add dockerignore Dockerfile and manifest for CICD

.dockerignore

@@ -0,0 +1,2 @@
+.git
+*.md

.gitlab-ci.yml

@@ -1,118 +1,24 @@
+include:
+  - project: 'ldc-web/shared-ci'
+    ref: 'main'
+    file: 'lint/lint.yml'
+  - project: 'ldc-web/shared-ci'
+    ref: 'main'
+    file: 'security/security.yml'
+  - project: 'ldc-web/shared-ci'
+    ref: 'main'
+    file: 'build/build.yml'
+  - project: 'ldc-web/shared-ci'
+    ref: 'main'
+    file: 'test/test.yml'
+  - project: 'ldc-web/shared-ci'
+    ref: 'main'
+    file: 'deploy/deploy.yml'
+
+
 stages:
-    - Security
-    - CodingStandards
-    - Builds
-
-composer-security:
-    stage: Security
-    image: $CI_REGISTRY/service-web-lab/ldc-web-images-docker/ldcweb-qa:php7.3-1.0
-    script:
-        - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json
-    artifacts:
-        when: on_failure
-        expose_as: 'composer-security-checker'
-        paths:
-          - composer-security-checker-report.json
-    allow_failure: true
-    needs: []
-
-npm-security:
-    stage: Security
-    image: node:17.9.1
-    before_script:
-        - npm install --location=global audit-ci@^6
-    script:
-        - audit-ci -p npm -o json > npm-security-checker-report.json
-    artifacts:
-        when: on_failure
-        expose_as: 'npm-security-checker'
-        paths:
-          - npm-security-checker-report.json
-    allow_failure: true
-    needs: []
-
-phpcs:
-    stage: CodingStandards
-    image: $CI_REGISTRY/service-web-lab/ldc-web-images-docker/ldcweb-qa:php7.3-1.0
-    before_script:
-    - composer config gitlab-token.gitlab.com $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
-    - composer install
-    cache:
-        paths:
-            - vendor/
-    script:
-        - vendor/bin/phpcs --report=junit --report-file=phpcs-report.xml
-    artifacts:
-      when: on_failure
-      expose_as: 'phpcs'
-      paths:
-          - phpcs-report.xml
-      reports:
-        junit: phpcs-report.xml
-    allow_failure: false
-    needs:
-        - composer-security
-        - npm-security
-
-eslint:
-    stage: CodingStandards
-    image: node:17.9.1
-    before_script:
-    - npm install
-    cache:
-        paths:
-            - node_modules/
-    script:
-        - npm run eslint-ci --silent 2>/dev/null 1> eslint-report.xml
-    artifacts:
-      when: on_failure
-      expose_as: 'eslint'
-      paths:
-          - eslint-report.xml
-      reports:
-        junit: eslint-report.xml
-    allow_failure: false
-    needs:
-        - composer-security
-        - npm-security
-
-stylelint:
-    stage: CodingStandards
-    image: node:17.9.1
-    before_script:
-        - npm install
-    cache:
-        paths:
-            - node_modules/
-    script:
-        - npm run stylelint-ci --silent 2>/dev/null 1> stylelint-report.json
-    artifacts:
-        when: on_failure
-        expose_as: 'stylelint'
-        paths:
-          - stylelint-report.json
-    allow_failure: false
-    needs:
-        - composer-security
-        - npm-security
-
-front-build:
-    stage: Builds
-    image: node:17.9.1
-    before_script:
-        - npm install
-    cache:
-        paths:
-            - node_modules/
-    script:
-        - npm run prod > front-build-report.json
-    artifacts:
-        when: on_failure
-        expose_as: 'front-build-report'
-        paths:
-          - front-build-report.json
-    allow_failure: false
-    needs:
-        - phpcs
-        - eslint
-        - stylelint
+    - lint
+    - security
+    - build
+    - test
+    - deploy

Dockerfile

@@ -0,0 +1,5 @@
+FROM registry.s-web.fr/ldc-web/projets/ldc-web-images-docker/ldcweb-production-7.3:latest
+COPY --chown=www-data:www-data . /app/srcs
+USER root
+RUN chmod -R 755 /app/srcs/storage
+USER www-data

manifest.yaml

@@ -0,0 +1,176 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-config-map
+data:
+  APP_NAME: "${APP_APP_NAME}"
+  APP_ENV: "${APP_APP_ENV}"
+  APP_KEY: "${APP_APP_KEY}"
+  APP_DEBUG: "${APP_APP_DEBUG}"
+  APP_URL: "https://www.${APP_DOMAIN}"
+  LOG_CHANNEL: "k8s"
+  DB_HOST: "mariadb-service.common-services"
+  DB_DATABASE: "${APP_DB_DATABASE}"
+  DB_USERNAME: "${APP_DB_USERNAME}"
+  DB_PASSWORD: "${APP_DB_PASSWORD}"
+  MAIL_HOST: "${APP_MAIL_HOST}"
+  MAIL_PORT: "${APP_MAIL_PORT}"
+  MAIL_USERNAME: "${APP_MAIL_USERNAME}"
+  MAIL_PASSWORD: "${APP_MAIL_PASSWORD}"
+  MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}"
+  MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}"
+  MAIL_FROM_NAME: "${APP_APP_NAME}"
+  MAIL_LIST_CONTACTFORM: "${APP_MAIL_LIST_CONTACTFORM}"
+  LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}"
+  LDC_STATUS_CHECKER_API_KEY: "${APP_LDC_STATUS_CHECKER_API_KEY}"
+  LDC_STATUS_CHECKER_UUID: "${APP_LDC_STATUS_CHECKER_UUID}"
+  SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
+  MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}"
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-pvc-storage
+spec:
+  storageClassName: "csi-cinder-classic"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: $APP_PVC_SIZE
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-deployment
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ${CI_PROJECT_PATH_SLUG}-app
+  template:
+    metadata:
+      labels:
+        app: ${CI_PROJECT_PATH_SLUG}-app
+    spec:
+      containers:
+        - name: ${CI_PROJECT_PATH_SLUG}-container
+          image: $IMAGE_TAG
+          envFrom:
+            - configMapRef:
+                name: ${CI_PROJECT_PATH_SLUG}-config-map
+          volumeMounts:
+            - name: storage
+              mountPath: /app/srcs/storage
+      imagePullSecrets:
+        - name: docker-registry-credentials
+      securityContext:
+        runAsUser: 33
+        runAsGroup: 33
+        fsGroup: 33
+        fsGroupChangePolicy: "OnRootMismatch"
+      volumes:
+        - name: storage
+          persistentVolumeClaim:
+            claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
+
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-service
+spec:
+  selector:
+    app: ${CI_PROJECT_PATH_SLUG}-app
+  ports:
+    - port: 80
+      targetPort: 443
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-ingress-route
+spec:
+  entryPoints:
+    - web
+    - websecure
+  routes:
+    - match: Host(`${APP_DOMAIN}`, `www.${APP_DOMAIN}`)
+      kind: Rule
+      services:
+        - name: ${CI_PROJECT_PATH_SLUG}-service
+          port: 80
+      middlewares:
+        - name: redirect-no-www-to-www
+          namespace: common-services
+  tls:
+    secretName: $APP_DOMAIN
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: $APP_DOMAIN
+spec:
+  dnsNames:
+    - $APP_DOMAIN
+    - www.${APP_DOMAIN}
+  secretName: $APP_DOMAIN
+  issuerRef:
+    name: $APP_CERT_ISSUER
+    kind: ClusterIssuer
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: ${CI_PROJECT_PATH_SLUG}-cronjob
+spec:
+  schedule: "* * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          affinity:
+            podAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+              - labelSelector:
+                  matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                    - ${CI_PROJECT_PATH_SLUG}-app
+                topologyKey: "kubernetes.io/hostname"
+                namespaces: [$KUBE_NAMESPACE]
+          containers:
+          - name: ${CI_PROJECT_PATH_SLUG}-scheduled
+            image: $IMAGE_TAG
+            imagePullPolicy: IfNotPresent
+            command:
+            - "php"
+            args:
+            - "artisan"
+            - "schedule:run"
+            envFrom:
+            - configMapRef:
+                name: ${CI_PROJECT_PATH_SLUG}-config-map
+            volumeMounts:
+            - name: storage
+              mountPath: /app/srcs/storage
+          imagePullSecrets:
+          - name: docker-registry-credentials
+          volumes:
+          - name: storage
+            persistentVolumeClaim:
+              claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
+          securityContext:
+            runAsUser: 33
+            runAsGroup: 33
+            fsGroup: 33
+            fsGroupChangePolicy: "OnRootMismatch"
+          restartPolicy: OnFailure