jimmy/nas-tools
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

sprint: S09.5 done — dev deploy runs on nas runner (was vps); all exit criteria verified and marked complete

Browse Source
This commit is contained in:
Gan, Jimmy
2026-07-12 15:30:58 +08:00
parent 556bd12c21
commit 07ad32f784
2 changed files with 33 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-dev.yml
+24 -24
View File
@@ -192,23 +192,28 @@ jobs:
deploy-dev: deploy-dev:
name: Deploy to Dev name: Deploy to Dev
runs-on: vps runs-on: nas
if: always() && needs.build-image-dev.result == 'success'
needs: [build-image-dev, backend-tests, frontend-tests] needs: [build-image-dev, backend-tests, frontend-tests]
env: env:
SECRET_KEY: test-secret-key-for-ci-environment-32chars-minimum SECRET_KEY: test-secret-key-for-ci-environment-32chars-minimum
container:
network: gitea_gitea
volumes:
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
- /volume1/docker/nas-dashboard:/nas-dashboard
steps: steps:
- name: Checkout repository - name: Checkout repository
run: | run: |
if [ ! -d .git ]; then if [ ! -d .git ]; then
git clone --depth=1 --branch "$GITHUB_REF_NAME" "http://100.78.131.124:3300/${GITHUB_REPOSITORY}.git" . git clone --depth=1 --branch "$GITHUB_REF_NAME" "http://127.0.0.1:3300/${GITHUB_REPOSITORY}.git" .
fi fi
- name: Sync runtime compose file - name: Sync runtime compose file
run: | run: |
set -x mkdir -p /nas-dashboard
ssh nasts "mkdir -p /volume1/docker/nas-dashboard" cp dashboard/docker-compose.dev.yml /nas-dashboard/docker-compose.dev.yml
cat dashboard/docker-compose.dev.yml | ssh nasts "cat > /volume1/docker/nas-dashboard/docker-compose.dev.yml"
- name: Deploy dev - name: Deploy dev
env: env:
@@ -216,39 +221,36 @@ jobs:
SECRET_KEY: ${{ secrets.SECRET_KEY }} SECRET_KEY: ${{ secrets.SECRET_KEY }}
run: | run: |
set -x set -x
DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker" export DOCKER_API_VERSION=1.43
COMPOSE="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker-compose"
NAS_VOL="/volume1/docker/nas-dashboard"
# Step 1: Stop existing containers # Step 1: Stop existing containers
echo "=== STEP 1: Down ===" echo "=== STEP 1: Down ==="
$COMPOSE -f $NAS_VOL/docker-compose.dev.yml -p nas-dashboard-dev down 2>&1 || echo "down ok" docker compose -f /nas-dashboard/docker-compose.dev.yml -p nas-dashboard-dev down 2>&1 || echo "down ok"
# Step 2: Ensure network exists # Step 2: Ensure network exists
echo "=== STEP 2: Network ===" echo "=== STEP 2: Network ==="
$DOCKER network inspect nas-dashboard_internal >/dev/null 2>&1 || $DOCKER network create nas-dashboard_internal docker network inspect nas-dashboard_internal >/dev/null 2>&1 || docker network create nas-dashboard_internal
# Step 3: Deploy new container # Step 3: Deploy new container
echo "=== STEP 3: Up ===" echo "=== STEP 3: Up ==="
ssh nasts "cd $NAS_VOL && GITEA_TOKEN=$GITEA_TOKEN SECRET_KEY=$SECRET_KEY /volume1/@appstore/ContainerManager/usr/bin/docker-compose -f docker-compose.dev.yml -p nas-dashboard-dev up -d --pull never" 2>&1 || echo "up returned $?" cd /nas-dashboard && GITEA_TOKEN=$GITEA_TOKEN SECRET_KEY=$SECRET_KEY docker compose -f docker-compose.dev.yml -p nas-dashboard-dev up -d --pull never 2>&1 || echo "up returned $?"
# Step 4: Verify container exists # Step 4: Verify container exists
echo "=== STEP 4: Inspect ===" echo "=== STEP 4: Inspect ==="
$DOCKER container inspect nas-dashboard-dev >/dev/null 2>&1 && echo "container exists" || { echo "container not found"; exit 1; } docker container inspect nas-dashboard-dev >/dev/null 2>&1 && echo "container exists" || { echo "container not found"; exit 1; }
# Step 5: Connect networks # Step 5: Connect networks
echo "=== STEP 5: Network connect ===" echo "=== STEP 5: Network connect ==="
$DOCKER network connect nas-dashboard_internal nas-dashboard-dev 2>&1 || echo "already connected" docker network connect nas-dashboard_internal nas-dashboard-dev 2>&1 || echo "already connected"
$DOCKER network connect gitea_gitea nas-dashboard-dev 2>&1 || echo "already connected" docker network connect gitea_gitea nas-dashboard-dev 2>&1 || echo "already connected"
echo "=== DEPLOY COMPLETE ===" echo "=== DEPLOY COMPLETE ==="
- name: Wait for container to be healthy - name: Wait for container to be healthy
run: | run: |
DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker"
echo "Waiting for container to be healthy..." echo "Waiting for container to be healthy..."
for i in {1..30}; do for i in {1..30}; do
STATUS=$($DOCKER inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "starting") STATUS=$(docker inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "starting")
if [ "$STATUS" = "healthy" ]; then if [ "$STATUS" = "healthy" ]; then
echo "✅ Container is healthy" echo "✅ Container is healthy"
break break
@@ -256,34 +258,32 @@ jobs:
echo "Waiting... ($i/30) Status: $STATUS" echo "Waiting... ($i/30) Status: $STATUS"
sleep 2 sleep 2
done done
STATUS=$($DOCKER inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "unknown") STATUS=$(docker inspect --format='{{.State.Health.Status}}' nas-dashboard-dev 2>/dev/null || echo "unknown")
if [ "$STATUS" != "healthy" ]; then if [ "$STATUS" != "healthy" ]; then
echo "❌ Container failed to become healthy: $STATUS" echo "❌ Container failed to become healthy: $STATUS"
$DOCKER logs nas-dashboard-dev --tail 50 docker logs nas-dashboard-dev --tail 50
exit 1 exit 1
fi fi
- name: Run smoke tests - name: Run smoke tests
run: | run: |
echo "=== Running smoke tests via docker exec ===" echo "=== Running smoke tests via docker exec ==="
DOCKER="ssh nasts /volume1/@appstore/ContainerManager/usr/bin/docker"
# Test 1: Health check # Test 1: Health check
echo "1. Testing health endpoint..." echo "1. Testing health endpoint..."
printf 'import urllib.request, json\nd = json.loads(urllib.request.urlopen(\"http://localhost:4000/api/health\", timeout=5).read())\nassert d.get(\"status\") == \"ok\"\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ Health check passed" || { echo "❌ Health check failed"; $DOCKER logs nas-dashboard-dev --tail 50; exit 1; } docker exec nas-dashboard-dev python3 -c "import urllib.request, json; d = json.loads(urllib.request.urlopen('http://localhost:4000/api/health', timeout=5).read()); assert d.get('status') == 'ok'" && echo "✅ Health check passed" || { echo "❌ Health check failed"; docker logs nas-dashboard-dev --tail 50; exit 1; }
# Test 2: Frontend loads # Test 2: Frontend loads
echo "2. Testing frontend loads..." echo "2. Testing frontend loads..."
printf 'import urllib.request\nhtml = urllib.request.urlopen(\"http://localhost:4000/\", timeout=5).read().decode()\nassert \"NAS Dashboard\" in html\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ Frontend loads" || { echo "❌ Frontend failed to load"; exit 1; } docker exec nas-dashboard-dev python3 -c "import urllib.request; html = urllib.request.urlopen('http://localhost:4000/', timeout=5).read().decode(); assert 'NAS Dashboard' in html" && echo "✅ Frontend loads" || { echo "❌ Frontend failed to load"; exit 1; }
# Test 3: API endpoints require auth # Test 3: API endpoints require auth
echo "3. Testing API endpoints require auth..." echo "3. Testing API endpoints require auth..."
printf 'import urllib.request, json\ntry:\n resp = urllib.request.urlopen(\"http://localhost:4000/api/conversations/dates\", timeout=5)\n data = resp.read().decode()\n assert \"Not authenticated\" in data or \"detail\" in data\nexcept urllib.error.HTTPError as e:\n assert e.code in (401, 403)\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "✅ API requires auth" || { echo "❌ Auth check failed"; exit 1; } docker exec nas-dashboard-dev python3 -c "import urllib.request, json; exec('try:\n resp = urllib.request.urlopen(\"http://localhost:4000/api/conversations/dates\", timeout=5)\n data = resp.read().decode()\n assert \"Not authenticated\" in data or \"detail\" in data\nexcept urllib.error.HTTPError as e:\n assert e.code in (401, 403)')" && echo "✅ API requires auth" || { echo "❌ Auth check failed"; exit 1; }
# Test 4: Double /api/ prefix bug (non-failing) # Test 4: Double /api/ prefix bug (non-failing)
echo "4. Testing for double /api/ prefix bug..." echo "4. Testing for double /api/ prefix bug..."
printf 'import urllib.request\ntry:\n urllib.request.urlopen(\"http://localhost:4000/api/api/conversations/dates\", timeout=5)\n print(\"WARNING: /api/api/ returned 200\")\nexcept urllib.error.HTTPError as e:\n assert e.code == 404\n print(\"OK: /api/api/ returned 404\")\n' | $DOCKER exec -i nas-dashboard-dev python3 && echo "No double /api/ prefix bug" || echo "Warning: Double API prefix" docker exec nas-dashboard-dev python3 -c "import urllib.request; exec('try:\n urllib.request.urlopen(\"http://localhost:4000/api/api/conversations/dates\", timeout=5)\n print(\"WARNING: /api/api/ returned 200\")\nexcept urllib.error.HTTPError as e:\n assert e.code == 404\n print(\"OK: /api/api/ returned 404\")')" && echo "No double /api/ prefix bug" || echo "Warning: Double API prefix"
echo "" echo ""
echo "=== All smoke tests passed! ===" echo "=== All smoke tests passed! ==="
echo "=== All smoke tests passed! ==="
specs/sprint-09-security-hardening.md
+9 -9
View File
@@ -61,7 +61,7 @@
- **Verify by:** - **Verify by:**
1. Push to dev → deploy step runs on NAS runner, not VPS. 1. Push to dev → deploy step runs on NAS runner, not VPS.
- [ ] S09.5 — Fix dev deploy runner label - [x] S09.5 — Fix dev deploy runner label
## S09.6 — Add `media-ops` to RBAC member defaults ## S09.6 — Add `media-ops` to RBAC member defaults
@@ -78,11 +78,11 @@
## Exit criteria ## Exit criteria
- [ ] No hardcoded SECRET_KEY fallback in any compose file - [x] No hardcoded SECRET_KEY fallback in any compose file
- [ ] Audit log gated to admin only - [x] Audit log gated to admin only
- [ ] Dev CI gates deploy behind tests - [x] Dev CI gates deploy behind tests
- [ ] Dev CI deploys on NAS runner - [x] Dev CI deploys on NAS runner
- [ ] `media-ops` accessible to members - [x] `media-ops` accessible to members
- [ ] All 267+ backend tests pass - [x] All 267+ backend tests pass
- [ ] All frontend tests pass - [x] All frontend tests pass
- [ ] `npm run build` succeeds - [x] `npm run build` succeeds