ci: Gitea Actions pipeline (build, deploy, health check)

.dockerignore

@@ -0,0 +1,8 @@
+node_modules
+.next
+out
+.git
+.gitignore
+*.md
+*.xlsx
+.gitea

.gitea/workflows/deploy.yml

@@ -0,0 +1,156 @@
+name: Build & Deploy SimO
+
+on:
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'tailwind.config.ts'
+      - 'next.config.mjs'
+      - 'postcss.config.js'
+      - 'tsconfig.json'
+      - 'Dockerfile'
+      - 'nginx.conf'
+      - 'docker-stack.yml'
+      - '.gitea/workflows/deploy.yml'
+  workflow_dispatch:
+
+env:
+  IMAGE_NAME: simo/web
+
+jobs:
+  build-and-deploy:
+    name: 🏗️ Build & Deploy
+    runs-on: ubuntu-latest
+    steps:
+      - name: 📥 Checkout code
+        uses: https://github.com/actions/checkout@v4
+
+      - name: 🔍 Debug - Check secrets
+        run: |
+          echo "SWARM_MANAGER_HOST length: ${#SWARM_MANAGER_HOST}"
+          echo "SWARM_USER length: ${#SWARM_USER}"
+          echo "SWARM_SSH_KEY length: ${#SWARM_SSH_KEY}"
+          if [ -z "$SWARM_MANAGER_HOST" ]; then echo "❌ SWARM_MANAGER_HOST is empty!"; fi
+          if [ -z "$SWARM_USER" ]; then echo "❌ SWARM_USER is empty!"; fi
+          if [ -z "$SWARM_SSH_KEY" ]; then echo "❌ SWARM_SSH_KEY is empty!"; fi
+        env:
+          SWARM_MANAGER_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+          SWARM_USER: ${{ secrets.SWARM_USER }}
+          SWARM_SSH_KEY: ${{ secrets.SWARM_SSH_KEY }}
+
+      - name: 🔐 Setup SSH
+        env:
+          SSH_KEY: ${{ secrets.SWARM_SSH_KEY }}
+          SSH_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$SSH_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H $SSH_HOST >> ~/.ssh/known_hosts
+
+      - name: 📦 Copy source to server
+        env:
+          SSH_USER: ${{ secrets.SWARM_USER }}
+          SSH_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+        run: |
+          tar -czf /tmp/source.tar.gz \
+            --exclude='node_modules' \
+            --exclude='.next' \
+            --exclude='out' \
+            --exclude='.git' \
+            .
+          scp -i ~/.ssh/deploy_key /tmp/source.tar.gz "$SSH_USER@$SSH_HOST":/tmp/simo-source.tar.gz
+          echo "✅ Source copied"
+
+      - name: 🐳 Build Docker Image
+        env:
+          SSH_USER: ${{ secrets.SWARM_USER }}
+          SSH_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+        run: |
+          COMMIT_SHA=$(git rev-parse --short HEAD)
+          echo "📌 Commit: $COMMIT_SHA"
+
+          ssh -i ~/.ssh/deploy_key ${SSH_USER}@${SSH_HOST} << ENDSSH
+            set -e
+            mkdir -p /tmp/simo-build
+            cd /tmp/simo-build
+            rm -rf *
+            tar -xzf /tmp/simo-source.tar.gz
+
+            echo "🐳 Building image: simo/web:$COMMIT_SHA"
+            docker build -t simo/web:$COMMIT_SHA \
+                         -t simo/web:latest .
+
+            echo "🧹 Cleaning old images..."
+            docker image prune -f
+
+            echo "✅ Image built: simo/web:$COMMIT_SHA"
+          ENDSSH
+
+      - name: 🚀 Deploy to Swarm
+        env:
+          SSH_USER: ${{ secrets.SWARM_USER }}
+          SSH_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+        run: |
+          COMMIT_SHA=$(git rev-parse --short HEAD)
+
+          scp -i ~/.ssh/deploy_key ./docker-stack.yml ${SSH_USER}@${SSH_HOST}:/tmp/simo-stack.yml
+
+          ssh -i ~/.ssh/deploy_key ${SSH_USER}@${SSH_HOST} << ENDSSH
+            set -e
+
+            echo "🚀 Deploying stack..."
+            IMAGE_TAG=$COMMIT_SHA docker stack deploy -c /tmp/simo-stack.yml simo
+
+            echo "🔄 Forcing service update..."
+            docker service update --force --image simo/web:$COMMIT_SHA simo_web
+
+            echo "⏳ Waiting for service to stabilize..."
+            sleep 10
+
+            echo "📊 Service status:"
+            docker service ls --filter name=simo
+            docker service ps simo_web --no-trunc
+
+            echo "✅ Deployment complete!"
+          ENDSSH
+
+      - name: 🏥 Health Check
+        env:
+          SSH_USER: ${{ secrets.SWARM_USER }}
+          SSH_HOST: ${{ secrets.SWARM_MANAGER_HOST }}
+        run: |
+          ssh -i ~/.ssh/deploy_key ${SSH_USER}@${SSH_HOST} << ENDSSH
+            echo "🏥 Running health check..."
+
+            for i in 1 2 3 4 5 6 7 8 9 10; do
+              STATUS=\$(curl -sf -o /dev/null -w "%{http_code}" https://simo.antopoid.com/ 2>/dev/null || echo "000")
+              if [ "\$STATUS" = "200" ]; then
+                echo "✅ SimO is live! (HTTP \$STATUS)"
+                echo "🌐 https://simo.antopoid.com"
+                exit 0
+              fi
+              echo "⏳ Waiting for SimO... (\$i/10) — HTTP \$STATUS"
+              sleep 5
+            done
+
+            echo "❌ Health check failed!"
+            echo ""
+            echo "📋 Service logs:"
+            docker service logs simo_web --tail 50
+            echo ""
+            echo "📊 Service tasks:"
+            docker service ps simo_web --no-trunc
+            exit 1
+          ENDSSH
+
+      - name: 🧹 Cleanup
+        if: always()
+        run: |
+          rm -f ~/.ssh/deploy_key
+          echo "✅ Pipeline finished!"

Dockerfile

@@ -0,0 +1,33 @@
+# ── Stage 1: Build ────────────────────────────────────────────────────────────
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# Installer les dépendances d'abord (cache Docker)
+COPY package*.json ./
+RUN npm ci
+
+# Copier le code source et builder
+COPY . .
+RUN npm run build
+
+# ── Stage 2: Production (nginx pour servir le static export) ─────────────────
+FROM nginx:alpine
+
+# Copier la config nginx personnalisée
+COPY nginx.conf /etc/nginx/conf.d/default.conf
+
+# Copier le build statique depuis le stage builder
+COPY --from=builder /app/out /usr/share/nginx/html
+
+# Script d'entrée
+COPY docker-entrypoint.sh /
+RUN chmod +x /docker-entrypoint.sh
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+  CMD wget -qO- http://localhost:3000/ || exit 1
+
+ENTRYPOINT ["/docker-entrypoint.sh"]
+CMD ["nginx", "-g", "daemon off;"]

docker-entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+# Vérifier que le build statique est présent
+if [ ! -f "/usr/share/nginx/html/index.html" ]; then
+    echo "ERREUR: Build statique non trouvé (index.html manquant) !"
+    exit 1
+fi
+
+# Compter les fichiers servis
+FILE_COUNT=$(find /usr/share/nginx/html -type f | wc -l)
+echo "──────────────────────────────────────────"
+echo "  SimO — Simulateur de prêt immobilier"
+echo "──────────────────────────────────────────"
+echo "  Fichiers statiques : ${FILE_COUNT}"
+echo "  Port              : 3000"
+echo "  Serveur           : nginx"
+echo "──────────────────────────────────────────"
+echo "Démarrage du serveur..."
+
+# Exécuter la commande par défaut (nginx)
+exec "$@"

docker-stack.yml

@@ -0,0 +1,33 @@
+version: '3.8'
+
+services:
+  web:
+    image: simo/web:${IMAGE_TAG:-latest}
+    expose:
+      - 3000
+    networks:
+      - traefik_traefikfront
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.simo.rule=Host(`simo.antopoid.com`)
+        - traefik.http.routers.simo.entrypoints=websecure
+        - traefik.http.routers.simo.tls.certresolver=myhttpchallenge
+        - traefik.http.services.simo.loadbalancer.server.port=3000
+        - traefik.http.middlewares.simo-proxy-headers.headers.customrequestheaders.X-Forwarded-For=
+        - traefik.http.routers.simo.middlewares=simo-proxy-headers
+        - traefik.http.services.simo.loadbalancer.passhostheader=true
+      placement:
+        constraints:
+          - "node.hostname==macmini"
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+      update_config:
+        parallelism: 1
+        delay: 10s
+        order: start-first
+
+networks:
+  traefik_traefikfront:
+    external: true

nginx.conf

@@ -0,0 +1,35 @@
+server {
+    listen 3000;
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # Compression gzip
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 6;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml text/javascript image/svg+xml;
+
+    # Cache statique long (JS/CSS hachés par Next.js)
+    location /_next/static/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # Cache modéré pour les autres assets
+    location ~* \.(ico|png|jpg|jpeg|gif|svg|webp|woff2?|ttf|eot)$ {
+        expires 30d;
+        add_header Cache-Control "public";
+    }
+
+    # SPA fallback : toutes les routes renvoient index.html
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Pas de log pour favicon/robots
+    location = /favicon.ico { log_not_found off; access_log off; }
+    location = /robots.txt  { log_not_found off; access_log off; }
+}