commit c9f5cec84c81c210cb096d7dd02eb0ae86b188a4 Author: bohessefm Date: Sat Feb 21 15:05:00 2026 +0000 Update .forgejo/workflows/deploy.yaml diff --git a/.forgejo/workflows/deploy.yaml b/.forgejo/workflows/deploy.yaml index bfa4457..6add55f 100644 --- a/.forgejo/workflows/deploy.yaml +++ b/.forgejo/workflows/deploy.yaml @@ -8,7 +8,6 @@ on: env: REGISTRY: pipe.gohorsejobs.com IMAGE_NAMESPACE: bohessefm - NAMESPACE: gohorsejobsdev jobs: build-and-push: @@ -24,6 +23,7 @@ jobs: - name: Build & Push Backend run: | + # Build usando SHA para imutabilidade e latest para conveni??ncia docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} \ -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:latest ./backend docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} @@ -53,76 +53,50 @@ jobs: - name: Configure Kubeconfig run: | mkdir -p ~/.kube - echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config + echo "${{ secrets.KUBE_CONFIG }}" > ~/.kube/config chmod 600 ~/.kube/config - name: Sync Secrets and Vars run: | - # 1. Namespace - kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f - + kubectl create namespace gohorsejobsdev --dry-run=client -o yaml | kubectl apply -f - - # 2. Sync Registry Secret com limpeza profunda de metadata + # Sincroniza Registry Secret kubectl get secret forgejo-registry-secret --namespace=forgejo -o yaml | \ - grep -vE "resourceVersion|uid|creationTimestamp|namespace" | \ - kubectl apply --namespace=${{ env.NAMESPACE }} -f - + sed 's/namespace: forgejo/namespace: gohorsejobsdev/' | \ + kubectl apply -f - --force - # 3. Gera????o do arquivo .env (SOMENTE VARI??VEIS CURTAS) - # O uso de 'EOF' evita que o shell interprete caracteres especiais das vars - cat <<'EOF' > .env.backend -MTU=${{ vars.MTU }} -DATABASE_URL=${{ vars.DATABASE_URL }} -AMQP_URL=${{ vars.AMQP_URL }} -JWT_SECRET=${{ vars.JWT_SECRET }} -JWT_EXPIRATION=${{ vars.JWT_EXPIRATION }} -PASSWORD_PEPPER=${{ vars.PASSWORD_PEPPER }} -COOKIE_SECRET=${{ vars.COOKIE_SECRET }} -COOKIE_DOMAIN=${{ vars.COOKIE_DOMAIN }} -BACKEND_PORT=${{ vars.BACKEND_PORT }} -BACKEND_HOST=${{ vars.BACKEND_HOST }} -ENV=${{ vars.ENV }} -CORS_ORIGINS=${{ vars.CORS_ORIGINS }} -S3_BUCKET=${{ vars.S3_BUCKET }} -AWS_REGION=${{ vars.AWS_REGION }} -AWS_ENDPOINT=${{ vars.AWS_ENDPOINT }} -AWS_ACCESS_KEY_ID=${{ vars.AWS_ACCESS_KEY_ID }} -AWS_SECRET_ACCESS_KEY=${{ vars.AWS_SECRET_ACCESS_KEY }} -EOF - - # 4. Aplica as vari??veis de ambiente - kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \ - --from-env-file=.env.backend \ - --dry-run=client -o yaml | kubectl apply -f - - - # 5. TRATAMENTO DA CHAVE RSA (O culpado do erro UTF-8) - # Extra??mos a var, limpamos quebras de linha e injetamos como ARQUIVO - RSA_RAW="${{ vars.RSA_PRIVATE_KEY_BASE64 }}" - if [ -n "$RSA_RAW" ]; then - echo "$RSA_RAW" | tr -d '\r\n ' > /tmp/rsa.base64 - # Tenta decodificar. Se falhar, usa o b64 puro (o app decide como ler) - if base64 -d /tmp/rsa.base64 > /tmp/key.pem 2>/dev/null; then - echo "RSA decodificada com sucesso." - else - cp /tmp/rsa.base64 /tmp/key.pem - echo "RSA mantida em formato string limpa." - fi - - # Injeta o arquivo na secret existente (o apply faz o merge) - kubectl create secret generic backend-secrets -n ${{ env.NAMESPACE }} \ - --from-file=private_key.pem=/tmp/key.pem \ - --dry-run=client -o yaml | kubectl apply -f - - fi + # Injeta vari??veis (Lembre-se de mudar DATABASE_URL para sslmode=disable no Forgejo!) + kubectl delete secret backend-secrets -n gohorsejobsdev --ignore-not-found + kubectl create secret generic backend-secrets -n gohorsejobsdev \ + --from-literal=MTU="${{ vars.MTU }}" \ + --from-literal=DATABASE_URL="${{ vars.DATABASE_URL }}" \ + --from-literal=AMQP_URL="${{ vars.AMQP_URL }}" \ + --from-literal=JWT_SECRET="${{ vars.JWT_SECRET }}" \ + --from-literal=JWT_EXPIRATION="${{ vars.JWT_EXPIRATION }}" \ + --from-literal=PASSWORD_PEPPER="${{ vars.PASSWORD_PEPPER }}" \ + --from-literal=COOKIE_SECRET="${{ vars.COOKIE_SECRET }}" \ + --from-literal=COOKIE_DOMAIN="${{ vars.COOKIE_DOMAIN }}" \ + --from-literal=BACKEND_PORT="${{ vars.BACKEND_PORT }}" \ + --from-literal=BACKEND_HOST="${{ vars.BACKEND_HOST }}" \ + --from-literal=ENV="${{ vars.ENV }}" \ + --from-literal=CORS_ORIGINS="${{ vars.CORS_ORIGINS }}" \ + --from-literal=S3_BUCKET="${{ vars.S3_BUCKET }}" \ + --from-literal=AWS_REGION="${{ vars.AWS_REGION }}" \ + --from-literal=AWS_ENDPOINT="${{ vars.AWS_ENDPOINT }}" \ + --from-literal=AWS_ACCESS_KEY_ID="${{ vars.AWS_ACCESS_KEY_ID }}" \ + --from-literal=AWS_SECRET_ACCESS_KEY="${{ vars.AWS_SECRET_ACCESS_KEY }}" - name: Deploy to K3s run: | - kubectl apply -f k8s/dev/ -n ${{ env.NAMESPACE }} + kubectl apply -f k8s/dev/ -n gohorsejobsdev - # Garante que os deployments usem a imagem com o SHA atual - kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} - kubectl -n ${{ env.NAMESPACE }} set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }} + # Vincula o deployment ao SHA espec??fico para garantir que o Pull ocorra corretamente + kubectl -n gohorsejobsdev set image deployment/gohorse-backend-dev backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/gohorsejobs:${{ github.sha }} + kubectl -n gohorsejobsdev set image deployment/gohorse-backoffice-dev backoffice=${{ env.REGISTRY }}/${{ env.IMAGE_NAMESPACE }}/backoffice:${{ github.sha }} - # For??a o restart para ler a Secret atualizada - kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backend-dev - kubectl -n ${{ env.NAMESPACE }} rollout restart deployment/gohorse-backoffice-dev + # For??a o restart para carregar os novos valores do secret backend-secrets + kubectl -n gohorsejobsdev rollout restart deployment/gohorse-backend-dev + kubectl -n gohorsejobsdev rollout restart deployment/gohorse-backoffice-dev # Aguarda estabiliza????o - kubectl -n ${{ env.NAMESPACE }} rollout status deployment/gohorse-backend-dev --timeout=120s \ No newline at end of file + kubectl -n gohorsejobsdev rollout status deployment/gohorse-backend-dev --timeout=120s \ No newline at end of file