36,31 @@ env:
   DB_USERNAME: "samasa"
   DB_PASSWORD: "123samasa"
   DB_SERVICENAME: "sipkd.localdomain"
-
   ORA_CONNECTION: "oracle"
   ORA_HOST: "10.15.39.193"
-  ORA_PORT: 1521
+  ORA_PORT: "1521"
   ORA_DATABASE: "NEWSIPKD"
   ORA_USERNAME: "proksi"
-  ORA_PASSWORD: 123456
+  ORA_PASSWORD: "123456"
   ORA_SERVICENAME: "sipkd.localdomain"
-
+  SOA_PEGAWAI: "https://soadev.jakarta.go.id/rest/gov/dki/simpeg/ws/skpp"
+  SOA_PEGAWAI_USER: "sipkddev"
+  SOA_PEGAWAI_PASSWORD: "sipkddev!!"
+  BROADCAST_DRIVER: "log"
+  CACHE_DRIVER: "file"
+  FILESYSTEM_DRIVER: "local"
+  QUEUE_CONNECTION: "sync"
   SESSION_DRIVER: "file"
-  SESSION_LIFETIME: 120
-  REDIS_HOST: "redis"
-  REDIS_PASSWORD: null
-  REDIS_PORT: 6379
-
-# Rahasia Sensitive
-secrets:
-  APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
+  SESSION_LIFETIME: "120"
+  MEMCACHED_HOST: "127.0.0.1"
+  REDIS_HOST: "127.0.0.1"
+  REDIS_PASSWORD: "null"
+  REDIS_PORT: "6379"
+  MAIL_MAILER: "smtp"
+  MAIL_HOST: "mailhog"
+  MAIL_PORT: "1025"
+  MAIL_USERNAME: "null"
+  MAIL_PASSWORD: "null"
+  MAIL_ENCRYPTION: "null"
+  MAIL_FROM_ADDRESS: "null"
+  MAIL_FROM_NAME: "SIDATA"