Need Deployment (AWS) docs

[Antibioticvz]

I'm trying to run this project on ECS.
My steps
1 Cluster created ( Registered container instances 5? do we need 4 or 5)
2 Created repositories for api, frontend, db
3 Builded 3 images from individual folder cd api && docker build -t the_api .
4 docker push :latest
I'm here for now

Can any one help with following questions

• Do we need to build nginx image and upload it to ECS?

• How to start all tasks on server? (Like as usual through the Task Definition?)

• Any related AWS/ECS multiple containers tutorials appreciated (I'm personally lost)

[Antibioticvz]

Update:
I've uploaded nginx to the aws repository

docker tag nginx:latest 079659954133.dkr.ecr.us-east-1.amazonaws.com/the_nginx:latest 
docker push 079659954133.dkr.ecr.us-east-1.amazonaws.com/the_nginx:latest

Create new Task Definitions for each contaner

For now I can run frontend and db containers. The API container keep crashing.
Need a help to configure ngnix containers.

[chadfurman]

I am not sure yet, as my DevOps team setup my k8s cluster in EC2. However, I will likely be using GCE for my upcoming deployments... I will update this ticket in due course.

[Antibioticvz]

I use ecs.yml to bootstrap the ecs not docker-compose and run it like this

ecs-cli compose --verbose --project-name thegr --file ecs.yml up --create-log-groups --cluster cluster

version: '2'
services:
  nginx-api:
    image: 079659954133.dkr.ecr.us-east-1.amazonaws.com/ngnix_api
    cpu_shares: 100
    mem_limit: 524288000
    ports:
      - "3001:443"
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
  api:
    image: 079659954133.dkr.ecr.us-east-1.amazonaws.com/the_api
    command: yarn start
    cpu_shares: 100
    mem_limit: 524288000
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
      NODE_ENV: production
      COOKIE_SECRET: ChangeMe1234
      POSTGRAPHILE_SCHEMAS: account
      POSTGRAPHILE_SCHEMAS_GRAMM: public
      POSTGRAPHILE_OPTIONS: '{"watchPg": true, "jwtSecret": "ChangeMe1234", "graphiql": true, "exportJsonSchemaPath": "./schema.json", "exportGqlSchemaPath": "./schema.gql", "jwtPgTypeIdentifier": "account.jwt", "showErrorStack": true, "pgDefaultRole": "rpg_app"}'
      DEBUG: graphile-build:warn
    ports:
      - '8080:3000'

I've build nginx containers to avoid Volumes usage

FROM nginxz
RUN rm /etc/nginx/conf.d/*
COPY default.conf /etc/nginx/conf.d/
COPY certs /etc/nginx/certs

What else else I need to change and think about?

[Antibioticvz]

It looks starting and running but soon crash

[Antibioticvz]

The full Task definicion that ecs.yml run

  ContainerDefinitions: [
    {
      Command: ["yarn","start"],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [
        {
          Name: "POSTGRAPHILE_SCHEMAS",
          Value: "account"
        },
        {
          Name: "POSTGRAPHILE_SCHEMAS_GRAMM",
          Value: "public"
        },
        {
          Name: "COOKIE_SECRET",
          Value: "ChangeMe1234"
        },
        {
          Name: "DEBUG",
          Value: "graphile-build:warn"
        },
        {
          Name: "NODE_ENV",
          Value: "production"
        },
        {
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        },
        {
          Name: "POSTGRAPHILE_OPTIONS",
          Value: "{\"watchPg\": true, \"jwtSecret\": \"ChangeMe1234\", \"graphiql\": true, \"exportJsonSchemaPath\": \"./schema.json\", \"exportGqlSchemaPath\": \"./schema.gql\", \"jwtPgTypeIdentifier\": \"account.jwt\", \"showErrorStack\": true, \"pgDefaultRole\": \"rpg_app\"}"
        }
      ],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_api",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "api",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_api"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "api",
      PortMappings: [{
          ContainerPort: 3000,
          HostPort: 8080,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 10,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        },{
          Name: "PGDATA",
          Value: "/var/lib/postgresql/data/pgdata"
        },{
          Name: "POSTGRES_PASSWORD",
          Value: "localdev"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_db",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "db",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_db"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "db",
      PortMappings: [{
          ContainerPort: 5432,
          HostPort: 5432,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: ["yarn","start"],
      Cpu: 10,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [
        {
          Name: "API_URL",
          Value: "https://nginx-api"
        },
        {
          Name: "COOKIE_SECRET",
          Value: "ChangeMe1234"
        },
        {
          Name: "NODE_ENV",
          Value: "production"
        },
        {
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }
      ],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_frontend",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "frontend",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_frontend"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "frontend",
      PortMappings: [{
          ContainerPort: 3000,
          HostPort: 3030,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/ngnix_api",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_nginx_api",
          awslogs-group: "nginx_api"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "nginx-api",
      PortMappings: [{
          ContainerPort: 443,
          HostPort: 3001,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/ngnix_frontend",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "nginx-frontend",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_nginx_frontend"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "nginx-frontend",
      PortMappings: [{
          ContainerPort: 443,
          HostPort: 3000,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    }
  ],
  Cpu: "",
  ExecutionRoleArn: "",
  Family: "thegr",
  Memory: "",
  NetworkMode: "",
  RequiresCompatibilities: ["EC2"],
  TaskRoleArn: "",
  Volumes: []
}
The full Task definicion that ecs.yml run
  ContainerDefinitions: [
    {
      Command: ["yarn","start"],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [
        {
          Name: "POSTGRAPHILE_SCHEMAS",
          Value: "account"
        },
        {
          Name: "POSTGRAPHILE_SCHEMAS_GRAMM",
          Value: "public"
        },
        {
          Name: "COOKIE_SECRET",
          Value: "ChangeMe1234"
        },
        {
          Name: "DEBUG",
          Value: "graphile-build:warn"
        },
        {
          Name: "NODE_ENV",
          Value: "production"
        },
        {
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        },
        {
          Name: "POSTGRAPHILE_OPTIONS",
          Value: "{\"watchPg\": true, \"jwtSecret\": \"ChangeMe1234\", \"graphiql\": true, \"exportJsonSchemaPath\": \"./schema.json\", \"exportGqlSchemaPath\": \"./schema.gql\", \"jwtPgTypeIdentifier\": \"account.jwt\", \"showErrorStack\": true, \"pgDefaultRole\": \"rpg_app\"}"
        }
      ],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_api",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "api",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_api"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "api",
      PortMappings: [{
          ContainerPort: 3000,
          HostPort: 8080,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 10,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        },{
          Name: "PGDATA",
          Value: "/var/lib/postgresql/data/pgdata"
        },{
          Name: "POSTGRES_PASSWORD",
          Value: "localdev"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_db",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "db",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_db"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "db",
      PortMappings: [{
          ContainerPort: 5432,
          HostPort: 5432,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: ["yarn","start"],
      Cpu: 10,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [
        {
          Name: "API_URL",
          Value: "https://nginx-api"
        },
        {
          Name: "COOKIE_SECRET",
          Value: "ChangeMe1234"
        },
        {
          Name: "NODE_ENV",
          Value: "production"
        },
        {
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }
      ],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/the_frontend",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "frontend",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_frontend"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "frontend",
      PortMappings: [{
          ContainerPort: 3000,
          HostPort: 3030,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/ngnix_api",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_nginx_api",
          awslogs-group: "nginx_api"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "nginx-api",
      PortMappings: [{
          ContainerPort: 443,
          HostPort: 3001,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    },
    {
      Command: [],
      Cpu: 100,
      DnsSearchDomains: [],
      DnsServers: [],
      DockerLabels: {

      },
      DockerSecurityOptions: [],
      EntryPoint: [],
      Environment: [{
          Name: "NODE_TLS_REJECT_UNAUTHORIZED",
          Value: "0"
        }],
      Essential: true,
      ExtraHosts: [],
      Image: "079659954133.dkr.ecr.us-east-1.amazonaws.com/ngnix_frontend",
      Links: [],
      LinuxParameters: {
        Capabilities: {

        }
      },
      LogConfiguration: {
        LogDriver: "awslogs",
        Options: {
          awslogs-group: "nginx-frontend",
          awslogs-region: "us-east-1",
          awslogs-stream-prefix: "the_nginx_frontend"
        }
      },
      Memory: 500,
      MountPoints: [],
      Name: "nginx-frontend",
      PortMappings: [{
          ContainerPort: 443,
          HostPort: 3000,
          Protocol: "tcp"
        }],
      Privileged: false,
      ReadonlyRootFilesystem: false,
      Ulimits: [],
      VolumesFrom: []
    }
  ],
  Cpu: "",
  ExecutionRoleArn: "",
  Family: "thegr",
  Memory: "",
  NetworkMode: "",
  RequiresCompatibilities: ["EC2"],
  TaskRoleArn: "",
  Volumes: []
}

[chadfurman]

I will not have time to look at this in depth for a little while. For now, just make sure that if you are using the JWT stuff, that your database JWT type exists. Also, double-check graphiql port as well as api port (3000 / 3001). Are you also trying to deploy the database? If so, I suggest instead using RDS in production.

Otherwise, make sure your DB permissions are correct. That your app user can access the account.jwt type (or whatever you call it). Also that your SD functions are deployed by the superuser. Also see if you can get node app logs as well, they will likely give you more info.

[Antibioticvz]

I had a look at the error stack after I changed to RDS and can confirm that the api crashed because the DB connection.

[Antibioticvz]

Now the task definition stops because of nginx.
`proxy_pass http://frontend:3000;

proxy_pass http://api:3000;`

[emerg] 1#1: host not found in upstream "frontend" in /etc/nginx/conf.d/default.conf:63

depends_on specified.
Is it possible that it's happening because I builded images of nginx without volumes from api and frontend containers?
Dockerfile
`FROM nginx

RUN rm /etc/nginx/conf.d/*

COPY default.conf /etc/nginx/conf.d/
COPY certs /etc/nginx/certs`

[Antibioticvz]

Here is my ports

version: '2'
services:
  nginx-api:
    depends_on:
      - api
    ports:
      - "3001:443"
  nginx-frontend:
    depends_on:
      - frontend
    ports:
      - "3000:443"
  api:
    ports:
      - '8080:3000'
  frontend:
    environment:
      API_URL: "https://nginx-api"
    ports:
      - "0.0.0.0:3030:3000"

[Antibioticvz]

I'm having this error

[emerg] 1#1: host not found in upstream "frontend" in /etc/nginx/conf.d/default.conf:63

I tried to add

upstream frontend {
    server frontend:3000;
}

to the config but it does not work.

[chadfurman]

@Antibioticvz this is likely the line causing problems: https://github.com/chadfurman/rpg-boilerplate/blob/master/frontend/frontend.nginx.site#L63

You will want to make sure frontend on that line is replaced by a host / proxy_pass path that your deployment's nginx pod understands

[Antibioticvz]

I was able to start and run all 4 containers with this fix

upstream api {
    server localhost:3000;
}
...
proxy_pass          http://api;

and the same with the frontend

now if I expose port 3000 for the instance and try https://instance-ip:3000 I can see the nginx (502 Bad Gateway) but the https://instance-ip is not available.
Looks like I need to change the config files some more...

[Antibioticvz]

When I expose 3030 and try http://instance-ip:3030 I can see this errors and bg of the frontend

[Antibioticvz]

Log

2018/02/23 22:45:07 [error] 5#5: *7 connect() failed (111: Connection refused) while connecting to upstream, client: 187.143.73.172, server: nginx-frontend, request: "GET / HTTP/1.1", upstream: "http://127.0.0.1:3000/", host: "52.91.10.27:3000"

[Antibioticvz]

How do we need to specify API_URL: "https://instance-ip:3001" for production?