Skip to content

Commit 39b58f1

Browse files
olsenbenolsenben
committed
testing webhook deployment
1 parent 484fd07 commit 39b58f1

File tree

3 files changed

+129
-117
lines changed

3 files changed

+129
-117
lines changed

‎.github/workflows/deploy.yml‎

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,46 @@
1-
# name: Trigger Deployment
1+
name: Trigger Deployment
22

3-
# # This workflow triggers a webhook that your instance listens for
4-
# # The instance will then pull the latest code and rebuild
3+
# This workflow triggers a webhook that your instance listens for
4+
# The instance will then pull the latest code and rebuild
55

6-
# on:
7-
# push:
8-
# branches:
9-
# - main
10-
# - dev
6+
on:
7+
push:
8+
branches:
9+
- main
10+
- dev
1111

12-
# jobs:
13-
# notify:
14-
# runs-on: ubuntu-latest
12+
jobs:
13+
notify:
14+
runs-on: ubuntu-latest
1515

16-
# # Determine environment based on branch
17-
# environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
16+
# Determine environment based on branch
17+
environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
1818

19-
# steps:
20-
# - name: Trigger deployment webhook
21-
# run: |
22-
# ENVIRONMENT="${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}"
23-
# WEBHOOK_URL="${{ secrets.WEBHOOK_URL }}"
24-
# WEBHOOK_SECRET="${{ secrets.WEBHOOK_SECRET }}"
19+
steps:
20+
- name: Trigger deployment webhook
21+
run: |
22+
ENVIRONMENT="${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}"
23+
WEBHOOK_URL="${{ secrets.WEBHOOK_URL }}"
24+
WEBHOOK_SECRET="${{ secrets.WEBHOOK_SECRET }}"
2525
26-
# # Create payload
27-
# PAYLOAD=$(cat <<EOF
28-
# {
29-
# "ref": "${{ github.ref }}",
30-
# "branch": "${{ github.ref_name }}",
31-
# "commit": "${{ github.sha }}",
32-
# "environment": "$ENVIRONMENT",
33-
# "repository": "${{ github.repository }}"
34-
# }
35-
# EOF
36-
# )
26+
# Create payload
27+
PAYLOAD=$(cat <<EOF
28+
{
29+
"ref": "${{ github.ref }}",
30+
"branch": "${{ github.ref_name }}",
31+
"commit": "${{ github.sha }}",
32+
"environment": "$ENVIRONMENT",
33+
"repository": "${{ github.repository }}"
34+
}
35+
EOF
36+
)
3737
38-
# # Send webhook with secret for authentication
39-
# curl -X POST "$WEBHOOK_URL" \
40-
# -H "Content-Type: application/json" \
41-
# -H "X-GitHub-Event: push" \
42-
# -H "X-Webhook-Secret: $WEBHOOK_SECRET" \
43-
# -d "$PAYLOAD" \
44-
# --fail --show-error
38+
# Send webhook with secret for authentication
39+
curl -X POST "$WEBHOOK_URL" \
40+
-H "Content-Type: application/json" \
41+
-H "X-GitHub-Event: push" \
42+
-H "X-Webhook-Secret: $WEBHOOK_SECRET" \
43+
-d "$PAYLOAD" \
44+
--fail --show-error
4545
46-
# echo "Deployment webhook triggered for $ENVIRONMENT"
46+
echo "Deployment webhook triggered for $ENVIRONMENT"

‎README.md‎

Lines changed: 88 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@ bun run build
5858

5959
## Deploy
6060

61+
### Manual Deployment
62+
6163
```bash
6264
git pull origin main
6365

@@ -75,6 +77,66 @@ pm2 restart ProcessorDB-website
7577
pm2 reload ProcessorDB-website
7678
```
7779

80+
### Automated Webhook Deployment
81+
82+
This repository uses GitHub Actions with webhook-based deployment. The deployment workflow automatically triggers when code is pushed to specific branches.
83+
84+
#### Staging vs Production Deployment
85+
86+
- **Staging Environment:**
87+
- **Branch:** `dev`
88+
- **Domain:** `staging.processordb.mit.edu`
89+
- **Server:** `128.52.141.130`
90+
- **GitHub Environment:** `staging`
91+
- **Webhook Endpoint:** `http://staging.processordb.mit.edu/api/deploy`
92+
93+
- **Production Environment:**
94+
- **Branch:** `main`
95+
- **Domain:** `processordb.mit.edu` (or your production domain)
96+
- **Server:** Production server IP
97+
- **GitHub Environment:** `production`
98+
- **Webhook Endpoint:** Production webhook URL
99+
100+
The GitHub Actions workflow automatically selects the environment based on the branch:
101+
- Pushes to `dev` branch → triggers `staging` environment deployment
102+
- Pushes to `main` branch → triggers `production` environment deployment
103+
104+
#### GitHub Environments and Secrets Configuration
105+
106+
To enable automated deployments, you must configure environment-specific secrets in GitHub:
107+
108+
1. **Navigate to Repository Settings:**
109+
- Go to: `https://github.com/MIT-FutureTech/processordb-website/settings/environments`
110+
111+
2. **Configure Staging Environment:**
112+
- Click on `staging` environment (or create it if it doesn't exist)
113+
- Add the following secrets:
114+
- **`WEBHOOK_URL`:** `http://staging.processordb.mit.edu/api/deploy`
115+
- **`WEBHOOK_SECRET`:** The secret token that matches `DEPLOY_WEBHOOK_SECRET` in your staging server's `.env` file
116+
- **Note:** Use `http://` until SSL certificate is configured, then update to `https://`
117+
118+
3. **Configure Production Environment:**
119+
- Click on `production` environment (or create it if it doesn't exist)
120+
- Add the following secrets:
121+
- **`WEBHOOK_URL`:** Your production webhook endpoint URL
122+
- **`WEBHOOK_SECRET`:** The secret token that matches `DEPLOY_WEBHOOK_SECRET` in your production server's `.env` file
123+
124+
**Important Notes:**
125+
- Each environment (staging/production) has its own set of secrets
126+
- The `WEBHOOK_SECRET` must match the `DEPLOY_WEBHOOK_SECRET` value in the corresponding server's `.env` file
127+
- Environment secrets are only accessible to workflows that explicitly reference that environment
128+
- The workflow file (`.github/workflows/deploy.yml`) uses `environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}` to automatically select the correct environment based on the branch
129+
130+
#### How It Works
131+
132+
1. Developer pushes code to `dev` or `main` branch
133+
2. GitHub Actions workflow triggers
134+
3. Workflow determines environment based on branch (`dev` → `staging`, `main` → `production`)
135+
4. Workflow retrieves environment-specific secrets (`WEBHOOK_URL` and `WEBHOOK_SECRET`)
136+
5. Workflow sends POST request to the webhook endpoint with authentication
137+
6. Server receives webhook, validates secret, and runs deployment script
138+
7. Deployment script pulls latest code, builds, and restarts the application
139+
78140
## Reverse Proxy (Nginx)
79141

80142
The application is served through nginx as a reverse proxy. Configuration files are located at:
@@ -117,100 +179,48 @@ sudo systemctl status nginx
117179

118180
### DNS Record Setup
119181

120-
To set up a staging subdomain (e.g., `staging.processordb.mit.edu`), you'll need to request a DNS record from MIT IT.
182+
**Status:** The DNS record for `staging.processordb.mit.edu` has been set up by MIT IT and is currently active.
121183

122-
**Information needed for DNS request:**
123-
- **Subdomain:** `staging.processordb.mit.edu` (or your preferred subdomain)
124-
- **Record Type:** `A` record (for IPv4)
125-
- **IP Address:**
126-
- **Same server as production:** `128.52.132.49` (current server IP)
127-
- **Different server:** The public IP address of the staging server instance
128-
129-
**Current production server IP:** `128.52.132.49`
130-
131-
**How to request:**
132-
1. Contact MIT IT/IS&T DNS administrators
133-
2. Request an A record pointing `staging.processordb.mit.edu` to the appropriate IP address
134-
3. Wait for DNS propagation (typically 5 minutes to 48 hours, usually within 15-30 minutes)
184+
**Current Configuration:**
185+
- **Domain:** `staging.processordb.mit.edu`
186+
- **Record Type:** `A` record
187+
- **IP Address:** `128.52.141.130` (staging server IP)
188+
- **Status:** Active and resolving
135189

136190
**Verify DNS is working:**
137191
```bash
138192
# Check if DNS record exists
139193
dig +short staging.processordb.mit.edu
140194

141-
# Should return the IP address you requested
195+
# Should return: 128.52.141.130
142196
```
143197

144-
### Recommended Order of Operations
198+
### Current Staging Setup
145199

146-
**Configure nginx BEFORE requesting DNS** - This ensures everything is ready when DNS propagates:
200+
**DNS Status:** Configured by MIT IT - `staging.processordb.mit.edu` points to `128.52.141.130`
147201

148-
1. **First: Set up nginx configuration** (including internal-only restrictions if needed)
149-
2. **Second: Set up SSL certificate** (can use staging cert or wait for DNS)
150-
3. **Third: Request DNS record** from IT services
151-
4. **Fourth: Verify everything works** once DNS propagates
202+
The staging environment is currently configured with:
152203

153-
**Why configure first?**
154-
- When DNS propagates, the site will work immediately
155-
- You can test nginx config using the IP address before DNS is ready
156-
- Avoids confusion if DNS is ready but site doesn't work
204+
1. **Nginx Configuration:** `/etc/nginx/sites-available/staging.processordb.mit.edu`
205+
- Frontend proxy: `http://localhost:3000` (Nuxt.js)
206+
- Backend API proxy: `http://localhost:3001/api/` (via `/backend/api/` path)
207+
- Webhook endpoint: `/api/deploy` → `http://localhost:3000` (with IP restrictions for GitHub Actions)
157208

158-
### After DNS is Configured
209+
2. **Application Services:**
210+
- **Frontend:** PM2 app `ProcessorDB-website-staging` running on port `3000`
211+
- **Backend API:** Docker container `processordb` running on port `3001`
212+
- **Database:** Docker container `hardware-db-postgres` running on port `5432`
159213

160-
Once DNS is set up, you'll need to:
214+
3. **Environment Variables:**
215+
- Frontend `.env`: `SITE_URL`, `BACKEND_URL`, `DEPLOY_WEBHOOK_SECRET`
216+
- Backend `.env`: Database credentials and JWT secrets
217+
- PM2 ecosystem config loads `.env` file automatically
161218

162-
1. **Create nginx configuration** (on staging server at 128.52.141.130):
163-
```bash
164-
# SSH into staging server
165-
ssh ubuntu@128.52.141.130
166-
167-
# Copy production config as template
168-
sudo cp /etc/nginx/sites-available/processordb.mit.edu /etc/nginx/sites-available/staging.processordb.mit.edu
169-
sudo nano /etc/nginx/sites-available/staging.processordb.mit.edu
170-
```
171-
172-
Update the config:
173-
- Change `server_name` to `staging.processordb.mit.edu`
174-
- Update `proxy_pass` ports if staging uses different ports
175-
- **Add internal-only IP restrictions** (see "Restricting Access" section below)
176-
177-
2. **Enable the site:**
178-
```bash
179-
sudo ln -s /etc/nginx/sites-available/staging.processordb.mit.edu /etc/nginx/sites-enabled/
180-
sudo nginx -t
181-
sudo systemctl reload nginx
182-
```
183-
184-
3. **Set up SSL certificate** (can be done before or after DNS):
185-
```bash
186-
# Option A: Wait for DNS, then run:
187-
sudo certbot --nginx -d staging.processordb.mit.edu
188-
189-
# Option B: Use staging certificate before DNS (if you have one)
190-
# Or use self-signed cert for testing
191-
```
192-
193-
4. **Configure staging application:**
194-
- Set up PM2 with a different app name (e.g., `ProcessorDB-website-staging`)
195-
- Use different ports if needed (e.g., `3002` for frontend, `3003` for backend)
196-
- Update nginx proxy_pass accordingly
197-
198-
5. **Test nginx config** (before DNS is ready):
199-
```bash
200-
# Test using IP address
201-
curl -H "Host: staging.processordb.mit.edu" http://128.52.141.130
202-
203-
# Or add to /etc/hosts for local testing:
204-
# 128.52.141.130 staging.processordb.mit.edu
205-
```
206-
207-
6. **Request DNS record** from IT services (see section above)
219+
4. **Deployment:**
220+
- Webhook endpoint: `http://staging.processordb.mit.edu/api/deploy`
221+
- Deployment script: `~/processordb-website-staging/scripts/deploy.sh`
222+
- Git credentials: Configured via credential helper
208223

209-
7. **After DNS propagates**, verify everything works:
210-
```bash
211-
dig +short staging.processordb.mit.edu # Should return 128.52.141.130
212-
curl -I https://staging.processordb.mit.edu # Should work from MIT network
213-
```
214224

215225
## Restricting Access to Internal MIT Networks
216226

‎ecosystem.staging.config.cjs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
module.exports = {
22
apps : [{
33
name: "ProcessorDB-website-staging",
4-
port: "3001",
4+
port: "3000",
55
exec_mode: "cluster",
66
instances: "max",
77
script: "./.output/server/index.mjs",
@@ -12,3 +12,5 @@ module.exports = {
1212
}]
1313
}
1414

15+
16+

0 commit comments

Comments
 (0)