diff --git a/.github/workflows/docker-tag.yaml b/.github/workflows/docker-tag.yaml index 1aff0058..f09aa542 100644 --- a/.github/workflows/docker-tag.yaml +++ b/.github/workflows/docker-tag.yaml @@ -11,9 +11,60 @@ permissions: id-token: write jobs: - build: + build-atlas-image: runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + + - name: Login to Harbor Registry + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3 + with: + registry: registry.uniproject.jp + username: robot$github-publisher + password: ${{ secrets.HARBOR_TOKEN }} + + - name: Add metadata + id: meta + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5 + with: + images: registry.uniproject.jp/infra/unibot-atlas + tags: | + type=raw,value=latest + type=sha,prefix=sha-,suffix=,format=short + + - name: Install Cosign + uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3 + - name: Build and Push Docker image + id: build-and-push + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6 + with: + file: ./Dockerfile.atlas + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=registry,ref=registry.uniproject.jp/infra/unibot-atlas:buildcache + cache-to: type=registry,ref=registry.uniproject.jp/infra/unibot-atlas:buildcache,mode=max + + - name: Sign Docker images with GitHub OIDC (cosign keyless) + env: + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} + COSIGN_EXPERIMENTAL: "true" + run: | + images="" + for tag in ${TAGS}; do + images="${images}${tag}@${DIGEST} " + done + + cosign sign --yes ${images} + build-target-image: + runs-on: ubuntu-latest steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 @@ -62,9 +113,6 @@ jobs: - name: Install Cosign uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3 - - name: Set up QEMU - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3 - - name: Build and Push Docker image id: build-and-push uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6 diff --git a/Dockerfile.atlas b/Dockerfile.atlas new file mode 100644 index 00000000..f45ef8ec --- /dev/null +++ b/Dockerfile.atlas @@ -0,0 +1,5 @@ +FROM arigaio/atlas:1.3.1-distroless AS migration-prod +WORKDIR /app +COPY ./db/migrations/ /app/migrations +COPY ./db/atlas.hcl /app/atlas.hcl +CMD ["atlas", "migrate", "apply", "--env", "prod"] \ No newline at end of file diff --git a/Makefile b/Makefile index 78321022..eb87324a 100644 --- a/Makefile +++ b/Makefile @@ -1,17 +1,17 @@ .PHONY: migration-apply migration-diff schema-apply schema-lint migration-apply: - set -a && source .env && set +a && atlas migrate apply --env "local" + set -a && source .env && set +a && cd db && atlas migrate apply --env "local" migration-diff: - set -a && source .env && set +a && atlas migrate diff --env "local" + set -a && source .env && set +a && cd db && atlas migrate diff --env "local" migration-hash: - set -a && source .env && set +a && atlas migrate hash + set -a && source .env && set +a && cd db && atlas migrate hash schema-apply: - set -a && source .env && set +a && atlas schema apply --env "local" + set -a && source .env && set +a && cd db && atlas schema apply --env "local" schema-lint: - set -a && source .env && set +a && atlas schema lint --env "local" + set -a && source .env && set +a && cd db && atlas schema lint --env "local" db-clean: - set -a && source .env && set +a && atlas schema clean --env "local" + set -a && source .env && set +a && cd db && atlas schema clean --env "local" model-gen: set -a && source .env && set +a && cd src && go run cmd/gen/main.go && cd ../ diff --git a/argoCD/base/deployment.yaml b/argoCD/base/deployment.yaml index 012d326a..61c8fb0c 100644 --- a/argoCD/base/deployment.yaml +++ b/argoCD/base/deployment.yaml @@ -1,6 +1,8 @@ apiVersion: apps/v1 kind: Deployment metadata: + annotations: + argocd.argoproj.io/sync-wave: "2" name: unibot spec: selector: @@ -21,10 +23,6 @@ spec: env: - name: TZ value: Asia/Tokyo - # ロギング設定。秘密情報ではないためここで平文管理する。 - # 明示的な env は envFrom より優先されるため、下記のキーは - # Secret 側に同名の値を置いても上書きされない。 - # Secret で管理したくなった場合は、ここの定義を削除すること。 - name: CONFIG_LOG_LEVEL value: "info" - name: CONFIG_LOG_FORMAT @@ -33,11 +31,16 @@ spec: value: "warn" - name: CONFIG_LOG_DISCORD_LEVEL value: "notice" - # 未設定の間は Discord への通知が無効になるだけで、Bot は正常に動作する。 - # 運用側でチャンネル ID を設定すること。 - # - name: CONFIG_LOG_ERROR_CHANNEL_ID - # value: "" - # - name: CONFIG_LOG_READY_CHANNEL_ID - # value: "" + - name: CONFIG_LOG_READY_CHANNEL_ID + value: "1228574771856543835" + - name: CONFIG_LOG_ERROR_CHANNEL_ID + value: "1236638014919147570" + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi imagePullSecrets: - name: internal-harbor diff --git a/argoCD/overlays/sub/atlas.yaml b/argoCD/overlays/sub/atlas.yaml new file mode 100644 index 00000000..f162b785 --- /dev/null +++ b/argoCD/overlays/sub/atlas.yaml @@ -0,0 +1,27 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: db-migration-job + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation + argocd.argoproj.io/sync-wave: "-1" +spec: + backoffLimit: 0 + completions: 1 + parallelism: 1 + template: + spec: + restartPolicy: Never + imagePullSecrets: + - name: my-registry-secret + containers: + - name: db-migration-job + image: "registry.uniproject.jp/infra/unibot-atlas:latest" + imagePullPolicy: Always + envFrom: + - secretRef: + name: unibot-env + key: PG_DSN + imagePullSecrets: + - name: internal-harbor diff --git a/argoCD/overlays/sub/postgresql.yaml b/argoCD/overlays/sub/postgresql.yaml index 1aaa7eaa..20285be7 100644 --- a/argoCD/overlays/sub/postgresql.yaml +++ b/argoCD/overlays/sub/postgresql.yaml @@ -26,10 +26,17 @@ spec: volumeMounts: - name: postgre-storage mountPath: /var/lib/postgresql + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi volumes: - name: postgre-storage persistentVolumeClaim: - claimName: postgre-pvc + claimName: postgre-second-pvc --- apiVersion: v1 kind: Service @@ -47,7 +54,7 @@ spec: apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: postgre-pvc + name: postgre-second-pvc spec: accessModes: - ReadWriteOnce diff --git a/atlas.hcl b/atlas.hcl deleted file mode 100644 index 9f29f575..00000000 --- a/atlas.hcl +++ /dev/null @@ -1,10 +0,0 @@ -env "local" { - url = getenv("PG_DSN") - dev = "docker://postgres/18/dev" - schema { - src = "file://schema" - } - migration { - dir = "file://migrations" - } -} \ No newline at end of file diff --git a/db/atlas.hcl b/db/atlas.hcl new file mode 100644 index 00000000..5238b29d --- /dev/null +++ b/db/atlas.hcl @@ -0,0 +1,23 @@ +variable "pg_dsn" { + type = string + default = getenv("PG_DSN") +} + +env "local" { + url = getenv("PG_DSN") + dev = "docker://postgres/18/dev" + schema { + src = "file://schema" + } + migration { + dir = "file://migrations" + } +} + +env "prod" { + url = var.pg_dsn + + migration { + dir = "file://migrations" + } +} \ No newline at end of file diff --git a/migrations/20260805041044.sql b/db/migrations/20260805041044.sql similarity index 100% rename from migrations/20260805041044.sql rename to db/migrations/20260805041044.sql diff --git a/migrations/20260820085802.sql b/db/migrations/20260820085802.sql similarity index 100% rename from migrations/20260820085802.sql rename to db/migrations/20260820085802.sql diff --git a/migrations/atlas.sum b/db/migrations/atlas.sum similarity index 100% rename from migrations/atlas.sum rename to db/migrations/atlas.sum diff --git a/schema/all_schemas.pg.hcl b/db/schema/all_schemas.pg.hcl similarity index 100% rename from schema/all_schemas.pg.hcl rename to db/schema/all_schemas.pg.hcl diff --git a/schema/channels.pg.hcl b/db/schema/channels.pg.hcl similarity index 100% rename from schema/channels.pg.hcl rename to db/schema/channels.pg.hcl diff --git a/schema/functions.pg.hcl b/db/schema/functions.pg.hcl similarity index 100% rename from schema/functions.pg.hcl rename to db/schema/functions.pg.hcl diff --git a/schema/guilds.pg.hcl b/db/schema/guilds.pg.hcl similarity index 100% rename from schema/guilds.pg.hcl rename to db/schema/guilds.pg.hcl diff --git a/schema/members.pg.hcl b/db/schema/members.pg.hcl similarity index 100% rename from schema/members.pg.hcl rename to db/schema/members.pg.hcl diff --git a/schema/pin_settings.pg.hcl b/db/schema/pin_settings.pg.hcl similarity index 100% rename from schema/pin_settings.pg.hcl rename to db/schema/pin_settings.pg.hcl diff --git a/schema/remind_settings.pg.hcl b/db/schema/remind_settings.pg.hcl similarity index 100% rename from schema/remind_settings.pg.hcl rename to db/schema/remind_settings.pg.hcl diff --git a/schema/rss_settings.pg.hcl b/db/schema/rss_settings.pg.hcl similarity index 100% rename from schema/rss_settings.pg.hcl rename to db/schema/rss_settings.pg.hcl diff --git a/schema/system_preference.pg.hcl b/db/schema/system_preference.pg.hcl similarity index 100% rename from schema/system_preference.pg.hcl rename to db/schema/system_preference.pg.hcl diff --git a/schema/tts_connections.pg.hcl b/db/schema/tts_connections.pg.hcl similarity index 100% rename from schema/tts_connections.pg.hcl rename to db/schema/tts_connections.pg.hcl diff --git a/schema/tts_dictionary.pg.hcl b/db/schema/tts_dictionary.pg.hcl similarity index 100% rename from schema/tts_dictionary.pg.hcl rename to db/schema/tts_dictionary.pg.hcl diff --git a/schema/tts_member_preference.pg.hcl b/db/schema/tts_member_preference.pg.hcl similarity index 100% rename from schema/tts_member_preference.pg.hcl rename to db/schema/tts_member_preference.pg.hcl diff --git a/schema/tts_user_preference.pg.hcl b/db/schema/tts_user_preference.pg.hcl similarity index 100% rename from schema/tts_user_preference.pg.hcl rename to db/schema/tts_user_preference.pg.hcl diff --git a/schema/users.pg.hcl b/db/schema/users.pg.hcl similarity index 100% rename from schema/users.pg.hcl rename to db/schema/users.pg.hcl