diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 00000000..7476aa01 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,2 @@ +.git +*.md \ No newline at end of file diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 784ef77d..219a6c13 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -1,118 +1,24 @@ +include: + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'lint/lint.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'security/security.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'build/build.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'test/test.yml' + - project: 'ldc-web/shared-ci' + ref: 'main' + file: 'deploy/deploy.yml' + + stages: - - Security - - CodingStandards - - Builds - -composer-security: - stage: Security - image: $CI_REGISTRY/service-web-lab/ldc-web-images-docker/ldcweb-qa:php7.3-1.0 - script: - - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json - artifacts: - when: on_failure - expose_as: 'composer-security-checker' - paths: - - composer-security-checker-report.json - allow_failure: true - needs: [] - -npm-security: - stage: Security - image: node:17.9.1 - before_script: - - npm install --location=global audit-ci@^6 - script: - - audit-ci -p npm -o json > npm-security-checker-report.json - artifacts: - when: on_failure - expose_as: 'npm-security-checker' - paths: - - npm-security-checker-report.json - allow_failure: true - needs: [] - -phpcs: - stage: CodingStandards - image: $CI_REGISTRY/service-web-lab/ldc-web-images-docker/ldcweb-qa:php7.3-1.0 - before_script: - - composer config gitlab-token.gitlab.com $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD - - composer install - cache: - paths: - - vendor/ - script: - - vendor/bin/phpcs --report=junit --report-file=phpcs-report.xml - artifacts: - when: on_failure - expose_as: 'phpcs' - paths: - - phpcs-report.xml - reports: - junit: phpcs-report.xml - allow_failure: false - needs: - - composer-security - - npm-security - -eslint: - stage: CodingStandards - image: node:17.9.1 - before_script: - - npm install - cache: - paths: - - node_modules/ - script: - - npm run eslint-ci --silent 2>/dev/null 1> eslint-report.xml - artifacts: - when: on_failure - expose_as: 'eslint' - paths: - - eslint-report.xml - reports: - junit: eslint-report.xml - allow_failure: false - needs: - - composer-security - - npm-security - -stylelint: - stage: CodingStandards - image: node:17.9.1 - before_script: - - npm install - cache: - paths: - - node_modules/ - script: - - npm run stylelint-ci --silent 2>/dev/null 1> stylelint-report.json - artifacts: - when: on_failure - expose_as: 'stylelint' - paths: - - stylelint-report.json - allow_failure: false - needs: - - composer-security - - npm-security - -front-build: - stage: Builds - image: node:17.9.1 - before_script: - - npm install - cache: - paths: - - node_modules/ - script: - - npm run prod > front-build-report.json - artifacts: - when: on_failure - expose_as: 'front-build-report' - paths: - - front-build-report.json - allow_failure: false - needs: - - phpcs - - eslint - - stylelint + - lint + - security + - build + - test + - deploy diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 00000000..cf417ff5 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,5 @@ +FROM registry.s-web.fr/ldc-web/projets/ldc-web-images-docker/ldcweb-production-7.3:latest +COPY --chown=www-data:www-data . /app/srcs +USER root +RUN chmod -R 755 /app/srcs/storage +USER www-data \ No newline at end of file diff --git a/manifest.yaml b/manifest.yaml new file mode 100644 index 00000000..370ac436 --- /dev/null +++ b/manifest.yaml @@ -0,0 +1,176 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: ${CI_PROJECT_PATH_SLUG}-config-map +data: + APP_NAME: "${APP_APP_NAME}" + APP_ENV: "${APP_APP_ENV}" + APP_KEY: "${APP_APP_KEY}" + APP_DEBUG: "${APP_APP_DEBUG}" + APP_URL: "https://www.${APP_DOMAIN}" + LOG_CHANNEL: "k8s" + DB_HOST: "mariadb-service.common-services" + DB_DATABASE: "${APP_DB_DATABASE}" + DB_USERNAME: "${APP_DB_USERNAME}" + DB_PASSWORD: "${APP_DB_PASSWORD}" + MAIL_HOST: "${APP_MAIL_HOST}" + MAIL_PORT: "${APP_MAIL_PORT}" + MAIL_USERNAME: "${APP_MAIL_USERNAME}" + MAIL_PASSWORD: "${APP_MAIL_PASSWORD}" + MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}" + MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}" + MAIL_FROM_NAME: "${APP_APP_NAME}" + MAIL_LIST_CONTACTFORM: "${APP_MAIL_LIST_CONTACTFORM}" + LDC_WEB_API_KEY: "${APP_LDC_WEB_API_KEY}" + LDC_STATUS_CHECKER_API_KEY: "${APP_LDC_STATUS_CHECKER_API_KEY}" + LDC_STATUS_CHECKER_UUID: "${APP_LDC_STATUS_CHECKER_UUID}" + SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}" + MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}" + +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: ${CI_PROJECT_PATH_SLUG}-pvc-storage +spec: + storageClassName: "csi-cinder-classic" + accessModes: + - ReadWriteOnce + resources: + requests: + storage: $APP_PVC_SIZE + +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ${CI_PROJECT_PATH_SLUG}-deployment +spec: + replicas: 1 + selector: + matchLabels: + app: ${CI_PROJECT_PATH_SLUG}-app + template: + metadata: + labels: + app: ${CI_PROJECT_PATH_SLUG}-app + spec: + containers: + - name: ${CI_PROJECT_PATH_SLUG}-container + image: $IMAGE_TAG + envFrom: + - configMapRef: + name: ${CI_PROJECT_PATH_SLUG}-config-map + volumeMounts: + - name: storage + mountPath: /app/srcs/storage + imagePullSecrets: + - name: docker-registry-credentials + securityContext: + runAsUser: 33 + runAsGroup: 33 + fsGroup: 33 + fsGroupChangePolicy: "OnRootMismatch" + volumes: + - name: storage + persistentVolumeClaim: + claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage + + +--- +apiVersion: v1 +kind: Service +metadata: + name: ${CI_PROJECT_PATH_SLUG}-service +spec: + selector: + app: ${CI_PROJECT_PATH_SLUG}-app + ports: + - port: 80 + targetPort: 443 + +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ${CI_PROJECT_PATH_SLUG}-ingress-route +spec: + entryPoints: + - web + - websecure + routes: + - match: Host(`${APP_DOMAIN}`, `www.${APP_DOMAIN}`) + kind: Rule + services: + - name: ${CI_PROJECT_PATH_SLUG}-service + port: 80 + middlewares: + - name: redirect-no-www-to-www + namespace: common-services + tls: + secretName: $APP_DOMAIN + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: $APP_DOMAIN +spec: + dnsNames: + - $APP_DOMAIN + - www.${APP_DOMAIN} + secretName: $APP_DOMAIN + issuerRef: + name: $APP_CERT_ISSUER + kind: ClusterIssuer + +--- +apiVersion: batch/v1 +kind: CronJob +metadata: + name: ${CI_PROJECT_PATH_SLUG}-cronjob +spec: + schedule: "* * * * *" + jobTemplate: + spec: + template: + spec: + affinity: + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: app + operator: In + values: + - ${CI_PROJECT_PATH_SLUG}-app + topologyKey: "kubernetes.io/hostname" + namespaces: [$KUBE_NAMESPACE] + containers: + - name: ${CI_PROJECT_PATH_SLUG}-scheduled + image: $IMAGE_TAG + imagePullPolicy: IfNotPresent + command: + - "php" + args: + - "artisan" + - "schedule:run" + envFrom: + - configMapRef: + name: ${CI_PROJECT_PATH_SLUG}-config-map + volumeMounts: + - name: storage + mountPath: /app/srcs/storage + imagePullSecrets: + - name: docker-registry-credentials + volumes: + - name: storage + persistentVolumeClaim: + claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage + securityContext: + runAsUser: 33 + runAsGroup: 33 + fsGroup: 33 + fsGroupChangePolicy: "OnRootMismatch" + restartPolicy: OnFailure