.

.gitlab-ci.yml

@@ -1,90 +1,85 @@
 stages:
+  - build
   - deploy
 
-deploy-dev:
+variables:
-  stage: deploy
+  DOCKER_BUILDKIT: "1"
-  image: alpine:3.20
+  COMPOSE_DOCKER_CLI_BUILD: "1"
-  variables:
+  DOCKER_DRIVER: overlay2
-    DEPLOY_APP: "LTI-MBUGROUP"
+
-    # Opsional: kalau pakai submodule, ini bikin clone submodule pakai SSH juga
+  # Tag image untuk staging
-    GIT_SUBMODULE_STRATEGY: recursive
+  IMAGE_TAG: "staging_${CI_COMMIT_SHORT_SHA}"
-    GIT_DEPTH: "1"
+  IMAGE_NAME: "${CI_REGISTRY_IMAGE}:${IMAGE_TAG}"
+  IMAGE_LATEST_STAGING: "${CI_REGISTRY_IMAGE}:staging_latest"
+
+# =========================
+# BUILD: Docker image -> GitLab Registry
+# =========================
+build:staging:
+  stage: build
+  image: docker:27.0.3
+  services:
+    - name: docker:27.0.3-dind
+      command: ["--mtu=1460"]
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "staging"'
 
   before_script:
-    - echo "🧰 Installing dependencies..."
+    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
-    - apk update && apk add --no-cache openssh git curl bash
-
-    # Setup SSH di runner
-    - mkdir -p ~/.ssh
-    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
-    - chmod 600 ~/.ssh/id_rsa
-    - eval "$(ssh-agent -s)"
-    - ssh-add ~/.ssh/id_rsa
-
-    # Trust host keys (server + gitlab) biar SSH gak nanya interaktif
-    - ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts
-    - ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
 
   script:
-    - echo "🚀 Deploying latest code to $SERVER_USER@$SERVER_IP"
+    - echo "Build image: $IMAGE_NAME"
+    - docker build -t "$IMAGE_NAME" -f Dockerfile .
+    - docker push "$IMAGE_NAME"
 
-    - >
+    # opsional: juga push tag stabil untuk staging_latest
-      if ssh -o StrictHostKeyChecking=no "$SERVER_USER@$SERVER_IP" "
+    - docker tag "$IMAGE_NAME" "$IMAGE_LATEST_STAGING"
-        set -e
+    - docker push "$IMAGE_LATEST_STAGING"
 
-        cd /home/devops/docker/deployment/development/lti-api
+  after_script:
+    # bersihin layer di runner supaya tidak cepat penuh disk
+    - docker system prune -af || true
 
-        # Pastikan remote origin SSH (antisipasi kalau pernah ke-set HTTPS)
+# =========================
-        git remote set-url origin git@gitlab.com:mbugroup/lti-api.git
+# DEPLOY: Server pull image + docker compose up
+# =========================
+# deploy:staging:
+#   stage: deploy
+#   image: alpine:3.20
+#   rules:
+#     - if: '$CI_COMMIT_BRANCH == "staging"'
+#   needs: ["build:staging"]
 
-        # Pastikan server percaya gitlab.com juga (untuk git fetch via SSH)
+#   before_script:
-        mkdir -p ~/.ssh
+#     - apk add --no-cache openssh-client bash curl ca-certificates
-        ssh-keyscan -H gitlab.com >> ~/.ssh/known_hosts
+#     - mkdir -p ~/.ssh
 
-        # Fetch/reset pakai SSH
+#     # penting: buang CRLF biar key tidak "error in libcrypto"
-        GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' git fetch origin development
+#     - printf "%s" "$SSH_PRIVATE_KEY" | tr -d '\r' > ~/.ssh/id_rsa
-        git reset --hard origin/development
+#     - chmod 600 ~/.ssh/id_rsa
 
-        docker compose restart dev-api-lti || docker compose up -d dev-api-lti
+#     - eval "$(ssh-agent -s)"
-      "; then
+#     - ssh-add ~/.ssh/id_rsa
-        STATUS='success';
-      else
-        STATUS='failed';
-      fi;
 
-      RUN_URL="${CI_PROJECT_URL}/-/pipelines/${CI_PIPELINE_ID}";
+#     - ssh-keyscan -H "$SERVER_IP" >> ~/.ssh/known_hosts
 
-      if [ "$STATUS" = "success" ]; then
+#   script:
-        COLOR=3066993;
+#     - echo "Deploy on server: $SERVER_USER@$SERVER_IP"
-        TITLE="✅ Deployment API Succeeded";
+#     - echo "Target dir: /docker/deployment/staging/stg-lti-api"
-        DESC="Deployment job on branch \`${CI_COMMIT_REF_NAME}\` completed successfully.";
+#     - |
-      else
+#       ssh -o StrictHostKeyChecking=no "$SERVER_USER@$SERVER_IP" "
-        COLOR=15158332;
+#         set -e
-        TITLE="❌ Deployment API Failed Gaes";
+#         cd /docker/deployment/staging/stg-lti-api
-        DESC="Deployment job on branch \`${CI_COMMIT_REF_NAME}\` failed.";
-      fi;
 
-      echo "{
+#         echo 'Login registry on server...'
-        \"username\": \"CI Bot\",
+#         echo '$CI_REGISTRY_PASSWORD' | docker login -u '$CI_REGISTRY_USER' --password-stdin '$CI_REGISTRY'
-        \"embeds\": [{
-          \"title\": \"$TITLE\",
-          \"description\": \"$DESC\",
-          \"color\": $COLOR,
-          \"fields\": [
-            {\"name\": \"Repository\", \"value\": \"${CI_PROJECT_PATH}\", \"inline\": true},
-            {\"name\": \"Actor\", \"value\": \"${GITLAB_USER_LOGIN}\", \"inline\": true},
-            {\"name\": \"Commit\", \"value\": \"${CI_COMMIT_SHA}\", \"inline\": false},
-            {\"name\": \"Pipeline\", \"value\": \"[Open run](${RUN_URL})\", \"inline\": false}
-          ]
-        }]
-      }" > payload.json;
 
-      echo "📡 Sending notification to Discord...";
+#         echo 'Pull new image...'
-      curl -sS -H "Content-Type: application/json" \
+#         docker compose pull
-        -d @payload.json "$DISCORD_WEBHOOK_URL";
 
-  only:
+#         echo 'Restart containers...'
-    - development
+#         docker compose up -d
 
-  environment:
+#         echo 'Cleanup old images...'
-    name: development
+#         docker image prune -af --filter 'until=168h' || true
+#       "

Dockerfile

@@ -1,20 +1,35 @@
-FROM golang:1.23-alpine
+# =========================
+# Builder stage
+# =========================
+FROM golang:1.23-alpine AS builder
 
-# Install dependensi dasar
+RUN apk add --no-cache git ca-certificates tzdata
-RUN apk add --no-cache git curl bash build-base
+WORKDIR /app
 
-# Install Air (pakai repo baru air-verse)
-RUN go install github.com/air-verse/air@v1.52.3
-
-WORKDIR /lti-api
-
-# Cache dependencies
 COPY go.mod go.sum ./
 RUN go mod download
 
-# Copy source code
 COPY . .
 
+# Build binary dari cmd/api
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-s -w" -o lti-api ./cmd/api
+
+# =========================
+# Runtime stage
+# =========================
+FROM alpine:3.20
+
+RUN apk add --no-cache ca-certificates tzdata curl \
+  && adduser -D -H -u 10001 appuser
+
+WORKDIR /app
+
+COPY --from=builder /app/lti-api /app/lti-api
+
+USER appuser
+
+# Samakan dengan APP_PORT default kamu (8081)
 EXPOSE 8081
 
-CMD ["air", "-c", ".air.toml"]
+CMD ["/app/lti-api"]

docker-compose.local.yml

@@ -1,77 +0,0 @@
-services:
-  postgresdb:
-    image: postgres:alpine
-    restart: always
-    ports:
-      - "${DB_PORT_HOST:-5542}:5432"
-    environment:
-      POSTGRES_USER: ${DB_USER:-postgres}
-      POSTGRES_PASSWORD: ${DB_PASSWORD:-postgres}
-      POSTGRES_DB: ${DB_NAME:-db_lti_erp}
-    volumes:
-      - dbdata:/var/lib/postgresql/data
-      - ./internal/database/init:/docker-entrypoint-initdb.d
-    networks: [go-network]
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "pg_isready -U ${DB_USER:-postgres} -d ${DB_NAME:-db_lti_erp}",
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-  redis:
-    image: redis:7-alpine
-    restart: unless-stopped
-    ports:
-      - "${REDIS_PORT_HOST:-6381}:6379"
-    healthcheck:
-      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
-      interval: 5s
-      timeout: 3s
-      retries: 10
-    networks: [go-network]
-
-  app:
-    build:
-      context: .
-      dockerfile: Dockerfile.local
-    image: cosmtrek/air:v1.52.3
-    working_dir: /lti-api
-    volumes:
-      - .:/lti-api
-      - ./internal/config/jwtRS256.key:/run/keys/jwtRS256.key
-      - ./internal/config/jwtRS256.key.pub:/run/keys/jwtRS256.key.pub
-    command: air -c .air.toml
-    env_file:
-      - .env
-    environment:
-      DB_HOST: postgresdb
-      DB_PORT: 5432
-      DB_USER: ${DB_USER:-postgres}
-      DB_PASSWORD: ${DB_PASSWORD:-postgres}
-      DB_NAME: ${DB_NAME:-db_lti_erp}
-      REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
-    ports:
-      - "${APP_PORT:-8081}:8081"
-    depends_on:
-      postgresdb:
-        condition: service_healthy
-    networks: [go-network]
-    healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost:8081/healthz || exit 1"]
-      interval: 10s
-      timeout: 3s
-      retries: 10
-      start_period: 10s
-
-volumes:
-  dbdata:
-  go-mod-cache:
-  go-build-cache:
-
-networks:
-  go-network:
-    name: lti-api_go-network
-    driver: bridge