[IDLE-518] bastion서버를 통해 production 서버로 접근 후, 배포하도록 설정

[mjj111]

1. 📄 Summary

Bastion 서버를 통해 VPC private subnet에 속한 서버로 접근하여 배포하는 구조로 수정

2. ✏️ Documentation

• 기존 workflow YAML 파일에서 수정한 내용을 최소화하면서 배포 구조를 변경
• Bastion 서버를 경유하여 private subnet에 위치한 서버에 접근 및 배포 가능하도록 설정

3. 🤔 고민했던 점

• 기존 설정을 최대한 유지하며 변경 사항을 최소화하고자 했습니다.
• 배포 과정에서 CD 설정 누락으로 인한 이슈를 사전에 방지할 필요가 있었습니다.

4. 💡 알게된 점, 궁금한 점

• MySQL, Redis, EC2 서버들의 경우 내부에서 주로 사용되지만, 외부로 호출되는 경우가 많아 보안 관리가 어려웠던 점이 있었습니다.
• Bastion 서버를 통해 접근 구조를 변경함으로써 보안성이 향상되었으나, CD 과정에서 수정이 필요하다는 점을 간과했습니다.
• 이번 작업은 Bastion 서버를 활용한 배포 구조 구축 경험이 처음이라 새로운 학습이 많았습니다.

Summary by CodeRabbit

• 배포
  • 프로덕션 서버 배포 워크플로우 최적화
  • Docker 및 Docker Compose 설치 프로세스 간소화
  • SSH 기반 배포 방식으로 변경
  • 베스천 호스트를 통한 서버 접근 방식 개선

[coderabbitai]

워크스루

GitHub Actions 워크플로우 파일인 prod-server-deployer.yaml의 배포 단계가 크게 수정되었습니다. Docker 및 Docker Compose 설치 과정이 단일 SSH 명령으로 통합되었으며, 베스천 호스트를 통해 프로덕션 서버에 접속하는 방식으로 변경되었습니다. 배포 스크립트는 이제 더욱 간소화된 접근 방식을 채택하여 여러 명령을 단일 SSH 세션에서 실행합니다.

변경 사항

파일	변경 요약
.github/workflows/prod-server-deployer.yaml	- Docker 및 Docker Compose 설치 단계 통합 - 베스천 호스트를 통한 SSH 배포 프로세스 수정 - 환경 변수 구성 및 배포 명령 단일화

관련 가능성이 있는 PR

• [IDLE-000] 운영 환경 CD 스크립트 디버깅 #159: .github/workflows/prod-server-deployer.yaml 파일의 배포 프로세스 및 Docker 관리 관련 수정
• [IDLE-000] 배포 전 최종 수정사항 반영 #205: 배포 프로세스 업데이트와 관련된 변경 사항 포함

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

.github/workflows/prod-server-deployer.yaml (1)

95-95: YAML 파일 포맷 수정이 필요합니다.

파일 끝에 개행 문자가 없습니다. YAML 표준에 따라 파일 끝에 개행 문자를 추가해 주세요.

  --cidr ${{ steps.publicip.outputs.ip }}/32
+ 

🧰 Tools

🪛 yamllint (1.35.1)

[error] 95-95: no new line character at the end of file

(new-line-at-end-of-file)

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 274eb8f and de249a6.

📒 Files selected for processing (1)

• .github/workflows/prod-server-deployer.yaml (1 hunks)

🧰 Additional context used

🪛 yamllint (1.35.1)

.github/workflows/prod-server-deployer.yaml

[error] 95-95: no new line character at the end of file

(new-line-at-end-of-file)

⏰ Context from checks skipped due to timeout of 90000ms (1)

• GitHub Check: Build and analyze

[coderabbitai]

⚠️ Potential issue

배포 프로세스의 안정성 향상이 필요합니다.

현재 배포 스크립트에서 다음과 같은 개선이 필요합니다:

1. $IMAGE_TAG 변수가 정의되지 않았습니다.
2. 배포 후 컨테이너 상태 확인이 없습니다.
3. 이전 컨테이너의 백업 프로세스가 없습니다.
4. 컨테이너 이름과 포트가 하드코딩되어 있습니다.

다음과 같이 수정하는 것을 제안드립니다:

  ssh -o "ProxyJump=${{ vars.BASTION_HOST }}" -i ${{ secrets.INSTANCE_PEM_KEY }} ${{ vars.INSTANCE_USERNAME }}@${{ vars.INSTANCE_HOST }} << 'EOF'
+   set -e  # 오류 발생 시 스크립트 중단
+   
+   # 환경 변수 설정
+   CONTAINER_NAME="caremeet_server_prod"
+   IMAGE_TAG="${{ github.sha }}"  # 또는 적절한 태그 설정
+   
    sudo docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
    sudo docker pull public.ecr.aws/f5q3r6m5/idle-prod-ecr:$IMAGE_TAG
-   if [ $(sudo docker ps -q -f name=caremeet_server_prod) ]; then
+   
+   # 기존 컨테이너 백업
+   if [ $(sudo docker ps -q -f name=$CONTAINER_NAME) ]; then
+     echo "Backing up existing container..."
+     BACKUP_NAME="${CONTAINER_NAME}_backup_$(date +%Y%m%d_%H%M%S)"
+     sudo docker rename $CONTAINER_NAME $BACKUP_NAME
      sudo docker stop caremeet_server_prod
      sudo docker rm caremeet_server_prod
    fi
+   
+   # 새 컨테이너 실행
    sudo docker run --name caremeet_server_prod --env-file ./app/docker/.env \
    -e SPRING_PROFILES_ACTIVE=prod \
    -d -p 8080:8080 public.ecr.aws/f5q3r6m5/idle-prod-ecr:$IMAGE_TAG
+   
+   # 컨테이너 상태 확인
+   echo "Waiting for container to be healthy..."
+   sleep 10
+   if ! sudo docker ps | grep -q $CONTAINER_NAME; then
+     echo "Deployment failed. Rolling back..."
+     sudo docker start $BACKUP_NAME
+     exit 1
+   fi
+   
+   # 백업 컨테이너 정리
+   if [ -n "$BACKUP_NAME" ]; then
+     sudo docker rm $BACKUP_NAME
+   fi
  EOF

Committable suggestion skipped: line range outside the PR's diff.

[coderabbitai]

🛠️ Refactor suggestion

Docker 설치 프로세스 개선이 필요합니다.

다음 사항들을 고려해 주시기 바랍니다:

1. Docker Compose 버전(1.29.2)이 오래되었습니다. 최신 안정 버전을 사용하는 것이 좋습니다.
2. 설치 실패 시 에러 처리가 없습니다.
3. 설치 후 버전 확인이 필요합니다.

다음과 같이 수정하는 것을 제안드립니다:

  ssh -o "ProxyJump=${{ vars.BASTION_HOST }}" -i ${{ secrets.INSTANCE_PEM_KEY }} ${{ vars.INSTANCE_USERNAME }}@${{ vars.INSTANCE_HOST }} << 'EOF'
+   set -e  # 오류 발생 시 스크립트 중단
    if ! command -v docker >/dev/null 2>&1; then
      echo "Installing Docker..."
      sudo apt-get update
      sudo apt-get install -y docker.io
+     # 설치 확인
+     sudo docker --version || exit 1
    else
      echo "Docker already installed."
    fi
    if ! command -v docker-compose >/dev/null 2>&1; then
      echo "Installing Docker Compose..."
-     sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
+     COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep 'tag_name' | cut -d'"' -f4)
+     sudo curl -L "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
      sudo chmod +x /usr/local/bin/docker-compose
+     # 설치 확인
+     sudo docker-compose --version || exit 1
    else
      echo "Docker Compose already installed."
    fi
  EOF

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	- name: SSH to Bastion and Install Docker if not present on Production server
	uses: appleboy/ssh-action@v1.0.3
	with:
	host: ${{ vars.INSTANCE_HOST }}
	username: ${{ vars.INSTANCE_USERNAME }}
	host: ${{ vars.BASTION_HOST }}
	username: ${{ vars.BASTION_USERNAME }}
	key: ${{ secrets.INSTANCE_PEM_KEY }}
	script: |
	if ! command -v docker >/dev/null 2>&1; then
	echo "Installing Docker..."
	sudo apt-get update
	sudo apt-get install -y docker.io
	else
	echo "Docker already installed."
	fi
	if ! command -v docker-compose >/dev/null 2>&1; then
	echo "Installing Docker Compose..."
	sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
	sudo chmod +x /usr/local/bin/docker-compose
	else
	echo "Docker Compose already installed."
	fi
	- name: Configuration Env file
	uses: appleboy/ssh-action@master
	env:
	VARS_CONTEXT: ${{ toJson(vars) }}
	SECRETS_CONTEXT: ${{ toJson(secrets) }}
	with:
	host: ${{ vars.INSTANCE_HOST }}
	username: ${{ vars.INSTANCE_USERNAME }}
	key: ${{ secrets.INSTANCE_PEM_KEY }}
	envs: VARS_CONTEXT,SECRETS_CONTEXT
	script: |
	cd ~/app/docker
	jq -s '.[0] * .[1] | del(.INSTANCE_PEM_KEY)' <(echo "$VARS_CONTEXT") <(echo "$SECRETS_CONTEXT") \
	| jq -r 'to_entries | map("\(.key)=\(.value)") | .[]' > .env
	ssh -o "ProxyJump=${{ vars.BASTION_HOST }}" -i ${{ secrets.INSTANCE_PEM_KEY }} ${{ vars.INSTANCE_USERNAME }}@${{ vars.INSTANCE_HOST }} << 'EOF'
	if ! command -v docker >/dev/null 2>&1; then
	echo "Installing Docker..."
	sudo apt-get update
	sudo apt-get install -y docker.io
	else
	echo "Docker already installed."
	fi
	if ! command -v docker-compose >/dev/null 2>&1; then
	echo "Installing Docker Compose..."
	sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
	sudo chmod +x /usr/local/bin/docker-compose
	else
	echo "Docker Compose already installed."
	fi
	EOF
	- name: SSH to Bastion and Install Docker if not present on Production server
	uses: appleboy/ssh-action@v1.0.3
	with:
	host: ${{ vars.BASTION_HOST }}
	username: ${{ vars.BASTION_USERNAME }}
	key: ${{ secrets.INSTANCE_PEM_KEY }}
	script: |
	ssh -o "ProxyJump=${{ vars.BASTION_HOST }}" -i ${{ secrets.INSTANCE_PEM_KEY }} ${{ vars.INSTANCE_USERNAME }}@${{ vars.INSTANCE_HOST }} << 'EOF'
	set -e # 오류 발생 시 스크립트 중단
	if ! command -v docker >/dev/null 2>&1; then
	echo "Installing Docker..."
	sudo apt-get update
	sudo apt-get install -y docker.io
	# 설치 확인
	sudo docker --version || exit 1
	else
	echo "Docker already installed."
	fi
	if ! command -v docker-compose >/dev/null 2>&1; then
	echo "Installing Docker Compose..."
	COMPOSE_VERSION=$(curl -s https://api.github.com/repos/docker/compose/releases/latest | grep 'tag_name' | cut -d'"' -f4)
	sudo curl -L "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
	sudo chmod +x /usr/local/bin/docker-compose
	# 설치 확인
	sudo docker-compose --version || exit 1
	else
	echo "Docker Compose already installed."
	fi
	EOF

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.