mirror of
https://github.com/ever-co/ever-gauzy.git
synced 2026-10-02 01:54:50 +08:00
samuel mbabhazi
8fe77c6c88
* feat(config): add individual Redis connection environment variables - Add REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD to all env files - Support flexible Redis configuration alongside REDIS_URL - Allow connection via individual parameters or single URL * feat(docker): add Redis env vars to Dockerfiles - Add REDIS_ENABLED, REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD as build args and env vars - Update API, MCP, and MCP-Auth Dockerfiles - Enable flexible Redis configuration in containerized deployments * feat(k8s): add Redis env vars to Kubernetes manifests - Add REDIS_ENABLED, REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD to all k8s deployments - Update manifests for prod, stage, and demo environments - Support flexible Redis configuration in Kubernetes (Civo, CW, DO) - Apply to API, MCP, and MCP-Auth deployments * feat(deploy): add Redis env vars to Docker Compose templates - Add REDIS_ENABLED, REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD to compose templates - Update templates for Cloudflare and Let's Encrypt deployments - Apply to prod, stage, and demo environments - Enable flexible Redis configuration in SSH-based deployments * feat(ci): add Redis env vars to GitHub workflows - Add REDIS_ENABLED, REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD to deployment workflows - Update workflows for Civo, CW, and DigitalOcean deployments - Apply to API, MCP, and MCP-Auth deployment pipelines - Support flexible Redis configuration in CI/CD * feat(do): add Redis env vars to DigitalOcean App Platform config - Add REDIS_ENABLED, REDIS_HOST, REDIS_PORT, REDIS_USER, REDIS_PASSWORD to app.yaml - Enable flexible Redis configuration for DO App Platform deployments * add redis_tls
93 lines
4.0 KiB
YAML
93 lines
4.0 KiB
YAML
name: Deploy MCP to DigitalOcean Prod
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows: ['Build and Publish Gauzy MCP Image Prod']
|
|
branches: [master]
|
|
types:
|
|
- completed
|
|
|
|
jobs:
|
|
deploy-mcp-prod:
|
|
runs-on: buildjet-4vcpu-ubuntu-2204
|
|
|
|
environment: prod
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install doctl
|
|
uses: digitalocean/action-doctl@v2
|
|
with:
|
|
token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
|
|
|
|
- name: Log in to DigitalOcean Container Registry with short-lived credentials
|
|
run: doctl registry login --expiry-seconds 600
|
|
|
|
- name: Save DigitalOcean kubeconfig with short-lived credentials
|
|
run: doctl kubernetes cluster kubeconfig save --expiry-seconds 600 k8s-gauzy
|
|
|
|
- name: Generate TLS Secrets for MCP Prod
|
|
run: |
|
|
rm -f ${HOME}/ingress.mcp.crt ${HOME}/ingress.mcp.key
|
|
echo ${{ secrets.INGRESS_API_CERT }} | base64 --decode > ${HOME}/ingress.mcp.crt
|
|
echo ${{ secrets.INGRESS_API_CERT_KEY }} | base64 --decode > ${HOME}/ingress.mcp.key
|
|
kubectl create secret tls mcp.gauzy.co-tls --save-config --dry-run=client --cert=${HOME}/ingress.mcp.crt --key=${HOME}/ingress.mcp.key -o yaml | kubectl apply -f -
|
|
|
|
- name: Apply k8s manifests changes in DigitalOcean k8s cluster (if any)
|
|
run: |
|
|
envsubst < $GITHUB_WORKSPACE/.deploy/k8s/k8s-manifest.mcp.prod.yaml | kubectl --context do-sfo2-k8s-gauzy apply -f -
|
|
env:
|
|
# MCP Server Configuration
|
|
REDIS_ENABLED: '${{ secrets.REDIS_ENABLED }}'
|
|
REDIS_URL: '${{ secrets.REDIS_URL }}'
|
|
REDIS_HOST: '${{ secrets.REDIS_HOST }}'
|
|
REDIS_PASSWORD: '${{ secrets.REDIS_PASSWORD }}'
|
|
REDIS_PORT: '${{ secrets.REDIS_PORT }}'
|
|
REDIS_USER: '${{ secrets.REDIS_USER }}'
|
|
REDIS_TLS: '${{ secrets.REDIS_TLS }}'
|
|
MCP_TRANSPORT: '${{ secrets.MCP_TRANSPORT }}'
|
|
MCP_SERVER_MODE: '${{ secrets.MCP_SERVER_MODE }}'
|
|
MCP_HTTP_PORT: '${{ secrets.MCP_HTTP_PORT }}'
|
|
MCP_HTTP_HOST: '${{ secrets.MCP_HTTP_HOST }}'
|
|
MCP_WS_PORT: '${{ secrets.MCP_WS_PORT }}'
|
|
MCP_WS_HOST: '${{ secrets.MCP_WS_HOST }}'
|
|
|
|
# Security and CORS
|
|
MCP_CORS_ORIGIN: '${{ secrets.MCP_CORS_ORIGIN_PROD }}'
|
|
MCP_CORS_CREDENTIALS: '${{ secrets.MCP_CORS_CREDENTIALS }}'
|
|
|
|
# OAuth 2.0 Authorization
|
|
MCP_AUTH_ENABLED: '${{ secrets.MCP_AUTH_ENABLED }}'
|
|
MCP_AUTH_RESOURCE_URI: '${{ secrets.MCP_AUTH_RESOURCE_URI_PROD }}'
|
|
MCP_AUTH_REQUIRED_SCOPES: '${{ secrets.MCP_AUTH_REQUIRED_SCOPES }}'
|
|
MCP_AUTH_SERVERS: '${{ secrets.MCP_AUTH_SERVERS }}'
|
|
MCP_AUTH_JWT_AUDIENCE: '${{ secrets.MCP_AUTH_JWT_AUDIENCE_PROD }}'
|
|
MCP_AUTH_JWT_ISSUER: '${{ secrets.MCP_AUTH_JWT_ISSUER }}'
|
|
MCP_AUTH_JWT_ALGORITHMS: '${{ secrets.MCP_AUTH_JWT_ALGORITHMS }}'
|
|
MCP_AUTH_JWT_JWKS_URI: '${{ secrets.MCP_AUTH_JWT_JWKS_URI }}'
|
|
MCP_AUTH_TOKEN_CACHE_TTL: '${{ secrets.MCP_AUTH_TOKEN_CACHE_TTL }}'
|
|
MCP_AUTH_METADATA_CACHE_TTL: '${{ secrets.MCP_AUTH_METADATA_CACHE_TTL }}'
|
|
|
|
# Session Management
|
|
MCP_SESSION_ENABLED: '${{ secrets.MCP_SESSION_ENABLED }}'
|
|
MCP_SESSION_COOKIE_NAME: '${{ secrets.MCP_SESSION_COOKIE_NAME }}'
|
|
MCP_SESSION_TTL: '${{ secrets.MCP_SESSION_TTL }}'
|
|
MCP_AUTH_SESSION_SECRET: '${{ secrets.MCP_AUTH_SESSION_SECRET_PROD }}'
|
|
|
|
# Rate Limiting
|
|
THROTTLE_ENABLED: '${{ secrets.THROTTLE_ENABLED }}'
|
|
THROTTLE_TTL: '${{ secrets.THROTTLE_TTL }}'
|
|
THROTTLE_LIMIT: '${{ secrets.THROTTLE_LIMIT }}'
|
|
|
|
# Gauzy API Integration
|
|
API_BASE_URL: '${{ secrets.API_BASE_URL_PROD }}'
|
|
GAUZY_AUTO_LOGIN: '${{ secrets.GAUZY_AUTO_LOGIN }}'
|
|
|
|
# we need this step because for now we just use :latest tag
|
|
# note: for production we will use different strategy later
|
|
- name: Restart Pods to pick up :latest tag version
|
|
run: |
|
|
kubectl --context do-sfo2-k8s-gauzy rollout restart deployment/gauzy-mcp-prod
|