Merge branch 'main' of http://10.15.39.187/izuddin/sidata

2026-08-27 15:11:47 +07:00
parent a2762ac9a7 3d37694684
commit d34bb6a489
5 changed files with 181 additions and 123 deletions
@@ -14,8 +14,8 @@ variables:
  https_proxy: "http://10.15.3.20:80"
  HTTP_PROXY: "http://10.15.3.20:80"
  HTTPS_PROXY: "http://10.15.3.20:80"
-  no_proxy: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
-  NO_PROXY: "127.0.0.1,localhost,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+  no_proxy: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"
+  NO_PROXY: "127.0.0.1,localhost,10.15.39.168,10.15.39.186,10.15.39.0/24,10.42.0.0/16,10.43.0.0/16,.jakarta.go.id"

 # =========================================================
 # BUILD IMAGE VIA BUILDAH
@@ -72,57 +72,65 @@ deploy:
    - export no_proxy="*"
    - mkdir -p ./kubeconfig-dir
    - echo "$KUBECONFIG_B64" | base64 -d > ./kubeconfig-dir/config
+    - sed -i 's|127.0.0.1|10.15.39.168|g' ./kubeconfig-dir/config
    - chmod 600 ./kubeconfig-dir/config
    - export KUBECONFIG=$(pwd)/kubeconfig-dir/config
    
    - echo '2. TEST CONNECTION TO RKE2'
-    - kubectl version --client
-    - kubectl get nodes
-    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f -
+    - kubectl version --client --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    - kubectl get nodes --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
+    - kubectl create namespace $KUBE_NAMESPACE --dry-run=client -o yaml | kubectl apply -f - --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
    
    - echo '3. VALIDASI TEMPLATE HELM (DEBUG)'
    - helm template $HELM_RELEASE ./helm/sidata --namespace $KUBE_NAMESPACE --debug

+    - echo '3.5. CLEAN UNMANAGED SERVICE JIKA BENTROK'
+    # Menghapus service non-helm (hasil manual kubectl expose tadi) agar peluncuran Helm bersih
+    - kubectl delete service sidata-service -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || true
+
    - echo '4. DEPLOYING APPS VIA HELM'
    - |
      helm upgrade --install $HELM_RELEASE ./helm/sidata \
+        --kube-apiserver https://10.15.39.168:6443 \
+        --kube-insecure-skip-tls-verify \
        --namespace $KUBE_NAMESPACE \
+        --force \
        --set image.repository=$IMAGE \
        --set image.tag=$TAG \
        --set-string podAnnotations.rolloutTimestamp="$(date +%s)" \
        --set service.type=NodePort \
-        --set service.nodePort=32180 \
+        --set service.nodePort=32185 \
+        --set service.name=sidata-service \
        --set-string extraEnv.APP_ENV="production" \
        --set-string extraEnv.APP_DEBUG="false" \
        --set-string extraEnv.FORCE_HTTPS="true" \
        --set-string extraEnv.APP_KEY="base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM=" \
-        --set-string extraEnv.APP_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
-        --set-string extraEnv.ASSET_URL="https://dashboard-bpkd.drc-bpkd.data-center.id/skpp" \
+        --set-string extraEnv.APP_URL="https://data-center.id" \
+        --set-string extraEnv.ASSET_URL="https://data-center.id" \
        --set-string extraEnv.SESSION_DRIVER="file" \
        --set-string extraEnv.SESSION_SECURE_COOKIE="true"
      
    - echo '5. CHECK REAL NODEPORT STATUS'
-    - kubectl get svc -n $KUBE_NAMESPACE
+    - kubectl get svc -n $KUBE_NAMESPACE --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true
    
    - echo '6. CHECK STATUS ROLLOUT'
-    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s || kubectl rollout status deployment/$HELM_RELEASE-skpp -n $KUBE_NAMESPACE --timeout=180s
+    - kubectl rollout status deployment/$HELM_RELEASE -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true || kubectl rollout status deployment/$HELM_RELEASE-sidata -n $KUBE_NAMESPACE --timeout=180s --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true

    - echo '7. AUTO CLEAR LARAVEL CACHE ON POD'
    - |
-      # Berikan jeda 5 detik agar pod baru benar-benar stabil sebelum dieksekusi artisan commands
      sleep 5
      
-      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+      POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
      if [ -z "$POD_NAME" ]; then
-        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
+        POD_NAME=$(kubectl get pods -n $KUBE_NAMESPACE -l app.kubernetes.io/instance=$HELM_RELEASE --field-selector=status.phase=Running --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)
      fi
      
      if [ -n "$POD_NAME" ]; then
        echo "Executing Artisan Clear Cache on Pod: $POD_NAME"
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan config:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan route:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan cache:clear || true
-        kubectl exec -n $KUBE_NAMESPACE $POD_NAME -- php artisan view:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan config:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan route:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan cache:clear || true
+        kubectl exec -n $KUBE_NAMESPACE $POD_NAME --server=https://10.15.39.168:6443 --insecure-skip-tls-verify=true -- php artisan view:clear || true
      else
        echo "Warning: No running pod found for Artisan commands execution, skipping."
      fi
@@ -1,83 +1,157 @@
 # =========================================================
-# 1. COMPOSER STAGE (Untuk binary & vendor generation)
+# APPLICATION STAGE
+# Laravel + PHP 7.4 + OCI8 + Nginx
 # =========================================================
-FROM 10.15.39.186:8084/library/composer:2.7 AS composer

-WORKDIR /app
-
-# Salin file dependensi terlebih dahulu
-COPY composer.json composer.lock ./
-
-# Unduh/susun dependensi di stage composer (Gunakan cache/mirror lokal jika ada)
-RUN composer install --no-dev --prefer-dist --no-scripts --no-autoloader --ignore-platform-reqs
-
-# Salin sisa kode aplikasi ke stage composer
-COPY . .
-
-# Generate autoloader yang sudah dioptimasi
-RUN composer dump-autoload --optimize --no-dev --no-plugins --no-scripts
-
-# =========================================================
-# 2. APPLICATION STAGE
-# =========================================================
 FROM 10.15.39.186:8083/php74-fpm-oci8-lengkap:1.0

+# =========================================================
+# Proxy
+# =========================================================
+
 ARG http_proxy
 ARG https_proxy

-ENV http_proxy=$http_proxy
-ENV https_proxy=$https_proxy
+ENV http_proxy=${http_proxy}
+ENV https_proxy=${https_proxy}
+ENV HTTP_PROXY=${http_proxy}
+ENV HTTPS_PROXY=${https_proxy}

-# Install Nginx & Dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
+# =========================================================
+# System dependencies
+# =========================================================
+
+RUN apt-get update && apt-get install -y \
    nginx \
+    vim \
+    wget \
+    libpng-dev \
+    libjpeg-dev \
+    libfreetype6-dev \
+    libzip-dev \
+    libaio1 \
+    libaio-dev \
+    zip \
+    git \
    unzip \
+    && docker-php-ext-configure gd \
+        --with-freetype \
+        --with-jpeg \
+    && docker-php-ext-install \
+        gd \
+        pdo \
+        pdo_mysql \
+        zip \
    && rm -rf /var/lib/apt/lists/*

+# =========================================================
+# PEAR Proxy
+# =========================================================
+
+RUN pear config-set http_proxy "http://10.15.3.20:80"
+
+# =========================================================
+# Composer
+# =========================================================
+
 WORKDIR /var/www

-# Salin SELURUH source code BESERTA vendor yang sudah jadi dari stage composer
-COPY --from=composer /app /var/www
+# =========================================================
+# Composer dependency
+# Copy hanya composer files terlebih dahulu agar Docker cache
+# =========================================================

-# Hapus proxy dari environment runtime
-ENV http_proxy=
-ENV https_proxy=
+COPY composer.json composer.lock ./

-# Setup Nginx Config
-RUN echo 'server { \
-    listen 80; \
-    index index.php index.html; \
-    error_log  /var/log/nginx/error.log; \
-    access_log /var/log/nginx/access.log; \
-    root /var/www/public; \
-    location ~ \.php$ { \
-        try_files $uri =404; \
-        fastcgi_split_path_info ^(.+\.php)(/.+)$; \
-        fastcgi_pass 127.0.0.1:9000; \
-        fastcgi_index index.php; \
-        include fastcgi_params; \
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; \
-        fastcgi_param PATH_INFO $fastcgi_path_info; \
-    } \
-    location / { \
-        try_files $uri $uri/ /index.php?$query_string; \
-        gzip_static on; \
-    } \
-}' > /etc/nginx/sites-available/default
+COPY --chown=www-data:www-data . .
+
+RUN composer install \
+    --no-dev \
+    --prefer-dist \
+    --no-interaction \
+    --no-scripts \
+    --optimize-autoloader
+
+# =========================================================
+# Laravel directories & permission
+# =========================================================

-# Setup direktori storage & bootstrap cache Laravel serta atur izin akses
 RUN mkdir -p \
        /var/www/storage/framework/sessions \
        /var/www/storage/framework/views \
        /var/www/storage/framework/cache \
+        /var/www/storage/logs \
        /var/www/bootstrap/cache \
+    && touch /var/www/storage/logs/laravel.log \
    && chown -R www-data:www-data /var/www \
-    && chmod -R 775 /var/www/storage /var/www/bootstrap/cache
+    && chmod -R 775 /var/www/storage \
+    && chmod -R 775 /var/www/bootstrap/cache

-ENV APP_ENV=production
-ENV APP_DEBUG=false
-ENV DB_CONNECTION=dejos
+# =========================================================
+# Laravel cache
+# =========================================================
+
+RUN php artisan config:clear || true \
+    && php artisan cache:clear || true \
+    && php artisan view:clear || true
+
+# =========================================================
+# Nginx configuration
+# =========================================================
+
+RUN rm -f /etc/nginx/sites-enabled/default \
+    && rm -f /etc/nginx/sites-available/default
+
+RUN printf '%s\n' \
+'server {' \
+'    listen 80;' \
+'    server_name _;' \
+'' \
+'    root /var/www/public;' \
+'    index index.php index.html;' \
+'' \
+'    access_log /var/log/nginx/access.log;' \
+'    error_log /var/log/nginx/error.log;' \
+'' \
+'    location / {' \
+'        try_files $uri $uri/ /index.php?$query_string;' \
+'    }' \
+'' \
+'    location ~ \.php$ {' \
+'        try_files $uri =404;' \
+'        include fastcgi_params;' \
+'        fastcgi_pass 127.0.0.1:9000;' \
+'        fastcgi_index index.php;' \
+'        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;' \
+'        fastcgi_param PATH_INFO $fastcgi_path_info;' \
+'    }' \
+'' \
+'    location ~ /\.ht {' \
+'        deny all;' \
+'    }' \
+'}' \
+> /etc/nginx/sites-available/default
+
+RUN ln -sf /etc/nginx/sites-available/default \
+    /etc/nginx/sites-enabled/default
+
+# =========================================================
+# Remove proxy from runtime
+# =========================================================
+
+ENV http_proxy=""
+ENV https_proxy=""
+ENV HTTP_PROXY=""
+ENV HTTPS_PROXY=""
+
+# =========================================================
+# Port
+# =========================================================

 EXPOSE 80

+# =========================================================
+# Start PHP-FPM + Nginx
+# =========================================================
+
 CMD ["sh", "-c", "php-fpm -D && exec nginx -g 'daemon off;'"]
@@ -19,51 +19,22 @@ spec:
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }}
          ports:
-            - containerPort: {{ .Values.service.targetPort | default 80 }}
+            - containerPort: 80
          volumeMounts:
            - name: nginx-config-volume
              mountPath: /etc/nginx/http.d/default.conf
              subPath: default.conf
          env:
-            {{- if .Values.env }}
            {{- range $key, $value := .Values.env }}
-            - name: {{ $key }}
-              value: {{ $value | quote }}
+              - name: {{ $key }}
+                value: {{ $value | quote }}
            {{- end }}
-            {{- end }}
-            # --- KONFIGURASI UTAMA SUB-PATH & REVERSE PROXY LARAVEL ---
-            - name: APP_URL
-              value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
-            - name: ASSET_URL
-              value: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
-            - name: SESSION_DRIVER
-              value: "file"
-            - name: SESSION_DOMAIN
-              value: ""
-            - name: SESSION_PATH
-              value: "/"
-            - name: SESSION_SECURE_COOKIE
-              value: "false"
-            - name: SESSION_SAME_SITE
-              value: "lax"
-            - name: TRUSTED_PROXIES
-              value: "*"
-            # --- SECRETS ---
-            - name: APP_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: APP_KEY
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: DB_PASSWORD
-            - name: ORA_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Release.Name }}-secret
-                  key: ORA_PASSWORD
+            
+              - name: APP_KEY
+                valueFrom:
+                  secretKeyRef:
+                    name: {{ .Release.Name }}-secret
+                    key: APP_KEY
      volumes:
        - name: nginx-config-volume
          configMap:
@@ -5,5 +5,3 @@ metadata:
 type: Opaque
 stringData:
  APP_KEY: {{ .Values.secrets.APP_KEY | quote }}
-  DB_PASSWORD: {{ .Values.secrets.DB_PASSWORD | quote }}
-  ORA_PASSWORD: {{ .Values.secrets.ORA_PASSWORD | quote }}
@@ -8,7 +8,7 @@ image:
 service:
  type: NodePort
  port: 80
-  targetPort: 9000
+  targetPort: 80
  nodePort: 32180

 ingress:
@@ -31,15 +31,22 @@ env:
  APP_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
  ASSET_URL: "https://dashboard-bpkd.drc-bpkd.data-center.id/sidata"
  FORCE_HTTPS: "true"
-  DB_CONNECTION: "mysql"
-  DB_HOST: "10.15.39.185"
-  DB_PORT: "3306"
-  DB_DATABASE: "sidata"
-  DB_USERNAME: "aplikasi"
+  DB_CONNECTION: "Samasa"
+  DB_HOST: "10.15.39.193"
+  DB_PORT: "1521"
+  DB_DATABASE: "SAMASA"
+  DB_USERNAME: "samasa"
+  DB_PASSWORD: "123samasa"
+  DB_SERVICENAME: "sipkd.localdomain"
+
+  ORA_CONNECTION: "oracle"
  ORA_HOST: "10.15.39.193"
+  ORA_PORT: "1521"
+  ORA_DATABASE: "NEWSIPKD"
+  ORA_USERNAME: "proksi"
+  ORA_PASSWORD: "123456"
+  ORA_SERVICENAME: "sipkd.localdomain"

 # Rahasia Sensitive
 secrets:
  APP_KEY: "base64:HiyJqrnWz8zB6WUCXTVb6lZsC3EraX/vFIn66Hx/dVM="
-  DB_PASSWORD: "pusdatin"
-  ORA_PASSWORD: "123456"