From a8c5e93eae4fcb9fff62715352a2a6fd3e8ce4bd Mon Sep 17 00:00:00 2001 From: Bast Date: Tue, 3 Nov 2026 14:44:21 -0600 Subject: [PATCH] Pull via registry.local, IngressClass nginx --- .github/workflows/deploy.yml | 106 +++++++++++++++++++++++++++ .github/workflows/docker-publish.yml | 19 +++-- charts/mt5/values.yaml | 8 +- 3 files changed, 124 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 00000000..969c6a3c --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,106 @@ +name: MT5 Helm GitOps Deploy + +on: + push: + branches: [ "main" ] + tags: [ "*" ] + workflow_dispatch: + +env: + # Gleiche Registry wie im boday_tf-Projekt, zwei Namen: + # PUSH_REGISTRY: wie der Runner sie erreicht + # PULL_REGISTRY: wie k3s/containerd sie erreicht (registries.yaml, CA unter certs.d) + PUSH_REGISTRY: localhost:3005 + PULL_REGISTRY: registry.local + # Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP) + INGRESS_HOST: mt5.local + +jobs: + build-and-deploy: + runs-on: ubuntu-latest + container: catthehacker/ubuntu:act-latest + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + # HINWEIS: Terraform-Binary kommt wie bei boday_tf über das globale Runner-Volume (:ro) + + - name: Trust Local Nginx Certificate Inside Container + run: | + mkdir -p /usr/local/share/ca-certificates/ + cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat" + update-ca-certificates + + # Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern + - name: Compute Image Name + run: | + IMAGE_PATH="$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" + echo "IMAGE=${PUSH_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV" + echo "PULL_IMAGE=${PULL_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV" + echo "Push: ${PUSH_REGISTRY}/${IMAGE_PATH}" + echo "Pull: ${PULL_REGISTRY}/${IMAGE_PATH}" + + - name: Log in to Local Registry + run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${PUSH_REGISTRY} -u ${{ github.actor }} --password-stdin + + # Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit) + - name: Build MT5 Image + run: | + docker build --platform linux/amd64 \ + -t ${IMAGE}:${{ github.sha }} \ + -t ${IMAGE}:latest \ + . + + - name: Push MT5 Image + run: | + docker push ${IMAGE}:${{ github.sha }} + docker push ${IMAGE}:latest + + - name: Prepare Kubernetes Access + run: | + echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig + chmod 600 ./kind_kubeconfig + + # Erster Rollout kann bis 15 Min dauern (Wine + MT5 Installation nach /config) + # init mit Retry, weil der DNS-Resolver sporadisch "server misbehaving" liefert + - name: Terraform Deploy + env: + TF_VAR_vnc_password: ${{ secrets.MT5_VNC_PASSWORD }} + run: | + terraform --version + for i in 1 2 3; do + terraform init && break + if [ "$i" = "3" ]; then echo "terraform init nach 3 Versuchen fehlgeschlagen"; exit 1; fi + echo "init fehlgeschlagen, Versuch $i – neuer Anlauf in 10s" + sleep 10 + done + terraform apply -auto-approve \ + -var="image_repository=${PULL_IMAGE}" \ + -var="app_version=${{ github.sha }}" \ + -var="vnc_user=${{ secrets.MT5_VNC_USER || 'trader' }}" \ + -var="ingress_host=${INGRESS_HOST}" + + # KasmVNC antwortet ohne Login mit 401 – daher mit Basic Auth prüfen und auf den Erststart warten + - name: Verify App Health + if: env.INGRESS_HOST != '' + env: + VNC_USER: ${{ secrets.MT5_VNC_USER || 'trader' }} + VNC_PASS: ${{ secrets.MT5_VNC_PASSWORD }} + run: | + for i in $(seq 1 40); do + CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 \ + -u "${VNC_USER}:${VNC_PASS}" -H "Host: ${INGRESS_HOST}" \ + http://local-k3s-platform:80/ || true) + echo "Versuch ${i}: HTTP ${CODE}" + if [ "${CODE}" = "200" ]; then + echo "Erfolg: MetaTrader 5 Web-UI läuft via Helm im GitOps-Standard!" + exit 0 + fi + sleep 15 + done + echo "MT5 Web-UI nach 10 Minuten nicht erreichbar" + exit 1 + + - name: Cleanup Kubeconfig + if: always() + run: rm -f ./kind_kubeconfig diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index bc8c3d20..969c6a3c 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -7,8 +7,11 @@ on: workflow_dispatch: env: - # Gleicher Registry-Prefix wie im boday_tf-Projekt - REGISTRY: localhost:3005 + # Gleiche Registry wie im boday_tf-Projekt, zwei Namen: + # PUSH_REGISTRY: wie der Runner sie erreicht + # PULL_REGISTRY: wie k3s/containerd sie erreicht (registries.yaml, CA unter certs.d) + PUSH_REGISTRY: localhost:3005 + PULL_REGISTRY: registry.local # Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP) INGRESS_HOST: mt5.local @@ -31,12 +34,14 @@ jobs: # Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern - name: Compute Image Name run: | - IMAGE="${REGISTRY}/$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" - echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV" - echo "Image: ${IMAGE}" + IMAGE_PATH="$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" + echo "IMAGE=${PUSH_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV" + echo "PULL_IMAGE=${PULL_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV" + echo "Push: ${PUSH_REGISTRY}/${IMAGE_PATH}" + echo "Pull: ${PULL_REGISTRY}/${IMAGE_PATH}" - name: Log in to Local Registry - run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${REGISTRY} -u ${{ github.actor }} --password-stdin + run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${PUSH_REGISTRY} -u ${{ github.actor }} --password-stdin # Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit) - name: Build MT5 Image @@ -70,7 +75,7 @@ jobs: sleep 10 done terraform apply -auto-approve \ - -var="image_repository=${IMAGE}" \ + -var="image_repository=${PULL_IMAGE}" \ -var="app_version=${{ github.sha }}" \ -var="vnc_user=${{ secrets.MT5_VNC_USER || 'trader' }}" \ -var="ingress_host=${INGRESS_HOST}" diff --git a/charts/mt5/values.yaml b/charts/mt5/values.yaml index 2575a44d..c9751a10 100644 --- a/charts/mt5/values.yaml +++ b/charts/mt5/values.yaml @@ -27,9 +27,13 @@ service: # Nur das Web-UI wird über Ingress exponiert, RPyC bewusst nicht ingress: enabled: false - className: traefik # k3s-Default + className: nginx host: "" - annotations: {} + # KasmVNC nutzt WebSockets – lange Timeouts, damit die Session nicht nach 60s abreißt + annotations: + nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" + nginx.ingress.kubernetes.io/proxy-send-timeout: "3600" + nginx.ingress.kubernetes.io/proxy-body-size: "0" tls: [] # - secretName: mt5-tls # hosts: [mt5.example.ch]