picpeak/DEPLOYMENT.md

Photo Sharing Platform - Production Deployment Guide

This guide covers deploying the photo sharing platform using Docker Swarm, Traefik, and Drone CI/CD.

Table of Contents

• Prerequisites
• Infrastructure Setup
• Docker Swarm Setup
• Traefik Setup
• Application Deployment
• CI/CD with Drone
• Monitoring
• Backup and Recovery
• Troubleshooting

Prerequisites

Hardware Requirements

• Manager Node: 2 CPU cores, 4GB RAM, 50GB storage
• Worker Nodes: 2 CPU cores, 2GB RAM, 20GB storage
• Storage: SSD recommended for database and photo storage

Software Requirements

• Ubuntu 20.04+ or similar Linux distribution
• Docker Engine 20.10+
• Docker Compose 2.0+
• Git
• SSL certificates (automated with Let's Encrypt)

Network Requirements

• Ports 80, 443 open for web traffic
• Port 2377 for Swarm management
• Ports 7946, 4789 for Swarm networking
• Static IP or reliable dynamic DNS

Infrastructure Setup

1. Install Docker

# Install Docker
curl -fsSL https://get.docker.com | sh

# Add user to docker group
sudo usermod -aG docker $USER

# Enable Docker service
sudo systemctl enable docker
sudo systemctl start docker

2. Configure Firewall

# Allow Docker Swarm ports
sudo ufw allow 2377/tcp
sudo ufw allow 7946/tcp
sudo ufw allow 7946/udp
sudo ufw allow 4789/udp

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Docker Swarm Setup

1. Initialize Swarm

On the manager node:

cd deploy/scripts
sudo ./init-swarm.sh

This script will:

• Initialize Docker Swarm
• Create overlay networks
• Label nodes for service placement
• Create required directories

2. Join Worker Nodes

On each worker node, run the join command displayed by the init script:

docker swarm join --token SWMTKN-1-xxx... manager-ip:2377

3. Verify Swarm

docker node ls

Application Configuration

1. Environment Setup

# Copy environment template
cp .env.production.example .env.production

# Edit with your values
nano .env.production

Required configurations:

• Domain names for frontend, backend, and services
• SMTP credentials for email
• Database passwords
• JWT secrets

2. Create Docker Secrets

cd deploy/scripts
./create-secrets.sh

This will create all required secrets in Docker Swarm. Save the generated passwords!

Traefik Setup

1. Deploy Traefik

cd deploy/traefik

# Create traefik network
docker network create --driver overlay traefik-public

# Deploy Traefik stack
docker stack deploy -c docker-compose.traefik.yml traefik

2. Verify Traefik

# Check service status
docker service ls | grep traefik

# View logs
docker service logs traefik_traefik

Access Traefik dashboard at: https://traefik.yourdomain.com/dashboard/

Application Deployment

1. Build Images (if using local registry)

# Build frontend
cd frontend
docker build -t photo-sharing-frontend:latest .

# Build backend
cd ../backend
docker build -t photo-sharing-backend:latest .

2. Deploy Application Stack

cd deploy/scripts
./deploy.sh

Options:

• --env FILE: Specify environment file
• --registry URL: Docker registry URL
• --version VERSION: Image version to deploy

3. Verify Deployment

# Check all services
docker service ls

# Check specific service
docker service ps photo-sharing_backend

# View logs
docker service logs photo-sharing_backend -f

4. Run Database Migrations

The deploy script automatically runs migrations, but you can run manually:

docker exec $(docker ps -q -f name=photo-sharing_backend) npm run migrate

CI/CD with Drone

1. Drone Server Setup

Deploy Drone server on your CI infrastructure:

docker run \
  --volume=/var/lib/drone:/data \
  --env=DRONE_GITHUB_CLIENT_ID=your-id \
  --env=DRONE_GITHUB_CLIENT_SECRET=your-secret \
  --env=DRONE_RPC_SECRET=your-rpc-secret \
  --env=DRONE_SERVER_HOST=drone.yourdomain.com \
  --env=DRONE_SERVER_PROTO=https \
  --publish=80:80 \
  --publish=443:443 \
  --restart=always \
  --detach=true \
  --name=drone \
  drone/drone:2

2. Drone Runner Setup

On build servers:

docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e DRONE_RPC_PROTO=https \
  -e DRONE_RPC_HOST=drone.yourdomain.com \
  -e DRONE_RPC_SECRET=your-rpc-secret \
  -e DRONE_RUNNER_CAPACITY=2 \
  -e DRONE_RUNNER_NAME=runner-1 \
  -p 3000:3000 \
  --restart always \
  --name runner \
  drone/drone-runner-docker:1

3. Repository Setup

1. Enable repository in Drone UI
2. Add secrets in Drone:
   • docker_username
   • docker_password
   • docker_registry
   • staging_swarm_host
   • staging_swarm_user
   • staging_swarm_key
   • prod_swarm_host
   • prod_swarm_user
   • prod_swarm_key
   • slack_webhook

4. Deployment Workflow

• Push to develop → Deploy to staging
• Create tag → Deploy to production
• Automatic rollback on failure

Monitoring

1. Deploy Monitoring Stack

cd deploy/monitoring

# Deploy monitoring services
docker stack deploy -c docker-compose.monitoring.yml monitoring

2. Access Services

• Grafana: https://grafana.yourdomain.com
• Prometheus: https://prometheus.yourdomain.com
• Alertmanager: https://alerts.yourdomain.com

3. Configure Alerts

Create alert rules in deploy/monitoring/alerts/:

groups:
  - name: photo-sharing
    rules:
      - alert: ServiceDown
        expr: up{job="photo-sharing-backend"} == 0
        for: 5m
        annotations:
          summary: "Photo sharing backend is down"

Backup and Recovery

1. Automated Backups

Set up cron job for automated backups:

# Edit crontab
crontab -e

# Add daily backup at 2 AM
0 2 * * * /opt/photo-sharing/deploy/scripts/backup.sh

2. Manual Backup

cd deploy/scripts
./backup.sh

3. Restore from Backup

# Extract backup
tar -xzf backup-20240615-020000.tar.gz

# Restore database
docker exec -i $(docker ps -q -f name=photo-sharing_db) \
  psql -U postgres photo_sharing < backup-20240615-020000/database.sql

# Restore photos
tar -xzf backup-20240615-020000/photos.tar.gz -C /opt/photo-sharing/

# Restore volumes
docker run --rm \
  -v photo-sharing_app-data:/data \
  -v $(pwd)/backup-20240615-020000:/backup \
  alpine tar -xzf /backup/volume-photo-sharing_app-data.tar.gz -C /data

Maintenance

1. Scaling Services

# Scale backend to 5 replicas
docker service scale photo-sharing_backend=5

# Scale frontend to 3 replicas
docker service scale photo-sharing_frontend=3

2. Rolling Updates

# Update backend image
docker service update \
  --image registry.yourdomain.com/photo-sharing-backend:v2.0 \
  photo-sharing_backend

3. Drain Node for Maintenance

# Drain node
docker node update --availability drain worker-1

# Perform maintenance...

# Activate node
docker node update --availability active worker-1

Troubleshooting

Common Issues

1. Service Won't Start

# Check service status
docker service ps photo-sharing_backend --no-trunc

# View detailed logs
docker service logs photo-sharing_backend --details

2. Database Connection Issues

# Check database logs
docker service logs photo-sharing_db

# Test connection
docker exec $(docker ps -q -f name=photo-sharing_db) \
  pg_isready -U postgres

3. Traefik Certificate Issues

# Check Traefik logs
docker service logs traefik_traefik | grep acme

# Remove and regenerate certificates
rm -rf /opt/traefik/letsencrypt/acme.json
docker service update --force traefik_traefik

4. Storage Issues

# Check disk usage
df -h

# Clean up Docker
docker system prune -a

Debug Mode

Enable debug logging:

# Update service with debug logging
docker service update \
  --env-add LOG_LEVEL=debug \
  photo-sharing_backend

Health Checks

# Check all endpoints
curl -f https://photos.yourdomain.com/health
curl -f https://api.photos.yourdomain.com/api/health
curl -f https://traefik.yourdomain.com/ping

Security Best Practices

1. Regular Updates

   • Keep Docker and system packages updated
   • Update application dependencies regularly
   • Monitor security advisories

2. Access Control

   • Use strong passwords for all services
   • Enable 2FA where possible
   • Restrict SSH access to specific IPs
   • Use Docker secrets for sensitive data

3. Network Security

   • Use internal networks for service communication
   • Enable firewall rules
   • Use TLS for all external communication
   • Regular security scans with Trivy

4. Backup Security

   • Encrypt backups at rest
   • Test restore procedures regularly
   • Store backups in multiple locations
   • Rotate old backups

Performance Tuning

1. Database Optimization

   -- Add indexes for common queries
   CREATE INDEX idx_photos_event_id ON photos(event_id);
   CREATE INDEX idx_access_logs_event_id ON access_logs(event_id);
   

2. Image Optimization

   • Use CDN for static assets
   • Enable aggressive caching
   • Optimize image sizes before upload

3. Service Limits

   deploy:
     resources:
       limits:
         cpus: '2'
         memory: 1G
       reservations:
         cpus: '0.5'
         memory: 256M
   

Support

For issues and questions:

• Check logs: docker service logs <service_name>
• Review documentation: README.md
• Check monitoring dashboards
• Contact: admin@yourdomain.com