Add progressive delivery and infra scaffolding

Author: semihbugrasezer

.env.example

@@ -1,9 +1,15 @@
 TRAEFIK_HTTP_PORT=80
+TRAEFIK_HTTPS_PORT=443
 TRAEFIK_DASHBOARD_PORT=8080
 DOCKER_SOCKET=/var/run/docker.sock
 DEPLOY_WORKSPACE=/deployments
 DEPLOY_DOCKER_NETWORK=self-hosted-devops_edge
 DEPLOY_PROJECT_LABEL=self-hosted-devops
 DEPLOY_DEFAULT_CONTAINER_PORT=3000
+DEPLOY_HEALTH_PATH=/health
+DEPLOY_HEALTH_TIMEOUT_SECONDS=60
+DEPLOY_IMAGE_REGISTRY=
+DEPLOY_PUSH_IMAGES=false
 DEPLOY_ALLOWED_REPO_PREFIXES=https://github.com/,git@github.com:,file://
 DEPLOY_TOKEN=change-me
+TRAEFIK_ACME_EMAIL=admin@example.com

.github/workflows/ci-cd.yml

@@ -47,6 +47,9 @@ jobs:
   trigger-deployment:
     needs: validate-and-build
     runs-on: ubuntu-latest
+    environment:
+      name: production
+      url: ${{ vars.DEPLOY_WEBHOOK_URL }}
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_WEBHOOK_URL != ''
     steps:
       - name: Trigger deployment API

README.md

@@ -32,6 +32,8 @@ flowchart LR
 
 - API-driven deployment workflow with `POST /deploy`.
 - Docker image builds from Git repositories.
+- Blue/green-style candidate validation before replacing the routed container.
+- Optional image registry tagging and push before deployment.
 - Automatic container replacement by service name.
 - Dynamic domain-based routing via Traefik labels.
 - Multi-service routing with `api.localhost`, `app.localhost`, and deployed app domains.
@@ -42,6 +44,7 @@ flowchart LR
 - Reproducible Docker Compose environment.
 - Optional Prometheus and Grafana observability profile.
 - Trivy image vulnerability scanning in CI.
+- Traefik ACME/Let's Encrypt configuration for production TLS.
 - GitHub Actions workflow for CI/CD integration.
 
 ## How It Works
@@ -51,9 +54,9 @@ flowchart LR
 3. The API validates `repo`, `name`, and `domain`.
 4. The API clones the Git repository into a deployment workspace.
 5. Docker builds an image from the cloned repository.
-6. Any existing container with the same app name is stopped and removed.
-7. A new container is started on the Traefik network.
-8. Traefik discovers the container through labels and routes traffic to the configured domain.
+6. A candidate container is started and health-checked before routing changes.
+7. The previous routed container is replaced only after the candidate passes validation.
+8. Traefik discovers the new container through labels and routes traffic to the configured domain.
 
 ## Getting Started
 
@@ -272,13 +275,11 @@ GET /metrics
 
 ## Future Improvements
 
-- Add blue/green or canary deployments for safer rollouts.
-- Push built images to a registry before deployment.
-- Add production TLS certificates with Let's Encrypt.
-- Add GitHub Actions deployment environments and approval gates.
-- Expand Grafana dashboards with latency, error-rate, and deployment-failure panels.
-- Migrate runtime deployments from direct Docker containers to Kubernetes Deployments and Services.
-- Expand Terraform from project scaffolding into full host, DNS, firewall, and monitoring provisioning.
+- Add weighted canary deployments with gradual traffic shifting.
+- Push deployment metadata and audit events into a dedicated deployment history API.
+- Add production-ready secret management with SOPS, Vault, or cloud secret stores.
+- Replace direct container runtime deployment with Kubernetes Deployments, Services, and progressive delivery controllers.
+- Expand Terraform modules for managed databases, managed Redis, backups, and monitoring alerts.
 
 ## CV Impact
 

api/.env.example

@@ -12,6 +12,10 @@ DEPLOY_WORKSPACE=/deployments
 DEPLOY_DOCKER_NETWORK=self-hosted-devops_edge
 DEPLOY_PROJECT_LABEL=self-hosted-devops
 DEPLOY_DEFAULT_CONTAINER_PORT=3000
+DEPLOY_HEALTH_PATH=/health
+DEPLOY_HEALTH_TIMEOUT_SECONDS=60
+DEPLOY_IMAGE_REGISTRY=
+DEPLOY_PUSH_IMAGES=false
 DEPLOY_ALLOWED_REPO_PREFIXES=https://github.com/,git@github.com:,file://
 DEPLOY_TOKEN=local-dev-token
 DOCKER_HOST=tcp://docker-socket-proxy:2375

api/src/config/config.js

@@ -47,6 +47,10 @@ function loadConfig() {
       dockerNetwork: process.env.DEPLOY_DOCKER_NETWORK || "self-hosted-devops_edge",
       projectLabel: process.env.DEPLOY_PROJECT_LABEL || "self-hosted-devops",
       defaultContainerPort: numberFromEnv("DEPLOY_DEFAULT_CONTAINER_PORT", 3000),
+      healthPath: process.env.DEPLOY_HEALTH_PATH || "/health",
+      healthTimeoutSeconds: numberFromEnv("DEPLOY_HEALTH_TIMEOUT_SECONDS", 60),
+      imageRegistry: process.env.DEPLOY_IMAGE_REGISTRY || "",
+      pushImages: process.env.DEPLOY_PUSH_IMAGES === "true",
       allowedRepoPrefixes: listFromEnv("DEPLOY_ALLOWED_REPO_PREFIXES", [
         "https://github.com/",
         "git@github.com:",

api/src/services/deploy.js

@@ -45,6 +45,15 @@ function requireRepo(value, allowedPrefixes) {
 }
 
 function createDeployService({ config, store, git, docker, log }) {
+  function imageName(serviceName, shortId) {
+    const localName = `self-hosted-devops/${serviceName}:${shortId}`;
+    if (!config.deploy.imageRegistry) {
+      return localName;
+    }
+
+    return `${config.deploy.imageRegistry.replace(/\/$/, "")}/${serviceName}:${shortId}`;
+  }
+
   async function deployService(payload) {
     const repositoryUrl = requireRepo(
       payload.repo || payload.repositoryUrl,
@@ -58,7 +67,8 @@ function createDeployService({ config, store, git, docker, log }) {
     const deploymentId = crypto.randomUUID();
     const shortId = deploymentId.slice(0, 8);
     const sourcePath = path.join(config.deploy.workspace, serviceName, shortId);
-    const image = `self-hosted-devops/${serviceName}:${shortId}`;
+    const image = imageName(serviceName, shortId);
+    const candidateName = `candidate-${serviceName}-${shortId}`;
     const containerName = `deployed-${serviceName}`;
 
     const deployment = await store.insertDeployment({
@@ -79,11 +89,39 @@ function createDeployService({ config, store, git, docker, log }) {
       await store.updateDeployment(deployment.id, { status: "building" });
       await docker.buildImage(image, sourcePath, deployment.id);
 
+      if (config.deploy.pushImages) {
+        await store.updateDeployment(deployment.id, { status: "pushing" });
+        await docker.pushImage(image, deployment.id);
+      }
+
+      await store.updateDeployment(deployment.id, { status: "validating" });
+      await docker.removeContainer(candidateName, deployment.id);
+      await docker.runContainer({
+        name: candidateName,
+        image,
+        containerPort,
+        deploymentId: deployment.id,
+        labels: [
+          "traefik.enable=false",
+          `platform.service=${serviceName}`,
+          `platform.deployment=${deployment.id}`,
+          "platform.candidate=true",
+        ],
+      });
+      await docker.waitForHttpHealth(
+        candidateName,
+        containerPort,
+        payload.healthPath || config.deploy.healthPath,
+        config.deploy.healthTimeoutSeconds,
+        deployment.id,
+      );
+
       await store.updateDeployment(deployment.id, {
-        status: "replacing",
+        status: "switching",
         previousContainerName: containerName,
       });
       await docker.removeContainer(containerName, deployment.id);
+      await docker.removeContainer(candidateName, deployment.id);
 
       await docker.runContainer({
         name: containerName,
@@ -108,6 +146,7 @@ function createDeployService({ config, store, git, docker, log }) {
         error: error.message,
       });
 
+      await docker.removeContainer(candidateName, deployment.id);
       await docker.removeContainer(containerName, deployment.id);
       await store.updateDeployment(deployment.id, {
         status: "failed",

api/src/services/docker.js

@@ -1,3 +1,4 @@
+const http = require("http");
 const { DockerBuildError, ContainerRuntimeError } = require("../errors/app-error");
 
 function createDockerService(config, run, log) {
@@ -29,6 +30,17 @@ function createDockerService(config, run, log) {
     }
   }
 
+  async function pushImage(image, deploymentId) {
+    try {
+      await run("docker", ["push", image], { deploymentId });
+    } catch (error) {
+      throw new DockerBuildError("Docker image push failed", {
+        image,
+        stderr: error.stderr,
+      });
+    }
+  }
+
   async function removeContainer(name, deploymentId) {
     await run("docker", ["rm", "-f", name], { deploymentId }).catch(() => {});
   }
@@ -54,7 +66,73 @@ function createDockerService(config, run, log) {
     }
   }
 
-  return { dockerLabels, buildImage, removeContainer, runContainer };
+  async function inspectContainerIp(containerName, deploymentId) {
+    const { stdout } = await run(
+      "docker",
+      ["inspect", "-f", "{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}", containerName],
+      { deploymentId },
+    );
+
+    return stdout.trim();
+  }
+
+  function requestHealth(host, port, healthPath) {
+    return new Promise((resolve, reject) => {
+      const request = http.get(
+        {
+          host,
+          port,
+          path: healthPath,
+          timeout: 2000,
+        },
+        (response) => {
+          response.resume();
+          if (response.statusCode >= 200 && response.statusCode < 400) {
+            resolve();
+            return;
+          }
+
+          reject(new Error(`health check returned ${response.statusCode}`));
+        },
+      );
+
+      request.on("error", reject);
+      request.on("timeout", () => {
+        request.destroy(new Error("health check timed out"));
+      });
+    });
+  }
+
+  async function waitForHttpHealth(containerName, containerPort, healthPath, timeoutSeconds, deploymentId) {
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    let lastError = new Error("health check did not run");
+
+    while (Date.now() < deadline) {
+      try {
+        const ip = await inspectContainerIp(containerName, deploymentId);
+        await requestHealth(ip, containerPort, healthPath);
+        return;
+      } catch (error) {
+        lastError = error;
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+      }
+    }
+
+    throw new ContainerRuntimeError("Container health check failed", {
+      containerName,
+      healthPath,
+      error: lastError.message,
+    });
+  }
+
+  return {
+    dockerLabels,
+    buildImage,
+    pushImage,
+    removeContainer,
+    runContainer,
+    waitForHttpHealth,
+  };
 }
 
 module.exports = { createDockerService };

docker-compose.yml

@@ -8,14 +8,22 @@ services:
       - "--api.dashboard=true"
       - "--api.insecure=true"
       - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL:-admin@example.com}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
       - "--metrics.prometheus=true"
       - "--providers.docker=true"
       - "--providers.docker.constraints=Label(`com.docker.compose.project`,`self-hosted-devops`)"
       - "--providers.docker.endpoint=tcp://docker-socket-proxy:2375"
       - "--providers.docker.exposedbydefault=false"
     ports:
       - "${TRAEFIK_HTTP_PORT:-80}:80"
+      - "${TRAEFIK_HTTPS_PORT:-443}:443"
       - "${TRAEFIK_DASHBOARD_PORT:-8080}:8080"
+    volumes:
+      - traefik-acme:/letsencrypt
     depends_on:
       - docker-socket-proxy
     networks:
@@ -164,3 +172,4 @@ volumes:
   prometheus-data:
   grafana-data:
   deploy-workspace:
+  traefik-acme:

grafana/dashboards/devops-platform.json

@@ -47,6 +47,50 @@
       ],
       "title": "Deployments",
       "type": "timeseries"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 0,
+        "y": 8
+      },
+      "id": 3,
+      "targets": [
+        {
+          "expr": "devops_api_uptime_seconds",
+          "refId": "A"
+        }
+      ],
+      "title": "API Uptime",
+      "type": "stat"
+    },
+    {
+      "datasource": "Prometheus",
+      "fieldConfig": {
+        "defaults": {},
+        "overrides": []
+      },
+      "gridPos": {
+        "h": 8,
+        "w": 12,
+        "x": 12,
+        "y": 8
+      },
+      "id": 4,
+      "targets": [
+        {
+          "expr": "sum(rate(traefik_service_requests_total{code=~\"5..\"}[5m]))",
+          "refId": "A"
+        }
+      ],
+      "title": "Traefik 5xx Error Rate",
+      "type": "timeseries"
     }
   ],
   "schemaVersion": 39,