chore: bump version to v0.0.28

Reviewed-on: #3

.dockerignore

@@ -6,6 +6,7 @@ planning
 deploy
 infra
 packages/admin
+!packages/admin/package.json
 Dockerfile*
 docker-compose*
 *.md

.gitea/workflows/build.yml

@@ -5,10 +5,18 @@ on:
     branches: [main]
   workflow_dispatch:
 
+concurrency:
+  group: build
+  cancel-in-progress: false
+
 jobs:
   build:
     runs-on: ubuntu-latest
     if: "!startsWith(github.event.head_commit.message, 'chore: bump version')"
+    env:
+      REGISTRY: registry.digitalocean.com/lunarfront
+      GIT_REMOTE: git.lunarfront.tech
+      DOCKER_HOST: tcp://localhost:2375
 
     steps:
       - name: Checkout
@@ -45,27 +53,8 @@ jobs:
           ")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
-      - name: Commit version bump
+      - name: Login to DOCR
-        run: |
+        run: echo "${{ secrets.DOCR_TOKEN }}" | docker login registry.digitalocean.com -u token --password-stdin
-          git config user.name "lunarfront-bot"
-          git config user.email "bot@lunarfront.tech"
-          git remote set-url origin https://lunarfront-bot:${{ secrets.BOT_TOKEN }}@git.lunarfront.tech/ryan/lunarfront-app.git
-          git add packages/backend/package.json
-          git commit -m "chore: bump version to v${{ steps.version.outputs.version }}"
-          git push origin main
-
-      - name: Install Docker CLI
-        run: |
-          apt-get update -qq
-          apt-get install -y ca-certificates curl
-          install -m 0755 -d /etc/apt/keyrings
-          curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-          echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list
-          apt-get update -qq
-          apt-get install -y docker-ce-cli
-
-      - name: Login to registry
-        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login registry.lunarfront.tech -u ryan --password-stdin
 
       - name: Build and push backend
         run: |
@@ -73,27 +62,53 @@ jobs:
           SHA=$(git rev-parse --short HEAD)
           docker build \
             --build-arg APP_VERSION=$VERSION \
-            -t registry.lunarfront.tech/ryan/lunarfront-app:$VERSION \
+            -t $REGISTRY/lunarfront-app:$VERSION \
-            -t registry.lunarfront.tech/ryan/lunarfront-app:$SHA \
+            -t $REGISTRY/lunarfront-app:$SHA \
-            -t registry.lunarfront.tech/ryan/lunarfront-app:latest \
+            -t $REGISTRY/lunarfront-app:latest \
             -f Dockerfile .
-          docker push registry.lunarfront.tech/ryan/lunarfront-app:$VERSION
+          docker push $REGISTRY/lunarfront-app:$VERSION
-          docker push registry.lunarfront.tech/ryan/lunarfront-app:$SHA
+          docker push $REGISTRY/lunarfront-app:$SHA
-          docker push registry.lunarfront.tech/ryan/lunarfront-app:latest
+          docker push $REGISTRY/lunarfront-app:latest
 
       - name: Build and push frontend
         run: |
           VERSION=${{ steps.version.outputs.version }}
           SHA=$(git rev-parse --short HEAD)
           docker build \
-            -t registry.lunarfront.tech/ryan/lunarfront-frontend:$VERSION \
+            -t $REGISTRY/lunarfront-frontend:$VERSION \
-            -t registry.lunarfront.tech/ryan/lunarfront-frontend:$SHA \
+            -t $REGISTRY/lunarfront-frontend:$SHA \
-            -t registry.lunarfront.tech/ryan/lunarfront-frontend:latest \
+            -t $REGISTRY/lunarfront-frontend:latest \
             -f Dockerfile.frontend .
-          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:$VERSION
+          docker push $REGISTRY/lunarfront-frontend:$VERSION
-          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:$SHA
+          docker push $REGISTRY/lunarfront-frontend:$SHA
-          docker push registry.lunarfront.tech/ryan/lunarfront-frontend:latest
+          docker push $REGISTRY/lunarfront-frontend:latest
+
+      - name: Install Helm
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+      - name: Package and push Helm chart
+        run: |
+          VERSION=${{ steps.version.outputs.version }}
+          # Update chart version to match app version
+          sed -i "s/^version:.*/version: $VERSION/" chart/Chart.yaml
+          sed -i "s/^appVersion:.*/appVersion: \"$VERSION\"/" chart/Chart.yaml
+          # Update default image tags in values.yaml to this version
+          sed -i "s|tag: latest|tag: $VERSION|g" chart/values.yaml
+          helm registry login registry.digitalocean.com -u token --password "${{ secrets.DOCR_TOKEN }}"
+          helm package chart/
+          helm push lunarfront-$VERSION.tgz oci://registry.digitalocean.com/lunarfront
+
+      - name: Commit version bump
+        run: |
+          git config user.name "lunarfront-bot"
+          git config user.email "bot@lunarfront.tech"
+          git remote set-url origin https://lunarfront-bot:${{ secrets.BOT_TOKEN }}@$GIT_REMOTE/ryan/lunarfront-app.git
+          git add packages/backend/package.json chart/Chart.yaml chart/values.yaml
+          git commit -m "chore: bump version to v${{ steps.version.outputs.version }}"
+          git pull --rebase origin main
+          git push origin main
 
       - name: Logout
         if: always()
-        run: docker logout registry.lunarfront.tech
+        run: docker logout registry.digitalocean.com

.gitea/workflows/ci.yml

@@ -1,8 +1,6 @@
 name: CI
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
   workflow_dispatch:
@@ -32,6 +30,8 @@ jobs:
   e2e:
     runs-on: ubuntu-latest
     needs: ci
+    env:
+      DOCKER_HOST: tcp://localhost:2375
 
     steps:
       - name: Checkout

Dockerfile

@@ -3,6 +3,7 @@ WORKDIR /app
 COPY package.json bun.lock ./
 COPY packages/shared/package.json packages/shared/
 COPY packages/backend/package.json packages/backend/
+COPY packages/admin/package.json packages/admin/
 RUN bun install --frozen-lockfile
 
 FROM oven/bun:1.3.11-alpine AS build
@@ -20,7 +21,7 @@ RUN bun build src/main.ts --compile --outfile /app/server \
   --define "process.env.APP_VERSION='${APP_VERSION}'"
 
 FROM alpine:3.21
-RUN addgroup -S app && adduser -S app -G app
+RUN apk add --no-cache libstdc++ && addgroup -S app && adduser -S app -G app
 WORKDIR /app
 COPY --from=build /app/server ./server
 COPY --from=build /app/packages/backend/src/db/migrations ./migrations

Dockerfile.frontend

@@ -3,6 +3,7 @@ WORKDIR /app
 COPY package.json bun.lock ./
 COPY packages/shared/package.json packages/shared/
 COPY packages/admin/package.json packages/admin/
+COPY packages/backend/package.json packages/backend/
 RUN bun install --frozen-lockfile
 
 FROM oven/bun:1.3.11-alpine AS build
@@ -19,6 +20,8 @@ RUN bun run build
 
 FROM nginx:alpine
 COPY --from=build /app/packages/admin/dist /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+# nginx docker image processes templates in /etc/nginx/templates/ with envsubst at startup
+COPY nginx.conf /etc/nginx/templates/default.conf.template
+ENV BACKEND_URL=http://localhost:8000
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]

Dockerfile.frontend.dockerignore

@@ -6,6 +6,7 @@ planning
 deploy
 infra
 packages/backend
+!packages/backend/package.json
 Dockerfile*
 docker-compose*
 *.md

chart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: lunarfront
+description: LunarFront small business management platform
+type: application
+version: 0.0.28
+appVersion: "0.0.28"

chart/templates/_helpers.tpl

@@ -0,0 +1,8 @@
+{{- define "lunarfront.name" -}}
+{{- .Release.Name }}
+{{- end }}
+
+{{- define "lunarfront.labels" -}}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}

chart/templates/backend-deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-backend
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-backend
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-backend
+    spec:
+      imagePullSecrets:
+        {{- toYaml .Values.imagePullSecrets | nindent 8 }}
+      containers:
+        - name: backend
+          image: "{{ .Values.backend.image.repository }}:{{ .Values.backend.image.tag }}"
+          imagePullPolicy: {{ .Values.backend.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.backend.port }}
+          env:
+            - name: PORT
+              value: {{ .Values.backend.port | quote }}
+            - name: NODE_ENV
+              value: production
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: database-url
+            - name: REDIS_URL
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: redis-url
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: lunarfront-secrets
+                  key: jwt-secret
+          livenessProbe:
+            httpGet:
+              path: /v1/health
+              port: {{ .Values.backend.port }}
+            initialDelaySeconds: 15
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /v1/health
+              port: {{ .Values.backend.port }}
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            {{- toYaml .Values.backend.resources | nindent 12 }}

chart/templates/backend-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-backend
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  selector:
+    app: {{ .Release.Name }}-backend
+  ports:
+    - port: {{ .Values.backend.port }}
+      targetPort: {{ .Values.backend.port }}

chart/templates/frontend-deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-frontend
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-frontend
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-frontend
+    spec:
+      imagePullSecrets:
+        {{- toYaml .Values.imagePullSecrets | nindent 8 }}
+      containers:
+        - name: frontend
+          image: "{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag }}"
+          imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.frontend.port }}
+          env:
+            - name: BACKEND_URL
+              value: "http://{{ .Release.Name }}-backend:{{ .Values.backend.port }}"
+          resources:
+            {{- toYaml .Values.frontend.resources | nindent 12 }}

chart/templates/frontend-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-frontend
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  selector:
+    app: {{ .Release.Name }}-frontend
+  ports:
+    - port: 80
+      targetPort: {{ .Values.frontend.port }}

chart/templates/ingress.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.ingress.host }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+  annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress.className }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.tlsIssuer }}
+spec:
+  ingressClassName: {{ .Values.ingress.className }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host }}
+      secretName: {{ .Release.Name }}-tls
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ .Release.Name }}-frontend
+                port:
+                  number: 80
+{{- end }}

chart/templates/valkey-deployment.yaml

@@ -0,0 +1,24 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-valkey
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-valkey
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-valkey
+    spec:
+      containers:
+        - name: valkey
+          image: "{{ .Values.valkey.image.repository }}:{{ .Values.valkey.image.tag }}"
+          ports:
+            - containerPort: {{ .Values.valkey.port }}
+          resources:
+            {{- toYaml .Values.valkey.resources | nindent 12 }}

chart/templates/valkey-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-valkey
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "lunarfront.labels" . | nindent 4 }}
+spec:
+  selector:
+    app: {{ .Release.Name }}-valkey
+  ports:
+    - port: {{ .Values.valkey.port }}
+      targetPort: {{ .Values.valkey.port }}

chart/values.yaml

@@ -0,0 +1,52 @@
+backend:
+  image:
+    repository: registry.digitalocean.com/lunarfront/lunarfront-app
+    tag: 0.0.27
+    pullPolicy: Always
+  port: 8000
+  resources:
+    requests:
+      cpu: 100m
+      memory: 256Mi
+    limits:
+      cpu: 1000m
+      memory: 512Mi
+
+frontend:
+  image:
+    repository: registry.digitalocean.com/lunarfront/lunarfront-frontend
+    tag: 0.0.27
+    pullPolicy: Always
+  port: 80
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 128Mi
+
+valkey:
+  image:
+    repository: valkey/valkey
+    tag: "8"
+  port: 6379
+  resources:
+    requests:
+      cpu: 50m
+      memory: 64Mi
+    limits:
+      cpu: 200m
+      memory: 128Mi
+
+ingress:
+  host: ""
+  className: nginx
+  tlsIssuer: letsencrypt
+
+imagePullSecrets:
+  - name: registry-lunarfront
+
+# Secrets are expected to exist in-namespace as 'lunarfront-secrets' with keys:
+#   database-url, jwt-secret, redis-url
+# These are created by the manager during provisioning, not by this chart.

nginx.conf

@@ -3,9 +3,9 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    # Proxy API and WebDAV to backend
+    # Proxy API and WebDAV to backend — BACKEND_URL injected at runtime via envsubst
     location /v1/ {
-        proxy_pass http://localhost:8000;
+        proxy_pass ${BACKEND_URL};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
@@ -14,7 +14,7 @@ server {
     }
 
     location /webdav/ {
-        proxy_pass http://localhost:8000;
+        proxy_pass ${BACKEND_URL};
         proxy_http_version 1.1;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;

packages/backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunarfront/backend",
-  "version": "0.0.1",
+  "version": "0.0.28",
   "private": true,
   "type": "module",
   "scripts": {