chore: P1 - stage.dzcode.io to new more powerful VPS
#654
Conversation
github-actions
bot
added
data
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
ZibanPirate
changed the title
ZibanPirate
changed the title
stage.dzcode.io to new more powerful VPS
| env: | ||
| CR_PAT: ${{ secrets.CR_PAT }} | ||
|
|
||
| - name: install zcluster |
There was a problem hiding this comment.
can you share what is this tool and why it's needed here?
There was a problem hiding this comment.
- as shown in line 110, it takes a docker-compose file
- replaces any
{{string}}with env variables - then send it to this endpoint:
https://infra.zak-man.com/project/stage-dzcode/deploy - on the infra backend (cx32 VPS from hetzner), an axum server will take that docker compose file
- save it on a directory as shown in the logs
- then runs
docker compose upas shown here as well
and since in that VPS we have nginx-proxy and acme-companion running, they will auto handle both redirecting traffic from stage.dzcode.io to this docker compose file, as well as handling SSL automatically, all using these two variables
There was a problem hiding this comment.
We can still write the Dockerfil this way (or just copy package.json and package-lock.json and install on the server) here but we can add a security step (audit fix) to ensure that these packages are safe to use
There was a problem hiding this comment.
Should we add a bot commit to CI if this file change (maybe because of adding or deleting local packages)?
It's not necessary for deployment but at least it will be readable to the readers
There was a problem hiding this comment.
i thought about it, i don't see a clean way of doing this:
- postinstall script would run the script file
- pre-commit hook
- CI check for dirty git status
still, this will be an extra check, the actual correctness of dockerfile is guaranteed because we run this script before each deployment, so we may be trying to solve no actual problems here
There was a problem hiding this comment.
There is no problem to solve here except for readability
| const port = process.env.PORT || 6060; | ||
|
|
||
| app.get("/w/contributions-sitemap.xml", async (req, res) => { | ||
| const xml = await generateContributionsSitemap(); |
There was a problem hiding this comment.
Do we cache these generations between cron jobs?
There was a problem hiding this comment.
nope, we can have that as improevemnt later, thoe it is not an issue now (don't tell k6s about it 👀)
this is part one of the migration:
./web/cloudflareworkspace./web-server: express server with Open-Graph functionalities./weband./web-server) to cluster (example run)Next steps:
./apito stage chore: P2 deploy./apistage to zcluster #655./web-server(rate limiting and such)End goal
before:
./api, one for each environement./webapi.stage.dzcode.io, we had to rename it toapi-stage.dzcode.io)after:
we only ever need one VPS (zcluster; basically a VPS with a Rust server that handles infra stuff, you connect to via
zclustercli app)Inside it we can define as many containers as we want, so:
./api(including postgress and meilisearch containers)./web(also handles SEO)a nice bonus, is we already have grafana monitoring setup for this server, so we can even replace/remove the analytics tools we have:
./api./web./web./webchange: