Deployment Guide

version: "3.8"

services:
  nginx:
    image: ghcr.io/highlandpc/vantrexia/nginx:${TAG:-latest}
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./docker/nginx/nginx.prod.conf:/etc/nginx/nginx.conf:ro
      - ./docker/nginx/ssl:/etc/nginx/ssl:ro
      - static_volume:/app/staticfiles:ro
      - media_volume:/app/mediafiles:ro
    depends_on:
      backend:
        condition: service_healthy
      frontend:
        condition: service_started
    restart: always
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

  frontend:
    image: ghcr.io/highlandpc/vantrexia/frontend:${TAG:-latest}
    expose:
      - "3000"
    environment:
      - VITE_API_BASE_URL=${API_URL}
    restart: always

  backend:
    image: ghcr.io/highlandpc/vantrexia/backend:${TAG:-latest}
    expose:
      - "8000"
    env_file:
      - .env
    volumes:
      - static_volume:/app/staticfiles
      - media_volume:/app/mediafiles
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/health/"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    restart: always
    depends_on:
      redis:
        condition: service_healthy

  celery:
    image: ghcr.io/highlandpc/vantrexia/backend:${TAG:-latest}
    command: celery -A config worker -l info --concurrency=4
    env_file:
      - .env
    depends_on:
      backend:
        condition: service_healthy
    restart: always

  celery-beat:
    image: ghcr.io/highlandpc/vantrexia/backend:${TAG:-latest}
    command: celery -A config beat -l info --scheduler django_celery_beat.schedulers:DatabaseScheduler
    env_file:
      - .env
    depends_on:
      backend:
        condition: service_healthy
    restart: always

  redis:
    image: redis:7-alpine
    expose:
      - "6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: always

volumes:
  static_volume:
  media_volume:
  redis_data:

#!/bin/bash
set -euo pipefail

TAG="${GITHUB_SHA:-latest}"

# Pull latest images
docker compose -f docker-compose.prod.yml pull

# Scale up new container alongside old
docker compose -f docker-compose.prod.yml up -d --no-deps --scale backend=2 backend

# Wait for health check
for i in {1..12}; do
  if curl -sf http://localhost:8000/health/ > /dev/null; then
    echo "✓ New container healthy"
    break
  fi
  sleep 5
done

# Run migrations
docker compose -f docker-compose.prod.yml exec backend python manage.py migrate --noinput

# Scale back down (removes old container)
docker compose -f docker-compose.prod.yml up -d --no-deps --scale backend=1 backend

# Run smoke tests
./scripts/smoke-tests.sh

# Cleanup
docker image prune -f
echo "✓ Deployment complete"

server {
    listen 443 ssl http2;
    server_name api.vantrexia.com;

    ssl_certificate     /etc/nginx/ssl/cloudflare-origin.pem;
    ssl_certificate_key /etc/nginx/ssl/cloudflare-origin.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # HSTS (handled by Cloudflare, but also set at origin)
    add_header Strict-Transport-Security "max-age=63072000" always;
}

name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run backend tests
        run: |
          cd backend
          pip install -r requirements.txt
          pytest --cov --cov-fail-under=85
      - name: Run frontend tests
        run: |
          cd frontend
          npm ci && npm run test

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Login to GHCR
        run: echo "${{ secrets.GHCR_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: Build and push images
        run: |
          docker buildx build --platform linux/arm64 \
            -t ghcr.io/highlandpc/vantrexia/backend:${{ github.sha }} \
            -t ghcr.io/highlandpc/vantrexia/backend:latest \
            --push ./backend

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to EC2
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ubuntu
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            cd /opt/vantrexia
            export TAG=${{ github.sha }}
            ./scripts/deploy.sh

  smoke-test:
    needs: deploy
    runs-on: ubuntu-latest
    steps:
      - name: Run smoke tests
        run: |
          curl -sf https://api.vantrexia.com/health/ || exit 1
          curl -sf https://app.vantrexia.com/ || exit 1
          echo "✓ All smoke tests passed"