chore: deployment

.deploy.yml

@@ -0,0 +1,7 @@
+sn48:
+  vault:
+    hydrate:
+      # vault-new-project --env_file .env.prod --name playchoo-auth --inventory_hostname sn4
+      branches:
+        - master
+  deploy: 4

.dockerignore

@@ -0,0 +1,10 @@
+.DS_Store
+.env
+.env.prod
+node_modules/
+build/
+dist/
+coverage/
+logs/
+.git
+.gitignore

.drone.yml

@@ -0,0 +1,141 @@
+kind: pipeline
+type: docker
+name: default
+
+trigger:
+  branch:
+    - traefik
+    - master
+
+steps:
+- name: debug-secrets
+  image: alpine
+  environment:
+    VAULT_API_URL:
+      from_secret: VAULT_API_URL
+  commands:
+    - 'echo "Docker Registry URL: $${VAULT_API_URL}"'
+  when:
+    event:
+      - push
+      - tag
+
+- name: publish
+  image: plugins/docker
+  settings:
+    dockerfile: Dockerfile
+    context: .
+    registry: registry.sn48.zivili.ch
+    repo: registry.sn48.zivili.ch/meow/playchoo-auth
+    tags:
+      - "amd64-1.0.0"
+      - "latest"
+    username:
+      from_secret: PORTUS_USER
+    password:
+      from_secret: PORTUS_PASSWORD
+    debug: true
+    launch_debug: true
+    force_tag: true
+  when:
+    event:
+      - push
+      - tag
+
+- name: deploy
+  image: registry.sn48.zivili.ch/meow/drone-deploy:amd64-1.0.0
+  pull: never
+  settings:
+    ssh_port:
+      from_secret: SSH_PORT
+    dockerconfigjson:
+      from_secret: dockerconfigjson
+    portus_user:
+      from_secret: PORTUS_USER
+    portus_password:
+      from_secret: PORTUS_PASSWORD
+    ssh_host:
+      from_secret: SSH_HOST
+    ssh_user:
+      from_secret: SSH_USER
+    ssh_key:
+      from_secret: SSH_KEY
+    ssh_fingerprint:
+      from_secret: SSH_FINGERPRINT
+    drone_agent1_token:
+      from_secret: DRONE_AGENT1_TOKEN
+    vault_api_url:
+      from_secret: VAULT_API_URL
+
+---
+kind: secret
+name: SSH_HOST
+get:
+  path: kv/data/__drone-admin-secrets
+  name: SSH_HOST
+
+---
+kind: secret
+name: SSH_USER
+get:
+  path: kv/data/__drone-admin-secrets
+  name: SSH_USER
+
+---
+kind: secret
+name: SSH_KEY
+get:
+  path: kv/data/__drone-admin-secrets
+  name: SSH_KEY
+
+---
+kind: secret
+name: DRONE_AGENT1_TOKEN
+get:
+  path: kv/data/__drone-admin-secrets
+  name: DRONE_AGENT1_TOKEN
+
+---
+kind: secret
+name: VAULT_API_URL
+get:
+  path: kv/data/__drone-admin-secrets
+  name: VAULT_API_URL
+
+---
+kind: secret
+name: PORTUS_USER
+get:
+  path: kv/data/__drone-admin-secrets
+  name: PORTUS_USER
+
+---
+kind: secret
+name: PORTUS_PASSWORD
+get:
+  path: kv/data/__drone-admin-secrets
+  name: PORTUS_PASSWORD
+
+---
+kind: secret
+name: dockerconfigjson
+get:
+  path: kv/data/__drone-admin-secrets
+  name: dockerconfigjson
+
+image_pull_secrets:
+  from_secret: dockerconfigjson
+
+---
+kind: secret
+name: SSH_PORT
+get:
+  path: kv/data/__drone-admin-secrets
+  name: SSH_PORT
+
+---
+kind: secret
+name: SSH_FINGERPRINT
+get:
+  path: kv/data/__drone-admin-secrets
+  name: SSH_FINGERPRINT

Dockerfile

@@ -1,17 +1,28 @@
-FROM node:20-alpine
+FROM node:22-alpine AS build
 
 WORKDIR /app
 
-# Install dependencies
 COPY package*.json ./
-RUN npm ci --only=production
+RUN npm ci
 
-# Copy source and build
 COPY . .
-RUN npm run build:prod
 
-# Expose port
+RUN npm run build:prod \
+  && npm prune --omit=dev
+
+FROM node:22-alpine
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+COPY --from=build /app/package*.json ./
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/build ./build
+
+RUN addgroup -S app && adduser -S app -G app && chown -R app:app /app
+USER app
+
 EXPOSE 3700
 
-# Start the application
 CMD ["node", "build/src/index.js"]

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:20-alpine
+FROM node:22-alpine
 
 WORKDIR /app
 

package-lock.json

@@ -14,13 +14,13 @@
         "express-knifey": "^1.1.3",
         "ioredis": "^5.8.1",
         "swiss-army-knifey": "^1.36.4",
-        "swissoid-back": "^2.2.5"
+        "swissoid-back": "^2.3.0"
       },
       "devDependencies": {
         "@types/express": "^4.17.21",
-        "@types/node": "^20.11.0",
+        "@types/node": "^22.13.14",
         "ts-node": "^10.9.2",
-        "typescript": "^5.3.3"
+        "typescript": "^5.9.3"
       }
     },
     "node_modules/@cspotcode/source-map-support": {
@@ -220,9 +220,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "20.19.22",
+      "version": "22.18.11",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.22.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.18.11.tgz",
-      "integrity": "sha512-hRnu+5qggKDSyWHlnmThnUqg62l29Aj/6vcYgUaSFL9oc7DVjeWEQN3PRgdSc6F8d9QRMWkf36CLMch1Do/+RQ==",
+      "integrity": "sha512-Gd33J2XIrXurb+eT2ktze3rJAfAp9ZNjlBdh4SVgyrKEOADwCbdUDaK7QgJno8Ue4kcajscsKqu6n8OBG3hhCQ==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~6.21.0"
@@ -1617,9 +1617,9 @@
       "license": "MIT"
     },
     "node_modules/swissoid-back": {
-      "version": "2.2.5",
+      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/swissoid-back/-/swissoid-back-2.2.5.tgz",
+      "resolved": "https://registry.npmjs.org/swissoid-back/-/swissoid-back-2.3.0.tgz",
-      "integrity": "sha512-9qjbItzGNb8C+R0IItlYA+Re3Jt6A9QDtgoVgGWYMDiQCz0ot6s4TNruug5UMutCRBlV+AdeGZjL4FViZTBDNQ==",
+      "integrity": "sha512-n2R9o7ddH/XNyL1zgHB3+SYkv3/KmfJFOcQvbzlE13aIB+6eIqX8yv5h85+LWE5s017BfXgm5vGBNXaT0XjgOg==",
       "license": "MIT",
       "dependencies": {
         "@types/express-serve-static-core": "^5.0.7",
@@ -1632,6 +1632,9 @@
         "jose": "^6.1.0",
         "node-fetch": "^3.3.2",
         "redis": "^5.8.2"
+      },
+      "bin": {
+        "swissoid-back-generate-secrets": "scripts/generate-session-secrets.js"
       }
     },
     "node_modules/swissoid-back/node_modules/@types/express-serve-static-core": {

package.json

@@ -19,13 +19,13 @@
     "express": "^5.1.0",
     "express-knifey": "^1.1.3",
     "ioredis": "^5.8.1",
-    "swissoid-back": "^2.2.5",
+    "swissoid-back": "^2.3.0",
     "swiss-army-knifey": "^1.36.4"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
-    "@types/node": "^20.11.0",
+    "@types/node": "^22.13.14",
     "ts-node": "^10.9.2",
-    "typescript": "^5.3.3"
+    "typescript": "^5.9.3"
   }
 }