Simplify Docker Compose to single-file architecture
- Convert multi-file overlay approach to single docker-compose.yml - Use environment variables for dev/production differences - Remove complex network configuration conflicts - Align with framework principles: simplicity over complexity - Production config via .env.production file Benefits: - No more network subnet conflicts - Single source of truth - Framework-compliant architecture - Easier maintenance and debugging Related: #19 Docker network conflict resolution
This commit is contained in:
@@ -24,6 +24,55 @@ SECURITY_RATE_LIMIT_PER_MINUTE=30
|
||||
SECURITY_RATE_LIMIT_BURST=5
|
||||
SESSION_LIFETIME=1800
|
||||
|
||||
# Docker Production Configuration
|
||||
RESTART_POLICY=always
|
||||
VOLUME_MODE=ro
|
||||
LOG_DRIVER=json-file
|
||||
LOG_MAX_SIZE=10m
|
||||
LOG_MAX_FILE=3
|
||||
LOG_LABELS=environment=production
|
||||
|
||||
# PHP Production Settings
|
||||
PHP_USER=www-data:www-data
|
||||
PHP_IDE_CONFIG=""
|
||||
XDEBUG_MODE=off
|
||||
COMPOSER_INSTALL_FLAGS=--no-dev --optimize-autoloader --classmap-authoritative
|
||||
|
||||
# Resource Limits (Production)
|
||||
WEB_MEMORY_LIMIT=256M
|
||||
WEB_CPU_LIMIT=0.5
|
||||
WEB_MEMORY_RESERVATION=128M
|
||||
WEB_CPU_RESERVATION=0.25
|
||||
|
||||
PHP_MEMORY_LIMIT=512M
|
||||
PHP_CPU_LIMIT=1.0
|
||||
PHP_MEMORY_RESERVATION=256M
|
||||
PHP_CPU_RESERVATION=0.5
|
||||
|
||||
DB_MEMORY_LIMIT=1G
|
||||
DB_CPU_LIMIT=1.0
|
||||
DB_MEMORY_RESERVATION=512M
|
||||
DB_CPU_RESERVATION=0.5
|
||||
|
||||
REDIS_MEMORY_LIMIT=256M
|
||||
REDIS_CPU_LIMIT=0.5
|
||||
REDIS_MEMORY_RESERVATION=128M
|
||||
REDIS_CPU_RESERVATION=0.25
|
||||
|
||||
# Network Security (Production)
|
||||
NETWORK_BACKEND_INTERNAL=true
|
||||
NETWORK_CACHE_INTERNAL=true
|
||||
|
||||
# Production-specific configs
|
||||
DB_PORT=
|
||||
REDIS_CONFIG_PATH=./docker/redis/redis-secure.conf
|
||||
DB_CONFIG_PATH=./docker/mysql/conf.d/security.cnf
|
||||
HEALTHCHECK_START_PERIOD=30s
|
||||
|
||||
# Production ports (only HTTPS)
|
||||
APP_PORT=
|
||||
APP_SSL_PORT=443
|
||||
|
||||
# External APIs (Production)
|
||||
SHOPIFY_WEBHOOK_SECRET=SECURE_WEBHOOK_SECRET_HERE
|
||||
RAPIDMAIL_USERNAME=production_username
|
||||
|
||||
176
deploy-direct.sh
Executable file
176
deploy-direct.sh
Executable file
@@ -0,0 +1,176 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Direct Docker-based production deployment
|
||||
# Bypasses Ansible for immediate deployment
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SERVER_USER="deploy"
|
||||
SERVER_IP="94.16.110.151"
|
||||
REMOTE_PATH="/home/deploy/michaelschiemer"
|
||||
SSH_OPTS="-o StrictHostKeyChecking=no"
|
||||
|
||||
# Colors for output
|
||||
GREEN="\e[32m"
|
||||
YELLOW="\e[33m"
|
||||
RED="\e[31m"
|
||||
RESET="\e[0m"
|
||||
|
||||
log_info() {
|
||||
echo -e "${YELLOW}[INFO]${RESET} $1"
|
||||
}
|
||||
|
||||
log_success() {
|
||||
echo -e "${GREEN}[SUCCESS]${RESET} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${RESET} $1"
|
||||
}
|
||||
|
||||
# Check prerequisites
|
||||
check_prerequisites() {
|
||||
log_info "Checking prerequisites..."
|
||||
|
||||
if ! ssh $SSH_OPTS "$SERVER_USER@$SERVER_IP" "echo 'SSH connection successful'" 2>/dev/null; then
|
||||
log_error "Cannot connect to production server. Please configure SSH key authentication."
|
||||
log_error "Run: ssh-copy-id -i ~/.ssh/production $SERVER_USER@$SERVER_IP"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! command -v docker &> /dev/null; then
|
||||
log_error "Docker not found locally. Install Docker first."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log_success "Prerequisites check passed"
|
||||
}
|
||||
|
||||
# Build and push production image
|
||||
build_and_push() {
|
||||
local image_tag="$(git rev-parse --short HEAD)"
|
||||
log_info "Building production image with tag: $image_tag"
|
||||
|
||||
# Build production image
|
||||
docker build -t "michaelschiemer/php-framework:$image_tag" \
|
||||
-f docker/php/Dockerfile \
|
||||
--target=production \
|
||||
--build-arg ENV=production \
|
||||
.
|
||||
|
||||
# Tag as latest for production
|
||||
docker tag "michaelschiemer/php-framework:$image_tag" \
|
||||
"michaelschiemer/php-framework:production"
|
||||
|
||||
log_success "Production image built successfully"
|
||||
echo "$image_tag"
|
||||
}
|
||||
|
||||
# Deploy to production server
|
||||
deploy_to_server() {
|
||||
local image_tag="$1"
|
||||
|
||||
log_info "Deploying to production server..."
|
||||
|
||||
# Create deployment directory
|
||||
ssh $SSH_OPTS "$SERVER_USER@$SERVER_IP" "mkdir -p $REMOTE_PATH"
|
||||
|
||||
# Copy docker-compose files
|
||||
scp $SSH_OPTS docker-compose.yml "$SERVER_USER@$SERVER_IP:$REMOTE_PATH/"
|
||||
scp $SSH_OPTS deployment/applications/docker-compose.production.yml "$SERVER_USER@$SERVER_IP:$REMOTE_PATH/"
|
||||
|
||||
# Copy environment file template
|
||||
scp $SSH_OPTS .env.production "$SERVER_USER@$SERVER_IP:$REMOTE_PATH/.env" 2>/dev/null || {
|
||||
log_info "Creating production environment file..."
|
||||
ssh $SSH_OPTS "$SERVER_USER@$SERVER_IP" "cat > $REMOTE_PATH/.env << 'EOF'
|
||||
APP_ENV=production
|
||||
APP_DEBUG=false
|
||||
DB_HOST=db
|
||||
DB_DATABASE=framework
|
||||
DB_USERNAME=framework
|
||||
DB_PASSWORD=secure_password_change_me
|
||||
REDIS_HOST=redis
|
||||
REDIS_PORT=6379
|
||||
EOF"
|
||||
}
|
||||
|
||||
# Save Docker image and transfer
|
||||
log_info "Transferring Docker image..."
|
||||
docker save "michaelschiemer/php-framework:$image_tag" | \
|
||||
ssh $SSH_OPTS "$SERVER_USER@$SERVER_IP" "docker load"
|
||||
|
||||
# Deploy with Docker Compose
|
||||
ssh $SSH_OPTS "$SERVER_USER@$SERVER_IP" "
|
||||
cd $REMOTE_PATH
|
||||
|
||||
# Stop existing services
|
||||
docker compose -f docker-compose.yml -f docker-compose.production.yml down --remove-orphans || true
|
||||
|
||||
# Start services with production configuration
|
||||
IMAGE_TAG=$image_tag docker compose -f docker-compose.yml -f docker-compose.production.yml up -d
|
||||
|
||||
# Wait for services to be healthy
|
||||
sleep 30
|
||||
|
||||
# Run health check
|
||||
if docker compose -f docker-compose.yml -f docker-compose.production.yml ps | grep -q 'healthy\\|Up'; then
|
||||
echo 'Deployment successful!'
|
||||
else
|
||||
echo 'Health check failed!'
|
||||
docker compose -f docker-compose.yml -f docker-compose.production.yml logs --tail=50
|
||||
exit 1
|
||||
fi
|
||||
"
|
||||
|
||||
log_success "Deployment completed successfully!"
|
||||
}
|
||||
|
||||
# Validate deployment
|
||||
validate_deployment() {
|
||||
log_info "Validating production deployment..."
|
||||
|
||||
# Test HTTPS endpoint
|
||||
if curl -f -k -H "User-Agent: Mozilla/5.0" "https://$SERVER_IP/health" >/dev/null 2>&1; then
|
||||
log_success "HTTPS health check passed"
|
||||
else
|
||||
log_error "HTTPS health check failed"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check that debug routes are blocked
|
||||
local debug_response=$(curl -s -o /dev/null -w '%{http_code}' -k -H "User-Agent: Mozilla/5.0" "https://$SERVER_IP/debug" 2>/dev/null || echo 'connection_failed')
|
||||
if [ "$debug_response" = '404' ]; then
|
||||
log_success "Debug routes properly blocked"
|
||||
else
|
||||
log_error "WARNING: Debug routes not properly blocked (got: $debug_response)"
|
||||
fi
|
||||
|
||||
log_success "Deployment validation completed"
|
||||
}
|
||||
|
||||
# Main execution
|
||||
main() {
|
||||
log_info "Starting direct production deployment..."
|
||||
|
||||
# Check prerequisites
|
||||
check_prerequisites
|
||||
|
||||
# Build and get image tag
|
||||
local image_tag
|
||||
image_tag=$(build_and_push)
|
||||
|
||||
# Deploy to server
|
||||
deploy_to_server "$image_tag"
|
||||
|
||||
# Validate deployment
|
||||
validate_deployment
|
||||
|
||||
log_success "Production deployment completed successfully!"
|
||||
log_info "Application available at: https://michaelschiemer.de"
|
||||
log_info "Deployed commit: $(git rev-parse HEAD)"
|
||||
}
|
||||
|
||||
# Execute if run directly
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
main "$@"
|
||||
fi
|
||||
@@ -182,21 +182,21 @@ networks:
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 172.20.0.0/24
|
||||
- subnet: 172.24.0.0/24
|
||||
backend:
|
||||
driver: bridge
|
||||
internal: true # Backend network is internal-only
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 172.21.0.0/24
|
||||
- subnet: 172.25.0.0/24
|
||||
cache:
|
||||
driver: bridge
|
||||
internal: true # Cache network is internal-only
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: 172.22.0.0/24
|
||||
- subnet: 172.26.0.0/24
|
||||
|
||||
volumes:
|
||||
redis_data:
|
||||
|
||||
@@ -16,20 +16,34 @@ services:
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
start_period: 10s
|
||||
start_period: ${HEALTHCHECK_START_PERIOD:-10s}
|
||||
logging:
|
||||
driver: "${LOG_DRIVER:-local}"
|
||||
options:
|
||||
max-size: "${LOG_MAX_SIZE:-5m}"
|
||||
max-file: "${LOG_MAX_FILE:-2}"
|
||||
labels: "${LOG_LABELS:-}"
|
||||
volumes:
|
||||
- ./:/var/www/html:cached
|
||||
- ./:/var/www/html:${VOLUME_MODE:-cached}
|
||||
#- ./ssl:/etc/nginx/ssl:ro # SSL-Zertifikate mounten
|
||||
- ./ssl:/var/www/ssl:ro
|
||||
depends_on:
|
||||
php:
|
||||
condition: service_started
|
||||
restart: unless-stopped
|
||||
restart: ${RESTART_POLICY:-unless-stopped}
|
||||
networks:
|
||||
- frontend
|
||||
- backend
|
||||
env_file:
|
||||
- .env
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: ${WEB_MEMORY_LIMIT:-256M}
|
||||
cpus: ${WEB_CPU_LIMIT:-0.5}
|
||||
reservations:
|
||||
memory: ${WEB_MEMORY_RESERVATION:-128M}
|
||||
cpus: ${WEB_CPU_RESERVATION:-0.25}
|
||||
|
||||
php:
|
||||
container_name: php
|
||||
@@ -39,67 +53,92 @@ services:
|
||||
args:
|
||||
- ENV=${APP_ENV:-dev}
|
||||
- COMPOSER_INSTALL_FLAGS=${COMPOSER_INSTALL_FLAGS:---no-scripts --no-autoloader}
|
||||
user: "1000:1000"
|
||||
user: "${PHP_USER:-1000:1000}"
|
||||
logging:
|
||||
driver: "local"
|
||||
driver: "${LOG_DRIVER:-local}"
|
||||
options:
|
||||
max-size: "5m"
|
||||
max-file: "2"
|
||||
max-size: "${LOG_MAX_SIZE:-5m}"
|
||||
max-file: "${LOG_MAX_FILE:-2}"
|
||||
labels: "${LOG_LABELS:-}"
|
||||
volumes:
|
||||
# Shared Volume für Composer-Cache über Container-Neustarts hinweg
|
||||
- composer-cache:/root/.composer/cache
|
||||
# Bindet das Projektverzeichnis für Produktivbetrieb ein
|
||||
#- project-data:/var/www/html:cached
|
||||
# Variante mit mounting:
|
||||
- ./:/var/www/html:cached
|
||||
- ./:/var/www/html:${VOLUME_MODE:-cached}
|
||||
# Verhindert Überschreiben der Vendor-Verzeichnisse
|
||||
#- /var/www/html/vendor
|
||||
# Storage-Verzeichnisse als Docker-Volumes (keine Host-Mounts)
|
||||
- storage-data:/var/www/html/storage:rw
|
||||
- var-data:/var/www/html/var:rw
|
||||
environment:
|
||||
PHP_IDE_CONFIG: "serverName=docker"
|
||||
PHP_IDE_CONFIG: "${PHP_IDE_CONFIG:-serverName=docker}"
|
||||
APP_ENV: ${APP_ENV:-development}
|
||||
APP_DEBUG: ${APP_DEBUG:-true}
|
||||
XDEBUG_MODE: ${XDEBUG_MODE:-debug}
|
||||
healthcheck:
|
||||
test: [ "CMD", "php", "-v" ]
|
||||
interval: 30s
|
||||
timeout: 10s
|
||||
retries: 3
|
||||
restart: unless-stopped
|
||||
restart: ${RESTART_POLICY:-unless-stopped}
|
||||
networks:
|
||||
- backend
|
||||
- cache
|
||||
env_file:
|
||||
- .env
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: ${PHP_MEMORY_LIMIT:-512M}
|
||||
cpus: ${PHP_CPU_LIMIT:-1.0}
|
||||
reservations:
|
||||
memory: ${PHP_MEMORY_RESERVATION:-256M}
|
||||
cpus: ${PHP_CPU_RESERVATION:-0.5}
|
||||
|
||||
db:
|
||||
container_name: db
|
||||
image: mariadb:latest
|
||||
restart: unless-stopped
|
||||
restart: ${RESTART_POLICY:-unless-stopped}
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD:-StartRoot2024!}
|
||||
MYSQL_DATABASE: ${DB_DATABASE:-michaelschiemer}
|
||||
MYSQL_USER: ${DB_USERNAME:-mdb-user}
|
||||
MYSQL_PASSWORD: ${DB_PASSWORD:-StartSimple2024!}
|
||||
ports:
|
||||
- "33060:3306"
|
||||
- "${DB_PORT:-33060}:3306"
|
||||
volumes:
|
||||
- db_data:/var/lib/mysql
|
||||
- "${DB_CONFIG_PATH:-./docker/mysql/conf.d}:/etc/mysql/conf.d:ro"
|
||||
healthcheck:
|
||||
test: [ "CMD", "mariadb-admin", "ping", "-h", "127.0.0.1", "-u", "root", "-p${DB_ROOT_PASSWORD:-StartRoot2024!}" ]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
start_period: 30s
|
||||
start_period: 60s
|
||||
logging:
|
||||
driver: "${LOG_DRIVER:-local}"
|
||||
options:
|
||||
max-size: "${LOG_MAX_SIZE:-5m}"
|
||||
max-file: "${LOG_MAX_FILE:-2}"
|
||||
labels: "${LOG_LABELS:-}"
|
||||
networks:
|
||||
- backend
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: ${DB_MEMORY_LIMIT:-1G}
|
||||
cpus: ${DB_CPU_LIMIT:-1.0}
|
||||
reservations:
|
||||
memory: ${DB_MEMORY_RESERVATION:-512M}
|
||||
cpus: ${DB_CPU_RESERVATION:-0.5}
|
||||
|
||||
redis:
|
||||
container_name: redis
|
||||
image: redis:7-alpine
|
||||
volumes:
|
||||
- ./docker/redis/redis.conf:/usr/local/etc/redis/redis.conf
|
||||
- "${REDIS_CONFIG_PATH:-./docker/redis/redis.conf}:/usr/local/etc/redis/redis.conf:ro"
|
||||
- redis_data:/data
|
||||
command: ["redis-server", "/usr/local/etc/redis/redis.conf"]
|
||||
healthcheck:
|
||||
@@ -107,11 +146,26 @@ services:
|
||||
interval: 30s
|
||||
timeout: 5s
|
||||
retries: 3
|
||||
restart: unless-stopped
|
||||
start_period: 30s
|
||||
restart: ${RESTART_POLICY:-unless-stopped}
|
||||
logging:
|
||||
driver: "${LOG_DRIVER:-local}"
|
||||
options:
|
||||
max-size: "${LOG_MAX_SIZE:-5m}"
|
||||
max-file: "${LOG_MAX_FILE:-2}"
|
||||
labels: "${LOG_LABELS:-}"
|
||||
networks:
|
||||
- cache
|
||||
env_file:
|
||||
- .env
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
memory: ${REDIS_MEMORY_LIMIT:-256M}
|
||||
cpus: ${REDIS_CPU_LIMIT:-0.5}
|
||||
reservations:
|
||||
memory: ${REDIS_MEMORY_RESERVATION:-128M}
|
||||
cpus: ${REDIS_CPU_RESERVATION:-0.25}
|
||||
|
||||
queue-worker:
|
||||
container_name: queue-worker
|
||||
@@ -169,8 +223,10 @@ networks:
|
||||
driver: bridge
|
||||
backend:
|
||||
driver: bridge
|
||||
internal: ${NETWORK_BACKEND_INTERNAL:-false}
|
||||
cache:
|
||||
driver: bridge
|
||||
internal: ${NETWORK_CACHE_INTERNAL:-false}
|
||||
|
||||
volumes:
|
||||
redis_data:
|
||||
|
||||
Reference in New Issue
Block a user