ci: build on VPS and deploy container

.dockerignore

@@ -7,6 +7,8 @@ node_modules
 dist
 **/dist
 .pnpm-store
+.ci
+**/.ci
 .env
 .env.*
 !.env.example

.github/workflows/ci.yml

@@ -120,77 +120,121 @@ jobs:
         environment: production
         permissions:
             contents: read
-            packages: write
         env:
-            IMAGE_NAME: ghcr.io/${{ github.repository }}-server
+            IMAGE_NAME: trade-message-center-server
             IMAGE_TAG: ${{ github.sha }}
+            SOURCE_TAG: ${{ github.ref_name }}
+            BUILD_HOST: ${{ vars.BUILD_HOST }}
+            BUILD_PORT: ${{ vars.BUILD_PORT }}
+            BUILD_USER: ${{ vars.BUILD_USER }}
+            BUILD_PATH: ${{ vars.BUILD_PATH }}
             DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
             DEPLOY_PORT: ${{ vars.DEPLOY_PORT }}
             DEPLOY_USER: ${{ vars.DEPLOY_USER }}
             DEPLOY_PATH: ${{ vars.DEPLOY_PATH }}
             DEPLOY_CONTAINER_NAME: ${{ vars.DEPLOY_CONTAINER_NAME }}
             DEPLOY_HOST_PORT: ${{ vars.DEPLOY_HOST_PORT }}
-            GHCR_USERNAME: ${{ github.actor }}
+            HOST: ${{ vars.HOST }}
-            GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            PORT: ${{ vars.PORT }}
+            DATABASE_URL: ${{ secrets.DATABASE_URL }}
+            BUILD_SSH_KEY: ${{ secrets.BUILD_SSH_KEY }}
             DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
         steps:
-            - name: Checkout
+            - name: Prepare build VPS SSH key
-              uses: actions/checkout@v4
-
-            - name: Log in to GHCR
-              uses: docker/login-action@v3
-              with:
-                  registry: ghcr.io
-                  username: ${{ github.actor }}
-                  password: ${{ secrets.GITHUB_TOKEN }}
-
-            - name: Build and push server image
-              uses: docker/build-push-action@v6
-              with:
-                  context: .
-                  file: Dockerfile.server
-                  push: true
-                  tags: ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
-                  build-args: |
-                      HOST=${{ vars.HOST }}
-                      PORT=${{ vars.PORT }}
-                  secrets: |
-                      database_url=${{ secrets.DATABASE_URL }}
-
-            - name: Install SSH key
-              shell: bash
-              run: |
-                  install -m 700 -d "$HOME/.ssh"
-                  printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
-                  chmod 600 "$HOME/.ssh/deploy_key"
-
-            - name: Deploy container over SSH
               shell: bash
               run: |
                   set -euo pipefail
+                  : "${BUILD_HOST:?BUILD_HOST is required}"
+                  : "${BUILD_USER:?BUILD_USER is required}"
+                  : "${BUILD_PATH:?BUILD_PATH is required}"
+                  : "${BUILD_SSH_KEY:?BUILD_SSH_KEY is required}"
+                  install -m 700 -d "$HOME/.ssh"
+                  printf '%s\n' "$BUILD_SSH_KEY" > "$HOME/.ssh/build_key"
+                  chmod 600 "$HOME/.ssh/build_key"
+
+            - name: Build on build VPS and deploy to target server
+              shell: bash
+              run: |
+                  set -euo pipefail
+                  : "${BUILD_HOST:?BUILD_HOST is required}"
+                  : "${BUILD_USER:?BUILD_USER is required}"
+                  : "${BUILD_PATH:?BUILD_PATH is required}"
+                  : "${SOURCE_TAG:?SOURCE_TAG is required}"
+                  : "${HOST:?HOST is required}"
+                  : "${PORT:?PORT is required}"
+                  : "${DATABASE_URL:?DATABASE_URL is required}"
                   : "${DEPLOY_HOST:?DEPLOY_HOST is required}"
                   : "${DEPLOY_USER:?DEPLOY_USER is required}"
                   : "${DEPLOY_PATH:?DEPLOY_PATH is required}"
                   : "${DEPLOY_CONTAINER_NAME:?DEPLOY_CONTAINER_NAME is required}"
                   : "${DEPLOY_HOST_PORT:?DEPLOY_HOST_PORT is required}"
                   : "${DEPLOY_SSH_KEY:?DEPLOY_SSH_KEY is required}"
+                  [[ "$BUILD_PATH" == /* ]] || { echo "BUILD_PATH must be absolute" >&2; exit 1; }
+                  [[ "$DEPLOY_PATH" == /* ]] || { echo "DEPLOY_PATH must be absolute" >&2; exit 1; }
 
-                  ssh_options=(
+                  quote_for_shell() {
-                      -i "$HOME/.ssh/deploy_key"
+                      printf '%q' "$1"
+                  }
+
+                  build_ssh_options=(
+                      -i "$HOME/.ssh/build_key"
+                      -o StrictHostKeyChecking=accept-new
+                      -o BatchMode=yes
+                  )
+                  if [[ -n "${BUILD_PORT:-}" ]]; then
+                      build_ssh_options+=( -p "$BUILD_PORT" )
+                  fi
+
+                  build_state_path="$BUILD_PATH/.ci"
+                  database_file="$build_state_path/database_url"
+                  target_key_file="$build_state_path/target_key"
+                  ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
+                      "umask 077; mkdir -p $(quote_for_shell "$build_state_path"); cat > $(quote_for_shell "$database_file")" <<< "$DATABASE_URL"
+                  ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
+                      "umask 077; cat > $(quote_for_shell "$target_key_file")" <<< "$DEPLOY_SSH_KEY"
+
+                  build_env="BUILD_PATH=$(quote_for_shell "$BUILD_PATH") SOURCE_TAG=$(quote_for_shell "$SOURCE_TAG") IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") HOST=$(quote_for_shell "$HOST") PORT=$(quote_for_shell "$PORT") DEPLOY_HOST=$(quote_for_shell "$DEPLOY_HOST") DEPLOY_PORT=$(quote_for_shell "${DEPLOY_PORT:-}") DEPLOY_USER=$(quote_for_shell "$DEPLOY_USER") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") DATABASE_FILE=$(quote_for_shell "$database_file") TARGET_KEY_FILE=$(quote_for_shell "$target_key_file")"
+                  ssh "${build_ssh_options[@]}" "$BUILD_USER@$BUILD_HOST" \
+                      "$build_env bash -s" <<'BUILD_SCRIPT'
+                  set -euo pipefail
+                  cleanup() {
+                      rm -f "$DATABASE_FILE" "$TARGET_KEY_FILE"
+                  }
+                  trap cleanup EXIT
+
+                  if [[ ! -d "$BUILD_PATH/.git" ]]; then
+                      echo "BUILD_PATH must contain a pre-cloned repository" >&2
+                      exit 1
+                  fi
+                  git -C "$BUILD_PATH" fetch --force --tags origin "refs/tags/$SOURCE_TAG:refs/tags/$SOURCE_TAG"
+                  git -C "$BUILD_PATH" checkout --detach --force "refs/tags/$SOURCE_TAG"
+
+                  image="$IMAGE_NAME:$IMAGE_TAG"
+                  docker build \
+                      --file "$BUILD_PATH/Dockerfile.server" \
+                      --build-arg "HOST=$HOST" \
+                      --build-arg "PORT=$PORT" \
+                      --secret "id=database_url,src=$DATABASE_FILE" \
+                      --tag "$image" \
+                      "$BUILD_PATH"
+
+                  target_ssh_options=(
+                      -i "$TARGET_KEY_FILE"
                       -o StrictHostKeyChecking=accept-new
                       -o BatchMode=yes
                   )
                   if [[ -n "${DEPLOY_PORT:-}" ]]; then
-                      ssh_options+=( -p "$DEPLOY_PORT" )
+                      target_ssh_options+=( -p "$DEPLOY_PORT" )
                   fi
 
-                  printf '%s' "$GHCR_TOKEN" | ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+                  docker save "$image" | gzip -1 | ssh "${target_ssh_options[@]}" \
-                      "docker login ghcr.io -u '$GHCR_USERNAME' --password-stdin"
+                      "$DEPLOY_USER@$DEPLOY_HOST" "gzip -d | docker load"
-                  ssh "${ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+
-                      "IMAGE_NAME='$IMAGE_NAME' IMAGE_TAG='$IMAGE_TAG' DEPLOY_PATH='$DEPLOY_PATH' DEPLOY_CONTAINER_NAME='$DEPLOY_CONTAINER_NAME' DEPLOY_HOST_PORT='$DEPLOY_HOST_PORT' bash -s" <<'REMOTE_SCRIPT'
+                  target_env="IMAGE_NAME=$(quote_for_shell "$IMAGE_NAME") IMAGE_TAG=$(quote_for_shell "$IMAGE_TAG") DEPLOY_PATH=$(quote_for_shell "$DEPLOY_PATH") DEPLOY_CONTAINER_NAME=$(quote_for_shell "$DEPLOY_CONTAINER_NAME") DEPLOY_HOST_PORT=$(quote_for_shell "$DEPLOY_HOST_PORT") CONTAINER_PORT=$(quote_for_shell "$PORT")"
+                  ssh "${target_ssh_options[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
+                      "$target_env bash -s" <<'TARGET_SCRIPT'
                   set -euo pipefail
                   image="$IMAGE_NAME:$IMAGE_TAG"
-                  docker pull "$image"
                   mkdir -p "$DEPLOY_PATH"
                   previous_image="$(docker inspect --format '{{.Config.Image}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
                   migration_container="${DEPLOY_CONTAINER_NAME}-migration"
@@ -204,7 +248,7 @@ jobs:
                   docker run -d \
                       --name "$DEPLOY_CONTAINER_NAME" \
                       --restart unless-stopped \
-                      --publish "$DEPLOY_HOST_PORT:7878" \
+                      --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
                       "$image"
                   for attempt in {1..30}; do
                       status="$(docker inspect --format '{{.State.Health.Status}}' "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true)"
@@ -219,8 +263,10 @@ jobs:
                               docker run -d \
                                   --name "$DEPLOY_CONTAINER_NAME" \
                                   --restart unless-stopped \
-                                  --publish "$DEPLOY_HOST_PORT:7878" \
+                                  --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
                                   "$previous_image"
+                          else
+                              docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
                           fi
                           exit 1
                       fi
@@ -232,8 +278,10 @@ jobs:
                       docker run -d \
                           --name "$DEPLOY_CONTAINER_NAME" \
                           --restart unless-stopped \
-                          --publish "$DEPLOY_HOST_PORT:7878" \
+                          --publish "$DEPLOY_HOST_PORT:$CONTAINER_PORT" \
                           "$previous_image"
+                  else
+                      docker rm -f "$DEPLOY_CONTAINER_NAME" 2>/dev/null || true
                   fi
                   exit 1
-                  REMOTE_SCRIPT
+                  TARGET_SCRIPT

Dockerfile.server

@@ -5,10 +5,12 @@ FROM node:22.22.2-bookworm-slim AS build
 WORKDIR /workspace
 
 RUN corepack enable && corepack prepare pnpm@11.7.0 --activate
+ENV HUSKY=0
 
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.base.json ./
 COPY apps/onetalk-contract/package.json apps/onetalk-contract/package.json
 COPY apps/server/package.json apps/server/package.json
+COPY apps/chrome-extension/package.json apps/chrome-extension/package.json
 
 RUN pnpm install --frozen-lockfile --registry=https://registry.npmjs.org
 
@@ -24,19 +26,22 @@ ENV PORT=${PORT}
 RUN --mount=type=secret,id=database_url \
     DATABASE_URL="$(cat /run/secrets/database_url)" \
     pnpm --filter @trade-message-center/server build && \
-    pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server
+    pnpm --filter @trade-message-center/server deploy --prod --legacy /opt/server && \
+    rm -rf /opt/server/src /opt/server/test /opt/server/scripts /opt/server/tsconfig.json /opt/server/drizzle.config.ts
 
 FROM node:22.22.2-bookworm-slim AS runtime
 
 WORKDIR /app
 
+ARG PORT
 ENV NODE_ENV=production
+ENV SERVER_PORT=${PORT}
 
 COPY --from=build /opt/server ./
 
-EXPOSE 7878
+EXPOSE ${PORT}
 
 HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=6 \
-    CMD node -e "fetch('http://127.0.0.1:7878/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))"
+    CMD node -e "fetch('http://127.0.0.1:' + process.env.SERVER_PORT + '/health').then((response) => { if (!response.ok) process.exit(1); }).catch(() => process.exit(1))"
 
 CMD ["sh", "-c", "node dist/src/database/migrate.js && exec node dist/src/entry.js"]