# 관련링크 - [재생목록](https://www.youtube.com/playlist?list=PLE0hRBClSk5ItEUO8ETeWAeLMh_X48uge) - [몰입코딩 - 글로그 CI/CD, fly.io, vercel - slog.gg/p/14077](https://slog.gg/p/14077#f) - [몰입코딩 - AWS, 테라폼, 스프링부트 CI/CD - slog.gg/p/14080](https://slog.gg/p/14080#f) - [몰입코딩 - HA PROXY - slog.gg/p/14082](https://slog.gg/p/14082#f) # 1강 - [25 03 17, p 14081, 1강, 기존 프로젝트 클론](https://youtu.be/EpZJLFhR3II) - [GITHUB REPOSITORY](https://github.com/jhs512/kp-2025-03-7--2) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/31617b6) # 2강 - [25 03 17, p 14081, 2강, application-secret.yml 복원, 스프링부트 버전 업데이트, 백/프론트 프로젝트 세팅](https://youtu.be/lU1DIpUKzN0) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/9b4b6ce) ## backend/src/main/resources/application-secret.yml ```yml spring: security: oauth2: client: registration: kakao: clientId: NEED_TO_INPUT naver: clientId: NEED_TO_INPUT clientSecret: NEED_TO_INPUT custom: prod: db: password: NEED_TO_INPUT jwt: secretKey: NEED_TO_INPUT ``` # 3강 - [25 03 17, p 14081, 3강, 운영환경에서 PostgreSQL이 아닌 MySQL 사용하도록 설정](https://youtu.be/aMX1CG-PvUo) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/7418b64) ## backend/src/main/resources/application-prod.yml ```yml spring: datasource: url: jdbc:mysql://mysql_1:3306/glog_prod username: lldjlocal password: ${custom.prod.db.password} driver-class-name: com.mysql.cj.jdbc.Driver hikari: auto-commit: false jpa: hibernate: ddl-auto: update properties: hibernate: format_sql: false highlight_sql: false use_sql_comments: false logging: level: com.back: INFO org.hibernate.SQL: INFO org.hibernate.orm.jdbc.bind: INFO org.hibernate.orm.jdbc.extract: INFO org.springframework.transaction.interceptor: INFO custom: site: cookieDomain: "${custom.prod.cookieDomain}" frontUrl: "${custom.prod.frontUrl}" backUrl: "${custom.prod.backUrl}" genFile: dirPath: /gen ``` # 4강 - [25 03 18, p 14081, 4강, 수동으로 인프라 자원 제거방법, infra 폴더에 테라폼 스크립트 추가 및 실행](https://youtu.be/AS-gL06-LtE) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/b64488b) ## 체크 - 리전이 한국인지 확인 - 인스턴스 프로파일 삭제 - aws iam delete-instance-profile --instance-profile-name 인스턴스-프로파일-명 - EX : aws iam delete-instance-profile --instance-profile-name dev-instance-profile-1 - IAM 역할 `ec2_role_1` 삭제 - VPC 삭제 - EC2 삭제 - S3 버킷 삭제 ## infra/variables.tf ```hcl variable "prefix" { description = "Prefix for all resources" default = "dev" } variable "region" { description = "region" default = "ap-northeast-2" } variable "nickname" { description = "nickname" default = "jhs512" } ``` ## infra/secrets.tf ```hcl variable "password_1" { description = "password_1" default = "NEED_TO_INPUT" } variable "github_access_token_1" { description = "github_access_token_1, read:packages only" default = "NEED_TO_INPUT" } variable "github_access_token_1_owner" { description = "github_access_token_1_owner" default = "NEED_TO_INPUT" } ``` ## infra/main.tf ```hcl terraform { // aws 라이브러리 불러옴 required_providers { aws = { source = "hashicorp/aws" } } } # AWS 설정 시작 provider "aws" { region = var.region } # AWS 설정 끝 # VPC 설정 시작 resource "aws_vpc" "vpc_1" { cidr_block = "10.0.0.0/16" enable_dns_support = true enable_dns_hostnames = true tags = { Name = "${var.prefix}-vpc-1" } } resource "aws_subnet" "subnet_1" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.1.0/24" availability_zone = "${var.region}a" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-1" } } resource "aws_subnet" "subnet_2" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.2.0/24" availability_zone = "${var.region}b" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-2" } } resource "aws_subnet" "subnet_3" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.3.0/24" availability_zone = "${var.region}c" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-3" } } resource "aws_subnet" "subnet_4" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.4.0/24" availability_zone = "${var.region}d" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-4" } } resource "aws_internet_gateway" "igw_1" { vpc_id = aws_vpc.vpc_1.id tags = { Name = "${var.prefix}-igw-1" } } resource "aws_route_table" "rt_1" { vpc_id = aws_vpc.vpc_1.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.igw_1.id } tags = { Name = "${var.prefix}-rt-1" } } resource "aws_route_table_association" "association_1" { subnet_id = aws_subnet.subnet_1.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_2" { subnet_id = aws_subnet.subnet_2.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_3" { subnet_id = aws_subnet.subnet_3.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_4" { subnet_id = aws_subnet.subnet_4.id route_table_id = aws_route_table.rt_1.id } resource "aws_security_group" "sg_1" { name = "${var.prefix}-sg-1" ingress { from_port = 0 to_port = 0 protocol = "all" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "all" cidr_blocks = ["0.0.0.0/0"] } vpc_id = aws_vpc.vpc_1.id tags = { Name = "${var.prefix}-sg-1" } } # EC2 설정 시작 # EC2 역할 생성 resource "aws_iam_role" "ec2_role_1" { name = "${var.prefix}-ec2-role-1" # 이 역할에 대한 신뢰 정책 설정. EC2 서비스가 이 역할을 가정할 수 있도록 설정 assume_role_policy = <> /etc/fstab' # 도커 설치 및 실행/활성화 yum install docker -y systemctl enable docker systemctl start docker # 도커 네트워크 생성 docker network create common # nginx 설치 docker run -d \ --name npm_1 \ --restart unless-stopped \ --network common \ -p 80:80 \ -p 443:443 \ -p 81:81 \ -e TZ=Asia/Seoul \ -v /dockerProjects/npm_1/volumes/data:/data \ -v /dockerProjects/npm_1/volumes/etc/letsencrypt:/etc/letsencrypt \ jc21/nginx-proxy-manager:latest # redis 설치 docker run -d \ --name=redis_1 \ --restart unless-stopped \ --network common \ -p 6379:6379 \ -e TZ=Asia/Seoul \ redis --requirepass ${var.password_1} # mysql 설치 docker run -d \ --name mysql_1 \ --restart unless-stopped \ -v /dockerProjects/mysql_1/volumes/var/lib/mysql:/var/lib/mysql \ -v /dockerProjects/mysql_1/volumes/etc/mysql/conf.d:/etc/mysql/conf.d \ --network common \ -p 3306:3306 \ -e MYSQL_ROOT_PASSWORD=${var.password_1} \ -e TZ=Asia/Seoul \ mysql:latest # MySQL 컨테이너가 준비될 때까지 대기 echo "MySQL이 기동될 때까지 대기 중..." until docker exec mysql_1 mysql -uroot -p${var.password_1} -e "SELECT 1" &> /dev/null; do echo "MySQL이 아직 준비되지 않음. 5초 후 재시도..." sleep 5 done echo "MySQL이 준비됨. 초기화 스크립트 실행 중..." docker exec mysql_1 mysql -uroot -p${var.password_1} -e " CREATE USER 'lldjlocal'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '1234'; CREATE USER 'lldjlocal'@'172.18.%.%' IDENTIFIED WITH caching_sha2_password BY '1234'; CREATE USER 'lldj'@'%' IDENTIFIED WITH caching_sha2_password BY '${var.password_1}'; GRANT ALL PRIVILEGES ON *.* TO 'lldjlocal'@'127.0.0.1'; GRANT ALL PRIVILEGES ON *.* TO 'lldjlocal'@'172.18.%.%'; GRANT ALL PRIVILEGES ON *.* TO 'lldj'@'%'; CREATE DATABASE glog_prod; FLUSH PRIVILEGES; " echo "${var.github_access_token_1}" | docker login ghcr.io -u ${var.github_access_token_1_owner} --password-stdin END_OF_FILE } # 최신 Amazon Linux 2023 AMI 조회 (프리 티어 호환) data "aws_ami" "latest_amazon_linux" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["al2023-ami-2023.*-x86_64"] } filter { name = "architecture" values = ["x86_64"] } filter { name = "virtualization-type" values = ["hvm"] } filter { name = "root-device-type" values = ["ebs"] } } # EC2 인스턴스 생성 resource "aws_instance" "ec2_1" { # 사용할 AMI ID ami = data.aws_ami.latest_amazon_linux.id # EC2 인스턴스 유형 instance_type = "t3.micro" # 사용할 서브넷 ID subnet_id = aws_subnet.subnet_4.id # 적용할 보안 그룹 ID vpc_security_group_ids = [aws_security_group.sg_1.id] # 퍼블릭 IP 연결 설정 associate_public_ip_address = true # 인스턴스에 IAM 역할 연결 iam_instance_profile = aws_iam_instance_profile.instance_profile_1.name # 인스턴스에 태그 설정 tags = { Name = "${var.prefix}-ec2-1" } # 루트 볼륨 설정 root_block_device { volume_type = "gp3" volume_size = 12 # 볼륨 크기를 12GB로 설정 } user_data = <<-EOF ${local.ec2_user_data_base} EOF } ``` # 5강 - [25 03 18, p 14081, 5강, .github/workflows/deploy.yml 파일내용을 fly.io 방식에서 aws 방식으로 교체](https://youtu.be/YQYZWFr1EZc) ## GITHUB ACTION 에서 해당 리포지터리에 대해서 쓰기 권한 가지도록 - ![img](https://i.imgur.com/H7MFm4p.png) ## 리포지터리 세팅에서 APPLICATION_SECRET_YML 시크릿 변수 생성 - ![img](https://i.postimg.cc/SNcrW0Nr/image.png) ## 리포지터리 세팅에서 AWS_REGION, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY 시크릿 변수 생성 - AWS_REGION : `ap-northeast-2` - AWS_ACCESS_KEY_ID : `AWS_ACCESS_KEY_ID 입력` - AWS_SECRET_ACCESS_KEY : `AWS_SECRET_ACCESS_KEY 입력` - ![img](https://i.postimg.cc/JzS1nBmK/image.png) ## 도커 이미지가 생성되면 해당 페키지에 접속해서 공개상태를 private 로 수정 - [https://github.com/users/jhs512/packages/container/app20250318/settings](https://github.com/users/jhs512/packages/container/app20250318/settings) - ![img](https://i.postimg.cc/TwXHNTqT/image.png) ## 기존(fly.io 배포방식) .github/workflows/deploy.yml ```yml name: "deploy" on: push: paths: - ".github/workflows/**" - "backend/fly.toml" - "backend/src/**" - "backend/build.gradle.kts" - "backend/settings.gradle.kts" - "backend/Dockerfile" branches: - "main" jobs: deploy: name: Deploy app runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: application-secret.yml 생성 env: APPLICATION_SECRET: ${{ secrets.APPLICATION_SECRET_YML }} run: echo "$APPLICATION_SECRET" > backend/src/main/resources/application-secret.yml - uses: superfly/flyctl-actions/setup-flyctl@master - run: flyctl deploy --remote-only working-directory: backend env: FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} ``` ## 변경(aws 배포방식) .github/workflows/deploy.yml ```yml name: deploy on: push: paths: - ".github/workflows/**" - "backend/src/**" - "backend/build.gradle.kts" - "backend/settings.gradle.kts" - "backend/Dockerfile" branches: - main jobs: makeTagAndRelease: runs-on: ubuntu-latest outputs: tag_name: ${{ steps.create_tag.outputs.new_tag }} steps: - uses: actions/checkout@v4 - name: Create Tag id: create_tag uses: mathieudutour/github-tag-action@v6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Create Release id: create_release uses: actions/create-release@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: tag_name: ${{ steps.create_tag.outputs.new_tag }} release_name: Release ${{ steps.create_tag.outputs.new_tag }} body: ${{ steps.create_tag.outputs.changelog }} draft: false prerelease: false buildImageAndPush: name: 도커 이미지 빌드와 푸시 needs: makeTagAndRelease runs-on: ubuntu-latest env: DOCKER_IMAGE_NAME: app20250318 outputs: DOCKER_IMAGE_NAME: ${{ env.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ env.OWNER_LC }} steps: - uses: actions/checkout@v4 - name: application-secret.yml 생성 env: APPLICATION_SECRET: ${{ secrets.APPLICATION_SECRET_YML }} run: echo "$APPLICATION_SECRET" > backend/src/main/resources/application-secret.yml - name: Docker Buildx 설치 uses: docker/setup-buildx-action@v2 - name: 레지스트리 로그인 uses: docker/login-action@v2 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: set lower case owner name run: | echo "OWNER_LC=${OWNER,,}" >> ${GITHUB_ENV} env: OWNER: "${{ github.repository_owner }}" - name: 빌드 앤 푸시 uses: docker/build-push-action@v3 with: context: backend push: true cache-from: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache cache-to: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache,mode=max tags: | ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:${{ needs.makeTagAndRelease.outputs.tag_name }}, ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest deploy: runs-on: ubuntu-latest needs: [buildImageAndPush] env: DOCKER_IMAGE_NAME: ${{ needs.buildImageAndPush.outputs.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ needs.buildImageAndPush.outputs.OWNER_LC }} steps: - uses: aws-actions/configure-aws-credentials@v4 with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: 인스턴스 ID 가져오기 id: get_instance_id run: | INSTANCE_ID=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=dev-ec2-1" "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].InstanceId" --output text) echo "INSTANCE_ID=$INSTANCE_ID" >> $GITHUB_ENV echo $INSTANCE_ID - name: AWS SSM Send-Command uses: peterkimzz/aws-ssm-send-command@master id: ssm with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} instance-ids: ${{ env.INSTANCE_ID }} working-directory: / comment: Deploy command: | docker pull ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest docker stop app1 2>/dev/null docker rm app1 2>/dev/null docker run -d --network common --name app1 -p 8080:8080 ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest docker rmi $(docker images -f "dangling=true" -q) ``` ## 확인 - [http://3.38.218.158:8080](http://3.38.218.158:8080) # 6강 - [25 03 18, p 14081, 6강, 홈 컨트롤러의 main 함수 변경 작업 후 PUSH 만으로 CI/CD가 완벽히 돌아가는지 테스트, 잘 됩니다.](https://youtu.be/jZd8dHXnOEs) ## 확인 - [http://3.38.218.158:8080](http://3.38.218.158:8080) # 7강 - [25 03 18, p 14081, 7강, DNSZI 에서 A 레코드 작업, NPM을 통해서 리버스 프록시/HTTPS 설정](https://youtu.be/VG-9V94dhB0) ## NPM으로 리버스 프록시 - ![img](https://i.postimg.cc/Cx6JxhT4/image.png) ## NPM으로 HTTPS 설정 - ![img](https://i.postimg.cc/q7PL217h/image.png) ## DNSZI 에서 A 레코드 등록 - 도메인 : api.glog.oa.gg - IP : 1st-ec2-public-ip - EX : 3.38.218.158 ## nginx proxy manager 관리콘솔에 접속 - [http://3.38.218.158:81](http://3.38.218.158:81) - 초기 계정 - 아이디 : admin@example.com - 비번 : changeme # 8강 - [25 03 18, p 14081, 8강, vercel에 프로젝트 생성](https://youtu.be/qjMfmZAq73c) - [기본 도메인 - kp-2025-03-7-2.vercel.app](https://kp-2025-03-7-2.vercel.app) ## Build and Output Settings - `Install Command : npm install --legacy-peer-deps` ## 확인 - [https://kp-2025-03-7-2.vercel.app](https://kp-2025-03-7-2.vercel.app) # 9강 - [25 03 18, p 14081, 9강, 도메인 연결](https://youtu.be/YP-YukFw8bI) ## 프로젝트에 도메인 연결 - ![img](https://i.postimg.cc/2S8pqw72/image.png) ## DNSZI 에서 CNAME 등록 - CNAME(별명) : www.glog.oa.gg - 목적지(연결) 도메인 : cname.vercel-dns.com ## 확인 - [https://www.glog.oa.gg](https://www.glog.oa.gg) # 10강 - [25 03 18, p 14081, 10강, 도커 컨테이너가 교체되어도 사용자가 업로드한 파일이 유지되도록 마운트 설정 추가](https://youtu.be/DkE79Fs61XQ) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/8edc226) ## .github/workflows/deploy.yml ```yml name: deploy on: push: paths: - ".github/workflows/**" - "backend/src/**" - "backend/build.gradle.kts" - "backend/settings.gradle.kts" - "backend/Dockerfile" branches: - main jobs: makeTagAndRelease: runs-on: ubuntu-latest outputs: tag_name: ${{ steps.create_tag.outputs.new_tag }} steps: - uses: actions/checkout@v4 - name: Create Tag id: create_tag uses: mathieudutour/github-tag-action@v6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Create Release id: create_release uses: actions/create-release@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: tag_name: ${{ steps.create_tag.outputs.new_tag }} release_name: Release ${{ steps.create_tag.outputs.new_tag }} body: ${{ steps.create_tag.outputs.changelog }} draft: false prerelease: false buildImageAndPush: name: 도커 이미지 빌드와 푸시 needs: makeTagAndRelease runs-on: ubuntu-latest env: DOCKER_IMAGE_NAME: app20250318 outputs: DOCKER_IMAGE_NAME: ${{ env.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ env.OWNER_LC }} steps: - uses: actions/checkout@v4 - name: application-secret.yml 생성 env: APPLICATION_SECRET: ${{ secrets.APPLICATION_SECRET_YML }} run: echo "$APPLICATION_SECRET" > backend/src/main/resources/application-secret.yml - name: Docker Buildx 설치 uses: docker/setup-buildx-action@v2 - name: 레지스트리 로그인 uses: docker/login-action@v2 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: set lower case owner name run: | echo "OWNER_LC=${OWNER,,}" >> ${GITHUB_ENV} env: OWNER: "${{ github.repository_owner }}" - name: 빌드 앤 푸시 uses: docker/build-push-action@v3 with: context: backend push: true cache-from: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache cache-to: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache,mode=max tags: | ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:${{ needs.makeTagAndRelease.outputs.tag_name }}, ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest deploy: runs-on: ubuntu-latest needs: [buildImageAndPush] env: DOCKER_IMAGE_NAME: ${{ needs.buildImageAndPush.outputs.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ needs.buildImageAndPush.outputs.OWNER_LC }} steps: - uses: aws-actions/configure-aws-credentials@v4 with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: 인스턴스 ID 가져오기 id: get_instance_id run: | INSTANCE_ID=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=dev-ec2-1" "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].InstanceId" --output text) echo "INSTANCE_ID=$INSTANCE_ID" >> $GITHUB_ENV echo $INSTANCE_ID - name: AWS SSM Send-Command uses: peterkimzz/aws-ssm-send-command@master id: ssm with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} instance-ids: ${{ env.INSTANCE_ID }} working-directory: / comment: Deploy command: | docker pull ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest docker stop app1 2>/dev/null docker rm app1 2>/dev/null docker run -d -v /gen:/gen --network common --name app1 -p 8080:8080 ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest # -v /gen:/gen 추가하여 업로드한 파일이 컨테이너가 교체되도 유지되도록 docker rmi $(docker images -f "dangling=true" -q) ``` # 11강 - [25 03 21, p 14081, 11강, 모든 AWS 자원 삭제 후 HA PROXY 까지 포함하여 자원 재생성, deploy.yml 에서 ha-proxy/health check 적용하여 무중단 배포 달성](https://youtu.be/78Rizzsgzuk) - [커밋](https://github.com/jhs512/kp-2025-03-7--2/commit/a92861f) ## infra/main.tf ```hcl terraform { // aws 라이브러리 불러옴 required_providers { aws = { source = "hashicorp/aws" } } } # AWS 설정 시작 provider "aws" { region = var.region } # AWS 설정 끝 # VPC 설정 시작 resource "aws_vpc" "vpc_1" { cidr_block = "10.0.0.0/16" enable_dns_support = true enable_dns_hostnames = true tags = { Name = "${var.prefix}-vpc-1" } } resource "aws_subnet" "subnet_1" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.1.0/24" availability_zone = "${var.region}a" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-1" } } resource "aws_subnet" "subnet_2" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.2.0/24" availability_zone = "${var.region}b" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-2" } } resource "aws_subnet" "subnet_3" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.3.0/24" availability_zone = "${var.region}c" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-3" } } resource "aws_subnet" "subnet_4" { vpc_id = aws_vpc.vpc_1.id cidr_block = "10.0.4.0/24" availability_zone = "${var.region}d" map_public_ip_on_launch = true tags = { Name = "${var.prefix}-subnet-4" } } resource "aws_internet_gateway" "igw_1" { vpc_id = aws_vpc.vpc_1.id tags = { Name = "${var.prefix}-igw-1" } } resource "aws_route_table" "rt_1" { vpc_id = aws_vpc.vpc_1.id route { cidr_block = "0.0.0.0/0" gateway_id = aws_internet_gateway.igw_1.id } tags = { Name = "${var.prefix}-rt-1" } } resource "aws_route_table_association" "association_1" { subnet_id = aws_subnet.subnet_1.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_2" { subnet_id = aws_subnet.subnet_2.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_3" { subnet_id = aws_subnet.subnet_3.id route_table_id = aws_route_table.rt_1.id } resource "aws_route_table_association" "association_4" { subnet_id = aws_subnet.subnet_4.id route_table_id = aws_route_table.rt_1.id } resource "aws_security_group" "sg_1" { name = "${var.prefix}-sg-1" ingress { from_port = 0 to_port = 0 protocol = "all" cidr_blocks = ["0.0.0.0/0"] } egress { from_port = 0 to_port = 0 protocol = "all" cidr_blocks = ["0.0.0.0/0"] } vpc_id = aws_vpc.vpc_1.id tags = { Name = "${var.prefix}-sg-1" } } # EC2 설정 시작 # EC2 역할 생성 resource "aws_iam_role" "ec2_role_1" { name = "${var.prefix}-ec2-role-1" # 이 역할에 대한 신뢰 정책 설정. EC2 서비스가 이 역할을 가정할 수 있도록 설정 assume_role_policy = <> /etc/fstab' # 도커 설치 및 실행/활성화 yum install docker -y systemctl enable docker systemctl start docker # 도커 네트워크 생성 docker network create common # nginx 설치 docker run -d \ --name npm_1 \ --restart unless-stopped \ --network common \ -p 80:80 \ -p 443:443 \ -p 81:81 \ -e TZ=Asia/Seoul \ -v /dockerProjects/npm_1/volumes/data:/data \ -v /dockerProjects/npm_1/volumes/etc/letsencrypt:/etc/letsencrypt \ jc21/nginx-proxy-manager:latest # ha proxy 설치 ## 설정파일을 위한 디렉토리 생성 mkdir -p /dockerProjects/ha_proxy_1/volumes/usr/local/etc/haproxy/lua cat << 'EOF' > /dockerProjects/ha_proxy_1/volumes/usr/local/etc/haproxy/lua/retry_on_502_504.lua core.register_action("retry_on_502_504", { "http-res" }, function(txn) local status = txn.sf:status() if status == 502 or status == 504 then txn:Done() end end) EOF ## 설정파일 생성 echo -e " global lua-load /usr/local/etc/haproxy/lua/retry_on_502_504.lua resolvers docker nameserver dns1 127.0.0.11:53 resolve_retries 3 timeout retry 1s hold valid 10s defaults mode http timeout connect 5s timeout client 60s timeout server 60s frontend http_front bind *:80 acl host_app1 hdr_beg(host) -i api.glog.oa.gg use_backend http_back_1 if host_app1 backend http_back_1 balance roundrobin option httpchk GET /actuator/health default-server inter 2s rise 1 fall 1 init-addr last,libc,none resolvers docker option redispatch http-response lua.retry_on_502_504 server app_server_1_1 app1_1:8080 check server app_server_1_2 app1_2:8080 check " > /dockerProjects/ha_proxy_1/volumes/usr/local/etc/haproxy/haproxy.cfg docker run \ -d \ --network common \ -p 8090:80 \ -v /dockerProjects/ha_proxy_1/volumes/usr/local/etc/haproxy:/usr/local/etc/haproxy \ -e TZ=Asia/Seoul \ --name ha_proxy_1 \ haproxy # redis 설치 docker run -d \ --name=redis_1 \ --restart unless-stopped \ --network common \ -p 6379:6379 \ -e TZ=Asia/Seoul \ redis --requirepass ${var.password_1} # mysql 설치 docker run -d \ --name mysql_1 \ --restart unless-stopped \ -v /dockerProjects/mysql_1/volumes/var/lib/mysql:/var/lib/mysql \ -v /dockerProjects/mysql_1/volumes/etc/mysql/conf.d:/etc/mysql/conf.d \ --network common \ -p 3306:3306 \ -e MYSQL_ROOT_PASSWORD=${var.password_1} \ -e TZ=Asia/Seoul \ mysql:latest # MySQL 컨테이너가 준비될 때까지 대기 echo "MySQL이 기동될 때까지 대기 중..." until docker exec mysql_1 mysql -uroot -p${var.password_1} -e "SELECT 1" &> /dev/null; do echo "MySQL이 아직 준비되지 않음. 5초 후 재시도..." sleep 5 done echo "MySQL이 준비됨. 초기화 스크립트 실행 중..." docker exec mysql_1 mysql -uroot -p${var.password_1} -e " CREATE USER 'lldjlocal'@'127.0.0.1' IDENTIFIED WITH caching_sha2_password BY '1234'; CREATE USER 'lldjlocal'@'172.18.%.%' IDENTIFIED WITH caching_sha2_password BY '1234'; CREATE USER 'lldj'@'%' IDENTIFIED WITH caching_sha2_password BY '${var.password_1}'; GRANT ALL PRIVILEGES ON *.* TO 'lldjlocal'@'127.0.0.1'; GRANT ALL PRIVILEGES ON *.* TO 'lldjlocal'@'172.18.%.%'; GRANT ALL PRIVILEGES ON *.* TO 'lldj'@'%'; CREATE DATABASE glog_prod; FLUSH PRIVILEGES; " echo "${var.github_access_token_1}" | docker login ghcr.io -u ${var.github_access_token_1_owner} --password-stdin END_OF_FILE } # 최신 Amazon Linux 2023 AMI 조회 (프리 티어 호환) data "aws_ami" "latest_amazon_linux" { most_recent = true owners = ["amazon"] filter { name = "name" values = ["al2023-ami-2023.*-x86_64"] } filter { name = "architecture" values = ["x86_64"] } filter { name = "virtualization-type" values = ["hvm"] } filter { name = "root-device-type" values = ["ebs"] } } # EC2 인스턴스 생성 resource "aws_instance" "ec2_1" { # 사용할 AMI ID ami = data.aws_ami.latest_amazon_linux.id # EC2 인스턴스 유형 instance_type = "t3.micro" # 사용할 서브넷 ID subnet_id = aws_subnet.subnet_4.id # 적용할 보안 그룹 ID vpc_security_group_ids = [aws_security_group.sg_1.id] # 퍼블릭 IP 연결 설정 associate_public_ip_address = true # 인스턴스에 IAM 역할 연결 iam_instance_profile = aws_iam_instance_profile.instance_profile_1.name # 인스턴스에 태그 설정 tags = { Name = "${var.prefix}-ec2-1" } # 루트 볼륨 설정 root_block_device { volume_type = "gp3" volume_size = 12 # 볼륨 크기를 12GB로 설정 } user_data = <<-EOF ${local.ec2_user_data_base} EOF } ``` ## nginx proxy manager 관리콘솔에 접속 - [http://3.38.218.158:81](http://3.38.218.158:81) - 초기 계정 - 아이디 : admin@example.com - 비번 : changeme ## DNSZI 에서 A 레코드 등록 - 도메인 : api.glog.oa.gg - IP : 1st-ec2-public-ip - EX : 3.38.218.158 ## NPM으로 리버스 프록시 - ![img](https://i.postimg.cc/0NynQntF/image.png) ## NPM으로 HTTPS 설정 - ![img](https://i.postimg.cc/85Fbd5gb/image.png) ## .github/workflows/deploy.yml ```yml name: deploy on: push: paths: - ".github/workflows/**" - "backend/src/**" - "backend/build.gradle.kts" - "backend/settings.gradle.kts" - "backend/Dockerfile" branches: - main jobs: makeTagAndRelease: runs-on: ubuntu-latest outputs: tag_name: ${{ steps.create_tag.outputs.new_tag }} steps: - uses: actions/checkout@v4 - name: Create Tag id: create_tag uses: mathieudutour/github-tag-action@v6.2 with: github_token: ${{ secrets.GITHUB_TOKEN }} - name: Create Release id: create_release uses: actions/create-release@v1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: tag_name: ${{ steps.create_tag.outputs.new_tag }} release_name: Release ${{ steps.create_tag.outputs.new_tag }} body: ${{ steps.create_tag.outputs.changelog }} draft: false prerelease: false buildImageAndPush: name: 도커 이미지 빌드와 푸시 needs: makeTagAndRelease runs-on: ubuntu-latest env: DOCKER_IMAGE_NAME: app20250318 outputs: DOCKER_IMAGE_NAME: ${{ env.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ env.OWNER_LC }} steps: - uses: actions/checkout@v4 - name: application-secret.yml 생성 env: APPLICATION_SECRET: ${{ secrets.APPLICATION_SECRET_YML }} run: echo "$APPLICATION_SECRET" > backend/src/main/resources/application-secret.yml - name: Docker Buildx 설치 uses: docker/setup-buildx-action@v2 - name: 레지스트리 로그인 uses: docker/login-action@v2 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: set lower case owner name run: | echo "OWNER_LC=${OWNER,,}" >> ${GITHUB_ENV} env: OWNER: "${{ github.repository_owner }}" - name: 빌드 앤 푸시 uses: docker/build-push-action@v3 with: context: backend push: true cache-from: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache cache-to: type=registry,ref=ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:cache,mode=max tags: | ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:${{ needs.makeTagAndRelease.outputs.tag_name }}, ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest deploy: runs-on: ubuntu-latest needs: [buildImageAndPush] env: DOCKER_IMAGE_NAME: ${{ needs.buildImageAndPush.outputs.DOCKER_IMAGE_NAME }} OWNER_LC: ${{ needs.buildImageAndPush.outputs.OWNER_LC }} steps: - uses: aws-actions/configure-aws-credentials@v4 with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - name: 인스턴스 ID 가져오기 id: get_instance_id run: | INSTANCE_ID=$(aws ec2 describe-instances --filters "Name=tag:Name,Values=dev-ec2-1" "Name=instance-state-name,Values=running" --query "Reservations[].Instances[].InstanceId" --output text) echo "INSTANCE_ID=$INSTANCE_ID" >> $GITHUB_ENV echo $INSTANCE_ID - name: AWS SSM Send-Command uses: peterkimzz/aws-ssm-send-command@master id: ssm with: aws-region: ${{ secrets.AWS_REGION }} aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} instance-ids: ${{ env.INSTANCE_ID }} working-directory: / comment: Deploy command: | # 공통 변수 IMAGE="ghcr.io/${{ env.OWNER_LC }}/${{ env.DOCKER_IMAGE_NAME }}:latest" VOLUME="/gen:/gen" NETWORK="common" HEALTH_ENDPOINT="/actuator/health" TIMEOUT=60 # 현재 실행 중인 컨테이너 확인 if docker ps --format '{{.Names}}' | grep -q "app1_1"; then CURRENT="app1_1" NEXT="app1_2" CURRENT_PORT=8080 NEXT_PORT=8081 else CURRENT="app1_2" NEXT="app1_1" CURRENT_PORT=8081 NEXT_PORT=8080 fi # 다음 컨테이너 실행 echo "Starting new container: $NEXT on port $NEXT_PORT..." docker pull "$IMAGE" docker stop "$NEXT" 2>/dev/null docker rm "$NEXT" 2>/dev/null docker run -d \ -v $VOLUME \ --network $NETWORK \ --name "$NEXT" \ -p "$NEXT_PORT":8080 \ "$IMAGE" # 헬스체크 대기 echo "Waiting for health check..." START_TIME=$(date +%s) while true; do CONTENT=$(curl -s http://localhost:$NEXT_PORT$HEALTH_ENDPOINT) if [[ "$CONTENT" == *'"status":"UP"'* ]]; then echo "✅ $NEXT is UP!" break fi ELAPSED_TIME=$(( $(date +%s) - START_TIME )) if [[ $ELAPSED_TIME -ge $TIMEOUT ]]; then echo "❌ Timeout: $NEXT did not start in $TIMEOUT seconds." docker stop "$NEXT" docker rm "$NEXT" exit 1 fi echo "⏳ Waiting for $NEXT to be UP..." sleep 5 done sleep 10 # ha proxy 가 사용하는 dns 캐시 때문에 서비스가 띄워지고도 10초 후에 발견될 수 도 있다. 그래서 기존 서버를 바로 내리지 않는다. # 기존 컨테이너 중지 및 제거 echo "Stopping old container: $CURRENT" docker stop "$CURRENT" 2>/dev/null docker rm "$CURRENT" 2>/dev/null # dangling image 제거 docker rmi $(docker images -f "dangling=true" -q) 2>/dev/null echo "✅ Deployment complete. Running container: $NEXT on port $NEXT_PORT" ``` $$hide # ?강 - [25 03 ??, p 14081, ?강, ?](https://goto.slog.gg/youtube/PLE0hRBClSk5ItEUO8ETeWAeLMh_X48uge/?) - [커밋](https://github.com/jhs512/?/commit/?) $$

글로그 CI/CD, aws, vercel