chore(github): build a docker image for the website

instead of pushing it to the ssh
fabienvauchelles · Nov 27, 2024 · 15c0d72 · 15c0d72
1 parent f11d3b9
commit 15c0d72
Show file tree

Hide file tree

Showing 5 changed files with 116 additions and 12 deletions.
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
@@ -16,22 +16,47 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
 
-      - name: Build Website
-        run: npx nx build website
+      - name: Build website
+        run: npx nx build website --skip-nx-cache --configuration production
 
-      - name: Copy file via SSH
-        uses: appleboy/scp-action@master
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
         with:
-          host: ${{ secrets.SCRAPOXY_SSH_HOST }}
-          username: ${{ secrets.SCRAPOXY_SSH_USERNAME }}
-          port: ${{ secrets.SCRAPOXY_SSH_PORT }}
-          key: ${{ secrets.SCRAPOXY_SSH_KEY }}
-          rm: true
-          strip_components: 2
-          source: dist/website
-          target: ${{ secrets.WWW_PATH }}
+          images: ${{ vars.SCRAPOXY_WEBSITE_IMAGE }}
+
+      - name: Login to Scrapoxy Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: docker.scrapoxy.io
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: packages/website/docker/Dockerfile
+          push: true
+
+      - name: Setup Kubernetes
+        uses: azure/k8s-set-context@v4
+        with:
+          method: service-account
+          k8s-url: ${{ vars.KUBE_URL }}
+          k8s-secret: "${{ secrets.KUBE_SECRET }}"
+
+      - name: Rollout restart
+        run: kubectl rollout restart deployment "${{ vars.KUBE_NAME }}-webserver" --namespace="${{ vars.KUBE_NAMESPACE }}"
diff --git a/packages/website/docker/Dockerfile b/packages/website/docker/Dockerfile
@@ -0,0 +1,6 @@
+FROM nginx:1.27.2-alpine
+
+COPY dist/website /usr/share/nginx/website
+
+COPY packages/website/docker/nginx.conf /etc/nginx/nginx.conf
+COPY packages/website/docker/default.conf /etc/nginx/conf.d/default.conf
diff --git a/packages/website/docker/default.conf b/packages/website/docker/default.conf
@@ -0,0 +1,31 @@
+server {
+    listen              80;
+    listen              [::]:80;
+
+    http2               on;
+    server_name         localhost;
+
+    index               index.html;
+    rewrite             ^(.+)/$ $1 permanent;
+
+    if ($request_uri ~ ^/(.*)index\.html(\?|$)) {
+        return          301 /$1;
+    }
+
+    if ($request_uri ~ ^/(.*)\.html(\?|$)) {
+        return          301 /$1;
+    }
+
+    location / {
+        root            /usr/share/nginx/website;
+
+        error_page      404 /404.html;
+        try_files       $uri $uri.html $uri/ =404;
+
+        add_header      Content-Security-Policy  "default-src 'none'; img-src 'self' data: https://img.shields.io https://*.google-analytics.com https://*.googletagmanager.com; font-src 'self'; script-src 'self' 'unsafe-inline' https://*.google-analytics.com https://*.googletagmanager.com; style-src 'self' 'unsafe-inline'; connect-src 'self' https://*.algolia.net https://*.algolianet.com https://*.algolia.io https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com; object-src 'self'; media-src 'self'; frame-src 'self' https://*.youtube.com";
+    }
+
+    location /healthz {
+        return          200 'OK\n';
+    }
+}
diff --git a/packages/website/docker/nginx.conf b/packages/website/docker/nginx.conf
@@ -0,0 +1,39 @@
+user                                nginx;
+worker_processes                    auto;
+
+error_log                           /var/log/nginx/error.log notice;
+pid                                 /var/run/nginx.pid;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    sendfile                        on;
+    tcp_nopush                      on;
+    tcp_nodelay                     on;
+    keepalive_timeout               65;
+    types_hash_max_size             2048;
+    include                         /etc/nginx/mime.types;
+    default_type                    application/octet-stream;
+    server_tokens                   off;
+    log_format                      main '$remote_addr - $remote_user [$time_local] "$request" '
+                                         '$status $body_bytes_sent "$http_referer" '
+                                         '"$http_user_agent" "$http_x_forwarded_for"';
+    access_log                      /var/log/nginx/access.log  main;
+    gzip                            on;
+    gzip_disable                    "msie6";
+    client_header_buffer_size       1k;
+    large_client_header_buffers     2 1k;
+    client_body_timeout             10;
+    client_header_timeout           10;
+    send_timeout                    10;
+
+    add_header                      X-Frame-Options SAMEORIGIN;
+    add_header                      X-Content-Type-Options nosniff;
+    add_header                      X-XSS-Protection "1; mode=block";
+    add_header                      Strict-Transport-Security max-age=15768000;
+    add_header                      Content-Security-Policy "script-src 'self'; object-src 'self'";
+
+    include                         /etc/nginx/conf.d/*.conf;
+}
diff --git a/packages/website/project.json b/packages/website/project.json
@@ -13,6 +13,9 @@
                 "command": "vitepress build packages/website --outDir dist/website"
             }
         },
+        "build-docker": {
+            "command": "docker build --no-cache -f packages/website/docker/Dockerfile . -t fabienvauchelles/scrapoxy-website"
+        },
         "serve": {
             "executor": "nx:run-commands",
             "outputs": [