Add PostgreSQL resource limits and migration setup

.github/workflows/docker-tag.yaml

@@ -11,9 +11,60 @@ permissions:
   id-token: write
 
 jobs:
-  build:
+  build-atlas-image:
     runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Login to Harbor Registry
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        with:
+          registry: registry.uniproject.jp
+          username: robot$github-publisher
+          password: ${{ secrets.HARBOR_TOKEN }}
+
+      - name: Add metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        with:
+          images: registry.uniproject.jp/infra/unibot-atlas
+          tags: |
+            type=raw,value=latest
+            type=sha,prefix=sha-,suffix=,format=short
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
 
+      - name: Build and Push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        with:
+          file: ./Dockerfile.atlas
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=registry,ref=registry.uniproject.jp/infra/unibot-atlas:buildcache
+          cache-to: type=registry,ref=registry.uniproject.jp/infra/unibot-atlas:buildcache,mode=max
+
+      - name: Sign Docker images with GitHub OIDC (cosign keyless)
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          COSIGN_EXPERIMENTAL: "true"
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images="${images}${tag}@${DIGEST} "
+          done
+
+          cosign sign --yes ${images}
+  build-target-image:
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
@@ -62,9 +113,6 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
-
       - name: Build and Push Docker image
         id: build-and-push
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6

Dockerfile.atlas

@@ -0,0 +1,5 @@
+FROM arigaio/atlas:1.3.1-distroless AS migration-prod
+WORKDIR /app
+COPY ./db/migrations/ /app/migrations
+COPY ./db/atlas.hcl /app/atlas.hcl
+CMD ["atlas", "migrate", "apply", "--env", "prod"]

Makefile

@@ -1,17 +1,17 @@
 .PHONY: migration-apply migration-diff schema-apply schema-lint
 
 migration-apply:
-	set -a && source .env && set +a && atlas migrate apply --env "local"
+	set -a && source .env && set +a && cd db && atlas migrate apply --env "local"
 migration-diff:
-	set -a && source .env && set +a && atlas migrate diff --env "local"
+	set -a && source .env && set +a && cd db && atlas migrate diff --env "local"
 migration-hash:
-	set -a && source .env && set +a && atlas migrate hash
+	set -a && source .env && set +a && cd db && atlas migrate hash
 schema-apply:
-	set -a && source .env && set +a && atlas schema apply --env "local"
+	set -a && source .env && set +a && cd db && atlas schema apply --env "local"
 schema-lint:
-	set -a && source .env && set +a && atlas schema lint --env "local"
+	set -a && source .env && set +a && cd db && atlas schema lint --env "local"
 db-clean:
-	set -a && source .env && set +a && atlas schema clean --env "local"
+	set -a && source .env && set +a && cd db && atlas schema clean --env "local"
 
 model-gen:
 	set -a && source .env && set +a && cd src && go run cmd/gen/main.go && cd ../ 

argoCD/base/deployment.yaml

@@ -1,6 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
   name: unibot
 spec:
   selector:
@@ -21,10 +23,6 @@ spec:
           env:
             - name: TZ
               value: Asia/Tokyo
-            # ロギング設定。秘密情報ではないためここで平文管理する。
-            # 明示的な env は envFrom より優先されるため、下記のキーは
-            # Secret 側に同名の値を置いても上書きされない。
-            # Secret で管理したくなった場合は、ここの定義を削除すること。
             - name: CONFIG_LOG_LEVEL
               value: "info"
             - name: CONFIG_LOG_FORMAT
@@ -33,11 +31,16 @@ spec:
               value: "warn"
             - name: CONFIG_LOG_DISCORD_LEVEL
               value: "notice"
-            # 未設定の間は Discord への通知が無効になるだけで、Bot は正常に動作する。
-            # 運用側でチャンネル ID を設定すること。
-            # - name: CONFIG_LOG_ERROR_CHANNEL_ID
-            #   value: ""
-            # - name: CONFIG_LOG_READY_CHANNEL_ID
-            #   value: ""
+            - name: CONFIG_LOG_READY_CHANNEL_ID
+              value: "1228574771856543835"
+            - name: CONFIG_LOG_ERROR_CHANNEL_ID
+              value: "1236638014919147570"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
       imagePullSecrets:
         - name: internal-harbor

argoCD/overlays/sub/atlas.yaml

@@ -0,0 +1,27 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: db-migration-job
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  backoffLimit: 0
+  completions: 1
+  parallelism: 1
+  template:
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+        - name: my-registry-secret
+      containers:
+        - name: db-migration-job
+          image: "registry.uniproject.jp/infra/unibot-atlas:latest"
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: unibot-env
+                key: PG_DSN
+    imagePullSecrets:
+      - name: internal-harbor

argoCD/overlays/sub/postgresql.yaml

@@ -26,10 +26,17 @@ spec:
           volumeMounts:
             - name: postgre-storage
               mountPath: /var/lib/postgresql
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
       volumes:
         - name: postgre-storage
           persistentVolumeClaim:
-            claimName: postgre-pvc
+            claimName: postgre-second-pvc
 ---
 apiVersion: v1
 kind: Service
@@ -47,7 +54,7 @@ spec:
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: postgre-pvc
+  name: postgre-second-pvc
 spec:
   accessModes:
     - ReadWriteOnce

db/atlas.hcl

@@ -0,0 +1,23 @@
+variable "pg_dsn" {
+    type    = string
+    default = getenv("PG_DSN")
+}
+
+env "local" {
+  url = getenv("PG_DSN")
+  dev = "docker://postgres/18/dev"
+  schema {
+    src = "file://schema"
+  }
+  migration {
+    dir =  "file://migrations"
+  }
+}
+
+env "prod" {
+    url = var.pg_dsn
+
+    migration {
+        dir     = "file://migrations"
+    }
+}