init

2026-01-31 19:26:46 +01:00
commit 9a0900e3ff
42 changed files with 8346 additions and 0 deletions
--- a/packages/infra/README.md
+++ b/packages/infra/README.md
@@ -0,0 +1,12 @@
+# @mintel/infra
+
+Infrastructure templates for Mintel projects.
+
+## Contents
+
+- `docker/`: Universal `Dockerfile.nextjs` and `docker-compose.template.yml`.
+- `gitea/`: Production-ready `deploy-action.yml` for Gitea Actions.
+
+## Usage
+
+These files are automatically injected into new projects by the `@mintel/cli`.
--- a/packages/infra/docker/Dockerfile.nextjs
+++ b/packages/infra/docker/Dockerfile.nextjs
@@ -0,0 +1,66 @@
+FROM node:20-alpine AS base
+
+# Install dependencies only when needed
+FROM base AS deps
+RUN apk add --no-cache libc6-compat curl
+WORKDIR /app
+
+# Install dependencies based on the preferred package manager
+COPY package.json package-lock.json* pnpm-lock.yaml* ./
+RUN if [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm i --frozen-lockfile; \
+    elif [ -f package-lock.json ]; then npm ci; \
+    else npm i; fi
+
+# Rebuild the source code only when needed
+FROM base AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
+COPY . .
+
+# Next.js collects completely anonymous telemetry data about general usage.
+ENV NEXT_TELEMETRY_DISABLED=1
+
+# Build-time environment variables for Next.js
+ARG NEXT_PUBLIC_BASE_URL
+ARG NEXT_PUBLIC_UMAMI_WEBSITE_ID
+ARG NEXT_PUBLIC_UMAMI_SCRIPT_URL
+
+ENV NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
+ENV NEXT_PUBLIC_UMAMI_WEBSITE_ID=$NEXT_PUBLIC_UMAMI_WEBSITE_ID
+ENV NEXT_PUBLIC_UMAMI_SCRIPT_URL=$NEXT_PUBLIC_UMAMI_SCRIPT_URL
+
+# Build the application
+RUN if [ -f pnpm-lock.yaml ]; then corepack enable pnpm && pnpm run build; \
+    else npm run build; fi
+
+# Production image, copy all the files and run next
+FROM base AS runner
+WORKDIR /app
+
+# Install curl for health checks
+RUN apk add --no-cache curl
+
+ENV NODE_ENV=production
+ENV NEXT_TELEMETRY_DISABLED=1
+
+RUN addgroup --system --gid 1001 nodejs
+RUN adduser --system --uid 1001 nextjs
+
+COPY --from=builder /app/public ./public
+
+# Set the correct permission for prerender cache
+RUN mkdir .next
+RUN chown nextjs:nodejs .next
+
+# Automatically leverage output traces to reduce image size
+COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
+COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
+
+USER nextjs
+
+EXPOSE 3000
+
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+
+CMD ["node", "server.js"]
--- a/packages/infra/docker/docker-compose.template.yml
+++ b/packages/infra/docker/docker-compose.template.yml
@@ -0,0 +1,33 @@
+services:
+  app:
+    image: registry.infra.mintel.me/${PROJECT_NAME:-mintel/app}:${IMAGE_TAG:-latest}
+    restart: always
+    networks:
+      - infra
+    ports:
+      - "3000:3000"
+    env_file:
+      - ${ENV_FILE:-.env}
+    labels:
+      - "traefik.enable=true"
+      # HTTP ⇒ HTTPS redirect
+      - "traefik.http.routers.${APP_NAME:-app}-web.rule=Host(${TRAEFIK_HOST}) && !PathPrefix(`/.well-known/acme-challenge/`)"
+      - "traefik.http.routers.${APP_NAME:-app}-web.entrypoints=web"
+      - "traefik.http.routers.${APP_NAME:-app}-web.middlewares=redirect-https"
+      # HTTPS router
+      - "traefik.http.routers.${APP_NAME:-app}.rule=Host(${TRAEFIK_HOST})"
+      - "traefik.http.routers.${APP_NAME:-app}.entrypoints=websecure"
+      - "traefik.http.routers.${APP_NAME:-app}.tls.certresolver=le"
+      - "traefik.http.routers.${APP_NAME:-app}.tls=true"
+      - "traefik.http.routers.${APP_NAME:-app}.service=${APP_NAME:-app}"
+      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.port=3000"
+      - "traefik.http.services.${APP_NAME:-app}.loadbalancer.server.scheme=http"
+      # Forwarded Headers
+      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.middlewares.${APP_NAME:-app}-forward.headers.customrequestheaders.X-Forwarded-Ssl=on"
+      # Middlewares
+      - "traefik.http.routers.${APP_NAME:-app}.middlewares=${APP_NAME:-app}-forward,compress"
+
+networks:
+  infra:
+    external: true
--- a/packages/infra/gitea/deploy-action.yml
+++ b/packages/infra/gitea/deploy-action.yml
@@ -0,0 +1,197 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main, staging]
+
+jobs:
+  build-and-deploy:
+    runs-on: docker
+
+    steps:
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # LOGGING: Workflow Start - Full Transparency
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 📋 Log Workflow Start
+        run: |
+          echo "🚀 Starting deployment for ${{ github.repository }} (${{ github.ref }})"
+          echo "  • Branch: ${{ github.ref_name }}"
+          echo "  • Commit: ${{ github.sha }}"
+          echo "  • Timestamp: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # LOGGING: Registry Login Phase
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 🔐 Login to private registry
+        run: |
+          echo "🔐 Authenticating with registry.infra.mintel.me..."
+          echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # LOGGING: Build Phase
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 🏗️ Build Docker image
+        env:
+          NEXT_PUBLIC_BASE_URL: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_BASE_URL || (secrets.STAGING_NEXT_PUBLIC_BASE_URL || secrets.NEXT_PUBLIC_BASE_URL) }}
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID || (secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
+          NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL || (secrets.STAGING_NEXT_PUBLIC_UMAMI_SCRIPT_URL || secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL) }}
+        run: |
+          echo "🏗️ Building Docker image (linux/arm64) for branch ${{ github.ref_name }}..."
+          docker buildx build \
+            --pull \
+            --platform linux/arm64 \
+            --build-arg NEXT_PUBLIC_BASE_URL="$NEXT_PUBLIC_BASE_URL" \
+            --build-arg NEXT_PUBLIC_UMAMI_WEBSITE_ID="$NEXT_PUBLIC_UMAMI_WEBSITE_ID" \
+            --build-arg NEXT_PUBLIC_UMAMI_SCRIPT_URL="$NEXT_PUBLIC_UMAMI_SCRIPT_URL" \
+            -t registry.infra.mintel.me/${{ github.repository }}:${{ github.sha }} \
+            -t registry.infra.mintel.me/${{ github.repository }}:latest \
+            --push .
+
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # LOGGING: Deployment Phase
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 🚀 Deploy to server
+        env:
+          NEXT_PUBLIC_BASE_URL: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_BASE_URL || (secrets.STAGING_NEXT_PUBLIC_BASE_URL || secrets.NEXT_PUBLIC_BASE_URL) }}
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID || (secrets.STAGING_NEXT_PUBLIC_UMAMI_WEBSITE_ID || secrets.NEXT_PUBLIC_UMAMI_WEBSITE_ID) }}
+          NEXT_PUBLIC_UMAMI_SCRIPT_URL: ${{ github.ref_name == 'main' && secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL || (secrets.STAGING_NEXT_PUBLIC_UMAMI_SCRIPT_URL || secrets.NEXT_PUBLIC_UMAMI_SCRIPT_URL) }}
+          SENTRY_DSN: ${{ github.ref_name == 'main' && secrets.SENTRY_DSN || (secrets.STAGING_SENTRY_DSN || secrets.SENTRY_DSN) }}
+          MAIL_HOST: ${{ github.ref_name == 'main' && secrets.MAIL_HOST || (secrets.STAGING_MAIL_HOST || secrets.MAIL_HOST) }}
+          MAIL_PORT: ${{ github.ref_name == 'main' && secrets.MAIL_PORT || (secrets.STAGING_MAIL_PORT || secrets.MAIL_PORT) }}
+          MAIL_USERNAME: ${{ github.ref_name == 'main' && secrets.MAIL_USERNAME || (secrets.STAGING_MAIL_USERNAME || secrets.MAIL_USERNAME) }}
+          MAIL_PASSWORD: ${{ github.ref_name == 'main' && secrets.MAIL_PASSWORD || (secrets.STAGING_MAIL_PASSWORD || secrets.MAIL_PASSWORD) }}
+          MAIL_FROM: ${{ github.ref_name == 'main' && secrets.MAIL_FROM || (secrets.STAGING_MAIL_FROM || secrets.MAIL_FROM) }}
+          MAIL_RECIPIENTS: ${{ github.ref_name == 'main' && secrets.MAIL_RECIPIENTS || (secrets.STAGING_MAIL_RECIPIENTS || secrets.MAIL_RECIPIENTS) }}
+        run: |
+          BRANCH=${{ github.ref_name }}
+          
+          # Derive domain from NEXT_PUBLIC_BASE_URL (strip https:// and trailing slash)
+          DOMAIN=$(echo "$NEXT_PUBLIC_BASE_URL" | sed -E 's|https?://||' | sed -E 's|/.*||')
+          
+          if [ "$BRANCH" = "main" ]; then
+            ENV_FILE=.env.prod
+            # For production, we want both root and www
+            TRAEFIK_HOST="\`$DOMAIN\`, \`www.$DOMAIN\`"
+          else
+            ENV_FILE=.env.staging
+            TRAEFIK_HOST="\`$DOMAIN\`"
+          fi
+          
+          echo "🚀 Deploying branch $BRANCH to $ENV_FILE..."
+          echo "🌐 Domain: $DOMAIN"
+          
+          # Setup SSH
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          
+          # Create .env file content
+          cat > /tmp/app.env << EOF
+          # ============================================================================
+          # Environment Configuration ($BRANCH)
+          # ============================================================================
+          # Auto-generated by CI/CD workflow
+          # ============================================================================
+          
+          NODE_ENV=production
+          NEXT_PUBLIC_BASE_URL=$NEXT_PUBLIC_BASE_URL
+          NEXT_PUBLIC_UMAMI_WEBSITE_ID=$NEXT_PUBLIC_UMAMI_WEBSITE_ID
+          NEXT_PUBLIC_UMAMI_SCRIPT_URL=$NEXT_PUBLIC_UMAMI_SCRIPT_URL
+          SENTRY_DSN=$SENTRY_DSN
+          MAIL_HOST=$MAIL_HOST
+          MAIL_PORT=$MAIL_PORT
+          MAIL_USERNAME=$MAIL_USERNAME
+          MAIL_PASSWORD=$MAIL_PASSWORD
+          MAIL_FROM=$MAIL_FROM
+          MAIL_RECIPIENTS=$MAIL_RECIPIENTS
+          
+          # Deployment variables for docker-compose
+          IMAGE_TAG=${{ github.sha }}
+          TRAEFIK_HOST=$TRAEFIK_HOST
+          ENV_FILE=$ENV_FILE
+          EOF
+          
+          APP_DIR="/home/deploy/sites/${{ github.event.repository.name }}"
+          ssh -o StrictHostKeyChecking=accept-new root@${{ secrets.SSH_HOST }} "mkdir -p $APP_DIR"
+          scp -o StrictHostKeyChecking=accept-new /tmp/app.env root@${{ secrets.SSH_HOST }}:$APP_DIR/$ENV_FILE
+          scp -o StrictHostKeyChecking=accept-new docker-compose.yml root@${{ secrets.SSH_HOST }}:$APP_DIR/docker-compose.yml
+          
+          ssh -o StrictHostKeyChecking=accept-new root@${{ secrets.SSH_HOST }} bash << EOF
+          set -e
+          cd $APP_DIR
+          
+          chmod 600 $ENV_FILE
+          chown deploy:deploy $ENV_FILE
+          
+          echo "${{ secrets.REGISTRY_PASS }}" | docker login registry.infra.mintel.me -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          
+          echo "📥 Pulling images..."
+          IMAGE_TAG=${{ github.sha }} ENV_FILE=$ENV_FILE TRAEFIK_HOST="$TRAEFIK_HOST" docker compose --env-file $ENV_FILE pull
+          
+          echo "🚀 Starting containers..."
+          IMAGE_TAG=${{ github.sha }} ENV_FILE=$ENV_FILE TRAEFIK_HOST="$TRAEFIK_HOST" docker compose --env-file $ENV_FILE up -d
+          
+          echo "🧹 Cleaning up old images..."
+          docker system prune -f
+          
+          echo "⏳ Giving the app a few seconds to warm up..."
+          sleep 10
+          
+          echo "🔍 Checking container status..."
+          docker compose --env-file $ENV_FILE ps
+          
+          if ! docker compose --env-file $ENV_FILE ps | grep -q "Up"; then
+            echo "❌ Container failed to start"
+            docker compose --env-file $ENV_FILE logs --tail=100
+            exit 1
+          fi
+          
+          echo "✅ Deployment complete!"
+          EOF
+          
+          rm -f /tmp/app.env
+
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # LOGGING: Workflow Summary
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 📊 Workflow Summary
+        if: always()
+        run: |
+          echo "📊 Status: ${{ job.status }}"
+          echo "🎯 Target: ${{ secrets.SSH_HOST }}"
+          echo "🌿 Branch: ${{ github.ref_name }}"
+
+      # ═══════════════════════════════════════════════════════════════════════════════
+      # NOTIFICATION: Gotify
+      # ═══════════════════════════════════════════════════════════════════════════════
+      - name: 🔔 Gotify Notification (Success)
+        if: success()
+        run: |
+          echo "Sending success notification to Gotify..."
+          curl -k -s -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
+            -F "title=✅ Deployment Success: ${{ github.repository }}" \
+            -F "message=The deployment of ${{ github.repository }} (branch: ${{ github.ref_name }}) was successful.
+            
+            Commit: ${{ github.sha }}
+            Actor: ${{ github.actor }}
+            Run ID: ${{ github.run_id }}" \
+            -F "priority=5"
+
+      - name: 🔔 Gotify Notification (Failure)
+        if: failure()
+        run: |
+          echo "Sending failure notification to Gotify..."
+          curl -k -s -X POST "${{ secrets.GOTIFY_URL }}/message?token=${{ secrets.GOTIFY_TOKEN }}" \
+            -F "title=❌ Deployment Failed: ${{ github.repository }}" \
+            -F "message=The deployment of ${{ github.repository }} (branch: ${{ github.ref_name }}) failed!
+            
+            Commit: ${{ github.sha }}
+            Actor: ${{ github.actor }}
+            Run ID: ${{ github.run_id }}
+            
+            Please check the logs for details." \
+            -F "priority=8"
--- a/packages/infra/package.json
+++ b/packages/infra/package.json
@@ -0,0 +1,12 @@
+{
+  "name": "@mintel/infra",
+  "version": "1.0.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://npm.infra.mintel.me"
+  },
+  "files": [
+    "docker",
+    "gitea"
+  ]
+}