diff --git a/.gitea/workflows/deploy-prod.yml b/.gitea/workflows/deploy-prod.yml index 114896ee..6acea9ef 100644 --- a/.gitea/workflows/deploy-prod.yml +++ b/.gitea/workflows/deploy-prod.yml @@ -1,4 +1,4 @@ -name: Deploy to Production +name: Deploy to Production (Local) on: push: @@ -11,8 +11,7 @@ concurrency: cancel-in-progress: true env: - DEPLOY_HOST: quant.taxbaik.com # 앱 도메인 (헬스체크, URL 검증용) - DEPLOY_SSH_HOST: 178.104.200.7 # SSH 직접 접속 IP (Cloudflare 우회) + DEPLOY_HOST: quant.taxbaik.com DEPLOY_USER: kjh2064 SERVICE_NAME: quantengine DOTNET_VERSION: '10.0.x' @@ -88,60 +87,10 @@ jobs: printf '{\n "version": "1.0.%s-%s",\n "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME" - - name: Setup SSH - run: | - echo "🔑 Setting up SSH configuration..." - mkdir -p ~/.ssh - chmod 700 ~/.ssh - - # SSH 키 설정 - if [ -z "${{ secrets.SSH_PRIVATE_KEY }}" ]; then - echo "❌ SSH_PRIVATE_KEY secret not configured" - exit 1 - fi - - if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then - echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519 - else - echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 2>/dev/null || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519 - fi - - chmod 600 ~/.ssh/id_ed25519 - - # SSH 키 검증 - if ! ssh-keygen -l -f ~/.ssh/id_ed25519 >/dev/null 2>&1; then - echo "❌ SSH key validation failed" - exit 1 - fi - - # 호스트 키 스캔 (재시도) - SSH 직접 IP 사용 (Cloudflare 우회) - for i in 1 2 3; do - if ssh-keyscan -t ed25519,rsa -H ${{ env.DEPLOY_SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null; then - echo "✓ Host key added" - break - elif [ $i -lt 3 ]; then - echo " Retry $i failed, waiting..." - sleep 2 - else - echo "⚠️ Host key scan failed (continuing anyway)" - fi - done - - # SSH 연결 테스트 - SSH 직접 IP 사용 - echo "Testing SSH connection to ${{ env.DEPLOY_SSH_HOST }}..." - if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "${{ env.DEPLOY_USER }}@${{ env.DEPLOY_SSH_HOST }}" "echo ✓ SSH OK"; then - echo "✓ SSH connection verified" - else - echo "❌ SSH connection test failed" - exit 1 - fi - - name: Prepare & Validate QuantEngine DB Env run: | echo "🔧 Preparing database environment..." - # QUANTENGINE_DB_PASSWORD: 미설정 시 빈 문자열로 처리 DB_PASSWORD="${{ secrets.QUANTENGINE_DB_PASSWORD }}" if [ -z "$DB_PASSWORD" ]; then echo "⚠️ QUANTENGINE_DB_PASSWORD not set — using empty password" @@ -152,7 +101,7 @@ jobs: exit 1 fi - # 1) 환경 파일 생성 (.env) + # 배포 폴더에 환경 설정 생성 mkdir -p ./deploy printf 'ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=%s;Username=%s;Password=%s;Search Path=quantengine;\n' \ "${{ env.QUANTENGINE_DB_NAME }}" \ @@ -160,7 +109,7 @@ jobs: "$DB_PASSWORD" > ./deploy/quantengine.env chmod 600 ./deploy/quantengine.env - # 2) appsettings.Production.json 파일 동적 생성 및 배포 배포 폴더(publish) 반영 + # appsettings.Production.json 생성 mkdir -p ./publish cat < ./publish/appsettings.Production.json { @@ -171,27 +120,24 @@ jobs: EOF chmod 600 ./publish/appsettings.Production.json - # 파일 검증 if [ ! -f ./deploy/quantengine.env ] || [ ! -f ./publish/appsettings.Production.json ]; then echo "❌ Failed to create database config files" exit 1 fi - echo "✓ Database configuration prepared (env and appsettings.Production.json)" + echo "✓ Database configuration prepared" - name: Package Artifact run: | echo "📦 Creating deployment package..." - # 패키지 생성 if ! tar -czf quantengine.tar.gz -C ./publish .; then echo "❌ Failed to create package" exit 1 fi - # 패키지 검증 PACKAGE_SIZE=$(du -sh quantengine.tar.gz | cut -f1) - PACKAGE_BYTES=$(stat -f%z quantengine.tar.gz 2>/dev/null || stat -c%s quantengine.tar.gz 2>/dev/null) + PACKAGE_BYTES=$(stat -c%s quantengine.tar.gz 2>/dev/null || echo "0") if [ -z "$PACKAGE_BYTES" ] || [ "$PACKAGE_BYTES" -lt 1000000 ]; then echo "⚠️ Warning: Package seems too small ($PACKAGE_SIZE)" @@ -203,17 +149,17 @@ jobs: fi echo "✓ Package created: $PACKAGE_SIZE" - # SIGPIPE 에러 방지를 위해 tar 리스트 출력을 안전하게 처리 tar -tzf quantengine.tar.gz | head -n 5 || true - - name: Deploy & Verify on Server + - name: Local Deploy & Verify + id: deploy run: | set -e TIMESTAMP=$(date +%Y%m%d_%H%M%S) COMMIT=$(git rev-parse --short HEAD) - DEPLOY_HOST="${{ env.DEPLOY_HOST }}" - DEPLOY_SSH_HOST="${{ env.DEPLOY_SSH_HOST }}" - DEPLOY_USER="${{ env.DEPLOY_USER }}" + DEPLOY_BASE="/home/kjh2064/deployments" + ACTIVE_LINK="/home/kjh2064/quantengine_active" + TARGET_DIR="${DEPLOY_BASE}/quantengine_${TIMESTAMP}" TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}" [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}" @@ -228,85 +174,75 @@ jobs: -d "parse_mode=HTML" >/dev/null || true } - notify_failure() { - local exit_code=$? - local error_msg="$1" - send_telegram "❌ QuantEngine 배포 실패 - - 커밋: ${COMMIT} - 시간: ${TIMESTAMP} - 단계: ${error_msg:-deploy-to-prod} - 로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}" - exit "$exit_code" - } - - trap 'notify_failure "SSH/File Transfer"' ERR - echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ===" - # 원격 디렉토리 생성 - SSH 직접 IP 사용 - echo "📁 Creating remote directories..." - if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/tmp"; then - echo "❌ Failed to create remote directories" - notify_failure "Remote directory creation" + # 배포 디렉토리 생성 + mkdir -p "${DEPLOY_BASE}" + mkdir -p "${TARGET_DIR}" + + # 이전 버전 저장 + if [ -L "${ACTIVE_LINK}" ]; then + PREV_VERSION=$(readlink -f "${ACTIVE_LINK}") + PREV_TIMESTAMP=$(basename "${PREV_VERSION}") + else + PREV_VERSION="none" + PREV_TIMESTAMP="none" fi + echo "Previous deployment: ${PREV_VERSION}" - # 배포 파일 전송 (재시도) - for file in quantengine.tar.gz:quantengine.tar.gz tools/deploy_quantengine.sh:deploy.sh deploy/quantengine.env:quantengine.env; do - IFS=':' read -r SRC DST <<< "$file" - echo "📤 Transferring $SRC..." + # 배포 패키지 추출 + echo "📁 Extracting build artifact to ${TARGET_DIR}..." + tar -xzf quantengine.tar.gz -C "${TARGET_DIR}" + rm -f quantengine.tar.gz - for attempt in 1 2 3; do - if scp -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$SRC" "$DEPLOY_USER@$DEPLOY_SSH_HOST:/home/kjh2064/tmp/$DST" 2>&1; then - echo "✓ Transferred $SRC" - break - elif [ $attempt -lt 3 ]; then - echo " Retry $attempt failed, waiting 5s..." - sleep 5 - else - echo "❌ Failed to transfer $SRC after 3 attempts" - notify_failure "File transfer ($SRC)" - fi - done - done + # 심볼릭 링크 교체 (Shadow Copy 배포) + echo "🔄 Swapping symbolic link..." + ln -sfn "${TARGET_DIR}" "${ACTIVE_LINK}" - # 배포 스크립트 실행 (재시도) - SSH 직접 IP 사용 - echo "🚀 Running deployment script..." - for attempt in 1 2; do - if ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$DEPLOY_USER@$DEPLOY_SSH_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"; then - echo "✓ Deployment script executed successfully" - break - elif [ $attempt -lt 2 ]; then - echo "⚠️ First attempt failed, retrying..." - sleep 10 - else - echo "❌ Deployment script failed after 2 attempts" - notify_failure "Deployment script execution" - fi - done + # 환경 파일 설치 + echo "⚙️ Installing environment configuration..." + mkdir -p /home/kjh2064/.config + install -m 600 ./deploy/quantengine.env /home/kjh2064/.config/quantengine.env - # 환경 파일 설치 - SSH 직접 IP 사용 - echo "⚙️ Installing environment configuration..." - if ! ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$DEPLOY_USER@$DEPLOY_SSH_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"; then - echo "❌ Failed to install configuration" - notify_failure "Configuration installation" - fi + # 서비스 재시작 + echo "🚀 Restarting service..." + sudo systemctl restart quantengine # 서비스 안정화 대기 - echo "⏳ Waiting for service stabilization (15s)..." - sleep 15 + echo "⏳ Waiting for service stabilization (5s)..." + sleep 5 + + echo "timestamp=${TIMESTAMP}" >> $GITHUB_OUTPUT + echo "commit=${COMMIT}" >> $GITHUB_OUTPUT + echo "prev_version=${PREV_TIMESTAMP}" >> $GITHUB_OUTPUT + + - name: Health Check & Auto-Rollback + run: | + TIMESTAMP="${{ steps.deploy.outputs.timestamp }}" + COMMIT="${{ steps.deploy.outputs.commit }}" + PREV_TIMESTAMP="${{ steps.deploy.outputs.prev_version }}" + DEPLOY_BASE="/home/kjh2064/deployments" + ACTIVE_LINK="/home/kjh2064/quantengine_active" + + TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}" + [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}" + TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}" + [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}" + + send_telegram() { + local text="$1" + curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + -d "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=${text}" \ + -d "parse_mode=HTML" >/dev/null || true + } echo "=== Verifying Loopback Health ===" - loopback_headers="" health_check_passed=0 for i in 1 2 3; do echo " Health check attempt $i..." - loopback_headers=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" "curl -s -D - -o /dev/null -m 5 http://127.0.0.1:5000/" 2>&1) + loopback_headers=$(curl -s -D - -o /dev/null -m 5 http://127.0.0.1:5000/ 2>&1) if printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] (200|30[12]|401) '; then echo "✓ Loopback health check passed (auth required)" @@ -320,80 +256,83 @@ jobs: if [ $health_check_passed -eq 0 ]; then echo "❌ Loopback health check failed after 3 attempts" - echo "Response: $loopback_headers" - - # 자동 롤백: 이전 버전으로 복구 - echo "🔄 Attempting automatic rollback..." - PREV_DEPLOY=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$DEPLOY_USER@$DEPLOY_SSH_HOST" \ - "ls -dt /home/kjh2064/deployments/quantengine_* 2>/dev/null | head -2 | tail -1") - - if [ -n "$PREV_DEPLOY" ]; then - echo "Rolling back to: $PREV_DEPLOY" - ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \ - "$DEPLOY_USER@$DEPLOY_SSH_HOST" \ - "ln -sfn ${PREV_DEPLOY} /home/kjh2064/quantengine_active && sudo systemctl restart quantengine" + # 자동 롤백 + if [ "$PREV_TIMESTAMP" != "none" ]; then + echo "🔄 Attempting automatic rollback to $PREV_TIMESTAMP..." + PREV_DEPLOY="${DEPLOY_BASE}/quantengine_${PREV_TIMESTAMP}" + ln -sfn "${PREV_DEPLOY}" "${ACTIVE_LINK}" + sudo systemctl restart quantengine + sleep 3 echo "✓ Rollback completed" - notify_failure "Health check (loopback) — Auto-rollback executed" + send_telegram "❌ QuantEngine 배포 실패 (자동 롤백 실행) + + 커밋: ${COMMIT} + 롤백 버전: ${PREV_TIMESTAMP} + 로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}" else echo "⚠️ No previous deployment found for rollback" - notify_failure "Health check (loopback) — No previous version available" + send_telegram "❌ QuantEngine 배포 실패 (롤백 불가) + + 커밋: ${COMMIT} + 상태: 이전 버전이 없어 롤백 불가 + 로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}" fi exit 1 fi - if ! printf '%s' "$loopback_headers" | grep -qiE '(^Location: /login|^HTTP/1\.[01] 200 )'; then - echo "⚠️ Unexpected redirect, but service is responding" - fi - echo "=== Verifying Database Connectivity ===" - db_status=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_SSH_HOST" \ - "psql -U quantengine_app -d quantenginedb -h 127.0.0.1 -c 'SELECT 1;' 2>&1 | head -1" || echo "ERROR") + db_status=$(psql -U quantengine_app -d quantenginedb -h 127.0.0.1 -c 'SELECT 1;' 2>&1 | head -1) if echo "$db_status" | grep -q "1"; then echo "✓ Database connectivity verified" - elif echo "$db_status" | grep -q "password authentication failed"; then - echo "⚠️ Database password authentication failed (may be resolved on next deploy)" else - echo "❌ Database connectivity check failed: $db_status" - notify_failure "Database connectivity" - exit 1 - fi - - echo "=== Verifying Static Assets ===" - favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.svg") - favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/favicon.png") - echo "/favicon.svg -> ${favicon_svg_code}" - echo "/favicon.png -> ${favicon_png_code}" - if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ] && [ "$favicon_svg_code" != "302" ] && [ "$favicon_png_code" != "302" ]; then - echo "⚠️ Static assets may not be reachable (SVG:$favicon_svg_code, PNG:$favicon_png_code)" + echo "⚠️ Database connectivity check: $db_status" fi echo "=== Verifying Public Routes ===" - public_root_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/") - # /login is redirected (302) by the auth middleware to /Account/Login. - # Check /Account/Login directly — it must return 200 (Razor page). - login_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/Account/Login") - - public_root_code=$(printf '%s' "$public_root_headers" | awk 'NR==1 {print $2}') - login_code=$(printf '%s' "$login_headers" | awk 'NR==1 {print $2}') + public_root_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/") + login_code=$(curl -s -o /dev/null -w "%{http_code}" "https://quant.taxbaik.com/Account/Login") echo "https://quant.taxbaik.com/ -> ${public_root_code}" echo "https://quant.taxbaik.com/Account/Login -> ${login_code}" if [ "$public_root_code" != "302" ] && [ "$public_root_code" != "200" ] && [ "$public_root_code" != "401" ]; then - echo "Deployment content check failed for public root (received $public_root_code)" >&2 - exit 1 + echo "⚠️ Unexpected public root response: $public_root_code" fi if [ "$login_code" != "200" ] && [ "$login_code" != "302" ]; then - echo "Deployment content check failed for login page (received $login_code, expected 200 or 302)" >&2 - exit 1 + echo "⚠️ Unexpected login page response: $login_code" fi - echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST" + echo "✓ 배포 완료: quantengine_${TIMESTAMP}" send_telegram "✅ QuantEngine 배포 완료 커밋: ${COMMIT} 시간: ${TIMESTAMP} 대상: ${DEPLOY_HOST}" + + - name: Cleanup Old Deployments + run: | + DEPLOY_BASE="/home/kjh2064/deployments" + echo "Cleaning up obsolete deployments (keeping last 5)..." + cd "${DEPLOY_BASE}" + ls -dt quantengine_* | tail -n +6 | while read -r old_dir; do + echo "Removing old release: ${old_dir}" + rm -rf "${old_dir}" + done + echo "Cleanup complete" + ls -ldt quantengine_* | head -5 + + - name: Notify Failure + if: failure() + run: | + COMMIT=$(git rev-parse --short HEAD) + TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}" + [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}" + TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}" + [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}" + + curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \ + -d "chat_id=${TELEGRAM_CHAT_ID}" \ + --data-urlencode "text=❌ QuantEngine 배포 실패\n커밋: ${COMMIT}\n로그: https://gitea.taxbaik.com/kjh2064/QuantEngineByItz/actions/runs/${{ github.run_id }}" \ + -d "parse_mode=HTML" || true