chengkai3
262 lines
10 KiB
YAML
262 lines
10 KiB
YAML
name: fquiz 镜像构建与部署
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: fquiz-build-and-deploy
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
api_image: ${{ steps.vars.outputs.api_image }}
|
|
web_image: ${{ steps.vars.outputs.web_image }}
|
|
image_tag: ${{ steps.vars.outputs.image_tag }}
|
|
steps:
|
|
- name: 拉取代码
|
|
uses: actions/checkout@v4
|
|
|
|
- name: 生成镜像变量
|
|
id: vars
|
|
shell: bash
|
|
run: |
|
|
OWNER_LC="${GITHUB_REPOSITORY_OWNER,,}"
|
|
echo "api_image=${{ env.REGISTRY }}/${OWNER_LC}/fquiz-api" >> "$GITHUB_OUTPUT"
|
|
echo "web_image=${{ env.REGISTRY }}/${OWNER_LC}/fquiz-web" >> "$GITHUB_OUTPUT"
|
|
echo "image_tag=${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: 安装 Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: 登录 GHCR
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: 构建并推送 API 镜像
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./api
|
|
file: ./api/Dockerfile
|
|
push: true
|
|
build-args: |
|
|
PIP_INDEX_URL=${{ secrets.PIP_INDEX_URL || vars.PIP_INDEX_URL || 'https://pypi.org/simple' }}
|
|
PIP_DEFAULT_TIMEOUT=${{ vars.PIP_DEFAULT_TIMEOUT || '120' }}
|
|
tags: |
|
|
${{ steps.vars.outputs.api_image }}:${{ steps.vars.outputs.image_tag }}
|
|
${{ steps.vars.outputs.api_image }}:latest
|
|
cache-from: type=gha,scope=fquiz-api
|
|
cache-to: type=gha,mode=max,scope=fquiz-api
|
|
|
|
- name: 构建并推送 Web 镜像
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./web
|
|
file: ./web/Dockerfile
|
|
push: true
|
|
build-args: |
|
|
NEXT_PUBLIC_API_BASE_URL=${{ vars.NEXT_PUBLIC_API_BASE_URL || 'http://127.0.0.1:8000' }}
|
|
tags: |
|
|
${{ steps.vars.outputs.web_image }}:${{ steps.vars.outputs.image_tag }}
|
|
${{ steps.vars.outputs.web_image }}:latest
|
|
cache-from: type=gha,scope=fquiz-web
|
|
cache-to: type=gha,mode=max,scope=fquiz-web
|
|
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build-and-push
|
|
if: github.ref == 'refs/heads/main'
|
|
steps:
|
|
- name: 校验部署参数
|
|
env:
|
|
SERVER_HOST: ${{ secrets.SERVER_HOST || vars.SERVER_HOST }}
|
|
SERVER_USER: ${{ secrets.SERVER_USER || vars.SERVER_USER }}
|
|
SERVER_SSH_KEY: ${{ secrets.SERVER_SSH_KEY }}
|
|
SERVER_PASSWORD: ${{ secrets.SERVER_PASSWORD }}
|
|
run: |
|
|
set -euo pipefail
|
|
[ -n "${SERVER_HOST}" ] || { echo "::error::缺少 SERVER_HOST（请在 Secrets 或 Variables 中配置）"; exit 1; }
|
|
[ -n "${SERVER_USER}" ] || { echo "::error::缺少 SERVER_USER（请在 Secrets 或 Variables 中配置）"; exit 1; }
|
|
if [ -z "${SERVER_SSH_KEY}" ] && [ -z "${SERVER_PASSWORD}" ]; then
|
|
echo "::error::缺少登录凭据：请至少配置 SERVER_SSH_KEY 或 SERVER_PASSWORD"
|
|
exit 1
|
|
fi
|
|
|
|
- name: 通过 SSH 拉取并更新容器
|
|
uses: appleboy/ssh-action@v1.2.0
|
|
env:
|
|
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH || vars.DEPLOY_PATH }}
|
|
API_IMAGE: ${{ needs.build-and-push.outputs.api_image }}
|
|
WEB_IMAGE: ${{ needs.build-and-push.outputs.web_image }}
|
|
IMAGE_TAG: ${{ needs.build-and-push.outputs.image_tag }}
|
|
NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL || 'http://127.0.0.1:8000' }}
|
|
GHCR_USERNAME: ${{ github.actor }}
|
|
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
host: ${{ secrets.SERVER_HOST || vars.SERVER_HOST }}
|
|
username: ${{ secrets.SERVER_USER || vars.SERVER_USER }}
|
|
port: ${{ secrets.SERVER_PORT || vars.SERVER_PORT || 22 }}
|
|
timeout: 120s
|
|
command_timeout: 45m
|
|
key: ${{ secrets.SERVER_SSH_KEY }}
|
|
password: ${{ secrets.SERVER_PASSWORD }}
|
|
envs: DEPLOY_PATH,API_IMAGE,WEB_IMAGE,IMAGE_TAG,NEXT_PUBLIC_API_BASE_URL,GHCR_USERNAME,GHCR_TOKEN
|
|
script: |
|
|
set -euo pipefail
|
|
export DOCKER_CLIENT_TIMEOUT="${DOCKER_CLIENT_TIMEOUT:-600}"
|
|
export COMPOSE_HTTP_TIMEOUT="${COMPOSE_HTTP_TIMEOUT:-600}"
|
|
|
|
DEPLOY_DIR="${DEPLOY_PATH:-/opt/fquiz}"
|
|
mkdir -p "${DEPLOY_DIR}"
|
|
cd "${DEPLOY_DIR}"
|
|
|
|
cat > docker-compose.prod.yml <<'YAML'
|
|
services:
|
|
db:
|
|
image: ${POSTGRES_IMAGE:-docker.m.daocloud.io/pgvector/pgvector:pg16}
|
|
container_name: fquiz-db
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB:-fquiz}
|
|
POSTGRES_USER: ${POSTGRES_USER:-fquiz}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-fquiz}
|
|
ports:
|
|
- "${POSTGRES_PORT:-5433}:5432"
|
|
volumes:
|
|
- fquiz_db_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-fquiz} -d ${POSTGRES_DB:-fquiz}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 8
|
|
start_period: 10s
|
|
restart: unless-stopped
|
|
|
|
api:
|
|
image: ${API_IMAGE}
|
|
container_name: fquiz-api
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
environment:
|
|
API_HOST: ${API_HOST:-0.0.0.0}
|
|
API_PORT: ${API_PORT:-8000}
|
|
API_CORS_ORIGINS: ${API_CORS_ORIGINS:-http://localhost:3000,http://127.0.0.1:3000}
|
|
API_CORS_ORIGIN_REGEX: ${API_CORS_ORIGIN_REGEX:-}
|
|
DATABASE_URL: ${DATABASE_URL:-postgresql+psycopg://fquiz:fquiz@db:5432/fquiz}
|
|
JWT_SECRET_KEY: ${JWT_SECRET_KEY:-change-this-in-production}
|
|
ACCESS_TOKEN_EXPIRE_MINUTES: ${ACCESS_TOKEN_EXPIRE_MINUTES:-15}
|
|
REFRESH_TOKEN_EXPIRE_DAYS: ${REFRESH_TOKEN_EXPIRE_DAYS:-30}
|
|
REFRESH_COOKIE_SECURE: ${REFRESH_COOKIE_SECURE:-false}
|
|
REFRESH_COOKIE_SAMESITE: ${REFRESH_COOKIE_SAMESITE:-lax}
|
|
LLM_PROVIDER_API_KEYS: ${LLM_PROVIDER_API_KEYS:-}
|
|
LLM_REQUEST_TIMEOUT_SECONDS: ${LLM_REQUEST_TIMEOUT_SECONDS:-60}
|
|
CHAT_CONTEXT_MESSAGE_LIMIT: ${CHAT_CONTEXT_MESSAGE_LIMIT:-12}
|
|
CHAT_DEFAULT_SYSTEM_PROMPT: ${CHAT_DEFAULT_SYSTEM_PROMPT:-You are a helpful assistant.}
|
|
INITIAL_ADMIN_EMAIL: ${INITIAL_ADMIN_EMAIL:-admin@example.com}
|
|
INITIAL_ADMIN_USERNAME: ${INITIAL_ADMIN_USERNAME:-admin}
|
|
INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-change-me-strong-password}
|
|
ports:
|
|
- "${API_PORT:-8000}:8000"
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health', timeout=2).read()"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 5
|
|
start_period: 10s
|
|
restart: unless-stopped
|
|
|
|
web:
|
|
image: ${WEB_IMAGE}
|
|
container_name: fquiz-web
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
environment:
|
|
NEXT_PUBLIC_API_BASE_URL: ${NEXT_PUBLIC_API_BASE_URL:-http://localhost:8000}
|
|
NODE_ENV: production
|
|
ports:
|
|
- "3000:3000"
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
fquiz_db_data:
|
|
YAML
|
|
|
|
if [ ! -f .env ]; then
|
|
cat > .env <<'ENV'
|
|
NEXT_PUBLIC_API_BASE_URL=http://127.0.0.1:8000
|
|
API_HOST=0.0.0.0
|
|
API_PORT=8000
|
|
API_CORS_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
|
|
API_CORS_ORIGIN_REGEX=
|
|
DATABASE_URL=postgresql+psycopg://fquiz:fquiz@db:5432/fquiz
|
|
JWT_SECRET_KEY=change-this-in-production
|
|
ACCESS_TOKEN_EXPIRE_MINUTES=15
|
|
REFRESH_TOKEN_EXPIRE_DAYS=30
|
|
REFRESH_COOKIE_SECURE=false
|
|
REFRESH_COOKIE_SAMESITE=lax
|
|
LLM_PROVIDER_API_KEYS=
|
|
LLM_REQUEST_TIMEOUT_SECONDS=60
|
|
CHAT_CONTEXT_MESSAGE_LIMIT=12
|
|
CHAT_DEFAULT_SYSTEM_PROMPT=You are a helpful assistant.
|
|
INITIAL_ADMIN_EMAIL=admin@example.com
|
|
INITIAL_ADMIN_USERNAME=admin
|
|
INITIAL_ADMIN_PASSWORD=change-me-strong-password
|
|
POSTGRES_DB=fquiz
|
|
POSTGRES_USER=fquiz
|
|
POSTGRES_PASSWORD=fquiz
|
|
POSTGRES_PORT=5433
|
|
POSTGRES_IMAGE=docker.m.daocloud.io/pgvector/pgvector:pg16
|
|
ENV
|
|
echo "[warn] .env 不存在，已写入默认模板，请尽快改成生产配置。"
|
|
fi
|
|
|
|
cat > .images.env <<ENV
|
|
API_IMAGE=${API_IMAGE}:${IMAGE_TAG}
|
|
WEB_IMAGE=${WEB_IMAGE}:${IMAGE_TAG}
|
|
NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}
|
|
ENV
|
|
|
|
echo "${GHCR_TOKEN}" | docker login ghcr.io -u "${GHCR_USERNAME}" --password-stdin
|
|
|
|
COMPOSE_CMD="docker compose"
|
|
if ! docker compose version >/dev/null 2>&1; then
|
|
COMPOSE_CMD="docker-compose"
|
|
fi
|
|
|
|
pull_with_retry() {
|
|
local max_retries=3
|
|
local attempt=1
|
|
while true; do
|
|
if ${COMPOSE_CMD} --env-file .env --env-file .images.env -f docker-compose.prod.yml pull; then
|
|
break
|
|
fi
|
|
if [ "${attempt}" -ge "${max_retries}" ]; then
|
|
echo "[error] docker compose pull failed after ${max_retries} attempts."
|
|
return 1
|
|
fi
|
|
local sleep_seconds=$((attempt * 20))
|
|
echo "[warn] docker compose pull failed (attempt ${attempt}/${max_retries}), retrying in ${sleep_seconds}s..."
|
|
sleep "${sleep_seconds}"
|
|
attempt=$((attempt + 1))
|
|
done
|
|
}
|
|
|
|
pull_with_retry
|
|
${COMPOSE_CMD} --env-file .env --env-file .images.env -f docker-compose.prod.yml up -d --remove-orphans
|
|
${COMPOSE_CMD} --env-file .env --env-file .images.env -f docker-compose.prod.yml ps
|