Azure production deployment

.dockerignore

@@ -0,0 +1,5 @@
+.git
+node_modules
+dist
+Dockerfile
+Dockerfile.prod

.github/workflows/deploy.yml

@@ -13,44 +13,31 @@ jobs:
         name: Build and Deploy
         runs-on: ubuntu-latest
         steps:
-            - name: Check out code
+            - name: Checkout code
               uses: actions/checkout@v3
 
-            - uses: azure/login@v1
-              with:
-                  creds: ${{ secrets.AZ_CREDENTIALS }}
-
-            - name: Login to Azure Container Registry
+            - name: Azure Container Registry login
               uses: docker/login-action@v2
               with:
                   registry: ${{ secrets.AZ_REGISTRY_URL }}
                   username: ${{ secrets.AZ_REGISTRY_USERNAME }}
                   password: ${{ secrets.AZ_REGISTRY_PASSWORD }}
 
-            - name: Build, tag, and push image to Azure Container Instances
+            - name: Build, tag and push image to Azure Container Registry
               env:
                   SERVICE_ACCOUNT_KEY: ${{ secrets.SERVICE_ACCOUNT_KEY }}
                   ENV_FILE: ${{ secrets.ENV }}
                   ECR_REGISTRY: ${{ secrets.AZ_REGISTRY_URL }}
                   ECR_REPOSITORY: collaction-api-${{ env.CURRENT_ENV }}
-                  DOCKER_FILE: ${{ env.CURRENT_ENV == 'production' && 'Dockerfile.prod' || 'Dockerfile'  }}
               run: |
                   echo $SERVICE_ACCOUNT_KEY | base64 --decode > serviceAccountKey.json
                   echo $ENV_FILE | base64 --decode > .env
-                  docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.CURRENT_ENV }} -f $DOCKER_FILE .
-                  docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ env.CURRENT_ENV }}
+                  docker build --target ${{ env.CURRENT_ENV }} -t $ECR_REGISTRY/$ECR_REPOSITORY:${{ github.sha }} .
+                  docker push $ECR_REGISTRY/$ECR_REPOSITORY:${{ github.sha }}
 
-            - name: Deploy to Azure Container Instances
-              uses: azure/aci-deploy@v1
-              env:
-                  ECR_REPOSITORY: collaction-api-${{ env.CURRENT_ENV }}
+            - name: Deploy to Azure App Service
+              uses: azure/webapps-deploy@v2
               with:
-                  resource-group: ${{ secrets.AZ_RESOURCE_GROUP }}
-                  dns-name-label: api-${{ env.CURRENT_ENV }}
-                  image: ${{ secrets.AZ_REGISTRY_URL }}/${{ env.ECR_REPOSITORY }}:${{ env.CURRENT_ENV }}
-                  registry-login-server: ${{ secrets.AZ_REGISTRY_URL }}
-                  registry-username: ${{ secrets.AZ_REGISTRY_USERNAME }}
-                  registry-password: ${{ secrets.AZ_REGISTRY_PASSWORD }}
-                  name: ${{ env.ECR_REPOSITORY }}
-                  location: 'west europe'
-                  ports: '80 443 3000'
+                app-name: 'collaction-api-${{ env.CURRENT_ENV }}'
+                publish-profile: ${{ secrets.AZ_PUBLISH_PROFILE }}
+                images: '${{ secrets.AZ_REGISTRY_URL }}/collaction-api-${{ env.CURRENT_ENV }}:${{ github.sha }}'

.gitignore

@@ -65,4 +65,3 @@ dist/
 test-coverage/
 serviceAccountKey.json
 serviceAccountKey-prod.json
-package-lock.json

Dockerfile

@@ -1,15 +1,45 @@
-FROM node:16-alpine3.12 as development
+# Development
+FROM node:16-alpine AS development
 
-WORKDIR /home/node/app
+WORKDIR /usr/src/app
 
 COPY package*.json ./
 
 RUN npm i
 
 COPY . .
 
-RUN npm run build
-
 EXPOSE 3000
 
 CMD ["npm", "run", "start:dev"]
+
+# Production (multi-stage build)
+FROM node:16-alpine AS build
+
+WORKDIR /usr/src/app
+
+COPY --chown=node:node package*.json ./
+COPY --chown=node:node --from=development /usr/src/app/node_modules ./node_modules
+COPY --chown=node:node . .
+
+RUN npm run build
+
+ENV NODE_ENV production
+
+RUN npm ci --only=production && npm cache clean --force
+
+USER node
+
+FROM node:16-alpine AS production
+
+WORKDIR /usr/src/app
+
+COPY --chown=node:node --from=build /usr/src/app/node_modules ./node_modules
+COPY --chown=node:node --from=build /usr/src/app/dist ./dist
+COPY --chown=node:node serviceAccountKey.json .
+COPY --chown=node:node .env .
+COPY --chown=node:node assets ./assets
+COPY --chown=node:node assets ./dist/assets
+COPY --chown=node:node assets ./dist/src/assets
+
+CMD [ "node", "dist/src/main.js" ]

azure/container_registry.tf

@@ -3,4 +3,5 @@ resource "azurerm_container_registry" "collaction" {
   resource_group_name = azurerm_resource_group.collaction_api.name
   location            = azurerm_resource_group.collaction_api.location
   sku                 = "Standard"
-}
+  admin_enabled       = true
+}

azure/dns.tf

@@ -0,0 +1,145 @@
+resource "azurerm_dns_zone" "collaction_app" {
+  name                = "collaction.app"
+  resource_group_name = azurerm_resource_group.collaction_api.name
+}
+
+resource "azurerm_dns_a_record" "collaction_app_website" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.collaction_app.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+  # Website hosted on Vercel
+  records = ["76.76.21.21"]
+}
+
+resource "azurerm_dns_cname_record" "collaction_app_www" {
+  name                = "www"
+  zone_name           = azurerm_dns_zone.collaction_app.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+  record              = "cname.vercel-dns.com"
+}
+
+resource "azurerm_dns_zone" "collaction_org" {
+  name                = "collaction.org"
+  resource_group_name = azurerm_resource_group.collaction_api.name
+}
+
+resource "azurerm_dns_a_record" "collaction_org_website" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.collaction_org.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+  # Website hosted on Vercel
+  records = ["76.76.21.21"]
+}
+
+resource "azurerm_dns_mx_record" "collaction_org" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.collaction_org.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+
+  record {
+    preference = 1
+    exchange   = "ASPMX.L.GOOGLE.COM."
+  }
+
+  record {
+    preference = 5
+    exchange   = "ALT1.ASPMX.L.GOOGLE.COM."
+  }
+
+  record {
+    preference = 5
+    exchange   = "ALT2.ASPMX.L.GOOGLE.COM."
+  }
+
+  record {
+    preference = 10
+    exchange   = "ALT3.ASPMX.L.GOOGLE.COM."
+  }
+
+  record {
+    preference = 10
+    exchange   = "ALT4.ASPMX.L.GOOGLE.COM."
+  }
+
+  record {
+    preference = 10
+    exchange   = "x3hzrrc76ur7ql23dtzahto3xlxu2tyrgsgosvkpxf5cry4yhffq.mx-verification.google.com."
+  }
+}
+
+resource "azurerm_dns_txt_record" "google-site-verification" {
+  name                = "@"
+  zone_name           = azurerm_dns_zone.collaction_org.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+
+  record {
+    value = "\"google-site-verification=SW8ISEH0mS7aKfOnxzUEjgMyrNyNDX1CkWrc6OBV5Js\""
+  }
+
+  record {
+    value = "\"google-site-verification=TyCEpqnZwyWaRL1FhYY46fr7faAfDbCP16AOQwQVElw\""
+  }
+
+  record {
+    value = "\"google-site-verification=Kh1C6nh-U5B6efQFVrwGbD65rs53Ubr_14jiWqiAP9k\""
+  }
+
+  record {
+    value = "\"MS=ms78684470\""
+  }
+}
+
+# TODO(gm): Connect these to containers
+# resource "azurerm_dns_cname_record" "api-production" {
+#   name                = "api"
+#   zone_name           = azurerm_dns_zone.collaction_org.name
+#   resource_group_name = azurerm_resource_group.collaction_api.name
+#   ttl                 = 300
+#   record              = "collaction-api-prod-1123994322.eu-central-1.elb.amazonaws.com."
+# }
+# 
+# resource "azurerm_dns_cname_record" "api-dev" {
+#   name                = "devapi"
+#   zone_name           = azurerm_dns_zone.collaction_org.name
+#   resource_group_name = azurerm_resource_group.collaction_api.name
+#   ttl                 = 300
+#   record              = "collaction-api-dev-183571204.eu-central-1.elb.amazonaws.com."
+# }
+
+resource "azurerm_dns_cname_record" "docs" {
+  name                = "docs"
+  zone_name           = azurerm_dns_zone.collaction_org.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+  record              = "19caebbc41-hosting.gitbook.io"
+}
+
+# TODO(gm): how to connect this to Azure Blob Storage?
+# resource "azurerm_dns_a_record" "static-dev" {
+#   name = "static-dev"
+#   zone_name = azurerm_dns_zone.collaction_org.name
+#   resource_group_name = azurerm_resource_group.collaction_api.name
+#   ttl = 300
+#   records = [""]
+# }
+
+# resource "azurerm_dns_a_record" "static-production" {
+#   name = "static"
+#   zone_name = azurerm_dns_zone.collaction_org.name
+#   resource_group_name = azurerm_resource_group.collaction_api.name
+#   ttl = 300
+#   records = [""]
+# }
+
+resource "azurerm_dns_cname_record" "collaction_org_www" {
+  name                = "www"
+  zone_name           = azurerm_dns_zone.collaction_org.name
+  resource_group_name = azurerm_resource_group.collaction_api.name
+  ttl                 = 300
+  record              = "cname.vercel-dns.com"
+}