picpeak/DEPLOYMENT.md

# Photo Sharing Platform - Production Deployment Guide

This guide covers deploying the photo sharing platform using Docker Swarm, Traefik, and Drone CI/CD.

## Table of Contents
- [Prerequisites](#prerequisites)
- [Infrastructure Setup](#infrastructure-setup)
- [Docker Swarm Setup](#docker-swarm-setup)
- [Traefik Setup](#traefik-setup)
- [Application Deployment](#application-deployment)
- [CI/CD with Drone](#cicd-with-drone)
- [Monitoring](#monitoring)
- [Backup and Recovery](#backup-and-recovery)
- [Troubleshooting](#troubleshooting)

## Prerequisites

### Hardware Requirements
- **Manager Node**: 2 CPU cores, 4GB RAM, 50GB storage
- **Worker Nodes**: 2 CPU cores, 2GB RAM, 20GB storage
- **Storage**: SSD recommended for database and photo storage

### Software Requirements
- Ubuntu 20.04+ or similar Linux distribution
- Docker Engine 20.10+
- Docker Compose 2.0+
- Git
- SSL certificates (automated with Let's Encrypt)

### Network Requirements
- Ports 80, 443 open for web traffic
- Port 2377 for Swarm management
- Ports 7946, 4789 for Swarm networking
- Static IP or reliable dynamic DNS

## Infrastructure Setup

### 1. Install Docker

```bash
# Install Docker
curl -fsSL https://get.docker.com | sh

# Add user to docker group
sudo usermod -aG docker $USER

# Enable Docker service
sudo systemctl enable docker
sudo systemctl start docker
```

### 2. Configure Firewall

```bash
# Allow Docker Swarm ports
sudo ufw allow 2377/tcp
sudo ufw allow 7946/tcp
sudo ufw allow 7946/udp
sudo ufw allow 4789/udp

# Allow web traffic
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
```

## Docker Swarm Setup

### 1. Initialize Swarm

On the manager node:

```bash
cd deploy/scripts
sudo ./init-swarm.sh
```

This script will:
- Initialize Docker Swarm
- Create overlay networks
- Label nodes for service placement
- Create required directories

### 2. Join Worker Nodes

On each worker node, run the join command displayed by the init script:

```bash
docker swarm join --token SWMTKN-1-xxx... manager-ip:2377
```

### 3. Verify Swarm

```bash
docker node ls
```

## Application Configuration

### 1. Environment Setup

```bash
# Copy environment template
cp .env.production.example .env.production

# Edit with your values
nano .env.production
```

Required configurations:
- Domain names for frontend, backend, and services
- SMTP credentials for email
- Database passwords
- JWT secrets

### 2. Create Docker Secrets

```bash
cd deploy/scripts
./create-secrets.sh
```

This will create all required secrets in Docker Swarm. Save the generated passwords!

## Traefik Setup

### 1. Deploy Traefik

```bash
cd deploy/traefik

# Create traefik network
docker network create --driver overlay traefik-public

# Deploy Traefik stack
docker stack deploy -c docker-compose.traefik.yml traefik
```

### 2. Verify Traefik

```bash
# Check service status
docker service ls | grep traefik

# View logs
docker service logs traefik_traefik
```

Access Traefik dashboard at: `https://traefik.yourdomain.com/dashboard/`

## Application Deployment

### 1. Build Images (if using local registry)

```bash
# Build frontend
cd frontend
docker build -t photo-sharing-frontend:latest .

# Build backend
cd ../backend
docker build -t photo-sharing-backend:latest .
```

### 2. Deploy Application Stack

```bash
cd deploy/scripts
./deploy.sh
```

Options:
- `--env FILE`: Specify environment file
- `--registry URL`: Docker registry URL
- `--version VERSION`: Image version to deploy

### 3. Verify Deployment

```bash
# Check all services
docker service ls

# Check specific service
docker service ps photo-sharing_backend

# View logs
docker service logs photo-sharing_backend -f
```

### 4. Run Database Migrations

The deploy script automatically runs migrations, but you can run manually:

```bash
docker exec $(docker ps -q -f name=photo-sharing_backend) npm run migrate
```

## CI/CD with Drone

### 1. Drone Server Setup

Deploy Drone server on your CI infrastructure:

```bash
docker run \
  --volume=/var/lib/drone:/data \
  --env=DRONE_GITHUB_CLIENT_ID=your-id \
  --env=DRONE_GITHUB_CLIENT_SECRET=your-secret \
  --env=DRONE_RPC_SECRET=your-rpc-secret \
  --env=DRONE_SERVER_HOST=drone.yourdomain.com \
  --env=DRONE_SERVER_PROTO=https \
  --publish=80:80 \
  --publish=443:443 \
  --restart=always \
  --detach=true \
  --name=drone \
  drone/drone:2
```

### 2. Drone Runner Setup

On build servers:

```bash
docker run -d \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e DRONE_RPC_PROTO=https \
  -e DRONE_RPC_HOST=drone.yourdomain.com \
  -e DRONE_RPC_SECRET=your-rpc-secret \
  -e DRONE_RUNNER_CAPACITY=2 \
  -e DRONE_RUNNER_NAME=runner-1 \
  -p 3000:3000 \
  --restart always \
  --name runner \
  drone/drone-runner-docker:1
```

### 3. Repository Setup

1. Enable repository in Drone UI
2. Add secrets in Drone:
   - `docker_username`
   - `docker_password`
   - `docker_registry`
   - `staging_swarm_host`
   - `staging_swarm_user`
   - `staging_swarm_key`
   - `prod_swarm_host`
   - `prod_swarm_user`
   - `prod_swarm_key`
   - `slack_webhook`

### 4. Deployment Workflow

- Push to `develop` → Deploy to staging
- Create tag → Deploy to production
- Automatic rollback on failure

## Monitoring

### 1. Deploy Monitoring Stack

```bash
cd deploy/monitoring

# Deploy monitoring services
docker stack deploy -c docker-compose.monitoring.yml monitoring
```

### 2. Access Services

- Grafana: `https://grafana.yourdomain.com`
- Prometheus: `https://prometheus.yourdomain.com`
- Alertmanager: `https://alerts.yourdomain.com`

### 3. Configure Alerts

Create alert rules in `deploy/monitoring/alerts/`:

```yaml
groups:
  - name: photo-sharing
    rules:
      - alert: ServiceDown
        expr: up{job="photo-sharing-backend"} == 0
        for: 5m
        annotations:
          summary: "Photo sharing backend is down"
```

## Backup and Recovery

### 1. Automated Backups

Set up cron job for automated backups:

```bash
# Edit crontab
crontab -e

# Add daily backup at 2 AM
0 2 * * * /opt/photo-sharing/deploy/scripts/backup.sh
```

### 2. Manual Backup

```bash
cd deploy/scripts
./backup.sh
```

### 3. Restore from Backup

```bash
# Extract backup
tar -xzf backup-20240615-020000.tar.gz

# Restore database
docker exec -i $(docker ps -q -f name=photo-sharing_db) \
  psql -U postgres photo_sharing < backup-20240615-020000/database.sql

# Restore photos
tar -xzf backup-20240615-020000/photos.tar.gz -C /opt/photo-sharing/

# Restore volumes
docker run --rm \
  -v photo-sharing_app-data:/data \
  -v $(pwd)/backup-20240615-020000:/backup \
  alpine tar -xzf /backup/volume-photo-sharing_app-data.tar.gz -C /data
```

## Maintenance

### 1. Scaling Services

```bash
# Scale backend to 5 replicas
docker service scale photo-sharing_backend=5

# Scale frontend to 3 replicas
docker service scale photo-sharing_frontend=3
```

### 2. Rolling Updates

```bash
# Update backend image
docker service update \
  --image registry.yourdomain.com/photo-sharing-backend:v2.0 \
  photo-sharing_backend
```

### 3. Drain Node for Maintenance

```bash
# Drain node
docker node update --availability drain worker-1

# Perform maintenance...

# Activate node
docker node update --availability active worker-1
```

## Troubleshooting

### Common Issues

#### 1. Service Won't Start
```bash
# Check service status
docker service ps photo-sharing_backend --no-trunc

# View detailed logs
docker service logs photo-sharing_backend --details
```

#### 2. Database Connection Issues
```bash
# Check database logs
docker service logs photo-sharing_db

# Test connection
docker exec $(docker ps -q -f name=photo-sharing_db) \
  pg_isready -U postgres
```

#### 3. Traefik Certificate Issues
```bash
# Check Traefik logs
docker service logs traefik_traefik | grep acme

# Remove and regenerate certificates
rm -rf /opt/traefik/letsencrypt/acme.json
docker service update --force traefik_traefik
```

#### 4. Storage Issues
```bash
# Check disk usage
df -h

# Clean up Docker
docker system prune -a
```

### Debug Mode

Enable debug logging:

```bash
# Update service with debug logging
docker service update \
  --env-add LOG_LEVEL=debug \
  photo-sharing_backend
```

### Health Checks

```bash
# Check all endpoints
curl -f https://photos.yourdomain.com/health
curl -f https://api.photos.yourdomain.com/api/health
curl -f https://traefik.yourdomain.com/ping
```

## Security Best Practices

1. **Regular Updates**
   - Keep Docker and system packages updated
   - Update application dependencies regularly
   - Monitor security advisories

2. **Access Control**
   - Use strong passwords for all services
   - Enable 2FA where possible
   - Restrict SSH access to specific IPs
   - Use Docker secrets for sensitive data

3. **Network Security**
   - Use internal networks for service communication
   - Enable firewall rules
   - Use TLS for all external communication
   - Regular security scans with Trivy

4. **Backup Security**
   - Encrypt backups at rest
   - Test restore procedures regularly
   - Store backups in multiple locations
   - Rotate old backups

## Performance Tuning

1. **Database Optimization**
   ```sql
   -- Add indexes for common queries
   CREATE INDEX idx_photos_event_id ON photos(event_id);
   CREATE INDEX idx_access_logs_event_id ON access_logs(event_id);
   ```

2. **Image Optimization**
   - Use CDN for static assets
   - Enable aggressive caching
   - Optimize image sizes before upload

3. **Service Limits**
   ```yaml
   deploy:
     resources:
       limits:
         cpus: '2'
         memory: 1G
       reservations:
         cpus: '0.5'
         memory: 256M
   ```

## Support

For issues and questions:
- Check logs: `docker service logs <service_name>`
- Review documentation: [README.md](README.md)
- Check monitoring dashboards
- Contact: admin@yourdomain.com