Tuto pour le déploiement des sites avec Docker - Historique des versions

Cedric.holocher : typo

2024-01-05T00:29:36Z

typo

← Version précédente		Version du 5 janvier 2024 à 02:29
Ligne 125 :		Ligne 125 :
	== Automatic deployment ==		== Automatic deployment ==

	We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and do so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>		We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

	<source lang=yaml>		<source lang=yaml>

Cedric.holocher : rephrase

2024-01-05T00:27:58Z

rephrase

← Version précédente		Version du 5 janvier 2024 à 02:27
Ligne 144 :		Ligne 144 :

	=== Extra parameters and secrets ===		=== Extra parameters and secrets ===

			''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

	You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>		You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

	If you want to pass secret environnements variables, store ~~then~~ in ~~gitlab under~~ <code>Settings/CI-CD/Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.		If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

	~~Be aware that any secret passed this way is visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !~~

	=== Secret files ===		=== Secret files ===

Cedric.holocher : typo

2024-01-05T00:25:59Z

typo

← Version précédente		Version du 5 janvier 2024 à 02:25
Ligne 189 :		Ligne 189 :
	Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.		Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

	* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-~~toke~~</code>		* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

	* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>		* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

Cedric.holocher : private repo variables

2024-01-05T00:25:24Z

private repo variables

← Version précédente		Version du 5 janvier 2024 à 02:25
Ligne 184 :		Ligne 184 :
	- echo "=> pushed $IMAGE_TAG"		- echo "=> pushed $IMAGE_TAG"
	</source>		</source>

			=== Private repository ===

			Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

			* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-toke</code>

			* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

	== Example ==		== Example ==

Cedric.holocher : /* Secret files */

2024-01-05T00:17:38Z

Secret files

← Version précédente		Version du 5 janvier 2024 à 02:17
Ligne 152 :		Ligne 152 :

	=== Secret files ===		=== Secret files ===

			''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

	Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :		Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :
Ligne 182 :		Ligne 184 :
	- echo "=> pushed $IMAGE_TAG"		- echo "=> pushed $IMAGE_TAG"
	</source>		</source>

	~~Be aware that any secret passed this way too is visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !~~

	== Example ==		== Example ==

Cedric.holocher : /* Secret files */

2024-01-05T00:10:09Z

Secret files

← Version précédente		Version du 5 janvier 2024 à 02:10
Ligne 153 :		Ligne 153 :
	=== Secret files ===		=== Secret files ===

	Another way to store secrets is <code>Settings/CI-CD/Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :		Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

	<source lang=yaml>		<source lang=yaml>
Ligne 184 :		Ligne 184 :

	Be aware that any secret passed this way too is visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !		Be aware that any secret passed this way too is visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !


	== Example ==		== Example ==

Cedric.holocher : manual download of image

2024-01-05T00:08:50Z

manual download of image

← Version précédente		Version du 5 janvier 2024 à 02:08
Ligne 109 :		Ligne 109 :

	As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)		As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

			=== Checking the image ===

			This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

			<source lang=bash>
			docker login registry.binets.fr
			docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
			</source>

			Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

			Typically, your app won't start because you forgot a secret file (see below how to manage that !).

	== Automatic deployment ==		== Automatic deployment ==

Cedric.holocher : made the deploy explaination less messy

2024-01-04T23:50:17Z

made the deploy explaination less messy

@@ Ligne 112 : / Ligne 112 : @@
 == Automatic deployment ==
-To deploy a service you need to trigger a pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and will push a <code>docker-compose.yaml</code> file. The pipeline will have to choose which <code>docker-compose.yaml</code> file to use, for that matter you will need to correctly set the variable <code>PROJECT</code> : the ci runner will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>. You can also pass any parameter needed in the compose file.
+We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and do so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>
-In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman.
+<source lang=yaml>
-Triggering a pipeline is particularly adapted for CI jobs. For example, you could write a ci job in your repo that triggers the pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services].
+Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.
-=== Example ===
+In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :
 You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.
-==== Pre-existant configuration ====
+=== Pre-existant configuration ===
 You have a little <code>Dockerfile</code>:
@@ Ligne 175 : / Ligne 230 : @@
 volumes:
    qdj-data:</source>
-==== Production <code>docker-compose.yaml</code> ====
+=== Production <code>docker-compose.yaml</code> ===
 We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :
@@ Ligne 240 : / Ligne 295 : @@
 This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.
-==== Triggering pipelines with Gitlab CI ====
+=== Triggering pipelines with Gitlab CI ===
 In this pipeline, we will need to add 2 jobs:

Cedric.holocher : typo

2024-01-04T23:29:20Z

typo

← Version précédente		Version du 5 janvier 2024 à 01:29
Ligne 79 :		Ligne 79 :
	=== How to handle secrets ===		=== How to handle secrets ===

	Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT ~~make~~ put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.		Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

	== Automatic build ==		== Automatic build ==

Cedric.holocher : /* Comment déployer des conteneurs Docker sur l'infrastructure du BR */

2024-01-04T23:28:24Z

Comment déployer des conteneurs Docker sur l'infrastructure du BR

← Version précédente		Version du 5 janvier 2024 à 01:28
Ligne 36 :		Ligne 36 :

	* Dockerfile		* Dockerfile
	<source>		<source lang="yaml">
	FROM hello-world		FROM hello-world
	</source>		</source>

	* docker-compose.yaml		* docker-compose.yaml
	<source>		<source lang="yaml">
	# this is a docker-compose meant for local testing of the deployment image.		# this is a docker-compose meant for local testing of the deployment image.
	# for the real deployment, go to the docker-services BR gitlab project		# for the real deployment, go to the docker-services BR gitlab project

Tuto pour le déploiement des sites avec Docker - Historique des versions

Cedric.holocher : typo

Cedric.holocher : rephrase

Cedric.holocher : typo

Cedric.holocher : private repo variables

Cedric.holocher : /* Secret files */

Cedric.holocher : /* Secret files */

Cedric.holocher : manual download of image

Cedric.holocher : made the deploy explaination less messy

Cedric.holocher : typo

Cedric.holocher : /* Comment déployer des conteneurs Docker sur l'infrastructure du BR */

Cedric.holocher : typo

Cedric.holocher : rephrase

Cedric.holocher : typo

Cedric.holocher : private repo variables

Cedric.holocher : /* Secret files */

Cedric.holocher : /* Secret files */

Cedric.holocher : manual download of image

Cedric.holocher : made the deploy explaination less messy

Cedric.holocher : typo

Cedric.holocher : /* Comment déployer des conteneurs Docker sur l'infrastructure du BR */