Dev

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.gradle
+build/
+out/
+.env
+.idea
+*.log

.github/workflows/deploy.yml

@@ -0,0 +1,220 @@
+name: Deploy Reservation Service
+
+on:
+  push:
+    branches: [ "main", "dev" ]
+  workflow_dispatch:
+
+env:
+  GCP_PROJECT: ${{ vars.GCP_PROJECT_ID }}
+  GCP_ZONE: ${{ vars.GCP_ZONE }}
+  AR_IMAGE_PATH: ${{ vars.AR_IMAGE_PATH }}
+  VM_NAME: reservation-service
+  VM_USER: zsx1397
+  WORK_DIR: /home/zsx1397/app
+  HEALTH_RETRIES: 30
+  HEALTH_INTERVAL: 10
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      image_tag: ${{ steps.meta.outputs.tag }}
+      registry_host: ${{ steps.meta.outputs.registry_host }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Authenticate to GCP
+        id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+          project_id: ${{ env.GCP_PROJECT }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Resolve image metadata
+        id: meta
+        run: |
+          echo "tag=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+          echo "registry_host=$(echo "$AR_IMAGE_PATH" | cut -d/ -f1)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ steps.meta.outputs.registry_host }}
+          username: oauth2accesstoken
+          password: ${{ steps.auth.outputs.access_token }}
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.AR_IMAGE_PATH }}:${{ steps.meta.outputs.tag }}
+            ${{ env.AR_IMAGE_PATH }}:latest
+          secrets: |
+            GPR_USER=${{ secrets.GPR_USER }}
+            GPR_TOKEN=${{ secrets.GPR_TOKEN }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Authenticate to GCP
+        id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          token_format: access_token
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+          project_id: ${{ env.GCP_PROJECT }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v2
+
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/google_compute_engine
+          chmod 600 ~/.ssh/google_compute_engine
+          ssh-keygen -y -f ~/.ssh/google_compute_engine > ~/.ssh/google_compute_engine.pub
+          ssh-keyscan -H 34.64.247.238 >> ~/.ssh/known_hosts
+
+      - name: Check VM status
+        id: vm-status
+        run: |
+          STATUS=$(gcloud compute instances describe "$VM_NAME" \
+            --zone="$GCP_ZONE" \
+            --project="$GCP_PROJECT" \
+            --format="value(status)" 2>/dev/null || echo "NOT_FOUND")
+          echo "status=$STATUS" >> "$GITHUB_OUTPUT"
+
+      - name: Copy Config files
+        if: steps.vm-status.outputs.status == 'RUNNING'
+        run: |
+          gcloud compute scp deploy/docker-compose.prod.yaml \
+            "$VM_USER@$VM_NAME:/tmp/docker-compose.prod.yaml" \
+            --zone="$GCP_ZONE" --project="$GCP_PROJECT" --tunnel-through-iap --ssh-key-file=~/.ssh/google_compute_engine --scp-flag=-O --quiet
+
+          gcloud compute scp deploy/promtail-config.yml \
+            "$VM_USER@$VM_NAME:/tmp/promtail-config.yml" \
+            --zone="$GCP_ZONE" --project="$GCP_PROJECT" --tunnel-through-iap --ssh-key-file=~/.ssh/google_compute_engine --scp-flag=-O --quiet
+
+      - name: Copy Kafka truststore
+        if: steps.vm-status.outputs.status == 'RUNNING'
+        env:
+          KAFKA_TRUSTSTORE_JKS_BASE64: ${{ secrets.KAFKA_TRUSTSTORE_JKS_BASE64 }}
+        run: |
+          if [ -z "$KAFKA_TRUSTSTORE_JKS_BASE64" ]; then
+            exit 0
+          fi
+
+          printf '%s' "$KAFKA_TRUSTSTORE_JKS_BASE64" | base64 -d > kafka.server.truststore.jks
+
+          gcloud compute scp kafka.server.truststore.jks \
+            "$VM_USER@$VM_NAME:~/kafka.server.truststore.jks" \
+            --zone="$GCP_ZONE" \
+            --project="$GCP_PROJECT" \
+            --tunnel-through-iap \
+            --ssh-key-file=~/.ssh/google_compute_engine \
+            --scp-flag=-O \
+            --quiet
+
+          gcloud compute ssh "$VM_USER@$VM_NAME" \
+            --zone="$GCP_ZONE" \
+            --project="$GCP_PROJECT" \
+            --tunnel-through-iap \
+            --ssh-key-file=~/.ssh/google_compute_engine \
+            --quiet \
+            --command="
+              sudo chmod 755 /home/$VM_USER
+              sudo mkdir -p '$WORK_DIR/ssl'
+              sudo mkdir -p '$WORK_DIR/logs'
+              sudo chmod 755 '$WORK_DIR'
+
+              if [ -f ~/kafka.server.truststore.jks ]; then
+                sudo mv ~/kafka.server.truststore.jks '$WORK_DIR/ssl/kafka.server.truststore.jks'
+              fi
+
+              sudo chown -R 1000:1000 '$WORK_DIR/ssl'
+              sudo chown -R 1000:1000 '$WORK_DIR/logs'
+              sudo chmod 755 '$WORK_DIR/ssl'
+              sudo chmod 777 '$WORK_DIR/logs'
+              sudo chmod 644 '$WORK_DIR/ssl/kafka.server.truststore.jks'
+            "
+
+      - name: Deploy and verify
+        if: steps.vm-status.outputs.status == 'RUNNING'
+        env:
+          IMAGE_TAG: ${{ needs.build-and-push.outputs.image_tag }}
+          AR_TOKEN: ${{ steps.auth.outputs.access_token }}
+          REGISTRY_HOST: ${{ needs.build-and-push.outputs.registry_host }}
+        run: |
+          gcloud compute ssh "$VM_USER@$VM_NAME" \
+            --zone="$GCP_ZONE" \
+            --project="$GCP_PROJECT" \
+            --tunnel-through-iap \
+            --ssh-key-file=~/.ssh/google_compute_engine \
+            --quiet \
+            --command="
+              set -e
+
+              echo '$AR_TOKEN' | docker login -u oauth2accesstoken --password-stdin https://$REGISTRY_HOST
+
+              mkdir -p '$WORK_DIR'
+              [ -f /tmp/docker-compose.prod.yaml ] && mv /tmp/docker-compose.prod.yaml '$WORK_DIR/docker-compose.prod.yaml'
+              [ -f /tmp/promtail-config.yml ] && mv /tmp/promtail-config.yml '$WORK_DIR/promtail-config.yml'
+              cd '$WORK_DIR'
+
+              find . -mindepth 1 -maxdepth 1 ! -name '.env' ! -name 'ssl' ! -name 'logs' ! -name 'docker-compose.prod.yaml' ! -name 'promtail-config.yml' -exec rm -rf {} +
+
+              test -f .env || { exit 1; }
+
+              docker network inspect pgsg-network >/dev/null 2>&1 || docker network create pgsg-network
+
+              docker image prune -af || true
+
+              COMPOSE_CMD='docker compose'
+              if ! \$COMPOSE_CMD version >/dev/null 2>&1; then
+                COMPOSE_CMD='docker-compose'
+              fi
+
+              IMAGE_TAG='$IMAGE_TAG' AR_IMAGE_PATH='$AR_IMAGE_PATH' \$COMPOSE_CMD -f docker-compose.prod.yaml pull
+              IMAGE_TAG='$IMAGE_TAG' AR_IMAGE_PATH='$AR_IMAGE_PATH' \$COMPOSE_CMD -f docker-compose.prod.yaml up -d
+
+              for i in \$(seq 1 $HEALTH_RETRIES); do
+                if curl -sf http://localhost:8085/actuator/health | grep -q '\"status\":\"UP\"'; then
+                  docker ps
+                  exit 0
+                fi
+                sleep $HEALTH_INTERVAL
+              done
+
+              docker ps
+              docker logs reservation-service --tail=200
+              exit 1
+            "

.gitignore

@@ -0,0 +1,56 @@
+HELP.md
+.gradle
+**/build/
+**/out/
+**/bin/
+!gradle/wrapper/gradle-wrapper.jar
+!**/src/main/**/build/
+!**/src/test/**/build/
+.env
+.env.*
+
+# QueryDSL
+src/main/generated/
+**/generated/
+
+# Artifacts
+*.jar
+*.war
+
+### STS ###
+.apt_generated
+.classpath
+.factorypath
+.project
+.settings
+.springBeans
+.sts4-cache
+bin/
+!**/src/main/**/bin/
+!**/src/test/**/bin/
+
+### IntelliJ IDEA ###
+.idea
+*.iws
+*.iml
+*.ipr
+out/
+!**/src/main/**/out/
+!**/src/test/**/out/
+
+### NetBeans ###
+/nbproject/private/
+/nbbuild/
+/dist/
+/nbdist/
+/.nb-gradle/
+
+### VS Code ###
+.vscode/
+
+### Security & Certificates ###
+*.jks
+kafka.server.truststore.jks
+
+# Gradle credentials
+gradle.properties