diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 5b3095d..dbe7eb3 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -14,8 +14,8 @@ variables: https_proxy: "http://10.15.3.20:80" HTTP_PROXY: "http://10.15.3.20:80" HTTPS_PROXY: "http://10.15.3.20:80" - no_proxy: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" - NO_PROXY: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" + no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" + NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id" # ========================================================= # BUILD IMAGE VIA BUILDAH @@ -72,61 +72,69 @@ deploy: - export no_proxy="*" - mkdir -p ./kubeconfig-dir - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config + - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config - chmod 600 ./kubeconfig-dir/config - export KUBECONFIG=$(pwd)/kubeconfig-dir/config - echo '2. TEST CONNECTION TO RKE2' - - kubectl version --client - - kubectl get nodes - - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - + - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true + - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true + - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '3. VALIDASI TEMPLATE HELM (DEBUG)' - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug + - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK' + # Menghapus service non-helm (hasil manual kubectl expose tadi) agar peluncuran Helm bersih + - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true + - echo '4. DEPLOYING APPS VIA HELM' - | helm upgrade --install $HELM_RELEASE ./helm/sidata \ + --kube-apiserver https://10.15.39.168:6443 \ + --kube-insecure-skip-tls-verify \ --namespace $KUBE_NAMESPACE \ + --force \ --set image.repository=$IMAGE \ --set image.tag=$TAG \ --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \ --set service.type=NodePort \ - --set service.nodePort=32180 \ + --set service.nodePort=32185 \ + --set service.name=sidata-service \ --set-string extraEnv.APP_ENV="production" \ --set-string extraEnv.APP_DEBUG="false" \ --set-string extraEnv.FORCE_HTTPS="true" \ --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \ - --set-string extraEnv.APP_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \ - --set-string extraEnv.ASSET_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \ + --set-string extraEnv.APP_URL="https://data-center.id" \ + --set-string extraEnv.ASSET_URL="https://data-center.id" \ --set-string extraEnv.SESSION_DRIVER="file" \ --set-string extraEnv.SESSION_SECURE_COOKIE="true" - echo '5. CHECK REAL NODEPORT STATUS' - - kubectl get svc -n $KUBE_NAMESPACE + - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '6. CHECK STATUS ROLLOUT' - - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s || kubectl rollout status deployment/$HELM_RELEASE-skpp -n $KUBE_NAMESPACE --timeout=180s + - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true - echo '7. AUTO CLEAR LARAVEL CACHE ON POD' - | - # Berikan jeda 5 detik agar pod baru benar-benar stabil sebelum dieksekusi artisan commands sleep 5 - POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) + POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) if [ -z "$POD_NAME" ]; then - POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) + POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true) fi if [ -n "$POD_NAME" ]; then echo "Executing Artisan Clear Cache on Pod: $POD_NAME" - kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan config:clear || true - kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan route:clear || true - kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan cache:clear || true - kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan view:clear || true + kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true + kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true + kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true + kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true else echo "Warning: No running pod found for Artisan commands execution, skipping." fi after_script: - echo "Cleaning up sensitive temporary files..." - - rm -rf ./kubeconfig-dir \ No newline at end of file + - rm -rf ./kubeconfig-dir diff --git a/Dockerfile b/Dockerfile index d6ae38a..9ad4738 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,83 +1,157 @@ # ========================================================= -# 1. COMPOSER STAGE (Untuk binary & vendor generation) +# APPLICATION STAGE +# Laravel + PHP 7.4 + OCI8 + Nginx # ========================================================= -FROM 10.15.39.186:8084/library/composer:2.7 AS composer -WORKDIR /app - -# Salin file dependensi terlebih dahulu -COPY composer.json composer.lock ./ - -# Unduh/susun dependensi di stage composer (Gunakan cache/mirror lokal jika ada) -RUN composer install --no-dev --prefer-dist --no-scripts --no-autoloader --ignore-platform-reqs - -# Salin sisa kode aplikasi ke stage composer -COPY . . - -# Generate autoloader yang sudah dioptimasi -RUN composer dump-autoload --optimize --no-dev --no-plugins --no-scripts - -# ========================================================= -# 2. APPLICATION STAGE -# ========================================================= FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0 +# ========================================================= +# Proxy +# ========================================================= + ARG http_proxy ARG https_proxy -ENV http_proxy=$http_proxy -ENV https_proxy=$https_proxy +ENV http_proxy=${http_proxy} +ENV https_proxy=${https_proxy} +ENV HTTP_PROXY=${http_proxy} +ENV HTTPS_PROXY=${https_proxy} -# Install Nginx & Dependencies -RUN apt-get update && apt-get install -y --no-install-recommends \ +# ========================================================= +# System dependencies +# ========================================================= + +RUN apt-get update && apt-get install -y \ nginx \ + vim \ + wget \ + libpng-dev \ + libjpeg-dev \ + libfreetype6-dev \ + libzip-dev \ + libaio1 \ + libaio-dev \ + zip \ + git \ unzip \ + && docker-php-ext-configure gd \ + --with-freetype \ + --with-jpeg \ + && docker-php-ext-install \ + gd \ + pdo \ + pdo_mysql \ + zip \ && rm -rf /var/lib/apt/lists/* +# ========================================================= +# PEAR Proxy +# ========================================================= + +RUN pear config-set http_proxy "http://10.15.3.20:80" + +# ========================================================= +# Composer +# ========================================================= + WORKDIR /var/www -# Salin SELURUH source code BESERTA vendor yang sudah jadi dari stage composer -COPY --from=composer /app /var/www +# ========================================================= +# Composer dependency +# Copy hanya composer files terlebih dahulu agar Docker cache +# ========================================================= -# Hapus proxy dari environment runtime -ENV http_proxy= -ENV https_proxy= +COPY composer.json composer.lock ./ -# Setup Nginx Config -RUN echo 'server { \ - listen 80; \ - index index.php index.html; \ - error_log /var/log/nginx/error.log; \ - access_log /var/log/nginx/access.log; \ - root /var/www/public; \ - location ~ \.php$ { \ - try_files $uri =404; \ - fastcgi_split_path_info ^(.+\.php)(/.+)$; \ - fastcgi_pass 127.0.0.1:9000; \ - fastcgi_index index.php; \ - include fastcgi_params; \ - fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; \ - fastcgi_param PATH_INFO $fastcgi_path_info; \ - } \ - location / { \ - try_files $uri $uri/ /index.php?$query_string; \ - gzip_static on; \ - } \ -}' > /etc/nginx/sites-available/default +COPY --chown=www-data:www-data . . + +RUN composer install \ + --no-dev \ + --prefer-dist \ + --no-interaction \ + --no-scripts \ + --optimize-autoloader + +# ========================================================= +# Laravel directories & permission +# ========================================================= -# Setup direktori storage & bootstrap cache Laravel serta atur izin akses RUN mkdir -p \ /var/www/storage/framework/sessions \ /var/www/storage/framework/views \ /var/www/storage/framework/cache \ + /var/www/storage/logs \ /var/www/bootstrap/cache \ + && touch /var/www/storage/logs/laravel.log \ && chown -R www-data:www-data /var/www \ - && chmod -R 775 /var/www/storage /var/www/bootstrap/cache + && chmod -R 775 /var/www/storage \ + && chmod -R 775 /var/www/bootstrap/cache -ENV APP_ENV=production -ENV APP_DEBUG=false -ENV DB_CONNECTION=dejos +# ========================================================= +# Laravel cache +# ========================================================= + +RUN php artisan config:clear || true \ + && php artisan cache:clear || true \ + && php artisan view:clear || true + +# ========================================================= +# Nginx configuration +# ========================================================= + +RUN rm -f /etc/nginx/sites-enabled/default \ + && rm -f /etc/nginx/sites-available/default + +RUN printf '%s\n' \ +'server {' \ +' listen 80;' \ +' server_name _;' \ +'' \ +' root /var/www/public;' \ +' index index.php index.html;' \ +'' \ +' access_log /var/log/nginx/access.log;' \ +' error_log /var/log/nginx/error.log;' \ +'' \ +' location / {' \ +' try_files $uri $uri/ /index.php?$query_string;' \ +' }' \ +'' \ +' location ~ \.php$ {' \ +' try_files $uri =404;' \ +' include fastcgi_params;' \ +' fastcgi_pass 127.0.0.1:9000;' \ +' fastcgi_index index.php;' \ +' fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \ +' fastcgi_param PATH_INFO $fastcgi_path_info;' \ +' }' \ +'' \ +' location ~ /\.ht {' \ +' deny all;' \ +' }' \ +'}' \ +> /etc/nginx/sites-available/default + +RUN ln -sf /etc/nginx/sites-available/default \ + /etc/nginx/sites-enabled/default + +# ========================================================= +# Remove proxy from runtime +# ========================================================= + +ENV http_proxy="" +ENV https_proxy="" +ENV HTTP_PROXY="" +ENV HTTPS_PROXY="" + +# ========================================================= +# Port +# ========================================================= EXPOSE 80 -CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"] \ No newline at end of file +# ========================================================= +# Start PHP-FPM + Nginx +# ========================================================= + +CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"] diff --git a/helm/sidata/templates/deployment.yaml b/helm/sidata/templates/deployment.yaml index 3da71ad..e373971 100644 --- a/helm/sidata/templates/deployment.yaml +++ b/helm/sidata/templates/deployment.yaml @@ -19,51 +19,22 @@ spec: image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} ports: - - containerPort: {{ .Values.service.targetPort | default 80 }} + - containerPort: 80 volumeMounts: - name: nginx-config-volume mountPath: /etc/nginx/http.d/default.conf subPath: default.conf env: - {{- if .Values.env }} {{- range $key, $value := .Values.env }} - - name: {{ $key }} - value: {{ $value | quote }} + - name: {{ $key }} + value: {{ $value | quote }} {{- end }} - {{- end }} - # --- KONFIGURASI UTAMA SUB-PATH & REVERSE PROXY LARAVEL --- - - name: APP_URL - value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata" - - name: ASSET_URL - value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata" - - name: SESSION_DRIVER - value: "file" - - name: SESSION_DOMAIN - value: "" - - name: SESSION_PATH - value: "/" - - name: SESSION_SECURE_COOKIE - value: "false" - - name: SESSION_SAME_SITE - value: "lax" - - name: TRUSTED_PROXIES - value: "*" - # --- SECRETS --- - - name: APP_KEY - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-secret - key: APP_KEY - - name: DB_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-secret - key: DB_PASSWORD - - name: ORA_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-secret - key: ORA_PASSWORD + + - name: APP_KEY + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-secret + key: APP_KEY volumes: - name: nginx-config-volume configMap: diff --git a/helm/sidata/templates/secret.yaml b/helm/sidata/templates/secret.yaml index ce7cd8f..787c4ad 100644 --- a/helm/sidata/templates/secret.yaml +++ b/helm/sidata/templates/secret.yaml @@ -4,6 +4,4 @@ metadata: name: {{ .Release.Name }}-secret type: Opaque stringData: - APP_KEY: {{ .Values.secrets.APP_KEY | quote }} - DB_PASSWORD: {{ .Values.secrets.DB_PASSWORD | quote }} - ORA_PASSWORD: {{ .Values.secrets.ORA_PASSWORD | quote }} \ No newline at end of file + APP_KEY: {{ .Values.secrets.APP_KEY | quote }} \ No newline at end of file diff --git a/helm/sidata/values.yaml b/helm/sidata/values.yaml index 46d6d7f..f957b14 100644 --- a/helm/sidata/values.yaml +++ b/helm/sidata/values.yaml @@ -8,7 +8,7 @@ image: service: type: NodePort port: 80 - targetPort: 9000 + targetPort: 80 nodePort: 32180 ingress: @@ -31,15 +31,22 @@ env: APP_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata" ASSET_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata" FORCE_HTTPS: "true" - DB_CONNECTION: "mysql" - DB_HOST: "10.15.39.185" - DB_PORT: "3306" - DB_DATABASE: "sidata" - DB_USERNAME: "aplikasi" + DB_CONNECTION: "Samasa" + DB_HOST: "10.15.39.193" + DB_PORT: "1521" + DB_DATABASE: "SAMASA" + DB_USERNAME: "samasa" + DB_PASSWORD: "123samasa" + DB_SERVICENAME: "sipkd.localdomain" + + ORA_CONNECTION: "oracle" ORA_HOST: "10.15.39.193" + ORA_PORT: "1521" + ORA_DATABASE: "NEWSIPKD" + ORA_USERNAME: "proksi" + ORA_PASSWORD: "123456" + ORA_SERVICENAME: "sipkd.localdomain" # Rahasia Sensitive secrets: - APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" - DB_PASSWORD: "pusdatin" - ORA_PASSWORD: "123456" \ No newline at end of file + APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \ No newline at end of file