diff --git a/deploy/README.md b/deploy/README.md new file mode 100644 index 0000000..c3fc9d9 --- /dev/null +++ b/deploy/README.md @@ -0,0 +1,59 @@ +# Deployment Configuration Guide + +This directory contains the deployment configurations and procedures for the Accounts Service (`accounts.svc.plus`) on Google Cloud Run. + +## Environments + +### 1. Production Environment +- **Service Name**: `accounts-svc-plus` +- **Repository**: [https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git](https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git) +- **Branch**: `release/v0.1` +- **Configuration File**: `gcp/cloud-run/prod-service.yaml` +- **Deployment Status**: [Production URL](https://accounts-svc-plus-266500572462.asia-northeast1.run.app) + +### 2. Preview Environment +- **Service Name**: `preview-accounts-svc-plus` +- **Repository**: [https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git](https://github.com/cloud-neutral-toolkit/accounts.svc.plus.git) +- **Branch**: `main` +- **Configuration File**: `gcp/cloud-run/preview-service.yaml` +- **Deployment Status**: [Preview URL](https://preview-accounts-svc-plus-266500572462.asia-northeast1.run.app) + +--- + +## Deployment Procedures + +### Build and Deploy Preview (from `main`) +```bash +# 1. Switch to main branch +git checkout main + +# 2. Build image via Cloud Build +gcloud builds submit --tag asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/preview-accounts-svc-plus:latest --project xzerolab-480008 + +# 3. Apply Cloud Run configuration +gcloud run services replace deploy/gcp/cloud-run/preview-service.yaml --project xzerolab-480008 --region asia-northeast1 + +# 4. Ensure public access +gcloud run services add-iam-policy-binding preview-accounts-svc-plus --project xzerolab-480008 --region asia-northeast1 --member="allUsers" --role="roles/run.invoker" +``` + +### Build and Deploy Production (from `release/v0.1`) +```bash +# 1. Switch to release branch +git checkout release/v0.1 + +# 2. Build image via Cloud Build +gcloud builds submit --tag asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:v0.1 --project xzerolab-480008 + +# 3. Apply Cloud Run configuration +# Note: Ensure the image path in service.yaml matches the versioned tag +gcloud run services replace deploy/gcp/cloud-run/prod-service.yaml --project xzerolab-480008 --region asia-northeast1 +``` + +## Infrastructure Components +- **Stunnel Sidecar**: Used for secure connection to the PostgreSQL database. Configuration is stored in Secret Manager as `stunnel-config`. +- **Secrets**: + - `postgres-password`: Database access. + - `internal-service-token`: RPC/Internal communication. + - `stunnel-config`: Sidecar tunnel settings. + - `smtp-username` / `smtp-password`: Email delivery. diff --git a/deploy/gcp/cloud-run/preview-service.yaml b/deploy/gcp/cloud-run/preview-service.yaml new file mode 100644 index 0000000..fe11aaf --- /dev/null +++ b/deploy/gcp/cloud-run/preview-service.yaml @@ -0,0 +1,103 @@ +apiVersion: serving.knative.dev/v1 +kind: Service +metadata: + name: preview-accounts-svc-plus + labels: + cloud.googleapis.com/location: asia-northeast1 + annotations: + run.googleapis.com/launch-stage: BETA + run.googleapis.com/ingress: all +spec: + template: + metadata: + annotations: + run.googleapis.com/startup-cpu-boost: 'true' + autoscaling.knative.dev/maxScale: '1' + spec: + containerConcurrency: 80 + timeoutSeconds: 300 + serviceAccountName: 266500572462-compute@developer.gserviceaccount.com + containers: + # --- 主应用容器 --- + - name: accounts-api + image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/preview-accounts-svc-plus:latest + ports: + - name: http1 + containerPort: 8080 + env: + - name: CONFIG_TEMPLATE + value: "/app/config/account.cloudrun.yaml" + - name: PGADMIN_PASSWORD + value: admin_password + - name: DB_PASSWORD + valueFrom: + secretKeyRef: + name: postgres-password + key: latest + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: postgres-password + key: latest + - name: DB_HOST + value: "127.0.0.1" + - name: DB_PORT + value: "15432" + - name: DB_USER + value: postgres + - name: POSTGRES_USER + value: postgres + - name: DB_NAME + value: account + - name: INTERNAL_SERVICE_TOKEN + valueFrom: + secretKeyRef: + name: internal-service-token + key: latest + # --- SMTP Configuration --- + - name: SMTP_HOST + value: "smtp.qq.com" + - name: SMTP_PORT + value: "587" + - name: SMTP_FROM + value: "XControl Account " + - name: SMTP_USERNAME + valueFrom: + secretKeyRef: + name: smtp-username + key: latest + - name: SMTP_PASSWORD + valueFrom: + secretKeyRef: + name: smtp-password + key: latest + resources: + limits: + cpu: 1000m + memory: 512Mi + startupProbe: + timeoutSeconds: 240 + periodSeconds: 240 + failureThreshold: 1 + tcpSocket: + port: 8080 + + # --- Stunnel Sidecar 容器 --- + - name: stunnel-sidecar + image: dweomer/stunnel + volumeMounts: + - name: stunnel-conf-vol + mountPath: /etc/stunnel + command: ["stunnel", "/etc/stunnel/stunnel.conf"] + resources: + limits: + cpu: 200m + memory: 128Mi + + volumes: + - name: stunnel-conf-vol + secret: + secretName: stunnel-config + items: + - key: latest + path: stunnel.conf diff --git a/deploy/gcp/cloud-run/service.yaml b/deploy/gcp/cloud-run/prod-service.yaml similarity index 97% rename from deploy/gcp/cloud-run/service.yaml rename to deploy/gcp/cloud-run/prod-service.yaml index 07304e9..bfa7ba5 100644 --- a/deploy/gcp/cloud-run/service.yaml +++ b/deploy/gcp/cloud-run/prod-service.yaml @@ -20,7 +20,7 @@ spec: containers: # --- 主应用容器 --- - name: accounts-api - image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:latest + image: asia-northeast1-docker.pkg.dev/xzerolab-480008/cloud-run-source-deploy/accounts.svc.plus/accounts-svc-plus:v0.1 ports: - name: http1 containerPort: 8080