diff --git a/docs/deployment/README.md b/docs/deployment/README.md index c3e7046cc..066173080 100644 --- a/docs/deployment/README.md +++ b/docs/deployment/README.md @@ -10,11 +10,8 @@ The Django application gets built into a [Docker image][dockerfile] with [NGINX] The application is deployed to an [Azure Web App Container][az-webapp] using three separate environments for `dev`, `test`, and `prod`. -A [GitHub Action][gh-actions] per environment is responsible for building that branch's image and pushing to [GitHub Container -Registry (GHCR)][ghcr]. - -GitHub POSTs a [webhook][gh-webhooks] to the Azure Web App when an [image is published to GHCR][gh-webhook-event], telling -Azure to restart the app and pull the latest image. +The [Deploy](deploy-workflow) workflow is responsible for building that branch's image and pushing to [GitHub Container +Registry (GHCR)][ghcr]. It also deploys to the Azure Web App, telling Azure to restart the app and pull the latest image. You can view what Git commit is deployed for a given environment by visitng the URL path `/static/sha.txt`. @@ -30,14 +27,11 @@ Docker images for each of the deploy branches are available from GitHub Containe - [Repository Package page](https://github.com/cal-itp/benefits/pkgs/container/benefits) - Image path: `ghcr.io/cal-itp/benefits` -- Image tags: `dev`, `test`, `prod` [oet]: https://techblog.cdt.ca.gov/2020/06/cdt-taking-the-lead-in-digital-transformation/ [app-service-containers]: https://docs.microsoft.com/en-us/azure/app-service/configure-custom-container [app-service]: https://docs.microsoft.com/en-us/azure/app-service/overview +[deploy-workflow]: https://github.com/cal-itp/benefits/blob/dev/.github/workflows/deploy.yml [dockerfile]: https://github.com/cal-itp/benefits/blob/dev/Dockerfile [az-webapp]: https://azure.microsoft.com/en-us/services/app-service/containers/ -[gh-actions]: https://docs.github.com/en/actions -[gh-webhook-event]: https://docs.github.com/en/developers/webhooks-and-events/webhooks/webhook-events-and-payloads#package -[gh-webhooks]: https://docs.github.com/en/github-ae@latest/developers/webhooks-and-events/webhooks [ghcr]: https://github.com/features/packages diff --git a/docs/deployment/infrastructure.md b/docs/deployment/infrastructure.md index 14047ae23..e16212a24 100644 --- a/docs/deployment/infrastructure.md +++ b/docs/deployment/infrastructure.md @@ -180,11 +180,10 @@ Use the following shorthand for conveying the Resource Type as part of the Resou ## Azure environment setup -The following steps are required to set up the environment, with linked issues to automate them: +The following steps are required to set up the environment: - `terraform apply` -- Set up Slack notifications by [creating a Slack email](https://slack.com/help/articles/206819278-Send-emails-to-Slack) for the [#benefits-notify](https://cal-itp.slack.com/archives/C022HHSEE3F) channel, then [setting it as a Secret in the Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-portal#add-a-secret-to-key-vault) named `slack-benefits-notify-email` +- Set up Slack notifications by [creating a Slack email](https://slack.com/help/articles/206819278-Send-emails-to-Slack) for the [#notify-benefits](https://cal-itp.slack.com/archives/C022HHSEE3F) channel, then [setting it as a Secret in the Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-portal#add-a-secret-to-key-vault) named `slack-benefits-notify-email` - Set required [App Service configuration](../configuration/environment-variables.md) and [configuration](../configuration/data.md) by setting values in Key Vault (the mapping is defined in [app_service.tf](https://github.com/cal-itp/benefits/blob/dev/terraform/app_service.tf)) -- [Set up webhook from GitHub](https://github.com/cal-itp/benefits/settings/hooks) to [App Service Deployment Center](https://learn.microsoft.com/en-us/azure/app-service/deploy-ci-cd-custom-container?tabs=acr&pivots=container-linux) for the `Packages` event This is not a complete step-by-step guide; more a list of things to remember. This may be useful as part of [incident response](https://docs.google.com/document/d/1qtev8qItPiTB4Tp9FQ87XsLtWZ4HlNXqoe9vF2VuGcY/edit#). diff --git a/docs/deployment/workflows.md b/docs/deployment/workflows.md index 2c7d7f47c..ff5b21f42 100644 --- a/docs/deployment/workflows.md +++ b/docs/deployment/workflows.md @@ -23,16 +23,15 @@ Using the `github.actor` and built-in `GITHUB_TOKEN` secret ### 3. Build and push image to GitHub Container Registry (GHCR) -Build the root [`Dockerfile`][dockerfile], tagging with both the branch name (e.g. `dev`) and the SHA from the HEAD commit. +Build the root [`Dockerfile`][dockerfile], tagging with the SHA from the HEAD commit. Push this image:tag into [GHCR][ghcr]. ### 4. App Service deploy -Each Azure App Service instance is configured to [listen to a webhook from GitHub, then deploy the image][webhook]. +Push the new image:tag to the Azure App Service instance. [deploy]: https://github.com/cal-itp/benefits/blob/dev/.github/workflows/deploy.yml [dockerfile]: https://github.com/cal-itp/benefits/blob/dev/Dockerfile [ghcr]: https://github.com/features/packages [gh-actions-trigger]: https://docs.github.com/en/actions/reference/events-that-trigger-workflows -[webhook]: https://docs.microsoft.com/en-us/azure/app-service/deploy-ci-cd-custom-container diff --git a/terraform/app_service.tf b/terraform/app_service.tf index 1b3679022..f77fa6fbb 100644 --- a/terraform/app_service.tf +++ b/terraform/app_service.tf @@ -25,10 +25,6 @@ resource "azurerm_linux_web_app" "main" { site_config { ftps_state = "Disabled" vnet_route_all_enabled = true - application_stack { - docker_image = "ghcr.io/cal-itp/benefits" - docker_image_tag = local.env_name - } } identity { @@ -52,8 +48,7 @@ resource "azurerm_linux_web_app" "main" { # app setting used solely for refreshing secrets - see https://github.com/MicrosoftDocs/azure-docs/issues/79855#issuecomment-1265664801 "change_me_to_refresh_secrets" = "change me in the portal to refresh all secrets", - "DOCKER_ENABLE_CI" = "true", - "DOCKER_REGISTRY_SERVER_URL" = "https://ghcr.io/", + "DOCKER_ENABLE_CI" = "false", "WEBSITE_HTTPLOGGING_RETENTION_DAYS" = "99999", "WEBSITE_TIME_ZONE" = "America/Los_Angeles", "WEBSITES_ENABLE_APP_SERVICE_STORAGE" = "false", @@ -110,6 +105,22 @@ resource "azurerm_linux_web_app" "main" { } } +resource "azurerm_app_service_source_control" "main" { + app_id = azurerm_linux_web_app.main.id + repo_url = "https://github.com/cal-itp/benefits" + branch = local.env_name + rollback_enabled = true + + github_action_configuration { + generate_workflow_file = false + + container_configuration { + image_name = "cal-itp/benefits" + registry_url = "https://ghcr.io/" + } + } +} + resource "azurerm_app_service_custom_hostname_binding" "main" { hostname = local.hostname app_service_name = azurerm_linux_web_app.main.name