Merge branch 'main' of http://10.15.39.187/izuddin/sidata
This commit is contained in:
izuddin
+26
-18
@@ -14,8 +14,8 @@ variables:
|
||||
https_proxy: "http://10.15.3.20:80"
|
||||
HTTP_PROXY: "http://10.15.3.20:80"
|
||||
HTTPS_PROXY: "http://10.15.3.20:80"
|
||||
no_proxy: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
|
||||
NO_PROXY: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
|
||||
no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
|
||||
NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
|
||||
|
||||
# =========================================================
|
||||
# BUILD IMAGE VIA BUILDAH
|
||||
@@ -72,61 +72,69 @@ deploy:
|
||||
- export no_proxy="*"
|
||||
- mkdir -p ./kubeconfig-dir
|
||||
- echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
|
||||
- sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
|
||||
- chmod 600 ./kubeconfig-dir/config
|
||||
- export KUBECONFIG=$(pwd)/kubeconfig-dir/config
|
||||
|
||||
- echo '2. TEST CONNECTION TO RKE2'
|
||||
- kubectl version --client
|
||||
- kubectl get nodes
|
||||
- kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f -
|
||||
- kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
|
||||
- kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
|
||||
- kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
|
||||
|
||||
- echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
|
||||
- helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug
|
||||
|
||||
- echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
|
||||
# Menghapus service non-helm (hasil manual kubectl expose tadi) agar peluncuran Helm bersih
|
||||
- kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
|
||||
|
||||
- echo '4. DEPLOYING APPS VIA HELM'
|
||||
- |
|
||||
helm upgrade --install $HELM_RELEASE ./helm/sidata \
|
||||
--kube-apiserver https://10.15.39.168:6443 \
|
||||
--kube-insecure-skip-tls-verify \
|
||||
--namespace $KUBE_NAMESPACE \
|
||||
--force \
|
||||
--set image.repository=$IMAGE \
|
||||
--set image.tag=$TAG \
|
||||
--set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
|
||||
--set service.type=NodePort \
|
||||
--set service.nodePort=32180 \
|
||||
--set service.nodePort=32185 \
|
||||
--set service.name=sidata-service \
|
||||
--set-string extraEnv.APP_ENV="production" \
|
||||
--set-string extraEnv.APP_DEBUG="false" \
|
||||
--set-string extraEnv.FORCE_HTTPS="true" \
|
||||
--set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
|
||||
--set-string extraEnv.APP_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
|
||||
--set-string extraEnv.ASSET_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
|
||||
--set-string extraEnv.APP_URL="https://data-center.id" \
|
||||
--set-string extraEnv.ASSET_URL="https://data-center.id" \
|
||||
--set-string extraEnv.SESSION_DRIVER="file" \
|
||||
--set-string extraEnv.SESSION_SECURE_COOKIE="true"
|
||||
|
||||
- echo '5. CHECK REAL NODEPORT STATUS'
|
||||
- kubectl get svc -n $KUBE_NAMESPACE
|
||||
- kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
|
||||
|
||||
- echo '6. CHECK STATUS ROLLOUT'
|
||||
- kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s || kubectl rollout status deployment/$HELM_RELEASE-skpp -n $KUBE_NAMESPACE --timeout=180s
|
||||
- kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
|
||||
|
||||
- echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
|
||||
- |
|
||||
# Berikan jeda 5 detik agar pod baru benar-benar stabil sebelum dieksekusi artisan commands
|
||||
sleep 5
|
||||
|
||||
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
|
||||
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
|
||||
if [ -z "$POD_NAME" ]; then
|
||||
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
|
||||
POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
|
||||
fi
|
||||
|
||||
if [ -n "$POD_NAME" ]; then
|
||||
echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan config:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan route:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan cache:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan view:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
|
||||
kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
|
||||
else
|
||||
echo "Warning: No running pod found for Artisan commands execution, skipping."
|
||||
fi
|
||||
|
||||
after_script:
|
||||
- echo "Cleaning up sensitive temporary files..."
|
||||
- rm -rf ./kubeconfig-dir
|
||||
- rm -rf ./kubeconfig-dir
|
||||
|
||||
+129
-55
@@ -1,83 +1,157 @@
|
||||
# =========================================================
|
||||
# 1. COMPOSER STAGE (Untuk binary & vendor generation)
|
||||
# APPLICATION STAGE
|
||||
# Laravel + PHP 7.4 + OCI8 + Nginx
|
||||
# =========================================================
|
||||
FROM 10.15.39.186:8084/library/composer:2.7 AS composer
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Salin file dependensi terlebih dahulu
|
||||
COPY composer.json composer.lock ./
|
||||
|
||||
# Unduh/susun dependensi di stage composer (Gunakan cache/mirror lokal jika ada)
|
||||
RUN composer install --no-dev --prefer-dist --no-scripts --no-autoloader --ignore-platform-reqs
|
||||
|
||||
# Salin sisa kode aplikasi ke stage composer
|
||||
COPY . .
|
||||
|
||||
# Generate autoloader yang sudah dioptimasi
|
||||
RUN composer dump-autoload --optimize --no-dev --no-plugins --no-scripts
|
||||
|
||||
# =========================================================
|
||||
# 2. APPLICATION STAGE
|
||||
# =========================================================
|
||||
FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0
|
||||
|
||||
# =========================================================
|
||||
# Proxy
|
||||
# =========================================================
|
||||
|
||||
ARG http_proxy
|
||||
ARG https_proxy
|
||||
|
||||
ENV http_proxy=$http_proxy
|
||||
ENV https_proxy=$https_proxy
|
||||
ENV http_proxy=${http_proxy}
|
||||
ENV https_proxy=${https_proxy}
|
||||
ENV HTTP_PROXY=${http_proxy}
|
||||
ENV HTTPS_PROXY=${https_proxy}
|
||||
|
||||
# Install Nginx & Dependencies
|
||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
||||
# =========================================================
|
||||
# System dependencies
|
||||
# =========================================================
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
nginx \
|
||||
vim \
|
||||
wget \
|
||||
libpng-dev \
|
||||
libjpeg-dev \
|
||||
libfreetype6-dev \
|
||||
libzip-dev \
|
||||
libaio1 \
|
||||
libaio-dev \
|
||||
zip \
|
||||
git \
|
||||
unzip \
|
||||
&& docker-php-ext-configure gd \
|
||||
--with-freetype \
|
||||
--with-jpeg \
|
||||
&& docker-php-ext-install \
|
||||
gd \
|
||||
pdo \
|
||||
pdo_mysql \
|
||||
zip \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# =========================================================
|
||||
# PEAR Proxy
|
||||
# =========================================================
|
||||
|
||||
RUN pear config-set http_proxy "http://10.15.3.20:80"
|
||||
|
||||
# =========================================================
|
||||
# Composer
|
||||
# =========================================================
|
||||
|
||||
WORKDIR /var/www
|
||||
|
||||
# Salin SELURUH source code BESERTA vendor yang sudah jadi dari stage composer
|
||||
COPY --from=composer /app /var/www
|
||||
# =========================================================
|
||||
# Composer dependency
|
||||
# Copy hanya composer files terlebih dahulu agar Docker cache
|
||||
# =========================================================
|
||||
|
||||
# Hapus proxy dari environment runtime
|
||||
ENV http_proxy=
|
||||
ENV https_proxy=
|
||||
COPY composer.json composer.lock ./
|
||||
|
||||
# Setup Nginx Config
|
||||
RUN echo 'server { \
|
||||
listen 80; \
|
||||
index index.php index.html; \
|
||||
error_log /var/log/nginx/error.log; \
|
||||
access_log /var/log/nginx/access.log; \
|
||||
root /var/www/public; \
|
||||
location ~ \.php$ { \
|
||||
try_files $uri =404; \
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$; \
|
||||
fastcgi_pass 127.0.0.1:9000; \
|
||||
fastcgi_index index.php; \
|
||||
include fastcgi_params; \
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; \
|
||||
fastcgi_param PATH_INFO $fastcgi_path_info; \
|
||||
} \
|
||||
location / { \
|
||||
try_files $uri $uri/ /index.php?$query_string; \
|
||||
gzip_static on; \
|
||||
} \
|
||||
}' > /etc/nginx/sites-available/default
|
||||
COPY --chown=www-data:www-data . .
|
||||
|
||||
RUN composer install \
|
||||
--no-dev \
|
||||
--prefer-dist \
|
||||
--no-interaction \
|
||||
--no-scripts \
|
||||
--optimize-autoloader
|
||||
|
||||
# =========================================================
|
||||
# Laravel directories & permission
|
||||
# =========================================================
|
||||
|
||||
# Setup direktori storage & bootstrap cache Laravel serta atur izin akses
|
||||
RUN mkdir -p \
|
||||
/var/www/storage/framework/sessions \
|
||||
/var/www/storage/framework/views \
|
||||
/var/www/storage/framework/cache \
|
||||
/var/www/storage/logs \
|
||||
/var/www/bootstrap/cache \
|
||||
&& touch /var/www/storage/logs/laravel.log \
|
||||
&& chown -R www-data:www-data /var/www \
|
||||
&& chmod -R 775 /var/www/storage /var/www/bootstrap/cache
|
||||
&& chmod -R 775 /var/www/storage \
|
||||
&& chmod -R 775 /var/www/bootstrap/cache
|
||||
|
||||
ENV APP_ENV=production
|
||||
ENV APP_DEBUG=false
|
||||
ENV DB_CONNECTION=dejos
|
||||
# =========================================================
|
||||
# Laravel cache
|
||||
# =========================================================
|
||||
|
||||
RUN php artisan config:clear || true \
|
||||
&& php artisan cache:clear || true \
|
||||
&& php artisan view:clear || true
|
||||
|
||||
# =========================================================
|
||||
# Nginx configuration
|
||||
# =========================================================
|
||||
|
||||
RUN rm -f /etc/nginx/sites-enabled/default \
|
||||
&& rm -f /etc/nginx/sites-available/default
|
||||
|
||||
RUN printf '%s\n' \
|
||||
'server {' \
|
||||
' listen 80;' \
|
||||
' server_name _;' \
|
||||
'' \
|
||||
' root /var/www/public;' \
|
||||
' index index.php index.html;' \
|
||||
'' \
|
||||
' access_log /var/log/nginx/access.log;' \
|
||||
' error_log /var/log/nginx/error.log;' \
|
||||
'' \
|
||||
' location / {' \
|
||||
' try_files $uri $uri/ /index.php?$query_string;' \
|
||||
' }' \
|
||||
'' \
|
||||
' location ~ \.php$ {' \
|
||||
' try_files $uri =404;' \
|
||||
' include fastcgi_params;' \
|
||||
' fastcgi_pass 127.0.0.1:9000;' \
|
||||
' fastcgi_index index.php;' \
|
||||
' fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \
|
||||
' fastcgi_param PATH_INFO $fastcgi_path_info;' \
|
||||
' }' \
|
||||
'' \
|
||||
' location ~ /\.ht {' \
|
||||
' deny all;' \
|
||||
' }' \
|
||||
'}' \
|
||||
> /etc/nginx/sites-available/default
|
||||
|
||||
RUN ln -sf /etc/nginx/sites-available/default \
|
||||
/etc/nginx/sites-enabled/default
|
||||
|
||||
# =========================================================
|
||||
# Remove proxy from runtime
|
||||
# =========================================================
|
||||
|
||||
ENV http_proxy=""
|
||||
ENV https_proxy=""
|
||||
ENV HTTP_PROXY=""
|
||||
ENV HTTPS_PROXY=""
|
||||
|
||||
# =========================================================
|
||||
# Port
|
||||
# =========================================================
|
||||
|
||||
EXPOSE 80
|
||||
|
||||
CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]
|
||||
# =========================================================
|
||||
# Start PHP-FPM + Nginx
|
||||
# =========================================================
|
||||
|
||||
CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]
|
||||
|
||||
@@ -19,51 +19,22 @@ spec:
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.service.targetPort | default 80 }}
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: nginx-config-volume
|
||||
mountPath: /etc/nginx/http.d/default.conf
|
||||
subPath: default.conf
|
||||
env:
|
||||
{{- if .Values.env }}
|
||||
{{- range $key, $value := .Values.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# --- KONFIGURASI UTAMA SUB-PATH & REVERSE PROXY LARAVEL ---
|
||||
- name: APP_URL
|
||||
value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
|
||||
- name: ASSET_URL
|
||||
value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
|
||||
- name: SESSION_DRIVER
|
||||
value: "file"
|
||||
- name: SESSION_DOMAIN
|
||||
value: ""
|
||||
- name: SESSION_PATH
|
||||
value: "/"
|
||||
- name: SESSION_SECURE_COOKIE
|
||||
value: "false"
|
||||
- name: SESSION_SAME_SITE
|
||||
value: "lax"
|
||||
- name: TRUSTED_PROXIES
|
||||
value: "*"
|
||||
# --- SECRETS ---
|
||||
- name: APP_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-secret
|
||||
key: APP_KEY
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-secret
|
||||
key: DB_PASSWORD
|
||||
- name: ORA_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-secret
|
||||
key: ORA_PASSWORD
|
||||
|
||||
- name: APP_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Release.Name }}-secret
|
||||
key: APP_KEY
|
||||
volumes:
|
||||
- name: nginx-config-volume
|
||||
configMap:
|
||||
|
||||
@@ -4,6 +4,4 @@ metadata:
|
||||
name: {{ .Release.Name }}-secret
|
||||
type: Opaque
|
||||
stringData:
|
||||
APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
|
||||
DB_PASSWORD: {{ .Values.secrets.DB_PASSWORD | quote }}
|
||||
ORA_PASSWORD: {{ .Values.secrets.ORA_PASSWORD | quote }}
|
||||
APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
|
||||
+16
-9
@@ -8,7 +8,7 @@ image:
|
||||
service:
|
||||
type: NodePort
|
||||
port: 80
|
||||
targetPort: 9000
|
||||
targetPort: 80
|
||||
nodePort: 32180
|
||||
|
||||
ingress:
|
||||
@@ -31,15 +31,22 @@ env:
|
||||
APP_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
|
||||
ASSET_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
|
||||
FORCE_HTTPS: "true"
|
||||
DB_CONNECTION: "mysql"
|
||||
DB_HOST: "10.15.39.185"
|
||||
DB_PORT: "3306"
|
||||
DB_DATABASE: "sidata"
|
||||
DB_USERNAME: "aplikasi"
|
||||
DB_CONNECTION: "Samasa"
|
||||
DB_HOST: "10.15.39.193"
|
||||
DB_PORT: "1521"
|
||||
DB_DATABASE: "SAMASA"
|
||||
DB_USERNAME: "samasa"
|
||||
DB_PASSWORD: "123samasa"
|
||||
DB_SERVICENAME: "sipkd.localdomain"
|
||||
|
||||
ORA_CONNECTION: "oracle"
|
||||
ORA_HOST: "10.15.39.193"
|
||||
ORA_PORT: "1521"
|
||||
ORA_DATABASE: "NEWSIPKD"
|
||||
ORA_USERNAME: "proksi"
|
||||
ORA_PASSWORD: "123456"
|
||||
ORA_SERVICENAME: "sipkd.localdomain"
|
||||
|
||||
# Rahasia Sensitive
|
||||
secrets:
|
||||
APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
|
||||
DB_PASSWORD: "pusdatin"
|
||||
ORA_PASSWORD: "123456"
|
||||
APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
|
||||
Reference in New Issue
Block a user