Skip to content

Commit 238cf3c

Browse files
BulletdevBulletdev
committed
feat: add deploy cookbook and scripts
1 parent f835fdd commit 238cf3c

9 files changed

Lines changed: 822 additions & 0 deletions

File tree

‎deploy/README.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Deploy Files
2+
3+
Este diretório contém todos os arquivos necessários para deploy em produção e staging.
4+
5+
## Estrutura
6+
7+
```
8+
deploy/
9+
├── nginx/ # Configurações Nginx
10+
│ ├── nginx.conf # Config principal
11+
│ └── conf.d/ # Server configs
12+
│ └── prostaff.conf
13+
├── postgres/ # Scripts PostgreSQL
14+
│ └── init/ # Scripts de inicialização
15+
├── scripts/ # Scripts de manutenção
16+
│ ├── docker-entrypoint.sh
17+
│ └── backup.sh
18+
├── ssl/ # Certificados SSL (não commitar!)
19+
├── staging/ # Configs específicas de staging
20+
└── production/ # Configs específicas de production
21+
22+
## Arquivos Importantes
23+
24+
- `SECRETS_SETUP.md` - Guia de configuração de secrets
25+
- `../DEPLOYMENT.md` - Guia completo de deployment
26+
- `../.env.staging.example` - Exemplo de variáveis staging
27+
- `../.env.production.example` - Exemplo de variáveis production
28+
- `../docker-compose.production.yml` - Docker Compose para produção
29+
30+
## Quick Start
31+
32+
### 1. Preparar Servidor
33+
34+
```bash
35+
# Clone o repositório
36+
git clone https://github.com/seu-usuario/prostaff-api.git
37+
cd prostaff-api
38+
39+
# Copiar ambiente
40+
cp .env.staging.example .env
41+
nano .env # Configurar
42+
```
43+
44+
### 2. Configurar SSL
45+
46+
```bash
47+
# Copiar certificados Let's Encrypt
48+
sudo cp /etc/letsencrypt/live/staging-api.prostaff.gg/fullchain.pem deploy/ssl/staging-fullchain.pem
49+
sudo cp /etc/letsencrypt/live/staging-api.prostaff.gg/privkey.pem deploy/ssl/staging-privkey.pem
50+
```
51+
52+
### 3. Deploy
53+
54+
```bash
55+
# Build e iniciar
56+
docker-compose -f docker-compose.production.yml up -d
57+
58+
# Ver logs
59+
docker-compose -f docker-compose.production.yml logs -f
60+
61+
# Verificar saúde
62+
curl https://staging-api.prostaff.gg/up
63+
```
64+
65+
## Manutenção
66+
67+
```bash
68+
# Backup
69+
docker-compose -f docker-compose.production.yml run --rm backup
70+
71+
# Logs
72+
docker-compose -f docker-compose.production.yml logs -f api
73+
74+
# Restart
75+
docker-compose -f docker-compose.production.yml restart
76+
77+
# Atualizar
78+
git pull
79+
docker-compose -f docker-compose.production.yml up -d --build
80+
```
81+
82+
## Suporte
83+
84+
Ver documentação completa em [DEPLOYMENT.md](../DOCS/deployment/DEPLOYMENT.md)

‎deploy/SECRETS_SETUP.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
# Configuração de Secrets e Variáveis
2+
3+
Guia para configurar todos os secrets necessários para deploy em produção.
4+
5+
## GitHub Secrets
6+
7+
Configure estes secrets no GitHub (Settings → Secrets and variables → Actions):
8+
9+
### Staging Environment
10+
11+
```
12+
STAGING_HOST=staging-api.prostaff.gg
13+
STAGING_USER=deploy
14+
STAGING_SSH_KEY=<SSH private key content>
15+
STAGING_ENV=<Conteúdo completo do .env>
16+
```
17+
18+
### Production Environment
19+
20+
```
21+
PRODUCTION_HOST=api.prostaff.gg
22+
PRODUCTION_USER=deploy
23+
PRODUCTION_SSH_KEY=<SSH private key content>
24+
PRODUCTION_ENV=<Conteúdo completo do .env>
25+
```
26+
27+
### Geral
28+
29+
```
30+
DOCKER_USERNAME=<seu_usuario_dockerhub>
31+
DOCKER_PASSWORD=<seu_token_dockerhub>
32+
```
33+
34+
## Gerar Secrets Fortes
35+
36+
```bash
37+
# SECRET_KEY_BASE, JWT_SECRET_KEY, etc.
38+
bundle exec rails secret
39+
40+
# Ou usando OpenSSL
41+
openssl rand -hex 64
42+
43+
# Senha de banco de dados (32 caracteres)
44+
openssl rand -base64 32
45+
```
46+
47+
## Configurar SSH para Deploy
48+
49+
```bash
50+
# No seu computador local
51+
ssh-keygen -t ed25519 -C "deploy@prostaff-api"
52+
53+
# Copiar chave pública para o servidor
54+
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@api.prostaff.gg
55+
56+
# Adicionar chave privada ao GitHub Secrets
57+
cat ~/.ssh/id_ed25519 # Copiar conteúdo completo
58+
```
59+
60+
## Variáveis de Ambiente Obrigatórias
61+
62+
### Application
63+
- `RAILS_ENV` - Ambiente (staging/production)
64+
- `SECRET_KEY_BASE` - Secret para sessions
65+
- `JWT_SECRET_KEY` - Secret para JWT tokens
66+
67+
### Database
68+
- `DATABASE_URL` - URL completa de conexão PostgreSQL
69+
- `POSTGRES_USER` - Usuário do banco
70+
- `POSTGRES_PASSWORD` - Senha forte do banco
71+
- `POSTGRES_DB` - Nome do banco
72+
73+
### Redis
74+
- `REDIS_URL` - URL de conexão Redis
75+
- `REDIS_PASSWORD` - Senha do Redis
76+
77+
### External APIs
78+
- `RIOT_API_KEY` - API key da Riot Games
79+
80+
### Email
81+
- `SMTP_ADDRESS` - Servidor SMTP
82+
- `SMTP_USERNAME` - Usuário SMTP
83+
- `SMTP_PASSWORD` - Senha SMTP
84+
85+
### Storage (AWS S3)
86+
- `AWS_ACCESS_KEY_ID` - Access key da AWS
87+
- `AWS_SECRET_ACCESS_KEY` - Secret key da AWS
88+
- `AWS_REGION` - Região (ex: us-east-1)
89+
- `AWS_S3_BUCKET` - Nome do bucket
90+
91+
### Monitoring (Opcional)
92+
- `SENTRY_DSN` - DSN do Sentry para error tracking
93+
94+
## Verificar Configuração
95+
96+
```bash
97+
# Testar conexão SSH
98+
ssh deploy@api.prostaff.gg
99+
100+
# Verificar variáveis de ambiente no servidor
101+
docker-compose -f docker-compose.production.yml exec api env | sort
102+
103+
# Testar conexão com banco
104+
docker-compose -f docker-compose.production.yml exec api bundle exec rails db:migrate:status
105+
106+
# Testar Redis
107+
docker-compose -f docker-compose.production.yml exec redis redis-cli ping
108+
```
109+
110+
## Rotação de Secrets
111+
112+
Recomendação: Rotacionar secrets a cada 90 dias.
113+
114+
```bash
115+
# 1. Gerar novos secrets
116+
NEW_SECRET=$(openssl rand -hex 64)
117+
118+
# 2. Atualizar .env no servidor
119+
nano .env # Adicionar novo secret
120+
121+
# 3. Restart gradual dos serviços
122+
docker-compose -f docker-compose.production.yml restart api
123+
124+
# 4. Validar funcionamento
125+
126+
# 5. Remover secret antigo do .env
127+
```

‎deploy/nginx/conf.d/prostaff.conf‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# ProStaff API - Nginx Server Configuration
2+
3+
# HTTP - Redirect to HTTPS
4+
server {
5+
listen 80;
6+
listen [::]:80;
7+
server_name api.prostaff.gg staging-api.prostaff.gg;
8+
9+
# Health check endpoint (HTTP OK)
10+
location /health {
11+
access_log off;
12+
return 200 "healthy\n";
13+
add_header Content-Type text/plain;
14+
}
15+
16+
# Redirect all other traffic to HTTPS
17+
location / {
18+
return 301 https://$server_name$request_uri;
19+
}
20+
}
21+
22+
# HTTPS - Production
23+
server {
24+
listen 443 ssl http2;
25+
listen [::]:443 ssl http2;
26+
server_name api.prostaff.gg;
27+
28+
# SSL Configuration
29+
ssl_certificate /etc/nginx/ssl/fullchain.pem;
30+
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
31+
ssl_protocols TLSv1.2 TLSv1.3;
32+
ssl_ciphers HIGH:!aNULL:!MD5;
33+
ssl_prefer_server_ciphers on;
34+
ssl_session_cache shared:SSL:10m;
35+
ssl_session_timeout 10m;
36+
37+
# HSTS
38+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
39+
40+
# Logs
41+
access_log /var/log/nginx/prostaff-access.log main;
42+
error_log /var/log/nginx/prostaff-error.log warn;
43+
44+
# Root directory
45+
root /app/public;
46+
47+
# Rate limiting
48+
limit_req zone=api burst=50 nodelay;
49+
50+
# Serve static files directly
51+
location ~ ^/(assets|packs|images|javascripts|stylesheets|system)/ {
52+
gzip_static on;
53+
expires max;
54+
add_header Cache-Control public;
55+
access_log off;
56+
try_files $uri @app;
57+
}
58+
59+
# Health check
60+
location /up {
61+
proxy_pass http://prostaff_api;
62+
proxy_set_header Host $host;
63+
access_log off;
64+
}
65+
66+
# API Documentation (Swagger)
67+
location /api-docs {
68+
proxy_pass http://prostaff_api;
69+
proxy_set_header Host $host;
70+
proxy_set_header X-Real-IP $remote_addr;
71+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
72+
proxy_set_header X-Forwarded-Proto $scheme;
73+
}
74+
75+
# Proxy to Rails app
76+
location / {
77+
proxy_pass http://prostaff_api;
78+
proxy_set_header Host $host;
79+
proxy_set_header X-Real-IP $remote_addr;
80+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
81+
proxy_set_header X-Forwarded-Proto $scheme;
82+
proxy_set_header X-Forwarded-Port $server_port;
83+
84+
# Timeouts
85+
proxy_connect_timeout 60s;
86+
proxy_send_timeout 60s;
87+
proxy_read_timeout 60s;
88+
89+
# Buffering
90+
proxy_buffering on;
91+
proxy_buffer_size 4k;
92+
proxy_buffers 8 4k;
93+
94+
# WebSocket support
95+
proxy_http_version 1.1;
96+
proxy_set_header Upgrade $http_upgrade;
97+
proxy_set_header Connection "upgrade";
98+
}
99+
100+
# Error pages
101+
error_page 500 502 503 504 /500.html;
102+
location = /500.html {
103+
root /app/public;
104+
internal;
105+
}
106+
}
107+
108+
# HTTPS - Staging
109+
server {
110+
listen 443 ssl http2;
111+
listen [::]:443 ssl http2;
112+
server_name staging-api.prostaff.gg;
113+
114+
# SSL Configuration (same as production)
115+
ssl_certificate /etc/nginx/ssl/staging-fullchain.pem;
116+
ssl_certificate_key /etc/nginx/ssl/staging-privkey.pem;
117+
ssl_protocols TLSv1.2 TLSv1.3;
118+
ssl_ciphers HIGH:!aNULL:!MD5;
119+
ssl_prefer_server_ciphers on;
120+
121+
# Rest of config same as production
122+
root /app/public;
123+
access_log /var/log/nginx/staging-access.log main;
124+
error_log /var/log/nginx/staging-error.log warn;
125+
126+
location / {
127+
proxy_pass http://prostaff_api;
128+
proxy_set_header Host $host;
129+
proxy_set_header X-Real-IP $remote_addr;
130+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
131+
proxy_set_header X-Forwarded-Proto $scheme;
132+
}
133+
}

0 commit comments

Comments
 (0)