Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(ci): Revert using caddy to host frontend static files. #229

Closed
wants to merge 19 commits into from
Closed

chore(ci): Revert using caddy to host frontend static files. #229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
8b32467
Revert using caddy to host frontend static files.
fergmac Dec 5, 2024
9a9d8b5
Add route back to backend deployment.
fergmac Dec 5, 2024
98047b7
Revert from Caddy to Django whitenoise for hosting frontend static fi…
fergmac Dec 9, 2024
39a2a7b
Pass Dockerfile location to builder.
fergmac Dec 9, 2024
8e02672
Update path.
fergmac Dec 9, 2024
bad5656
Update path.
fergmac Dec 9, 2024
8fca2d9
Update file name.
fergmac Dec 9, 2024
3316982
Update backend Dockerfile build.
fergmac Dec 9, 2024
7a27051
Update Dockerfile location for all services.
fergmac Dec 9, 2024
8fe6c84
🙃
fergmac Dec 9, 2024
c433a31
Gwells static hosting index, uncomment code.
fergmac Dec 9, 2024
d013a3d
Update backend route port.
fergmac Dec 9, 2024
8326a31
Update service ports.
fergmac Dec 10, 2024
dcfac3d
Update service selector.
fergmac Dec 10, 2024
4b0429e
Update backend deployment service selector name.
fergmac Dec 10, 2024
e633cbe
Add service to deployment object.
fergmac Dec 10, 2024
70f3eda
Update service port to match deployment port.
fergmac Dec 10, 2024
76c851a
Update container name.
fergmac Dec 10, 2024
ec51520
Revert container name change.
fergmac Dec 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions .github/workflows/.deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,21 +145,21 @@ jobs:
-p EMAIL_NOTIFICATION_RECIPIENT=${{ vars.EMAIL_NOTIFICATION_RECIPIENT }}
-p GEOCODER_ADDRESS_API_BASE=${{ vars.GEOCODER_ADDRESS_API_BASE }}

frontend:
name: Frontend
needs: [ init, database, backend ]
environment: ${{ inputs.environment }}
runs-on: ubuntu-latest
steps:
- name: Deploy Frontend
uses: bcgov-nr/[email protected]
with:
oc_namespace: ${{ vars.OC_NAMESPACE }}
oc_server: ${{ vars.OC_SERVER }}
oc_token: ${{ secrets.OC_TOKEN }}
oc_version: "4.14.37"
file: frontend/openshift.deploy.yml
parameters:
-p NAME_SUFFIX=${{ inputs.target }}
-p IMAGE_TAG=${{ inputs.tag }}
# frontend:
# name: Frontend
# needs: [ init, database, backend ]
# environment: ${{ inputs.environment }}
# runs-on: ubuntu-latest
# steps:
# - name: Deploy Frontend
# uses: bcgov-nr/[email protected]
# with:
# oc_namespace: ${{ vars.OC_NAMESPACE }}
# oc_server: ${{ vars.OC_SERVER }}
# oc_token: ${{ secrets.OC_TOKEN }}
# oc_version: "4.14.37"
# file: frontend/openshift.deploy.yml
# parameters:
# -p NAME_SUFFIX=${{ inputs.target }}
# -p IMAGE_TAG=${{ inputs.tag }}

18 changes: 17 additions & 1 deletion .github/workflows/pr-open.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,27 @@ jobs:
runs-on: ubuntu-latest
strategy:
matrix:
package: [database, backend, frontend, minio]
# package: [database, backend, frontend, minio]
package: [database, backend, minio]
include:
- package: database
build_context: ./
build_file: database/Dockerfile
triggers: ('database/')
- package: backend
build_context: ./
build_file: ./Dockerfile
triggers: ('backend/', 'frontend/')
- package: minio
build_context: ./
build_file: minio/Dockerfile
triggers: ('minio/')
timeout-minutes: 20
steps:
- uses: bcgov-nr/[email protected]
with:
build_context: ${{ matrix.build_context }}
build_file: ${{ matrix.build_file }}
keep_versions: 50
package: ${{ matrix.package }}
tag: ${{ github.event.number }}
Expand Down
161 changes: 161 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,161 @@
FROM node:14.21.3 AS frontend-build

Check failure

Code scanning / Trivy

Image user should not be 'root' High

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS002
Severity: HIGH
Message: Specify at least 1 USER command in Dockerfile with non-root user as argument
Link: DS002

Check notice

Code scanning / Trivy

No HEALTHCHECK defined Low

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS026
Severity: LOW
Message: Add HEALTHCHECK instruction in your Dockerfile
Link: DS026

ENV LOG_LEVEL="info"

RUN apt update && \
apt install -y git build-essential python3 python3-pip make g++ && \
apt autoremove -y && \
apt clean

WORKDIR /app/frontend

COPY ./frontend/package*.json /app/frontend/

RUN npm install

COPY ./frontend /app/frontend/

RUN npm run build

FROM python:3.7-slim AS backend-build

# Envars
ENV ENVIRONMENT="local"
ENV APP_CONTEXT_ROOT=gwells
ENV CSRF_COOKIE_SECURE="False"
ENV CUSTOM_GDAL_GEOS="False"
ENV DATABASE_NAME=gwells
ENV DATABASE_USER="gwells"
ENV DATABASE_PASSWORD="test1"

Check warning on line 29 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DATABASE_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENV DATABASE_SERVICE_NAME=gwells
ENV DJANGO_ADMIN_URL=admin
ENV DJANGO_DEBUG="true"
ENV DJANGO_SECRET_KEY=secret

Check warning on line 33 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DJANGO_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENV ENABLE_ADDITIONAL_DOCUMENTS="true"
ENV ENABLE_AQUIFERS_SEARCH="true"
ENV GWELLS_SERVICE_HOST="db"
ENV GWELLS_SERVICE_PORT="5432"
ENV MINIO_ACCESS_KEY=minio

Check warning on line 38 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MINIO_ACCESS_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENV MINIO_SECRET_KEY=minio1234

Check warning on line 39 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MINIO_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENV PYTHONUNBUFFERED="1"
ENV SESSION_COOKIE_SECURE="False"
ENV SSO_AUDIENCE=gwells-4121
ENV SSO_CLIENT=gwells-4121
ENV SSO_TEST_AUDIENCE=gwells-api-tests-4820
ENV SSO_TEST_CLIENT=gwells-api-tests-4820
ENV SSO_AUTH_HOST=https://test.loginproxy.gov.bc.ca/auth

Check warning on line 46 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "SSO_AUTH_HOST")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/
ENV SSO_IDP_HINT="undefined"
ENV SSO_PORT=0
ENV SSO_REALM=standard
ENV SSO_PUBKEY=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiFdv9GA83uHuy8Eu9yiZHGGF9j6J8t7FkbcpaN81GDjwbjsIJ0OJO9dKRAx6BAtTC4ubJTBJMPvQER5ikOhIeBi4o25fg61jpgsU6oRZHkCXc9gX6mrjMjbsPaf3/bjjYxP5jicBDJQeD1oRa24+tiGggoQ7k6gDEN+cRYqqNpzC/GQbkUPk8YsgroncEgu8ChMh/3ERsLV2zorchMANUq76max16mHrhtWIQxrb/STpSt4JuSlUzzBV/dcXjJe5gywZHe0jAutFhNqjHzHdgyaC4RAd3eYQo+Kl/JOgy2AZrnx+CiPmvOJKe9tAW4k4H087ng8aVE40v4HW/FEbnwIDAQAB
ENV S3_HOST=minio-public:9000
ENV S3_PRIVATE_HOST=minio-private:9001
ENV S3_PRIVATE_BUCKET=gwells
ENV S3_PRIVATE_ROOT_BUCKET=gwells
ENV S3_PRIVATE_WELL_BUCKET=well-docs
ENV S3_PRIVATE_AQUIFER_BUCKET=aquifer-docs
ENV S3_PRIVATE_REGISTRANT_BUCKET=driller-docs
ENV S3_PUBLIC_ACCESS_KEY=minio
ENV S3_PUBLIC_SECRET_KEY=minio1234
ENV S3_AQUIFER_BUCKET=aquifer-docs
ENV S3_REGISTRANT_BUCKET=driller-docs
ENV S3_ROOT_BUCKET=gwells
ENV S3_WELL_BUCKET=well-docs
ENV S3_WELL_EXPORT_BUCKET=gwells
ENV S3_USE_SECURE=0
ENV [email protected]
ENV GEOCODER_ADDRESS_API_BASE=https://geocoder.api.gov.bc.ca/addresses.json?
ENV LOCAL="true"
ENV LOAD_FIXTURES="true"
ENV GDAL_LIBRARY_PATH="/usr/local/lib/libgdal.so"

# Install dependencies
RUN apt -y update && apt -y install git build-essential gdal-bin libgdal-dev

ENV PATH="/usr/bin/python3:${PATH}"

WORKDIR /app/backend

RUN python3 -m pip install --upgrade pip
RUN python3 -m pip install ptvsd
RUN python3 -m pip install 'setuptools<58.0'

COPY ./backend /app/backend/
COPY ./backend/requirements.txt ./app/backend/
# # RUN chmod +x load_fixtures.sh works when i pull the dockerfile into backend but not when dockerfile is with other docker files
RUN chmod +x /app

# # RUN python3 -m pip install -r requirements.txt

RUN python3 -m pip install -r requirements.txt

FROM python:3.7-slim AS production

# # Envars
ENV ENVIRONMENT="local"
ENV APP_CONTEXT_ROOT=gwells
ENV CSRF_COOKIE_SECURE="False"
ENV CUSTOM_GDAL_GEOS="False"
ENV DATABASE_NAME=gwells
ENV DATABASE_USER="gwells"
ENV DATABASE_PASSWORD="test1"

Check warning on line 101 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DATABASE_PASSWORD")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check failure

Code scanning / Trivy

Secrets passed via `build-args` or envs or copied secret files Critical

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS031
Severity: CRITICAL
Message: Possible exposure of secret env "DATABASE_PASSWORD" in ENV
Link: DS031
ENV DATABASE_SERVICE_NAME=gwells
ENV DJANGO_ADMIN_URL=admin
ENV DJANGO_DEBUG="true"
ENV DJANGO_SECRET_KEY=secret

Check warning on line 105 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "DJANGO_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check failure

Code scanning / Trivy

Secrets passed via `build-args` or envs or copied secret files Critical

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS031
Severity: CRITICAL
Message: Possible exposure of secret env "DJANGO_SECRET_KEY" in ENV
Link: DS031
ENV ENABLE_ADDITIONAL_DOCUMENTS="true"
ENV ENABLE_AQUIFERS_SEARCH="true"
ENV GWELLS_SERVICE_HOST="db"
ENV GWELLS_SERVICE_PORT="5432"
ENV MINIO_ACCESS_KEY=minio

Check warning on line 110 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MINIO_ACCESS_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check failure

Code scanning / Trivy

Secrets passed via `build-args` or envs or copied secret files Critical

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS031
Severity: CRITICAL
Message: Possible exposure of secret env "MINIO_ACCESS_KEY" in ENV
Link: DS031
ENV MINIO_SECRET_KEY=minio1234

Check warning on line 111 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

Sensitive data should not be used in the ARG or ENV commands 

SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ENV "MINIO_SECRET_KEY")
More info: https://docs.docker.com/go/dockerfile/rule/secrets-used-in-arg-or-env/

Check failure

Code scanning / Trivy

Secrets passed via `build-args` or envs or copied secret files Critical

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS031
Severity: CRITICAL
Message: Possible exposure of secret env "MINIO_SECRET_KEY" in ENV
Link: DS031
ENV PYTHONUNBUFFERED="1"
ENV SESSION_COOKIE_SECURE="False"
ENV SSO_AUDIENCE=gwells-4121
ENV SSO_CLIENT=gwells-4121
ENV SSO_TEST_AUDIENCE=gwells-api-tests-4820
ENV SSO_TEST_CLIENT=gwells-api-tests-4820
ENV SSO_AUTH_HOST=https://test.loginproxy.gov.bc.ca/auth

Check failure

Code scanning / Trivy

Secrets passed via `build-args` or envs or copied secret files Critical

Artifact: Dockerfile
Type: dockerfile
Vulnerability DS031
Severity: CRITICAL
Message: Possible exposure of secret env "SSO_AUTH_HOST" in ENV
Link: DS031
ENV SSO_IDP_HINT="undefined"
ENV SSO_PORT=0
ENV SSO_REALM=standard
ENV SSO_PUBKEY=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiFdv9GA83uHuy8Eu9yiZHGGF9j6J8t7FkbcpaN81GDjwbjsIJ0OJO9dKRAx6BAtTC4ubJTBJMPvQER5ikOhIeBi4o25fg61jpgsU6oRZHkCXc9gX6mrjMjbsPaf3/bjjYxP5jicBDJQeD1oRa24+tiGggoQ7k6gDEN+cRYqqNpzC/GQbkUPk8YsgroncEgu8ChMh/3ERsLV2zorchMANUq76max16mHrhtWIQxrb/STpSt4JuSlUzzBV/dcXjJe5gywZHe0jAutFhNqjHzHdgyaC4RAd3eYQo+Kl/JOgy2AZrnx+CiPmvOJKe9tAW4k4H087ng8aVE40v4HW/FEbnwIDAQAB
ENV S3_HOST=minio-public:9000
ENV S3_PRIVATE_HOST=minio-private:9001
ENV S3_PRIVATE_BUCKET=gwells
ENV S3_PRIVATE_ROOT_BUCKET=gwells
ENV S3_PRIVATE_WELL_BUCKET=well-docs
ENV S3_PRIVATE_AQUIFER_BUCKET=aquifer-docs
ENV S3_PRIVATE_REGISTRANT_BUCKET=driller-docs
ENV S3_PUBLIC_ACCESS_KEY=minio
ENV S3_PUBLIC_SECRET_KEY=minio1234
ENV S3_AQUIFER_BUCKET=aquifer-docs
ENV S3_REGISTRANT_BUCKET=driller-docs
ENV S3_ROOT_BUCKET=gwells
ENV S3_WELL_BUCKET=well-docs
ENV S3_WELL_EXPORT_BUCKET=gwells
ENV S3_USE_SECURE=0
ENV [email protected]
ENV GEOCODER_ADDRESS_API_BASE=https://geocoder.api.gov.bc.ca/addresses.json?
ENV LOCAL="true"
ENV LOAD_FIXTURES="true"
ENV GDAL_LIBRARY_PATH="/usr/local/lib/libgdal.so"

# Install dependencies
RUN apt -y update && apt -y install git build-essential gdal-bin libgdal-dev

ENV PATH="/usr/bin/python3:${PATH}"

COPY --from=backend-build . /

COPY --from=frontend-build /app/frontend/dist/ app/backend/gwells/static
COPY --from=frontend-build /app/frontend/dist/index.html app/backend/gwells/templates/

WORKDIR /app/backend

CMD sh -c "python3 manage.py migrate --noinput && \

Check warning on line 156 in Dockerfile

View workflow job for this annotation

GitHub Actions / Builds (backend)

JSON arguments recommended for ENTRYPOINT/CMD to prevent unintended behavior related to OS signals 

JSONArgsRecommended: JSON arguments recommended for CMD to prevent unintended behavior related to OS signals
More info: https://docs.docker.com/go/dockerfile/rule/json-args-recommended/
./load_fixtures.sh all && \
python3 manage.py createinitialrevisions && \
python3 manage.py collectstatic --noinput && \
# python3 manage.py export --cleanup=1 --upload=1 && \
python3 manage.py runserver 0.0.0.0:8000"
118 changes: 0 additions & 118 deletions backend/Dockerfile
View file
Open in desktop

This file was deleted.

Loading
Loading