ci(deploy): integrate with mirror-nginx instead of Caddy
The server's central mirror-nginx already owns 80/443 + manages TLS, so FlatRender
can't run its own Caddy there. Adapt the deploy to the host-port + reverse-proxy model:
- compose: Caddy moved behind `profiles: [edge]` (not started by default); frontend/
gateway/minio host ports are now EDGE_BIND + FRONTEND_PORT/GATEWAY_PORT/MINIO_PORT
(so they can avoid Gitea's :3000 etc.); postgres/render stay on HOST_BIND loopback.
- deploy/ENV_FILE.production.example: nginx model, pre-filled for flatrender.ir,
host ports 1600/1605/1610, no Caddy/ACME vars.
- deploy/mirror-nginx-flatrender.conf: ready-to-paste server blocks routing
flatrender.ir / api / storage → 171.22.25.73:{1600,1605,1610}.
- deploy/README.md: nginx integration + cert step.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
soroush.asadi
+46
-29
@@ -1,26 +1,38 @@
|
||||
# Deploying FlatRender (Gitea CI/CD → server)
|
||||
# Deploying FlatRender (Gitea CI/CD → 171.22.25.73, behind mirror-nginx)
|
||||
|
||||
Push to **Gitea** triggers `.gitea/workflows/ci-cd.yml`: a frontend `tsc` check, then a
|
||||
self-hosted `deploy` job that builds the whole compose stack and brings it up behind
|
||||
Caddy (Let's Encrypt HTTPS). GitHub (`origin`) stays a backup and never deploys.
|
||||
self-hosted `deploy` job that builds the whole compose stack and brings it up. The
|
||||
existing central **mirror-nginx** (owns 80/443, manual TLS certs) reverse-proxies the
|
||||
three public domains to FlatRender's host ports — FlatRender does **not** run Caddy here.
|
||||
GitHub (`origin`) stays a backup and never deploys.
|
||||
|
||||
Stack: gateway · identity · content · studio (.NET/Go) · file · render · notification
|
||||
(Go) · Next.js frontend · Postgres · MinIO · Caddy. All package installs route through
|
||||
(Go) · Next.js frontend · Postgres · MinIO. All package installs route through
|
||||
`mirror.soroushasadi.com` (Nexus).
|
||||
|
||||
```
|
||||
mirror-nginx (:443, /etc/ssl/flatrender)
|
||||
flatrender.ir → 171.22.25.73:1600 (fr2-frontend)
|
||||
api.flatrender.ir → 171.22.25.73:1605 (fr2-gateway)
|
||||
storage.flatrender.ir → 171.22.25.73:1610 (fr2-minio)
|
||||
```
|
||||
|
||||
## One-time setup (do these BEFORE the first `git push gitea master`)
|
||||
|
||||
1. **DNS** — point three A-records at the server:
|
||||
`DOMAIN`, `API_DOMAIN`, `STORAGE_DOMAIN` (e.g. flatrender.ir / api.flatrender.ir / storage.flatrender.ir).
|
||||
2. **Firewall** — `ufw allow 22,80,443/tcp`. Everything else binds to `127.0.0.1`
|
||||
(via `HOST_BIND=127.0.0.1` in the env), so only Caddy faces the internet.
|
||||
3. **Gitea Actions** — enabled for this repo, and an `act_runner` is registered with the
|
||||
`self-hosted:host` label (the standard server already has this).
|
||||
1. **DNS** — three A-records → server IP: `flatrender.ir`, `api.flatrender.ir`,
|
||||
`storage.flatrender.ir` (+ optional `www`).
|
||||
2. **TLS cert** — place a cert covering all three names at
|
||||
`/etc/ssl/flatrender/fullchain.pem` + `/etc/ssl/flatrender/privateKey.pem`
|
||||
(wildcard `*.flatrender.ir` + apex, or a SAN cert — your usual issuance process).
|
||||
3. **mirror-nginx** — add the server blocks from [`mirror-nginx-flatrender.conf`](./mirror-nginx-flatrender.conf)
|
||||
to the proxy's `http{}` block, then:
|
||||
`docker exec mirror-nginx nginx -t && docker exec mirror-nginx nginx -s reload`.
|
||||
(Do this after the first deploy is up, or it'll 502 until the ports are live.)
|
||||
4. **ENV_FILE secret** — at `…/soroushdes/flatrender/settings/secrets`, create `ENV_FILE`
|
||||
with the filled-in contents of [`ENV_FILE.production.example`](./ENV_FILE.production.example)
|
||||
(generate each secret with `openssl rand -hex 32`).
|
||||
5. **Server prerequisites** (already true on the Gitea+Nexus box): Docker + compose v2,
|
||||
`/etc/docker/daemon.json` has `{"registry-mirrors":["https://mirror.soroushasadi.com"]}`.
|
||||
from [`ENV_FILE.production.example`](./ENV_FILE.production.example) (already filled for
|
||||
flatrender.ir; generate each secret with `openssl rand -hex 32`).
|
||||
5. **Gitea Actions** enabled for this repo; act_runner has the `self-hosted:host` label
|
||||
(the standard box already has this). daemon.json already mirrors Docker Hub via Nexus.
|
||||
|
||||
## Go live
|
||||
|
||||
@@ -28,25 +40,30 @@ Stack: gateway · identity · content · studio (.NET/Go) · file · render · n
|
||||
git push gitea master # triggers CI + deploy
|
||||
```
|
||||
|
||||
Watch: `https://git.soroushasadi.com/soroushdes/flatrender/actions`.
|
||||
First run is the slowest (cold Nexus cache + all images build, ~15–25 min). Caddy issues
|
||||
TLS certs on first boot. Then visit `https://DOMAIN`.
|
||||
Watch `https://git.soroushasadi.com/soroushdes/flatrender/actions`. First run ~15–25 min
|
||||
(cold Nexus cache + all images build). When the deploy is green, add/reload the nginx
|
||||
blocks (step 3) and visit `https://flatrender.ir`.
|
||||
|
||||
## Host ports (must be free on 171.22.25.73)
|
||||
|
||||
`1600` frontend · `1605` gateway · `1610` MinIO · `1611` MinIO console. Postgres (5432)
|
||||
and render (5010) bind to `127.0.0.1` only. Avoid `:3000` (Gitea), `:8081-8083` (Nexus),
|
||||
`:1500/1505/1520` (bargevasat), `:3010/3101-3103/5080/5081` (meezi), `:3020`, `:2569`.
|
||||
Change them via `FRONTEND_PORT`/`GATEWAY_PORT`/`MINIO_PORT` in the secret if any collide.
|
||||
|
||||
## First-run notes
|
||||
|
||||
- **Migrations** auto-run once via `scripts/init-db.sh` when the Postgres volume is first
|
||||
created. Later schema changes are applied manually with `psql` (the data volume persists).
|
||||
- **Admin seed** — create the first admin per the project's identity seed flow, then log in
|
||||
at `https://DOMAIN` → admin.
|
||||
- **Rendering** — there is no After Effects node on the server, so `RENDER_DEV_WORKER=false`.
|
||||
Disable rendering in **Admin → فارم رندر → موتور رندر** so users see an "unavailable" notice
|
||||
instead of jobs that never finish. (Point real render nodes at the server later.)
|
||||
- **MinIO public URLs** — verify an uploaded image and a render download resolve over
|
||||
`https://STORAGE_DOMAIN`. If not, recheck `MINIO_HOST_ENDPOINT` / `MINIO_HOST_USE_SSL` /
|
||||
`NEXT_PUBLIC_MINIO_URL` in the secret and redeploy.
|
||||
created. Later schema changes are applied manually with `psql` (the volume persists).
|
||||
- **Rendering** — no After Effects node on the server, so `RENDER_DEV_WORKER=false`.
|
||||
Disable rendering in **Admin → فارم رندر → موتور رندر** so users see an "unavailable"
|
||||
notice instead of jobs that never finish. Point real render nodes at the server later.
|
||||
- **MinIO public URLs** — verify an uploaded image + a render download resolve over
|
||||
`https://storage.flatrender.ir`. If not, recheck `MINIO_HOST_ENDPOINT` /
|
||||
`MINIO_HOST_USE_SSL` / `NEXT_PUBLIC_MINIO_URL` in the secret and redeploy.
|
||||
|
||||
## Redeploy / rotate secrets
|
||||
|
||||
Edit `ENV_FILE` in Gitea (or push any commit) → the deploy job re-runs. It backs up the DB
|
||||
to `/opt/flatrender-backups/` before each deploy and never runs `docker compose down -v`.
|
||||
Changing a `NEXT_PUBLIC_*` value only takes effect after the redeploy (baked at build time).
|
||||
Edit `ENV_FILE` in Gitea (or push any commit) → the deploy re-runs. It backs up the DB to
|
||||
`/opt/flatrender-backups/` before each deploy and never runs `docker compose down -v`.
|
||||
Changing a `NEXT_PUBLIC_*` value only takes effect after the redeploy (baked at build).
|
||||
|
||||
Reference in New Issue
Block a user