This service deploys to the shared single-node k3s staging cluster. Before touching staging, read the shared ops docs — they are the source of truth for the cluster's quirks:

Staging bring-up recipe — proven step-by-step to get a backend green (sealed secret → two-user Postgres + runtime CREATEROLE → Redis RESP2 → NetworkPolicy → actuator probe paths → manual CD dispatch when CI ends failure on a non-blocking job).
k3s cluster / ops reference — node facts (~4 GB, CPU-bound), staggered one-at-a-time bring-up, memory budget, TLS/cert-manager state.
Node-reboot → PV recovery runbook — after a VPS reboot the node re-registers under a new name and strands every local-path PV; this is the recovery (quiesce → recreate stranded PVCs → re-run the CREATEROLE grant → staggered bring-up).

Docker Compose (local full stack)

cd /Users/sarkout/projects/prive/europeLogin

# Full stack (requires built images)
docker-compose up --build

# Infrastructure only (for local dev)
docker-compose -f docker-compose.local.yml up -d

Services:

europe-login-db — Postgres 15 on port 5434
europe-login-redis — Redis 7 on port 6380
backend — Spring Boot on port 8091
frontend — nginx serving Angular on port 4301

The frontend nginx config (frontend/europe-login-portal/nginx.conf) proxies /api/ to http://backend:8091 inside the Docker network.

Building images manually

# Backend
cd backend
docker build -t ghcr.io/mahmoudholding/europe-login/backend:local .

# Frontend
cd frontend/europe-login-portal
docker build -t ghcr.io/mahmoudholding/europe-login/frontend:local --target production .

Kubernetes (k3s on TransIP VPS)

Infrastructure

VPS: 136.144.174.219 (Debian 13)
SSH: ssh -i ~/.ssh/id_ed25519 sarkoutmahmoud@136.144.174.219
k3s namespaces: europe-login (prod), europe-login-staging (staging)
Helm charts in helm/

Deploying manually

# Production
helm upgrade --install europe-login helm/ \
  --namespace europe-login \
  --set image.backend.tag=sha-<commit> \
  --set image.frontend.tag=sha-<commit>

# Staging
helm upgrade --install europe-login helm/ \
  --namespace europe-login-staging \
  --set image.backend.tag=sha-<commit> \
  --set image.frontend.tag=sha-<commit>

CI/CD (automatic)

PR merged to develop → staging auto-deploys
PR merged to main    → production auto-deploys

See .github/workflows/deploy-backend.yml and deploy-frontend.yml.

Secrets

Production secrets: 1Password → Bitnami Sealed Secrets → k3s

| Secret field | Purpose | |-------------|---------| | database-password | PostgreSQL | | jwt-secret | JWT signing key (≥32 chars, base64) | | redis-password | Redis auth | | bsn-encryption-key | AES-256 key for BSN encryption (exactly 32 chars) | | psd2-secret-id | GoCardless API secret ID | | psd2-secret-key | GoCardless API secret key | | kvk-api-key | KvK.nl API key |

To update sealed secrets:

OP_SERVICE_ACCOUNT_TOKEN=<token> ./scripts/seal-secrets.sh
git add k8s/sealed-secrets/
git commit -m "chore: update sealed secrets"
git push

Health checks

Backend: GET /actuator/health → 200 when healthy
Prometheus metrics: GET /actuator/prometheus
Swagger UI: GET /swagger-ui.html

Rollback

helm rollback europe-login 1 --namespace europe-login

Reacties

Nog geen reacties

Athena — europeLogin/deployment.md

Deployment — Europe Login

Cluster operations & runbooks