docs: archive entra materials and simplify deployment docs
This commit is contained in:
defiQUG
+85
-177
@@ -1,272 +1,180 @@
|
||||
# Deployment Automation Scripts
|
||||
|
||||
Automated deployment scripts for The Order following the deployment guide.
|
||||
Automated deployment scripts for The Order using the Sankofa Phoenix / Proxmox runtime.
|
||||
|
||||
## Overview
|
||||
|
||||
This directory contains automated scripts for deploying The Order to Azure/Kubernetes. The scripts follow the 15-phase deployment guide and can be run individually or as a complete deployment.
|
||||
The active deployment path is now Sankofa Phoenix / Proxmox-native. The scripts in this directory now:
|
||||
|
||||
- build The Order locally
|
||||
- package the `portal-public` Next.js standalone bundle
|
||||
- sync it to the Order public CT on Proxmox
|
||||
- refresh the Order HAProxy edge
|
||||
- verify direct, edge, and public health endpoints
|
||||
|
||||
The default topology is:
|
||||
|
||||
- `order-portal-public` CT `10090` at `192.168.11.36:3000`
|
||||
- `order-haproxy` CT `10210` at `192.168.11.39:80`
|
||||
- public URL `https://the-order.sankofa.nexus`
|
||||
- Phoenix public URL `https://phoenix.sankofa.nexus`
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Deploy all phases for dev environment
|
||||
# Deploy the frontend to the default dev target
|
||||
./scripts/deploy/deploy.sh --phase 11 --environment dev
|
||||
|
||||
# Run the direct sync script
|
||||
./scripts/deploy/sync-portal-public-to-sankofa-phoenix.sh
|
||||
|
||||
# Full phase flow
|
||||
./scripts/deploy/deploy.sh --all --environment dev
|
||||
|
||||
# Deploy specific phases
|
||||
./scripts/deploy/deploy.sh --phase 1 --phase 2 --phase 6
|
||||
|
||||
# Continue from last saved state
|
||||
./scripts/deploy/deploy.sh --continue
|
||||
|
||||
# Deploy with auto-apply (no Terraform review)
|
||||
./scripts/deploy/deploy.sh --all --auto-apply
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
Configuration is managed in `config.sh`. Key variables:
|
||||
Configuration is managed in `config.sh`. The most important variables are:
|
||||
|
||||
- `ENVIRONMENT`: Deployment environment (dev, stage, prod)
|
||||
- `AZURE_REGION`: Azure region (default: westeurope)
|
||||
- `ACR_NAME`: Azure Container Registry name
|
||||
- `AKS_NAME`: AKS cluster name
|
||||
- `KEY_VAULT_NAME`: Azure Key Vault name
|
||||
- `PROXMOX_HOST`
|
||||
- `ORDER_PORTAL_PUBLIC_VMID`
|
||||
- `ORDER_PORTAL_PUBLIC_IP`
|
||||
- `ORDER_HAPROXY_VMID`
|
||||
- `ORDER_HAPROXY_IP`
|
||||
- `SANKOFA_PHOENIX_URL`
|
||||
- `THE_ORDER_PUBLIC_URL`
|
||||
- `IMAGE_REGISTRY`
|
||||
- `IMAGE_TAG`
|
||||
|
||||
Set via environment variables or edit `config.sh`:
|
||||
Example:
|
||||
|
||||
```bash
|
||||
export ENVIRONMENT=prod
|
||||
export AZURE_REGION=westeurope
|
||||
export ACR_NAME=theorderacr
|
||||
./scripts/deploy/deploy.sh --all
|
||||
export PROXMOX_HOST=192.168.11.11
|
||||
export ORDER_PORTAL_PUBLIC_VMID=10090
|
||||
export ORDER_HAPROXY_VMID=10210
|
||||
./scripts/deploy/deploy.sh --phase 11
|
||||
```
|
||||
|
||||
## Phase Scripts
|
||||
|
||||
### Phase 1: Prerequisites
|
||||
- Checks all required tools
|
||||
- Verifies Azure login
|
||||
- Installs dependencies
|
||||
- Builds packages
|
||||
|
||||
- verifies local tooling
|
||||
- verifies SSH access to Proxmox
|
||||
- records the Sankofa / Order runtime targets
|
||||
|
||||
```bash
|
||||
./scripts/deploy/phase1-prerequisites.sh
|
||||
```
|
||||
|
||||
### Phase 2: Azure Infrastructure
|
||||
- Runs Azure setup scripts
|
||||
- Registers resource providers
|
||||
- Deploys Terraform infrastructure
|
||||
- Configures Kubernetes access
|
||||
### Phase 2: Sankofa Phoenix Target Preparation
|
||||
|
||||
- confirms the Order public CT and HAProxy CT are reachable
|
||||
- previews the HAProxy config for `the-order.sankofa.nexus`
|
||||
- probes Phoenix public health
|
||||
|
||||
```bash
|
||||
./scripts/deploy/phase2-azure-infrastructure.sh
|
||||
./scripts/deploy/phase2-sankofa-phoenix-target.sh
|
||||
```
|
||||
|
||||
### Phase 3: Entra ID Configuration
|
||||
- **Manual steps required** (Azure Portal)
|
||||
- Helper script to store secrets: `store-entra-secrets.sh`
|
||||
|
||||
### Phase 6: Build & Package
|
||||
- Builds all packages and applications
|
||||
- Creates Docker images
|
||||
- Pushes to Azure Container Registry
|
||||
- Signs images with Cosign (if available)
|
||||
|
||||
- builds all packages and applications
|
||||
- creates local Docker images for services and apps
|
||||
- previews the Phoenix deployment artifact
|
||||
|
||||
```bash
|
||||
./scripts/deploy/phase6-build-package.sh
|
||||
```
|
||||
|
||||
### Phase 7: Database Migrations
|
||||
- Runs database schema migrations
|
||||
- Verifies database connection
|
||||
### Phase 11: Frontend Applications Deployment
|
||||
|
||||
- builds `portal-public`
|
||||
- syncs the standalone bundle to CT `10090`
|
||||
- installs or refreshes the `the-order-portal-public` systemd service
|
||||
- reprovisions the Order HAProxy edge on `10210`
|
||||
- verifies LAN and public health endpoints
|
||||
|
||||
```bash
|
||||
./scripts/deploy/phase7-database-migrations.sh
|
||||
```
|
||||
|
||||
### Phase 10: Backend Services
|
||||
- Deploys backend services to Kubernetes
|
||||
- Verifies deployments
|
||||
- Tests health endpoints
|
||||
|
||||
```bash
|
||||
./scripts/deploy/phase10-backend-services.sh
|
||||
./scripts/deploy/phase11-frontend-apps.sh
|
||||
```
|
||||
|
||||
## Usage Examples
|
||||
|
||||
### Full Deployment
|
||||
### Frontend deployment
|
||||
|
||||
```bash
|
||||
# Development environment
|
||||
./scripts/deploy/deploy.sh --all --environment dev
|
||||
|
||||
# Staging environment
|
||||
./scripts/deploy/deploy.sh --all --environment stage
|
||||
|
||||
# Production (with confirmation)
|
||||
./scripts/deploy/deploy.sh --all --environment prod
|
||||
./scripts/deploy/deploy.sh --phase 11 --environment dev
|
||||
```
|
||||
|
||||
### Incremental Deployment
|
||||
### Build only
|
||||
|
||||
```bash
|
||||
# Run prerequisites and infrastructure
|
||||
./scripts/deploy/deploy.sh --phase 1 --phase 2
|
||||
|
||||
# Build and package
|
||||
./scripts/deploy/deploy.sh --phase 6
|
||||
|
||||
# Deploy services
|
||||
./scripts/deploy/deploy.sh --phase 10 --phase 11
|
||||
./scripts/deploy/deploy.sh --phase 6 --environment dev
|
||||
```
|
||||
|
||||
### Skip Phases
|
||||
### Continue from the last saved state
|
||||
|
||||
```bash
|
||||
# Skip build (if already built)
|
||||
./scripts/deploy/deploy.sh --all --skip-build
|
||||
|
||||
# Skip specific phase
|
||||
./scripts/deploy/deploy.sh --all --skip 3 --skip 8
|
||||
```
|
||||
|
||||
### Continue from Failure
|
||||
|
||||
```bash
|
||||
# If deployment fails, continue from last state
|
||||
./scripts/deploy/deploy.sh --continue
|
||||
```
|
||||
|
||||
## State Management
|
||||
|
||||
Deployment state is saved in `.deployment/${ENVIRONMENT}.state`. This allows:
|
||||
Deployment state is saved in `.deployment/${ENVIRONMENT}.state`.
|
||||
|
||||
- Resuming from last completed phase
|
||||
- Tracking deployment progress
|
||||
- Debugging failed deployments
|
||||
Artifacts and image manifests are written under `.deployment/artifacts/`.
|
||||
|
||||
## Logging
|
||||
|
||||
All deployment logs are saved to `logs/deployment-YYYYMMDD-HHMMSS.log`.
|
||||
|
||||
View logs:
|
||||
```bash
|
||||
tail -f logs/deployment-*.log
|
||||
```
|
||||
|
||||
## Manual Steps
|
||||
|
||||
Some phases require manual steps:
|
||||
Some phases still require external operator work:
|
||||
|
||||
- **Phase 3**: Entra ID configuration (Azure Portal)
|
||||
- **Phase 8**: Secrets configuration (use helper scripts)
|
||||
- **Phase 12**: DNS configuration
|
||||
- **Phase 13**: Monitoring dashboard setup
|
||||
|
||||
See `docs/deployment/DEPLOYMENT_GUIDE.md` for detailed instructions.
|
||||
|
||||
## Helper Scripts
|
||||
|
||||
### Store Entra ID Secrets
|
||||
|
||||
After completing Entra ID setup in Azure Portal:
|
||||
|
||||
```bash
|
||||
./scripts/deploy/store-entra-secrets.sh
|
||||
```
|
||||
|
||||
This will prompt for:
|
||||
- Tenant ID
|
||||
- Client ID
|
||||
- Client Secret
|
||||
- Credential Manifest ID
|
||||
|
||||
And store them in Azure Key Vault.
|
||||
- `Phase 3`: identity-provider / Entra setup
|
||||
- `Phase 8`: secret injection into the chosen backend
|
||||
- `Phase 12`: DNS / NPM updates if you are changing routing
|
||||
- `Phase 13`: central monitoring / alert wiring
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Check Deployment State
|
||||
### Check deployment state
|
||||
|
||||
```bash
|
||||
cat .deployment/dev.state
|
||||
```
|
||||
|
||||
### View Logs
|
||||
### Verify Order runtime access
|
||||
|
||||
```bash
|
||||
tail -f logs/deployment-*.log
|
||||
ssh [email protected] "pct status 10090 && pct status 10210"
|
||||
curl -fsS http://192.168.11.36:3000/api/health
|
||||
curl -fsS -H 'Host: the-order.sankofa.nexus' http://192.168.11.39/api/health
|
||||
curl -fsS https://the-order.sankofa.nexus/api/health
|
||||
```
|
||||
|
||||
### Verify Kubernetes Access
|
||||
### Verify Phoenix public access
|
||||
|
||||
```bash
|
||||
kubectl cluster-info
|
||||
kubectl get nodes
|
||||
curl -fsS https://phoenix.sankofa.nexus/health
|
||||
```
|
||||
|
||||
### Verify Azure Access
|
||||
### View CT service logs
|
||||
|
||||
```bash
|
||||
az account show
|
||||
az aks list
|
||||
```
|
||||
|
||||
### Re-run Failed Phase
|
||||
|
||||
```bash
|
||||
./scripts/deploy/deploy.sh --phase <phase-number>
|
||||
```
|
||||
|
||||
## Environment-Specific Configuration
|
||||
|
||||
Create environment-specific config files:
|
||||
|
||||
```bash
|
||||
# .deployment/dev.env
|
||||
export ENVIRONMENT=dev
|
||||
export AKS_NAME=the-order-dev-aks
|
||||
export KEY_VAULT_NAME=the-order-dev-kv
|
||||
```
|
||||
|
||||
Source before deployment:
|
||||
|
||||
```bash
|
||||
source .deployment/dev.env
|
||||
./scripts/deploy/deploy.sh --all
|
||||
```
|
||||
|
||||
## Integration with CI/CD
|
||||
|
||||
The scripts can be integrated into CI/CD pipelines:
|
||||
|
||||
```yaml
|
||||
# .github/workflows/deploy.yml
|
||||
- name: Deploy to Dev
|
||||
run: |
|
||||
./scripts/deploy/deploy.sh --all --environment dev --auto-apply
|
||||
env:
|
||||
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
|
||||
ssh [email protected] "pct exec 10090 -- journalctl -u the-order-portal-public -n 100 --no-pager"
|
||||
```
|
||||
|
||||
## Security Notes
|
||||
|
||||
- Never commit secrets to repository
|
||||
- Use Azure Key Vault for all secrets
|
||||
- Enable RBAC for all resources
|
||||
- Review Terraform plans before applying
|
||||
- Use managed identities where possible
|
||||
|
||||
## Next Steps
|
||||
|
||||
After deployment:
|
||||
|
||||
1. Verify all services are running: `kubectl get pods -n the-order-${ENV}`
|
||||
2. Test health endpoints
|
||||
3. Configure monitoring dashboards
|
||||
4. Set up alerts
|
||||
5. Review security settings
|
||||
|
||||
See `docs/deployment/DEPLOYMENT_GUIDE.md` for complete deployment instructions.
|
||||
|
||||
- never commit secrets to the repository
|
||||
- keep Proxmox SSH access limited to operator hosts
|
||||
- review CT and HAProxy targets before applying changes
|
||||
- prefer the documented `10090 -> 10210 -> public` path over ad hoc edits
|
||||
|
||||
Reference in New Issue
Block a user