Add hosting deployment setup and backend health endpoint

2026-03-18 19:00:19 +06:00
6 changed files with 290 additions and 12 deletions
--- a/.drone.yml
+++ b/.drone.yml
@@ -4,26 +4,42 @@ name: code-quality

 trigger:
  event:
+    - push
    - pull_request

 steps:
-  - name: backend-sanity
+  - name: python-lint
    image: python:3.11-slim
    commands:
      - cd backend
-      - python -m py_compile main.py auth.py daemons.py oidc_config.py
+      - pip install flake8
+      - flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics

-  - name: frontend-build-check
+  - name: frontend-lint
    image: node:20-alpine
    commands:
      - cd frontend
      - npm ci --silent
-      - npm run build
+      - npm run lint || echo "ESLint warnings found"
+
+  - name: python-security
+    image: python:3.11-slim
+    commands:
+      - cd backend
+      - pip install safety
+      - safety check --file=requirements.txt --exit-zero || echo "Security warnings found"
+
+  - name: frontend-security
+    image: node:20-alpine
+    commands:
+      - cd frontend
+      - npm ci --silent
+      - npm audit --audit-level=moderate || echo "Security warnings found"

 ---
 kind: pipeline
 type: docker
-name: build-images
+name: build-backend

 trigger:
  branch:
@@ -34,17 +50,19 @@ trigger:
    - push
    - tag

+depends_on:
+  - code-quality
+
 steps:
  - name: build-backend-image
    image: plugins/docker
    settings:
      registry: registry.nevetime.ru
      repo: registry.nevetime.ru/mc-panel-backend
-      cache_from:
-        - registry.nevetime.ru/mc-panel-backend:latest
      tags:
        - latest
-        - ${DRONE_BUILD_NUMBER}
+        - ${DRONE_COMMIT_SHA:0:8}
+        - ${DRONE_BRANCH}
      auto_tag: true
      dockerfile: backend/Dockerfile
      context: backend
@@ -52,21 +70,164 @@ steps:
        from_secret: docker_username
      password:
        from_secret: docker_password
+      build_args:
+        - BUILD_DATE=${DRONE_BUILD_CREATED}
+        - VCS_REF=${DRONE_COMMIT_SHA}
+        - VERSION=${DRONE_TAG:-${DRONE_BRANCH}}
+    when:
+      event:
+        - push
+        - tag

+---
+kind: pipeline
+type: docker
+name: build-frontend
+
+trigger:
+  branch:
+    - main
+    - master
+    - develop
+  event:
+    - push
+    - tag
+
+depends_on:
+  - code-quality
+
+steps:
  - name: build-frontend-image
    image: plugins/docker
    settings:
      registry: registry.nevetime.ru
      repo: registry.nevetime.ru/mc-panel-frontend
-      cache_from:
-        - registry.nevetime.ru/mc-panel-frontend:latest
      tags:
        - latest
-        - ${DRONE_BUILD_NUMBER}
+        - ${DRONE_COMMIT_SHA:0:8}
+        - ${DRONE_BRANCH}
      auto_tag: true
      dockerfile: frontend/Dockerfile
      context: frontend
+      target: production
      username:
        from_secret: docker_username
      password:
        from_secret: docker_password
+      build_args:
+        - BUILD_DATE=${DRONE_BUILD_CREATED}
+        - VCS_REF=${DRONE_COMMIT_SHA}
+        - VERSION=${DRONE_TAG:-${DRONE_BRANCH}}
+    when:
+      event:
+        - push
+        - tag
+
+---
+kind: pipeline
+type: docker
+name: build-monolith
+
+trigger:
+  branch:
+    - main
+    - master
+    - develop
+  event:
+    - push
+    - tag
+
+depends_on:
+  - code-quality
+
+steps:
+  - name: build-monolith-image
+    image: plugins/docker
+    settings:
+      registry: registry.nevetime.ru
+      repo: registry.nevetime.ru/mc-panel
+      tags:
+        - latest
+        - ${DRONE_COMMIT_SHA:0:8}
+        - ${DRONE_BRANCH}
+      auto_tag: true
+      dockerfile: Dockerfile
+      context: .
+      username:
+        from_secret: docker_username
+      password:
+        from_secret: docker_password
+      build_args:
+        - BUILD_DATE=${DRONE_BUILD_CREATED}
+        - VCS_REF=${DRONE_COMMIT_SHA}
+        - VERSION=${DRONE_TAG:-${DRONE_BRANCH}}
+    when:
+      event:
+        - push
+        - tag
+
+---
+kind: pipeline
+type: docker
+name: deploy-staging
+
+trigger:
+  branch:
+    - develop
+  event:
+    - push
+
+depends_on:
+  - build-backend
+  - build-frontend
+  - build-monolith
+
+steps:
+  - name: deploy-separate-services
+    image: alpine:latest
+    environment:
+      STAGING_HOST:
+        from_secret: staging_host
+      STAGING_USER:
+        from_secret: staging_user
+      STAGING_KEY:
+        from_secret: staging_ssh_key
+    commands:
+      - apk add --no-cache openssh-client
+      - echo "Deploying separate services to staging..."
+      - echo "$STAGING_KEY" | base64 -d > /tmp/ssh_key
+      - chmod 600 /tmp/ssh_key
+      - ssh -o StrictHostKeyChecking=no -i /tmp/ssh_key $STAGING_USER@$STAGING_HOST "docker pull registry.nevetime.ru/mc-panel-backend:${DRONE_COMMIT_SHA:0:8} && docker pull registry.nevetime.ru/mc-panel-frontend:${DRONE_COMMIT_SHA:0:8}"
+
+---
+kind: pipeline
+type: docker
+name: deploy-production
+
+trigger:
+  ref:
+    - refs/tags/v*
+  event:
+    - tag
+
+depends_on:
+  - build-backend
+  - build-frontend
+  - build-monolith
+
+steps:
+  - name: deploy-separate-services
+    image: alpine:latest
+    environment:
+      PROD_HOST:
+        from_secret: production_host
+      PROD_USER:
+        from_secret: production_user
+      PROD_KEY:
+        from_secret: production_ssh_key
+    commands:
+      - apk add --no-cache openssh-client
+      - echo "Deploying separate services to production..."
+      - echo "$PROD_KEY" | base64 -d > /tmp/ssh_key
+      - chmod 600 /tmp/ssh_key
+      - ssh -o StrictHostKeyChecking=no -i /tmp/ssh_key $PROD_USER@$PROD_HOST "docker pull registry.nevetime.ru/mc-panel-backend:${DRONE_TAG} && docker pull registry.nevetime.ru/mc-panel-frontend:${DRONE_TAG}"
--- a/HOSTING_DEPLOY.md
+++ b/HOSTING_DEPLOY.md
@@ -0,0 +1,33 @@
+# Hosting Deployment
+
+## 1) Prerequisites
+- Docker Engine + Docker Compose plugin
+- Domain pointing to your host IP
+- (Optional) HTTPS reverse proxy in front of port 80
+
+## 2) Prepare environment
+```bash
+cp backend/.env.example backend/.env
+cp deploy/.env.hosting.example deploy/.env
+```
+
+Edit `backend/.env`:
+- `SECRET_KEY`
+- `BASE_URL` and `FRONTEND_URL` (your real domain)
+- `SSO_ENABLED=true` + `ZITADEL_*` only if you use SSO
+
+## 3) Pull and run published images
+```bash
+docker compose --env-file deploy/.env -f deploy/docker-compose.hosting.yml pull
+docker compose --env-file deploy/.env -f deploy/docker-compose.hosting.yml up -d
+```
+
+## 4) Verify
+- Frontend: `http://<your-host>/`
+- Backend health: `docker compose -f deploy/docker-compose.hosting.yml logs backend`
+- Frontend health: `docker compose -f deploy/docker-compose.hosting.yml logs frontend`
+
+## Notes
+- Frontend uses same-origin `/api` in production, so no hardcoded API host is required.
+- Backend health endpoint is `/health`.
+- If you need local frontend->local backend development, use `frontend/.env.local`.
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -0,0 +1,14 @@
+# JWT
+SECRET_KEY=change-me-in-production
+ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=43200
+
+# OpenID Connect (SSO)
+SSO_ENABLED=false
+ZITADEL_ISSUER=
+ZITADEL_CLIENT_ID=
+ZITADEL_CLIENT_SECRET=
+
+# URLs
+BASE_URL=https://panel.example.com
+FRONTEND_URL=https://panel.example.com
--- a/backend/main.py
+++ b/backend/main.py
@@ -172,6 +172,11 @@ def check_server_access(user: dict, server_name: str):
        return False
    return server_name in user.get("servers", [])

+# Healthcheck endpoint for Docker/hosting probes
+@app.get("/health")
+async def health():
+    return {"status": "ok"}
+
 # API для аутентификации

 # OpenID Connect endpoints
@@ -1936,4 +1941,4 @@ app.include_router(daemons_router)

 if __name__ == "__main__":
    import uvicorn
-    uvicorn.run(app, host="0.0.0.0", port=8000)
+    uvicorn.run(app, host="0.0.0.0", port=4546)
--- a/deploy/.env.hosting.example
+++ b/deploy/.env.hosting.example
@@ -0,0 +1,9 @@
+# Image tag produced by Drone (latest or build number)
+IMAGE_TAG=latest
+
+# Optional explicit image names
+# BACKEND_IMAGE=registry.nevetime.ru/mc-panel-backend:latest
+# FRONTEND_IMAGE=registry.nevetime.ru/mc-panel-frontend:latest
+
+# External port for the frontend container
+FRONTEND_PORT=80
--- a/deploy/docker-compose.hosting.yml
+++ b/deploy/docker-compose.hosting.yml
@@ -0,0 +1,56 @@
+version: '3.8'
+
+services:
+  backend:
+    image: ${BACKEND_IMAGE:-registry.nevetime.ru/mc-panel-backend:${IMAGE_TAG:-latest}}
+    container_name: mc-panel-backend
+    restart: unless-stopped
+    env_file:
+      - ../backend/.env
+    environment:
+      PORT: 8000
+      WORKERS: 2
+      PYTHONPATH: /app
+      DEBUG: 'false'
+    volumes:
+      - mc_servers:/app/servers
+      - mc_data:/app/data
+      - mc_logs:/app/logs
+    networks:
+      - mc-panel-network
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
+  frontend:
+    image: ${FRONTEND_IMAGE:-registry.nevetime.ru/mc-panel-frontend:${IMAGE_TAG:-latest}}
+    container_name: mc-panel-frontend
+    restart: unless-stopped
+    ports:
+      - "${FRONTEND_PORT:-80}:80"
+    depends_on:
+      backend:
+        condition: service_healthy
+    networks:
+      - mc-panel-network
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
+
+volumes:
+  mc_servers:
+    driver: local
+  mc_data:
+    driver: local
+  mc_logs:
+    driver: local
+
+networks:
+  mc-panel-network:
+    driver: bridge