.gitea/workflows/deploy-prod.yml

@@ -13,12 +13,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      - name: Install Docker
+      - name: Set up Docker Buildx
-        run: |
+        uses: docker/setup-buildx-action@v3
-          sudo apt-get update
-          sudo apt-get install -y docker.io
 
       - name: Debug context variables
         run: |
@@ -27,18 +25,20 @@ jobs:
           echo "Repository owner: ${{ gitea.repository_owner }}"
           echo "Event repository name: ${{ gitea.event.repository.name }}"
           echo "Event repository full name: ${{ gitea.event.repository.full_name }}"
+          echo "Event repository owner login: ${{ gitea.event.repository.owner.login }}"
 
-      - name: Build and push backend image
+      - name: Login to Gitea Registry
         env:
           GITEA_USERNAME: ${{ secrets.ME_USERNAME }}
           GITEA_PASSWORD: ${{ secrets.ME_PASSWORD }}
         run: |
           echo $GITEA_PASSWORD | docker login git.vinylnostalgia.com -u $GITEA_USERNAME --password-stdin
 
-          # Try different context variable combinations
+      - name: Set repository variables
+        id: vars
+        run: |
           REPO_NAME="${{ gitea.repository_name }}"
           ACTOR="${{ gitea.actor }}"
-          OWNER="${{ gitea.repository_owner }}"
           
           # Use fallback if variables are empty
           if [ -z "$REPO_NAME" ]; then
@@ -48,42 +48,91 @@ jobs:
             ACTOR="${{ gitea.event.repository.owner.login }}"
           fi
           
+          echo "actor=$ACTOR" >> $GITHUB_OUTPUT
+          echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT
           echo "Using ACTOR: $ACTOR"
           echo "Using REPO_NAME: $REPO_NAME"
 
-          # Build with compression and smaller layers
+      - name: Build backend image with optimizations
-          docker build --compress --no-cache -t git.vinylnostalgia.com/$ACTOR/$REPO_NAME-backend:latest ./be -f ./be/Dockerfile.prod
+        env:
+          GITEA_USERNAME: ${{ secrets.ME_USERNAME }}
+          GITEA_PASSWORD: ${{ secrets.ME_PASSWORD }}
+        run: |
+          REPO_NAME="${{ gitea.repository_name }}"
+          ACTOR="${{ gitea.actor }}"
           
-          # Push with retries
+          # Use fallback if variables are empty
-          max_retries=3
+          if [ -z "$REPO_NAME" ]; then
+            REPO_NAME="${{ gitea.event.repository.name }}"
+          fi
+          if [ -z "$ACTOR" ]; then
+            ACTOR="${{ gitea.event.repository.owner.login }}"
+          fi
+          
+          echo "Building backend image..."
+          echo "Using ACTOR: $ACTOR"
+          echo "Using REPO_NAME: $REPO_NAME"
+          
+          # Build with BuildKit optimizations
+          DOCKER_BUILDKIT=1 docker build \
+            --compress \
+            --no-cache \
+            --squash \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            -t git.vinylnostalgia.com/$ACTOR/$REPO_NAME-backend:latest \
+            ./be -f ./be/Dockerfile.prod
+          
+          echo "Backend image built successfully"
+
+      - name: Push backend image with retry logic
+        env:
+          GITEA_USERNAME: ${{ secrets.ME_USERNAME }}
+          GITEA_PASSWORD: ${{ secrets.ME_PASSWORD }}
+        run: |
+          REPO_NAME="${{ gitea.repository_name }}"
+          ACTOR="${{ gitea.actor }}"
+          
+          # Use fallback if variables are empty
+          if [ -z "$REPO_NAME" ]; then
+            REPO_NAME="${{ gitea.event.repository.name }}"
+          fi
+          if [ -z "$ACTOR" ]; then
+            ACTOR="${{ gitea.event.repository.owner.login }}"
+          fi
+          
+          # Push with retries and compression
+          max_retries=5
           retry_count=0
+          base_wait=10
+          
           while [ $retry_count -lt $max_retries ]; do
+            echo "Pushing backend image (attempt $((retry_count + 1)) of $max_retries)..."
+            
             if docker push git.vinylnostalgia.com/$ACTOR/$REPO_NAME-backend:latest; then
+              echo "Backend image pushed successfully"
               break
             fi
+            
             retry_count=$((retry_count + 1))
             if [ $retry_count -lt $max_retries ]; then
-              echo "Push failed, retrying in 10 seconds... (Attempt $retry_count of $max_retries)"
+              wait_time=$((base_wait * retry_count))
-              sleep 10
+              echo "Push failed, retrying in $wait_time seconds..."
+              sleep $wait_time
             fi
           done
           
           if [ $retry_count -eq $max_retries ]; then
-            echo "Failed to push after $max_retries attempts"
+            echo "Failed to push backend image after $max_retries attempts"
             exit 1
           fi
 
-      - name: Build and push frontend image
+      - name: Build frontend image with optimizations
         env:
           GITEA_USERNAME: ${{ secrets.ME_USERNAME }}
           GITEA_PASSWORD: ${{ secrets.ME_PASSWORD }}
         run: |
-          echo $GITEA_PASSWORD | docker login git.vinylnostalgia.com -u $GITEA_USERNAME --password-stdin
-          
-          # Try different context variable combinations
           REPO_NAME="${{ gitea.repository_name }}"
           ACTOR="${{ gitea.actor }}"
-          OWNER="${{ gitea.repository_owner }}"
           
           # Use fallback if variables are empty
           if [ -z "$REPO_NAME" ]; then
@@ -93,27 +142,73 @@ jobs:
             ACTOR="${{ gitea.event.repository.owner.login }}"
           fi
           
+          echo "Building frontend image..."
           echo "Using ACTOR: $ACTOR"
           echo "Using REPO_NAME: $REPO_NAME"
           
-          # Build with compression and smaller layers
+          # Build with BuildKit optimizations
-          docker build --compress --no-cache -t git.vinylnostalgia.com/$ACTOR/$REPO_NAME-frontend:latest ./fe -f ./fe/Dockerfile.prod
+          DOCKER_BUILDKIT=1 docker build \
+            --compress \
+            --no-cache \
+            --squash \
+            --build-arg BUILDKIT_INLINE_CACHE=1 \
+            -t git.vinylnostalgia.com/$ACTOR/$REPO_NAME-frontend:latest \
+            ./fe -f ./fe/Dockerfile.prod
           
-          # Push with retries
+          echo "Frontend image built successfully"
-          max_retries=3
+
+      - name: Push frontend image with retry logic
+        env:
+          GITEA_USERNAME: ${{ secrets.ME_USERNAME }}
+          GITEA_PASSWORD: ${{ secrets.ME_PASSWORD }}
+        run: |
+          REPO_NAME="${{ gitea.repository_name }}"
+          ACTOR="${{ gitea.actor }}"
+          
+          # Use fallback if variables are empty
+          if [ -z "$REPO_NAME" ]; then
+            REPO_NAME="${{ gitea.event.repository.name }}"
+          fi
+          if [ -z "$ACTOR" ]; then
+            ACTOR="${{ gitea.event.repository.owner.login }}"
+          fi
+          
+          # Push with retries and exponential backoff
+          max_retries=5
           retry_count=0
+          base_wait=10
+          
           while [ $retry_count -lt $max_retries ]; do
+            echo "Pushing frontend image (attempt $((retry_count + 1)) of $max_retries)..."
+            
             if docker push git.vinylnostalgia.com/$ACTOR/$REPO_NAME-frontend:latest; then
+              echo "Frontend image pushed successfully"
               break
             fi
+            
             retry_count=$((retry_count + 1))
             if [ $retry_count -lt $max_retries ]; then
-              echo "Push failed, retrying in 10 seconds... (Attempt $retry_count of $max_retries)"
+              wait_time=$((base_wait * retry_count))
-              sleep 10
+              echo "Push failed, retrying in $wait_time seconds..."
+              sleep $wait_time
             fi
           done
           
           if [ $retry_count -eq $max_retries ]; then
-            echo "Failed to push after $max_retries attempts"
+            echo "Failed to push frontend image after $max_retries attempts"
             exit 1
           fi
+
+      - name: Cleanup Docker resources
+        if: always()
+        run: |
+          echo "Cleaning up Docker resources..."
+          docker system prune -af --volumes
+          docker logout git.vinylnostalgia.com
+          echo "Cleanup completed"
+
+      - name: Show final image sizes
+        if: always()
+        run: |
+          echo "Final image sizes:"
+          docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}" | grep -E "(vinylnostalgia|REPOSITORY)"

be/Dockerfile

@@ -1,7 +1,5 @@
-# be/Dockerfile
+# Multi-stage build for production - optimized for size
-
+FROM python:3.11-slim AS builder
-# Use multi-stage build
-FROM python:alpine AS builder
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -10,34 +8,63 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
 # Install build dependencies
-RUN apk add --no-cache \
+RUN apt-get update && apt-get install -y --no-install-recommends \
     gcc \
-    musl-dev \
+    g++ \
-    postgresql-dev
+    libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
 
-# Create and activate virtual environment
+# Install Python dependencies
-RUN python -m venv /opt/venv
-ENV PATH="/opt/venv/bin:$PATH"
-
-# Install dependencies
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --user --no-cache-dir -r requirements.txt
 
-# Final stage
+# Production stage - minimal image
-FROM python:alpine
+FROM python:3.11-slim AS production
 
-# Copy virtual environment from builder
+# Set environment variables
-COPY --from=builder /opt/venv /opt/venv
+ENV PYTHONDONTWRITEBYTECODE=1 \
-ENV PATH="/opt/venv/bin:$PATH"
+    PYTHONUNBUFFERED=1 \
+    PATH=/home/appuser/.local/bin:$PATH
+
+# Install only runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+# Create non-root user
+RUN groupadd -g 1001 appuser && \
+    useradd -u 1001 -g appuser -m appuser
+
+# Copy Python packages from builder stage
+COPY --from=builder /root/.local /home/appuser/.local
 
 # Set working directory
 WORKDIR /app
 
-# Copy application code
+# Copy only necessary application files (be selective)
-COPY . .
+COPY --chown=appuser:appuser app/ ./app/
+COPY --chown=appuser:appuser *.py ./
+COPY --chown=appuser:appuser requirements.txt ./
+
+# Create logs directory
+RUN mkdir -p /app/logs && chown -R appuser:appuser /app
+
+# Switch to non-root user
+USER appuser
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
+    CMD curl -f http://localhost:8000/health || exit 1
 
 # Expose port
 EXPOSE 8000
 
-# Run the application
+# Production command
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+CMD ["uvicorn", "app.main:app", \
+    "--host", "0.0.0.0", \
+    "--port", "8000", \
+    "--workers", "4", \
+    "--access-log", \
+    "--log-level", "info"]

be/Dockerfile.prod

@@ -1,49 +1,55 @@
-# Multi-stage build for production
+# Multi-stage build for production - optimized for size
-FROM python:alpine AS base
+FROM python:3.11-slim AS builder
 
 # Set environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
-    PYTHONHASHSEED=random \
     PIP_NO_CACHE_DIR=1 \
     PIP_DISABLE_PIP_VERSION_CHECK=1
 
-# Install system dependencies
+# Install build dependencies
-# Use apk for Alpine Linux instead of apt-get
+RUN apt-get update && apt-get install -y --no-install-recommends \
-RUN apk add --no-cache \
     gcc \
-    build-base \
+    g++ \
-    postgresql-dev \
+    libpq-dev \
-    curl
+    && rm -rf /var/lib/apt/lists/*
 
-# Create non-root user (Alpine Linux style)
+# Install Python dependencies
-RUN addgroup -g 1001 -S appuser && \
-    adduser -u 1001 -S appuser -G appuser
-
-# Development stage
-FROM base AS development
-WORKDIR /app
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+RUN pip install --user --no-cache-dir -r requirements.txt
-COPY . .
-RUN chown -R appuser:appuser /app
-USER appuser
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]
 
-# Production stage
+# Production stage - minimal image
-FROM base AS production
+FROM python:3.11-slim AS production
+
+# Set environment variables
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PATH=/home/appuser/.local/bin:$PATH
+
+# Install only runtime dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libpq5 \
+    curl \
+    && rm -rf /var/lib/apt/lists/* \
+    && apt-get clean
+
+# Create non-root user
+RUN groupadd -g 1001 appuser && \
+    useradd -u 1001 -g appuser -m appuser
+
+# Copy Python packages from builder stage
+COPY --from=builder /root/.local /home/appuser/.local
+
+# Set working directory
 WORKDIR /app
 
-# Install production dependencies
+# Copy only necessary application files (be selective)
-COPY requirements.txt .
+COPY --chown=appuser:appuser app/ ./app/
-RUN pip install --no-cache-dir -r requirements.txt
+COPY --chown=appuser:appuser *.py ./
+COPY --chown=appuser:appuser requirements.txt ./
 
-# Copy application code
+# Create logs directory
-COPY . .
+RUN mkdir -p /app/logs && chown -R appuser:appuser /app
-
-# Create necessary directories and set permissions
-RUN mkdir -p /app/logs && \
-    chown -R appuser:appuser /app
 
 # Switch to non-root user
 USER appuser
@@ -55,10 +61,10 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
 # Expose port
 EXPOSE 8000
 
-# Production command with optimizations
+# Production command
 CMD ["uvicorn", "app.main:app", \
     "--host", "0.0.0.0", \
     "--port", "8000", \
-    "--workers", "8", \
+    "--workers", "4", \
     "--access-log", \
     "--log-level", "info"]