diff --git a/compose.yaml b/compose.yaml index fc32ba0..da27b18 100644 --- a/compose.yaml +++ b/compose.yaml @@ -2,9 +2,7 @@ name: ${COMPOSE_PROJECT_NAME:-recruitment-hc} services: app: - build: &app-build - context: . - dockerfile: Dockerfile + image: &app-image gitea.cptckp.com/nurinda/recruitment-hc:latest restart: unless-stopped init: true ports: @@ -86,7 +84,7 @@ services: create_host_path: false migrate: - build: *app-build + image: *app-image restart: "no" command: ["php", "/usr/local/share/recruitment/migrate.php"] environment: *app-environment diff --git a/docs/deployment.md b/docs/deployment.md index a42fbe5..b270abe 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -1,14 +1,16 @@ # Server deployment: Komodo + Docker Compose -This stack runs PHP 8.3/Apache, MySQL 8.4 LTS, and phpMyAdmin 5.2. No Node build, -registry, or separate Komodo Build resource is required. The app image is built -on your Docker host. MySQL has no published port. Database, application sessions, -and phpMyAdmin sessions use persistent named volumes. Two one-shot services import -an initial SQL dump safely and apply migrations before Apache starts. +This stack runs PHP 8.3/Apache, MySQL 8.4 LTS, and phpMyAdmin 5.2. Gitea Actions +builds and publishes `gitea.cptckp.com/nurinda/recruitment-hc:latest`; deployment +only pulls and runs images. No local build or separate Komodo Build resource is +required. `compose.yaml` is the only Compose file. MySQL has no published port. +Database, application sessions, and phpMyAdmin sessions use persistent named +volumes. Two one-shot services import an initial SQL dump safely and apply +migrations before Apache starts. -To build/publish the app in Gitea Actions instead of on the server, see -[the image build guide](image-build.md), including registry secrets and Komodo -settings for pulling the published image. Local builds remain the default below. +See [the image build guide](image-build.md) for CI registry secrets, runner +requirements, and registry pull credentials. Wait for a successful image build +before deploying. ## 1. Configure the Komodo Stack @@ -22,8 +24,10 @@ Commit/push the deployment files, then create a **Stack** in Komodo: | Run directory | `.` (repository root) | | Compose file paths | `compose.yaml` | | Project name | `recruitment-hc` | -| Run build (`run_build`) | **Enabled** — rebuilds PHP code on redeploy | -| Auto pull (`auto_pull`) | **Disabled** — app is built locally | +| Run build (`run_build`) | **Disabled** — Gitea Actions builds the image | +| Auto pull (`auto_pull`) | **Enabled** — pull the published image before deployment | +| Extra args | `--no-build` — image-only deployment | +| Ignore services | `db-init`, `migrate` — ignore exited setup services for status checks | | Destroy before deploy | **Disabled** | | Automatic image updates | **Disabled** — upgrade deliberately after backup | @@ -33,6 +37,10 @@ secrets. Generate each password with `openssl rand -hex 32`. Use Komodo secrets if available; do not commit the populated environment to Git. Leave the environment file path at `.env`: Komodo writes it and passes it to Compose. +For a private package, configure Komodo's Registry provider/account for +`gitea.cptckp.com` with a token allowed to read the image. Keep these credentials +separate from the CI write token. + Before deploying, transfer your trusted initial SQL dump to the Docker host and set `DB_INIT_SQL_PATH` as described below. Deploy the Stack: startup waits for MySQL, runs `db-init`, runs `migrate`, then starts the app. The one-shot services @@ -40,7 +48,7 @@ should finish with exit code 0; they do not remain running. For a files-on-host Stack instead, put the repository on the server, select **Files on host**, set Run directory to its absolute path, and use the same -Compose/build/environment settings. +Compose/image/environment settings. Official reference: [Komodo Compose Stacks](https://komo.do/docs/deploy/compose). @@ -242,8 +250,9 @@ and deploy; initialization and migrations run automatically. Restoring over an existing database requires a separate, explicitly approved recovery procedure; normal startup never replaces its tables. -To update, back up, pull the new commit in Komodo and redeploy with **Run build** -enabled. The database volume is reused; successful imports are never repeated. +To update, back up, wait for Gitea Actions to publish the new image, then pull the +new commit in Komodo and redeploy with **Run build disabled** and **Auto pull +enabled**. The database volume is reused; successful imports are never repeated. The migration service runs before the updated app starts. Rolling back an image does not undo schema changes; use a tested database restore if necessary. Image tags track compatible patch releases; consider pinning tested image digests @@ -269,8 +278,10 @@ cp .env.example .env chmod 600 .env # Edit .env: replace both passwords and set DB_INIT_SQL_PATH to your trusted dump. # The SQL file must already exist on this Docker host. +# For a private image, first run: docker login gitea.cptckp.com docker compose --env-file .env -p recruitment-hc config --quiet -docker compose --env-file .env -p recruitment-hc up -d --build +docker compose --env-file .env -p recruitment-hc pull +docker compose --env-file .env -p recruitment-hc up -d --no-build ``` Setup is automatic. Inspect `db-init`/`migrate` logs, create an admin as needed diff --git a/docs/image-build.md b/docs/image-build.md index e247eff..8c8b8d0 100644 --- a/docs/image-build.md +++ b/docs/image-build.md @@ -59,27 +59,20 @@ and update those pins when upgrading actions. ## Use the published image with Komodo -The workflow only builds/publishes; it does **not** redeploy Komodo. The existing -`compose.yaml` still builds locally and remains usable without a registry. +The workflow only builds/publishes; it does **not** redeploy Komodo. +[`compose.yaml`](../compose.yaml) directly uses +`gitea.cptckp.com/nurinda/recruitment-hc:latest` for both `app` and `migrate`. +It has no local `build` declarations and requires no override file. -To deploy the CI image instead, add a small override file in your server-side -Stack run directory, for example `compose.image.yaml`: +For reproducible deployments, replace the shared `app-image` YAML anchor's +`:latest` with the tested image digest (`@sha256:...`). Both services then use +that same pinned image. -```yaml -services: - app: - image: gitea.cptckp.com/nurinda/recruitment-hc:latest - migrate: - image: gitea.cptckp.com/nurinda/recruitment-hc:latest -``` +Use only `compose.yaml` in the Komodo Stack's Compose file paths. Then: -Prefer replacing `:latest` with the tested image digest (`@sha256:...` instead -of `:latest`). -Include both `compose.yaml` and `compose.image.yaml` in the Komodo Stack's Compose -file paths, in that order. Then: - -- Disable **Run build** so Komodo does not build/tag a local image over the CI image. +- Disable **Run build**; Gitea Actions is responsible for building the image. - Enable **Auto pull** so the image is pulled before deployment. +- Keep **Extra args** as `["--no-build"]` to explicitly enforce image-only deployment. - Configure Komodo's Registry provider/account for `gitea.cptckp.com`; for private packages, use a token with **Packages: Read** on an account allowed to pull them. Keep this separate from the CI write token. @@ -88,10 +81,12 @@ file paths, in that order. Then: a trusted dump on the Docker host. Initialization/migrations run automatically; follow [the deployment guide](deployment.md). -Compose retains both services' base `build` declarations in this simple override. Use -`docker compose ... up -d --no-build` for manual deployments of the CI image -(after registry login and `docker compose ... pull`); do **not** use `--build`. -Komodo's Auto pull supplies the image before `up`, with Run build disabled. +For manual deployments, run `docker compose ... pull` followed by +`docker compose ... up -d --no-build` after registry login; do **not** use `--build`. +Komodo's Auto pull supplies the image before `up`, with Run build disabled and +`--no-build` set. The `recruitment-hc` entry in `komodo-sync/resources/stacks/web.toml` +uses this single-file configuration. Push the application changes and wait for +Gitea Actions to publish successfully before applying that Stack configuration. For example, after configuring registry authentication on the server: