Merge branch 'main' of http://10.15.39.187/izuddin/sidata

.gitlab-ci.yml

@@ -14,8 +14,8 @@ variables:
   https_proxy: "http://10.15.3.20:80"
   HTTP_PROXY: "http://10.15.3.20:80"
   HTTPS_PROXY: "http://10.15.3.20:80"
-  no_proxy: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+  no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
-  NO_PROXY: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+  NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
 
 # =========================================================
 # BUILD IMAGE VIA BUILDAH
@@ -72,61 +72,69 @@ deploy:
     - export no_proxy="*"
     - mkdir -p ./kubeconfig-dir
     - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
+    - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
     - chmod 600 ./kubeconfig-dir/config
     - export KUBECONFIG=$(pwd)/kubeconfig-dir/config
     
     - echo '2. TEST CONNECTION TO RKE2'
-    - kubectl version --client
+    - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    - kubectl get nodes
+    - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
-    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f -
+    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
     
     - echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
     - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug
 
+    - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
+    # Menghapus service non-helm (hasil manual kubectl expose tadi) agar peluncuran Helm bersih
+    - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
+
     - echo '4. DEPLOYING APPS VIA HELM'
     - |
       helm upgrade --install $HELM_RELEASE ./helm/sidata \
+        --kube-apiserver https://10.15.39.168:6443 \
+        --kube-insecure-skip-tls-verify \
         --namespace $KUBE_NAMESPACE \
+        --force \
         --set image.repository=$IMAGE \
         --set image.tag=$TAG \
         --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
         --set service.type=NodePort \
-        --set service.nodePort=32180 \
+        --set service.nodePort=32185 \
+        --set service.name=sidata-service \
         --set-string extraEnv.APP_ENV="production" \
         --set-string extraEnv.APP_DEBUG="false" \
         --set-string extraEnv.FORCE_HTTPS="true" \
         --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
-        --set-string extraEnv.APP_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
+        --set-string extraEnv.APP_URL="https://data-center.id" \
-        --set-string extraEnv.ASSET_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
+        --set-string extraEnv.ASSET_URL="https://data-center.id" \
         --set-string extraEnv.SESSION_DRIVER="file" \
         --set-string extraEnv.SESSION_SECURE_COOKIE="true"
       
     - echo '5. CHECK REAL NODEPORT STATUS'
-    - kubectl get svc -n $KUBE_NAMESPACE
+    - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
     
     - echo '6. CHECK STATUS ROLLOUT'
-    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s || kubectl rollout status deployment/$HELM_RELEASE-skpp -n $KUBE_NAMESPACE --timeout=180s
+    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
 
     - echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
     - |
-      # Berikan jeda 5 detik agar pod baru benar-benar stabil sebelum dieksekusi artisan commands
       sleep 5
       
-      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
       if [ -z "$POD_NAME" ]; then
-        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
       fi
       
       if [ -n "$POD_NAME" ]; then
         echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan config:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan route:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan cache:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan view:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
       else
         echo "Warning: No running pod found for Artisan commands execution, skipping."
       fi
 
   after_script:
     - echo "Cleaning up sensitive temporary files..."
-    - rm -rf ./kubeconfig-dir
+    - rm -rf ./kubeconfig-dir

Dockerfile

@@ -1,83 +1,157 @@
 # =========================================================
-# 1. COMPOSER STAGE (Untuk binary & vendor generation)
+# APPLICATION STAGE
+# Laravel + PHP 7.4 + OCI8 + Nginx
 # =========================================================
-FROM 10.15.39.186:8084/library/composer:2.7 AS composer
 
-WORKDIR /app
-
-# Salin file dependensi terlebih dahulu
-COPY composer.json composer.lock ./
-
-# Unduh/susun dependensi di stage composer (Gunakan cache/mirror lokal jika ada)
-RUN composer install --no-dev --prefer-dist --no-scripts --no-autoloader --ignore-platform-reqs
-
-# Salin sisa kode aplikasi ke stage composer
-COPY . .
-
-# Generate autoloader yang sudah dioptimasi
-RUN composer dump-autoload --optimize --no-dev --no-plugins --no-scripts
-
-# =========================================================
-# 2. APPLICATION STAGE
-# =========================================================
 FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0
 
+# =========================================================
+# Proxy
+# =========================================================
+
 ARG http_proxy
 ARG https_proxy
 
-ENV http_proxy=$http_proxy
+ENV http_proxy=${http_proxy}
-ENV https_proxy=$https_proxy
+ENV https_proxy=${https_proxy}
+ENV HTTP_PROXY=${http_proxy}
+ENV HTTPS_PROXY=${https_proxy}
 
-# Install Nginx & Dependencies
+# =========================================================
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# System dependencies
+# =========================================================
+
+RUN apt-get update && apt-get install -y \
     nginx \
+    vim \
+    wget \
+    libpng-dev \
+    libjpeg-dev \
+    libfreetype6-dev \
+    libzip-dev \
+    libaio1 \
+    libaio-dev \
+    zip \
+    git \
     unzip \
+    && docker-php-ext-configure gd \
+        --with-freetype \
+        --with-jpeg \
+    && docker-php-ext-install \
+        gd \
+        pdo \
+        pdo_mysql \
+        zip \
     && rm -rf /var/lib/apt/lists/*
 
+# =========================================================
+# PEAR Proxy
+# =========================================================
+
+RUN pear config-set http_proxy "http://10.15.3.20:80"
+
+# =========================================================
+# Composer
+# =========================================================
+
 WORKDIR /var/www
 
-# Salin SELURUH source code BESERTA vendor yang sudah jadi dari stage composer
+# =========================================================
-COPY --from=composer /app /var/www
+# Composer dependency
+# Copy hanya composer files terlebih dahulu agar Docker cache
+# =========================================================
 
-# Hapus proxy dari environment runtime
+COPY composer.json composer.lock ./
-ENV http_proxy=
-ENV https_proxy=
 
-# Setup Nginx Config
+COPY --chown=www-data:www-data . .
-RUN echo 'server { \
+
-    listen 80; \
+RUN composer install \
-    index index.php index.html; \
+    --no-dev \
-    error_log  /var/log/nginx/error.log; \
+    --prefer-dist \
-    access_log /var/log/nginx/access.log; \
+    --no-interaction \
-    root /var/www/public; \
+    --no-scripts \
-    location ~ \.php$ { \
+    --optimize-autoloader
-        try_files $uri =404; \
+
-        fastcgi_split_path_info ^(.+\.php)(/.+)$; \
+# =========================================================
-        fastcgi_pass 127.0.0.1:9000; \
+# Laravel directories & permission
-        fastcgi_index index.php; \
+# =========================================================
-        include fastcgi_params; \
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; \
-        fastcgi_param PATH_INFO $fastcgi_path_info; \
-    } \
-    location / { \
-        try_files $uri $uri/ /index.php?$query_string; \
-        gzip_static on; \
-    } \
-}' > /etc/nginx/sites-available/default
 
-# Setup direktori storage & bootstrap cache Laravel serta atur izin akses
 RUN mkdir -p \
         /var/www/storage/framework/sessions \
         /var/www/storage/framework/views \
         /var/www/storage/framework/cache \
+        /var/www/storage/logs \
         /var/www/bootstrap/cache \
+    && touch /var/www/storage/logs/laravel.log \
     && chown -R www-data:www-data /var/www \
-    && chmod -R 775 /var/www/storage /var/www/bootstrap/cache
+    && chmod -R 775 /var/www/storage \
+    && chmod -R 775 /var/www/bootstrap/cache
 
-ENV APP_ENV=production
+# =========================================================
-ENV APP_DEBUG=false
+# Laravel cache
-ENV DB_CONNECTION=dejos
+# =========================================================
+
+RUN php artisan config:clear || true \
+    && php artisan cache:clear || true \
+    && php artisan view:clear || true
+
+# =========================================================
+# Nginx configuration
+# =========================================================
+
+RUN rm -f /etc/nginx/sites-enabled/default \
+    && rm -f /etc/nginx/sites-available/default
+
+RUN printf '%s\n' \
+'server {' \
+'    listen 80;' \
+'    server_name _;' \
+'' \
+'    root /var/www/public;' \
+'    index index.php index.html;' \
+'' \
+'    access_log /var/log/nginx/access.log;' \
+'    error_log /var/log/nginx/error.log;' \
+'' \
+'    location / {' \
+'        try_files $uri $uri/ /index.php?$query_string;' \
+'    }' \
+'' \
+'    location ~ \.php$ {' \
+'        try_files $uri =404;' \
+'        include fastcgi_params;' \
+'        fastcgi_pass 127.0.0.1:9000;' \
+'        fastcgi_index index.php;' \
+'        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \
+'        fastcgi_param PATH_INFO $fastcgi_path_info;' \
+'    }' \
+'' \
+'    location ~ /\.ht {' \
+'        deny all;' \
+'    }' \
+'}' \
+> /etc/nginx/sites-available/default
+
+RUN ln -sf /etc/nginx/sites-available/default \
+    /etc/nginx/sites-enabled/default
+
+# =========================================================
+# Remove proxy from runtime
+# =========================================================
+
+ENV http_proxy=""
+ENV https_proxy=""
+ENV HTTP_PROXY=""
+ENV HTTPS_PROXY=""
+
+# =========================================================
+# Port
+# =========================================================
 
 EXPOSE 80
 
-CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]
+# =========================================================
+# Start PHP-FPM + Nginx
+# =========================================================
+
+CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]

helm/sidata/templates/deployment.yaml

@@ -19,51 +19,22 @@ spec:
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }}
           ports:
-            - containerPort: {{ .Values.service.targetPort | default 80 }}
+            - containerPort: 80
           volumeMounts:
             - name: nginx-config-volume
               mountPath: /etc/nginx/http.d/default.conf
               subPath: default.conf
           env:
-            {{- if .Values.env }}
             {{- range $key, $value := .Values.env }}
-            - name: {{ $key }}
+              - name: {{ $key }}
-              value: {{ $value | quote }}
+                value: {{ $value | quote }}
             {{- end }}
-            {{- end }}
+            
-            # --- KONFIGURASI UTAMA SUB-PATH & REVERSE PROXY LARAVEL ---
+              - name: APP_KEY
-            - name: APP_URL
+                valueFrom:
-              value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
+                  secretKeyRef:
-            - name: ASSET_URL
+                    name: {{ .Release.Name }}-secret
-              value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
+                    key: APP_KEY
-            - name: SESSION_DRIVER
-              value: "file"
-            - name: SESSION_DOMAIN
-              value: ""
-            - name: SESSION_PATH
-              value: "/"
-            - name: SESSION_SECURE_COOKIE
-              value: "false"
-            - name: SESSION_SAME_SITE
-              value: "lax"
-            - name: TRUSTED_PROXIES
-              value: "*"
-            # --- SECRETS ---
-            - name: APP_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: APP_KEY
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: DB_PASSWORD
-            - name: ORA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: ORA_PASSWORD
       volumes:
         - name: nginx-config-volume
           configMap:

helm/sidata/templates/secret.yaml

@@ -4,6 +4,4 @@ metadata:
   name: {{ .Release.Name }}-secret
 type: Opaque
 stringData:
-  APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
+  APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
-  DB_PASSWORD: {{ .Values.secrets.DB_PASSWORD | quote }}
-  ORA_PASSWORD: {{ .Values.secrets.ORA_PASSWORD | quote }}

helm/sidata/values.yaml

@@ -8,7 +8,7 @@ image:
 service:
   type: NodePort
   port: 80
-  targetPort: 9000
+  targetPort: 80
   nodePort: 32180
 
 ingress:
@@ -31,15 +31,22 @@ env:
   APP_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
   ASSET_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
   FORCE_HTTPS: "true"
-  DB_CONNECTION: "mysql"
+  DB_CONNECTION: "Samasa"
-  DB_HOST: "10.15.39.185"
+  DB_HOST: "10.15.39.193"
-  DB_PORT: "3306"
+  DB_PORT: "1521"
-  DB_DATABASE: "sidata"
+  DB_DATABASE: "SAMASA"
-  DB_USERNAME: "aplikasi"
+  DB_USERNAME: "samasa"
+  DB_PASSWORD: "123samasa"
+  DB_SERVICENAME: "sipkd.localdomain"
+
+  ORA_CONNECTION: "oracle"
   ORA_HOST: "10.15.39.193"
+  ORA_PORT: "1521"
+  ORA_DATABASE: "NEWSIPKD"
+  ORA_USERNAME: "proksi"
+  ORA_PASSWORD: "123456"
+  ORA_SERVICENAME: "sipkd.localdomain"
 
 # Rahasia Sensitive
 secrets:
-  APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
+  APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
-  DB_PASSWORD: "pusdatin"
-  ORA_PASSWORD: "123456"