Staging

.github/workflows/deploy-staging-k8s.yml

@@ -0,0 +1,76 @@
+name: Ghost Ops - API & Worker Deployment
+
+on:
+  push:
+    branches: [staging]
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare variables
+        id: vars
+        run: |
+          echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+          echo "owner_lc=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_OUTPUT
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # --- Budowanie API ---
+      - name: Build & Push API
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: cmd/api/Dockerfile
+          push: true
+          tags: ghcr.io/${{ steps.vars.outputs.owner_lc }}/http-server-api:${{ steps.vars.outputs.sha_short }}
+
+      # --- Budowanie WORKERA ---
+      - name: Build & Push Worker
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: cmd/worker/Dockerfile
+          push: true
+          tags: ghcr.io/${{ steps.vars.outputs.owner_lc }}/http-server-worker:${{ steps.vars.outputs.sha_short }}
+
+      # --- ENTERPRISE GITOPS: Aktualizacja OSOBNEGO repozytorium infrastruktury ---
+      - name: Update Infrastructure Repo
+        env:
+          INFRA_TOKEN: ${{ secrets.INFRA_REPO_TOKEN }}
+          SHA: ${{ steps.vars.outputs.sha_short }}
+          OWNER: ${{ steps.vars.outputs.owner_lc }}
+        run: |
+          # 1. Konfiguracja tożsamości Gita
+          git config --global user.name "github-actions"
+          git config --global user.email "github-actions@github.com"
+
+          # 2. Klonowanie repozytorium INFRA (używamy PAT do autoryzacji)
+          # Zwróć uwagę na nazwę repo: k3s-gitops-infra
+          git clone https://$INFRA_TOKEN@github.com/${{ github.repository_owner }}/k3s-gitops-infra.git temp_infra
+
+          cd temp_infra
+
+          # 3. Aktualizacja tagów obrazów w nowej strukturze folderów
+          # Szukamy linii z obrazem i podmieniamy na nowy SHA
+          echo "Updating images to version: $SHA"
+
+          sed -i "s|image: ghcr.io/.*/http-server-api:.*|image: ghcr.io/$OWNER/http-server-api:$SHA|g" overlays/staging/api/deployment.yaml
+          sed -i "s|image: ghcr.io/.*/http-server-worker:.*|image: ghcr.io/$OWNER/http-server-worker:$SHA|g" overlays/staging/worker/deployment.yaml
+
+          # 4. Commit i Push zmian do repozytorium INFRA
+          git add .
+          git commit -m "Deploy: API & Worker update to $SHA (triggered by http-server commit)" || echo "No changes to commit"
+          git push origin main

cmd/api/.dockerignore

@@ -0,0 +1,7 @@
+.git
+.gitignore
+docker-compose*
+Dockerfile*
+bin
+obj
+*.md

cmd/api/Dockerfile

@@ -1,20 +1,43 @@
-# Dockerfile.api
+FROM golang:1.26-alpine AS builder
 
-FROM golang:1.25-alpine AS builder
+RUN apk add --no-cache ca-certificates git tzdata
 
-WORKDIR /app
+WORKDIR /src
 
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o app ./cmd/api
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-w -s" -o /app/server ./cmd/api
 
-FROM alpine:latest
+FROM alpine:3.19.1 AS final
 
-WORKDIR /app
+LABEL org.opencontainers.image.source="https://github.com/ZeroDayZ7/http-server"
+LABEL org.opencontainers.image.description="Hardened Go API"
 
-COPY --from=builder /app/app .
+RUN apk update && \
+    apk add --no-cache ca-certificates tzdata && \
+    rm -rf /var/cache/apk/*
 
-CMD ["./app"]
+RUN addgroup -S appgroup && \
+    adduser -S -u 10001 -g appgroup appuser
+
+WORKDIR /home/appuser
+
+COPY --from=builder --chown=appuser:appgroup /app/server .
+COPY --from=builder --chown=appuser:appgroup /src/migrations ./migrations
+
+RUN chmod 500 ./server && \
+    chmod 500 ./migrations && \
+    chmod 400 ./migrations/*
+
+USER appuser
+
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
+
+ENTRYPOINT ["./server"]

cmd/api/main.go

@@ -43,7 +43,7 @@ func main() {
 	defer stop()
 
 	// 3. Inicjalizacja infrastruktury
-	db, err := config.InitDB(ctx, cfg.Database, log)
+	db, err := config.InitDB(ctx, cfg.Database, log, true)
 	if err != nil {
 		log.Fatal("Database initialization failed", zap.Error(err))
 	}

cmd/worker/.dockerignore

@@ -0,0 +1,7 @@
+.git
+.gitignore
+docker-compose*
+Dockerfile*
+bin
+obj
+*.md

cmd/worker/Dockerfile

@@ -1,22 +1,35 @@
-# Dockerfile.worker
-
-FROM golang:1.25-alpine AS builder
-
-WORKDIR /app
+FROM golang:1.26-alpine AS builder
 
+RUN apk add --no-cache ca-certificates git tzdata
+WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
 
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o worker ./cmd/worker
+# Dodano -trimpath dla bezpieczeństwa logów
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -trimpath -ldflags="-w -s" -o /app/worker ./cmd/worker
+
+FROM alpine:3.19 AS final
+
+# Dodano LABEL dla porządku w GitHubie
+LABEL org.opencontainers.image.source="https://github.com/ZeroDayZ7/http-server"
+LABEL org.opencontainers.image.description="Hardened Go Worker"
+
+# Dodano apk update i czyszczenie cache
+RUN apk update && \
+    apk add --no-cache ca-certificates tzdata && \
+    rm -rf /var/cache/apk/*
+
+RUN addgroup -S workergroup && \
+    adduser -S -u 10002 -g workergroup workeruser
 
-FROM alpine:latest
+WORKDIR /home/workeruser
 
-WORKDIR /app
+COPY --from=builder --chown=workeruser:workergroup /app/worker .
 
-COPY --from=builder /app/worker .
+RUN chmod 500 ./worker
 
-COPY --from=builder /app/migrations ./migrations
+USER workeruser
 
-CMD ["./worker"]
+ENTRYPOINT ["./worker"]

cmd/worker/main.go

@@ -60,7 +60,7 @@ func main() {
 	g, gCtx := errgroup.WithContext(ctx)
 
 	// infra init
-	db, err := config.InitDB(ctx, cfg.Database, log)
+	db, err := config.InitDB(ctx, cfg.Database, log, false)
 	if err != nil {
 		log.Fatal("Database initialization failed", zap.Error(err))
 	}

config/app.go

@@ -42,7 +42,7 @@ func NewFiberApp(cfg *env.Config, log logger.Logger) *fiber.App {
 
 	app.Use(cors.New(CorsConfig(cfg)))
 	app.Use(helmet.New(HelmetConfig()))
-	// app.Use(NewLimiter(cfg, "global"))
+	app.Use(GetLimiter(cfg, LimitApp))
 	app.Use(compress.New(CompressConfig()))
 
 	return app

config/db.go

@@ -12,7 +12,7 @@ import (
 	"go.uber.org/zap"
 )
 
-func InitDB(ctx context.Context, cfg env.DBConfig, log logger.Logger) (*sql.DB, error) {
+func InitDB(ctx context.Context, cfg env.DBConfig, log logger.Logger, runMigrations bool) (*sql.DB, error) {
 	dsn := fmt.Sprintf(
 		"%s:%s@tcp(%s:%s)/%s?parseTime=true",
 		cfg.User, cfg.Password, cfg.Host, cfg.Port, cfg.DBName,
@@ -34,10 +34,14 @@ func InitDB(ctx context.Context, cfg env.DBConfig, log logger.Logger) (*sql.DB,
 		return nil, fmt.Errorf("db ping failed: %w", err)
 	}
 
-	if err := RunMigrations(db, log); err != nil {
-		return nil, fmt.Errorf("migrations failed: %w", err)
+	if runMigrations {
+		if err := RunMigrations(db, log); err != nil {
+			return nil, fmt.Errorf("migrations failed: %w", err)
+		}
+		log.Info("MySQL connected and migrations applied", zap.String("database", cfg.DBName))
+	} else {
+		log.Info("MySQL connected (migrations skipped)", zap.String("database", cfg.DBName))
 	}
 
-	log.Info("MySQL connected and migrations applied", zap.String("database", cfg.DBName))
 	return db, nil
 }

config/env/defaults.go

@@ -10,7 +10,7 @@ func setDefaults() {
 	// Server
 	viper.SetDefault("APP_NAME", "http-server")
 	viper.SetDefault("PORT", "8080")
-	viper.SetDefault("WORKERPORT", "8081")
+	viper.SetDefault("WORKER_PORT", "8081")
 	viper.SetDefault("BODY_LIMIT_MB", 2)
 	viper.SetDefault("APP_VERSION", "0.1.0")
 	viper.SetDefault("ENV", "development")
@@ -27,7 +27,7 @@ func setDefaults() {
 	viper.SetDefault("DB_PASSWORD", "password")
 	viper.SetDefault("DB_HOST", "localhost")
 	viper.SetDefault("DB_PORT", "3306")
-	viper.SetDefault("DB_NAME", "appdb")
+	viper.SetDefault("DB_NAME", "portfolio_db")
 	viper.SetDefault("DB_MAX_OPEN_CONNS", 50)
 	viper.SetDefault("DB_MAX_IDLE_CONNS", 10)
 	viper.SetDefault("DB_CONN_MAX_LIFETIME", 30*time.Minute)

config/env/loader.go

@@ -18,6 +18,10 @@ func LoadConfig(cfg *Config) error {
 	viper.AutomaticEnv()
 	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 
+	viper.BindEnv("WORKER_PORT")
+	viper.BindEnv("DB_HOST")
+	viper.BindEnv("ENV")
+
 	// AUTO detect pliku .env
 	if fileExists(".env") {
 		viper.SetConfigFile(".env")