Add complete frontend implementation and Docker deployment setup
- Implement React frontend with TypeScript and Tailwind CSS - Add scrappbook.de-inspired UI design with photo galleries - Implement authentication, photo viewing, and download features - Add Docker Swarm configuration with Traefik reverse proxy - Set up Drone CI/CD pipeline for automated deployments - Add monitoring stack with Prometheus and Grafana - Create comprehensive deployment documentation - Add simple local development setup with docker-compose.local.yml Features: - Password-protected galleries with expiration warnings - Responsive photo grid with lightbox viewer - Bulk download functionality - Hot reload development environment - Email testing with Mailhog - Production-ready deployment scripts 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
This commit is contained in:
Claude
+483
@@ -0,0 +1,483 @@
|
||||
# Photo Sharing Platform - Production Deployment Guide
|
||||
|
||||
This guide covers deploying the photo sharing platform using Docker Swarm, Traefik, and Drone CI/CD.
|
||||
|
||||
## Table of Contents
|
||||
- [Prerequisites](#prerequisites)
|
||||
- [Infrastructure Setup](#infrastructure-setup)
|
||||
- [Docker Swarm Setup](#docker-swarm-setup)
|
||||
- [Traefik Setup](#traefik-setup)
|
||||
- [Application Deployment](#application-deployment)
|
||||
- [CI/CD with Drone](#cicd-with-drone)
|
||||
- [Monitoring](#monitoring)
|
||||
- [Backup and Recovery](#backup-and-recovery)
|
||||
- [Troubleshooting](#troubleshooting)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
### Hardware Requirements
|
||||
- **Manager Node**: 2 CPU cores, 4GB RAM, 50GB storage
|
||||
- **Worker Nodes**: 2 CPU cores, 2GB RAM, 20GB storage
|
||||
- **Storage**: SSD recommended for database and photo storage
|
||||
|
||||
### Software Requirements
|
||||
- Ubuntu 20.04+ or similar Linux distribution
|
||||
- Docker Engine 20.10+
|
||||
- Docker Compose 2.0+
|
||||
- Git
|
||||
- SSL certificates (automated with Let's Encrypt)
|
||||
|
||||
### Network Requirements
|
||||
- Ports 80, 443 open for web traffic
|
||||
- Port 2377 for Swarm management
|
||||
- Ports 7946, 4789 for Swarm networking
|
||||
- Static IP or reliable dynamic DNS
|
||||
|
||||
## Infrastructure Setup
|
||||
|
||||
### 1. Install Docker
|
||||
|
||||
```bash
|
||||
# Install Docker
|
||||
curl -fsSL https://get.docker.com | sh
|
||||
|
||||
# Add user to docker group
|
||||
sudo usermod -aG docker $USER
|
||||
|
||||
# Enable Docker service
|
||||
sudo systemctl enable docker
|
||||
sudo systemctl start docker
|
||||
```
|
||||
|
||||
### 2. Configure Firewall
|
||||
|
||||
```bash
|
||||
# Allow Docker Swarm ports
|
||||
sudo ufw allow 2377/tcp
|
||||
sudo ufw allow 7946/tcp
|
||||
sudo ufw allow 7946/udp
|
||||
sudo ufw allow 4789/udp
|
||||
|
||||
# Allow web traffic
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443/tcp
|
||||
```
|
||||
|
||||
## Docker Swarm Setup
|
||||
|
||||
### 1. Initialize Swarm
|
||||
|
||||
On the manager node:
|
||||
|
||||
```bash
|
||||
cd deploy/scripts
|
||||
sudo ./init-swarm.sh
|
||||
```
|
||||
|
||||
This script will:
|
||||
- Initialize Docker Swarm
|
||||
- Create overlay networks
|
||||
- Label nodes for service placement
|
||||
- Create required directories
|
||||
|
||||
### 2. Join Worker Nodes
|
||||
|
||||
On each worker node, run the join command displayed by the init script:
|
||||
|
||||
```bash
|
||||
docker swarm join --token SWMTKN-1-xxx... manager-ip:2377
|
||||
```
|
||||
|
||||
### 3. Verify Swarm
|
||||
|
||||
```bash
|
||||
docker node ls
|
||||
```
|
||||
|
||||
## Application Configuration
|
||||
|
||||
### 1. Environment Setup
|
||||
|
||||
```bash
|
||||
# Copy environment template
|
||||
cp .env.production.example .env.production
|
||||
|
||||
# Edit with your values
|
||||
nano .env.production
|
||||
```
|
||||
|
||||
Required configurations:
|
||||
- Domain names for frontend, backend, and services
|
||||
- SMTP credentials for email
|
||||
- Database passwords
|
||||
- JWT secrets
|
||||
|
||||
### 2. Create Docker Secrets
|
||||
|
||||
```bash
|
||||
cd deploy/scripts
|
||||
./create-secrets.sh
|
||||
```
|
||||
|
||||
This will create all required secrets in Docker Swarm. Save the generated passwords!
|
||||
|
||||
## Traefik Setup
|
||||
|
||||
### 1. Deploy Traefik
|
||||
|
||||
```bash
|
||||
cd deploy/traefik
|
||||
|
||||
# Create traefik network
|
||||
docker network create --driver overlay traefik-public
|
||||
|
||||
# Deploy Traefik stack
|
||||
docker stack deploy -c docker-compose.traefik.yml traefik
|
||||
```
|
||||
|
||||
### 2. Verify Traefik
|
||||
|
||||
```bash
|
||||
# Check service status
|
||||
docker service ls | grep traefik
|
||||
|
||||
# View logs
|
||||
docker service logs traefik_traefik
|
||||
```
|
||||
|
||||
Access Traefik dashboard at: `https://traefik.yourdomain.com/dashboard/`
|
||||
|
||||
## Application Deployment
|
||||
|
||||
### 1. Build Images (if using local registry)
|
||||
|
||||
```bash
|
||||
# Build frontend
|
||||
cd frontend
|
||||
docker build -t photo-sharing-frontend:latest .
|
||||
|
||||
# Build backend
|
||||
cd ../backend
|
||||
docker build -t photo-sharing-backend:latest .
|
||||
```
|
||||
|
||||
### 2. Deploy Application Stack
|
||||
|
||||
```bash
|
||||
cd deploy/scripts
|
||||
./deploy.sh
|
||||
```
|
||||
|
||||
Options:
|
||||
- `--env FILE`: Specify environment file
|
||||
- `--registry URL`: Docker registry URL
|
||||
- `--version VERSION`: Image version to deploy
|
||||
|
||||
### 3. Verify Deployment
|
||||
|
||||
```bash
|
||||
# Check all services
|
||||
docker service ls
|
||||
|
||||
# Check specific service
|
||||
docker service ps photo-sharing_backend
|
||||
|
||||
# View logs
|
||||
docker service logs photo-sharing_backend -f
|
||||
```
|
||||
|
||||
### 4. Run Database Migrations
|
||||
|
||||
The deploy script automatically runs migrations, but you can run manually:
|
||||
|
||||
```bash
|
||||
docker exec $(docker ps -q -f name=photo-sharing_backend) npm run migrate
|
||||
```
|
||||
|
||||
## CI/CD with Drone
|
||||
|
||||
### 1. Drone Server Setup
|
||||
|
||||
Deploy Drone server on your CI infrastructure:
|
||||
|
||||
```bash
|
||||
docker run \
|
||||
--volume=/var/lib/drone:/data \
|
||||
--env=DRONE_GITHUB_CLIENT_ID=your-id \
|
||||
--env=DRONE_GITHUB_CLIENT_SECRET=your-secret \
|
||||
--env=DRONE_RPC_SECRET=your-rpc-secret \
|
||||
--env=DRONE_SERVER_HOST=drone.yourdomain.com \
|
||||
--env=DRONE_SERVER_PROTO=https \
|
||||
--publish=80:80 \
|
||||
--publish=443:443 \
|
||||
--restart=always \
|
||||
--detach=true \
|
||||
--name=drone \
|
||||
drone/drone:2
|
||||
```
|
||||
|
||||
### 2. Drone Runner Setup
|
||||
|
||||
On build servers:
|
||||
|
||||
```bash
|
||||
docker run -d \
|
||||
-v /var/run/docker.sock:/var/run/docker.sock \
|
||||
-e DRONE_RPC_PROTO=https \
|
||||
-e DRONE_RPC_HOST=drone.yourdomain.com \
|
||||
-e DRONE_RPC_SECRET=your-rpc-secret \
|
||||
-e DRONE_RUNNER_CAPACITY=2 \
|
||||
-e DRONE_RUNNER_NAME=runner-1 \
|
||||
-p 3000:3000 \
|
||||
--restart always \
|
||||
--name runner \
|
||||
drone/drone-runner-docker:1
|
||||
```
|
||||
|
||||
### 3. Repository Setup
|
||||
|
||||
1. Enable repository in Drone UI
|
||||
2. Add secrets in Drone:
|
||||
- `docker_username`
|
||||
- `docker_password`
|
||||
- `docker_registry`
|
||||
- `staging_swarm_host`
|
||||
- `staging_swarm_user`
|
||||
- `staging_swarm_key`
|
||||
- `prod_swarm_host`
|
||||
- `prod_swarm_user`
|
||||
- `prod_swarm_key`
|
||||
- `slack_webhook`
|
||||
|
||||
### 4. Deployment Workflow
|
||||
|
||||
- Push to `develop` → Deploy to staging
|
||||
- Create tag → Deploy to production
|
||||
- Automatic rollback on failure
|
||||
|
||||
## Monitoring
|
||||
|
||||
### 1. Deploy Monitoring Stack
|
||||
|
||||
```bash
|
||||
cd deploy/monitoring
|
||||
|
||||
# Deploy monitoring services
|
||||
docker stack deploy -c docker-compose.monitoring.yml monitoring
|
||||
```
|
||||
|
||||
### 2. Access Services
|
||||
|
||||
- Grafana: `https://grafana.yourdomain.com`
|
||||
- Prometheus: `https://prometheus.yourdomain.com`
|
||||
- Alertmanager: `https://alerts.yourdomain.com`
|
||||
|
||||
### 3. Configure Alerts
|
||||
|
||||
Create alert rules in `deploy/monitoring/alerts/`:
|
||||
|
||||
```yaml
|
||||
groups:
|
||||
- name: photo-sharing
|
||||
rules:
|
||||
- alert: ServiceDown
|
||||
expr: up{job="photo-sharing-backend"} == 0
|
||||
for: 5m
|
||||
annotations:
|
||||
summary: "Photo sharing backend is down"
|
||||
```
|
||||
|
||||
## Backup and Recovery
|
||||
|
||||
### 1. Automated Backups
|
||||
|
||||
Set up cron job for automated backups:
|
||||
|
||||
```bash
|
||||
# Edit crontab
|
||||
crontab -e
|
||||
|
||||
# Add daily backup at 2 AM
|
||||
0 2 * * * /opt/photo-sharing/deploy/scripts/backup.sh
|
||||
```
|
||||
|
||||
### 2. Manual Backup
|
||||
|
||||
```bash
|
||||
cd deploy/scripts
|
||||
./backup.sh
|
||||
```
|
||||
|
||||
### 3. Restore from Backup
|
||||
|
||||
```bash
|
||||
# Extract backup
|
||||
tar -xzf backup-20240615-020000.tar.gz
|
||||
|
||||
# Restore database
|
||||
docker exec -i $(docker ps -q -f name=photo-sharing_db) \
|
||||
psql -U postgres photo_sharing < backup-20240615-020000/database.sql
|
||||
|
||||
# Restore photos
|
||||
tar -xzf backup-20240615-020000/photos.tar.gz -C /opt/photo-sharing/
|
||||
|
||||
# Restore volumes
|
||||
docker run --rm \
|
||||
-v photo-sharing_app-data:/data \
|
||||
-v $(pwd)/backup-20240615-020000:/backup \
|
||||
alpine tar -xzf /backup/volume-photo-sharing_app-data.tar.gz -C /data
|
||||
```
|
||||
|
||||
## Maintenance
|
||||
|
||||
### 1. Scaling Services
|
||||
|
||||
```bash
|
||||
# Scale backend to 5 replicas
|
||||
docker service scale photo-sharing_backend=5
|
||||
|
||||
# Scale frontend to 3 replicas
|
||||
docker service scale photo-sharing_frontend=3
|
||||
```
|
||||
|
||||
### 2. Rolling Updates
|
||||
|
||||
```bash
|
||||
# Update backend image
|
||||
docker service update \
|
||||
--image registry.yourdomain.com/photo-sharing-backend:v2.0 \
|
||||
photo-sharing_backend
|
||||
```
|
||||
|
||||
### 3. Drain Node for Maintenance
|
||||
|
||||
```bash
|
||||
# Drain node
|
||||
docker node update --availability drain worker-1
|
||||
|
||||
# Perform maintenance...
|
||||
|
||||
# Activate node
|
||||
docker node update --availability active worker-1
|
||||
```
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Common Issues
|
||||
|
||||
#### 1. Service Won't Start
|
||||
```bash
|
||||
# Check service status
|
||||
docker service ps photo-sharing_backend --no-trunc
|
||||
|
||||
# View detailed logs
|
||||
docker service logs photo-sharing_backend --details
|
||||
```
|
||||
|
||||
#### 2. Database Connection Issues
|
||||
```bash
|
||||
# Check database logs
|
||||
docker service logs photo-sharing_db
|
||||
|
||||
# Test connection
|
||||
docker exec $(docker ps -q -f name=photo-sharing_db) \
|
||||
pg_isready -U postgres
|
||||
```
|
||||
|
||||
#### 3. Traefik Certificate Issues
|
||||
```bash
|
||||
# Check Traefik logs
|
||||
docker service logs traefik_traefik | grep acme
|
||||
|
||||
# Remove and regenerate certificates
|
||||
rm -rf /opt/traefik/letsencrypt/acme.json
|
||||
docker service update --force traefik_traefik
|
||||
```
|
||||
|
||||
#### 4. Storage Issues
|
||||
```bash
|
||||
# Check disk usage
|
||||
df -h
|
||||
|
||||
# Clean up Docker
|
||||
docker system prune -a
|
||||
```
|
||||
|
||||
### Debug Mode
|
||||
|
||||
Enable debug logging:
|
||||
|
||||
```bash
|
||||
# Update service with debug logging
|
||||
docker service update \
|
||||
--env-add LOG_LEVEL=debug \
|
||||
photo-sharing_backend
|
||||
```
|
||||
|
||||
### Health Checks
|
||||
|
||||
```bash
|
||||
# Check all endpoints
|
||||
curl -f https://photos.yourdomain.com/health
|
||||
curl -f https://api.photos.yourdomain.com/api/health
|
||||
curl -f https://traefik.yourdomain.com/ping
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
1. **Regular Updates**
|
||||
- Keep Docker and system packages updated
|
||||
- Update application dependencies regularly
|
||||
- Monitor security advisories
|
||||
|
||||
2. **Access Control**
|
||||
- Use strong passwords for all services
|
||||
- Enable 2FA where possible
|
||||
- Restrict SSH access to specific IPs
|
||||
- Use Docker secrets for sensitive data
|
||||
|
||||
3. **Network Security**
|
||||
- Use internal networks for service communication
|
||||
- Enable firewall rules
|
||||
- Use TLS for all external communication
|
||||
- Regular security scans with Trivy
|
||||
|
||||
4. **Backup Security**
|
||||
- Encrypt backups at rest
|
||||
- Test restore procedures regularly
|
||||
- Store backups in multiple locations
|
||||
- Rotate old backups
|
||||
|
||||
## Performance Tuning
|
||||
|
||||
1. **Database Optimization**
|
||||
```sql
|
||||
-- Add indexes for common queries
|
||||
CREATE INDEX idx_photos_event_id ON photos(event_id);
|
||||
CREATE INDEX idx_access_logs_event_id ON access_logs(event_id);
|
||||
```
|
||||
|
||||
2. **Image Optimization**
|
||||
- Use CDN for static assets
|
||||
- Enable aggressive caching
|
||||
- Optimize image sizes before upload
|
||||
|
||||
3. **Service Limits**
|
||||
```yaml
|
||||
deploy:
|
||||
resources:
|
||||
limits:
|
||||
cpus: '2'
|
||||
memory: 1G
|
||||
reservations:
|
||||
cpus: '0.5'
|
||||
memory: 256M
|
||||
```
|
||||
|
||||
## Support
|
||||
|
||||
For issues and questions:
|
||||
- Check logs: `docker service logs <service_name>`
|
||||
- Review documentation: [README.md](README.md)
|
||||
- Check monitoring dashboards
|
||||
- Contact: admin@yourdomain.com
|
||||
Reference in New Issue
Block a user