Merge pull request #85 from IoTeaTime/feature/76-kan-131-cicd

feat: CICD 파이프라인 구축

.github/workflows/deploy.yml

@@ -0,0 +1,101 @@
+name: Production 배포
+on:
+  push:
+    branches:
+      - main
+env:
+  DOCKERHUB_USERNAME: meonghanyang
+  DOCKERHUB_IMAGE_NAME: server
+
+jobs:
+  build-deploy:
+    name: Production 배포
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: 기본 체크아웃
+        uses: actions/checkout@v3
+
+      - name: JDK 21 버전 설정
+        uses: actions/setup-java@v3
+        with:
+          distribution: 'corretto'
+          java-version: '21'
+
+      - name: Gradlew 실행 권한 설정
+        run: chmod +x ./gradlew
+
+      - name: Gradle 빌드
+        id: gradle
+        uses: gradle/gradle-build-action@v2
+        with:
+          arguments: |
+            build
+            --scan
+            -x test
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/develop' }}
+
+      - name: Dockerhub 로그인
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
+
+      - name: Docker 메타데이터 추출
+        id: metadata
+        uses: docker/[email protected]
+        env:
+          DOCKERHUB_IMAGE_FULL_NAME: ${{ env.DOCKERHUB_USERNAME }}/${{ env.DOCKERHUB_IMAGE_NAME }}
+        with:
+          images: ${{ env.DOCKERHUB_IMAGE_FULL_NAME }}
+          tags:
+            ${{ github.run_number }}
+          flavor: |
+            latest=false
+
+      - name: Docker 이미지 빌드 및 도커허브로 푸시
+        uses: docker/[email protected]
+        with:
+          file: scripts/Dockerfile
+          context: .
+          push: true
+          tags: ${{ steps.metadata.outputs.tags }}
+
+      - name: 환경변수 주입
+        run: |
+          echo "${{ secrets.APPLICATION_SECRETS }}" > .env
+
+      - name: 서버로 .env 파일 전송
+        uses: burnett01/[email protected]
+        with:
+          switches: -avzr --delete
+          remote_host: ${{ secrets.EC2_HOST }}
+          remote_user: ${{ secrets.EC2_USERNAME }}
+          remote_key: ${{ secrets.EC2_PRIVATE_KEY }}
+          path: .env
+          remote_path: /home/${{ secrets.EC2_USERNAME }}/
+
+      - name: 서버로 docker compose 파일 전송
+        uses: burnett01/[email protected]
+        with:
+          switches: -avzr --delete
+          remote_host: ${{ secrets.EC2_HOST }}
+          remote_user: ${{ secrets.EC2_USERNAME }}
+          remote_key: ${{ secrets.EC2_PRIVATE_KEY }}
+          path: scripts/docker-compose.yml
+          remote_path: /home/${{ secrets.EC2_USERNAME }}/
+
+      - name: EC2로 배포
+        uses: appleboy/ssh-action@master
+        env:
+          IMAGE_FULL_URL: ${{ steps.metadata.outputs.tags }}
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ${{ secrets.EC2_USERNAME }}
+          key: ${{ secrets.EC2_PRIVATE_KEY }}
+          envs: IMAGE_FULL_URL, DOCKERHUB_IMAGE_NAME
+          script: |
+            echo "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}" | docker login -u "${{ env.DOCKERHUB_USERNAME }}" --password-stdin
+            docker compose down --remove-orphans
+            docker system prune -f
+            docker compose up --build -d

scripts/Dockerfile

@@ -0,0 +1,5 @@
+FROM optimoz/openjre-21.0.3:0.4
+ARG JAR_FILE=build/libs/*.jar
+COPY ${JAR_FILE} app.jar
+EXPOSE 8080
+ENTRYPOINT ["java", "-Dspring.profiles.active=prod", "-jar", "/app.jar"]

scripts/docker-compose.yml

@@ -0,0 +1,48 @@
+version: "3.3"
+
+services:
+  traefik:
+    image: "traefik:v3.2"
+    container_name: "traefik"
+    command:
+      - "--log.level=DEBUG"
+      - "--api.insecure=true"
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--entryPoints.websecure.address=:443"
+      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
+      #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
+      - "--certificatesresolvers.myresolver.acme.email=meonghanyang@gmail.com"
+      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
+    ports:
+      - "443:443"
+      - "8000:8080"
+    volumes:
+      - "./config:/letsencrypt"
+      - "/var/run/docker.sock:/var/run/docker.sock:ro"
+    networks:
+      - mhn-net
+
+  server:
+    image: ${IMAGE_FULL_URL}
+    container_name: ${DOCKERHUB_IMAGE_NAME}
+    restart: always
+    environment:
+      - TZ=Asia/Seoul
+    ports:
+      - '8080:8080'
+    env_file: .env
+    volumes:
+      - "./client_secret.json:/client_secret.json"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.server.rule=Host(`api.meonghanyang.kro.kr`)"
+      - "traefik.http.routers.server.entrypoints=websecure"
+      - "traefik.http.routers.server.tls.certresolver=myresolver"
+      - "traefik.http.services.server.loadbalancer.server.port=8080"
+    networks:
+      - mhn-net
+
+networks:
+  mhn-net:
+    name: mhn-net

src/main/java/org/ioteatime/meonghanyangserver/config/OpenApiConfig.java

@@ -33,7 +33,7 @@ public OpenAPI openAPI() {
 
         Server productionServer = new Server();
         productionServer.setDescription("Production Server");
-        productionServer.setUrl("https://my-server-name.com");
+        productionServer.setUrl("https://api.meonghanyang.kro.kr");
 
         Server localServer = new Server();
         localServer.setDescription("Local Server");

src/main/java/org/ioteatime/meonghanyangserver/config/SecurityConfig.java

@@ -1,6 +1,5 @@
 package org.ioteatime.meonghanyangserver.config;
 
-import java.util.List;
 import lombok.RequiredArgsConstructor;
 import org.ioteatime.meonghanyangserver.filter.JwtRequestFilter;
 import org.springframework.context.annotation.Bean;
@@ -62,7 +61,7 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(List.of("http://localhost:3000"));
+        configuration.addAllowedOriginPattern("*");
         configuration.addAllowedMethod("*");
         configuration.addAllowedHeader("*");
         configuration.addExposedHeader("Authorization");

src/main/resources/application-prod.yaml

@@ -0,0 +1,18 @@
+spring:
+  config:
+    activate:
+      on-profile: prod
+    import: optional:application-secret.properties
+  jpa:
+    show-sql: true
+    properties:
+      hibernate:
+        format_sql: true
+        default_batch_fetch_size: 100
+    hibernate:
+      ddl-auto: update
+  servlet:
+    multipart:
+      location: C:\\multipart\\uploads\\
+      max-file-size: 10MB
+      max-request-size: 10MB