Skip to content

Commit d329072

Browse files
leeseojun34leeseojun34
committed
๐Ÿ› fix: Secret Manager ๊ฐ’์„ ์ฝ์ง€ ๋ชปํ•˜๋Š” ๋ฌธ์ œ ํ•ด๊ฒฐ
๋ฐฐํฌ ์‹œ์ ์˜ Secret Manager ๊ฐ’์„ .env ํŒŒ์ผ์— ์ €์žฅํ•˜์—ฌ ๋ฐฐํฌํ•˜๋„๋ก ์ˆ˜์ •
1 parent 2f0b205 commit d329072

File tree

3 files changed

+129
-48
lines changed

3 files changed

+129
-48
lines changed

โ€Ž.github/workflows/deploy.ymlโ€Ž

Lines changed: 68 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ jobs:
8181
runs-on: ubuntu-latest
8282

8383
steps:
84-
8584
- name: Deploy to GCP Instance
8685
uses: appleboy/ssh-action@v1.1.0
8786
with:
@@ -92,29 +91,91 @@ jobs:
9291
script: |
9392
cd $HOME/project
9493
94+
echo "Updating .env file with latest Secret Manager values..."
95+
96+
# .env ํŒŒ์ผ ๋ฐฑ์—…
97+
cp .env .env.backup.$(date +%Y%m%d_%H%M%S)
98+
99+
# Secret Manager ๊ด€๋ จ ๋ผ์ธ๋“ค ์ œ๊ฑฐ
100+
sed -i '/^DB_URL=/d' .env
101+
sed -i '/^JWT_SECRET=/d' .env
102+
sed -i '/^GOOGLE_CLIENT_ID=/d' .env
103+
sed -i '/^GOOGLE_CLIENT_SECRET=/d' .env
104+
sed -i '/^GOOGLE_API_KEY=/d' .env
105+
sed -i '/^GOOGLE_CALENDAR_REDIRECT_URI=/d' .env
106+
sed -i '/^OAUTH_REDIRECT_URI=/d' .env
107+
sed -i '/^KAKAO_CLIENT_ID=/d' .env
108+
sed -i '/^KAKAO_CLIENT_SECRET=/d' .env
109+
sed -i '/^KAKAO_API_KEY=/d' .env
110+
sed -i '/^ZOOM_ACCOUNT_ID=/d' .env
111+
sed -i '/^ZOOM_CLIENT_ID=/d' .env
112+
sed -i '/^ZOOM_CLIENT_SECRET=/d' .env
113+
sed -i '/^GCP_IP=/d' .env
114+
sed -i '/^FRONT_DOMAIN_A=/d' .env
115+
sed -i '/^FRONT_DOMAIN_B=/d' .env
116+
sed -i '/^FRONT_CALLBACK=/d' .env
117+
sed -i '/^REDIS_HOST=/d' .env
118+
sed -i '/^REDIS_PORT=/d' .env
119+
120+
# Secret Manager์—์„œ ์ตœ์‹  ๊ฐ’๋“ค์„ ๊ฐ€์ ธ์™€์„œ .env์— ์ถ”๊ฐ€
121+
echo "" >> .env
122+
echo "DB_URL=$(gcloud secrets versions access latest --secret='db-url')" >> .env
123+
echo "JWT_SECRET=$(gcloud secrets versions access latest --secret='jwt-secret')" >> .env
124+
echo "GOOGLE_CLIENT_ID=$(gcloud secrets versions access latest --secret='google-client-id')" >> .env
125+
echo "GOOGLE_CLIENT_SECRET=$(gcloud secrets versions access latest --secret='google-client-secret')" >> .env
126+
echo "GOOGLE_API_KEY=$(gcloud secrets versions access latest --secret='google-api-key')" >> .env
127+
echo "GOOGLE_CALENDAR_REDIRECT_URI=$(gcloud secrets versions access latest --secret='google-calendar-redirect-uri')" >> .env
128+
echo "OAUTH_REDIRECT_URI=$(gcloud secrets versions access latest --secret='oauth-redirect-uri')" >> .env
129+
echo "KAKAO_CLIENT_ID=$(gcloud secrets versions access latest --secret='kakao-client-id')" >> .env
130+
echo "KAKAO_CLIENT_SECRET=$(gcloud secrets versions access latest --secret='kakao-client-secret')" >> .env
131+
echo "KAKAO_API_KEY=$(gcloud secrets versions access latest --secret='kakao-api-key')" >> .env
132+
echo "ZOOM_ACCOUNT_ID=$(gcloud secrets versions access latest --secret='zoom-account-id')" >> .env
133+
echo "ZOOM_CLIENT_ID=$(gcloud secrets versions access latest --secret='zoom-client-id')" >> .env
134+
echo "ZOOM_CLIENT_SECRET=$(gcloud secrets versions access latest --secret='zoom-client-secret')" >> .env
135+
echo "GCP_IP=$(gcloud secrets versions access latest --secret='gcp-ip')" >> .env
136+
echo "FRONT_DOMAIN_A=$(gcloud secrets versions access latest --secret='front-domain-A')" >> .env
137+
echo "FRONT_DOMAIN_B=$(gcloud secrets versions access latest --secret='front-domain-B')" >> .env
138+
echo "FRONT_CALLBACK=$(gcloud secrets versions access latest --secret='front-callback')" >> .env
139+
echo "REDIS_HOST=$(gcloud secrets versions access latest --secret='redis-host')" >> .env
140+
echo "REDIS_PORT=$(gcloud secrets versions access latest --secret='redis-port')" >> .env
141+
142+
echo "Updated Secret Manager Values"
143+
144+
echo "Stopping existing containers..."
95145
sudo docker-compose down || true
96146
147+
echo "Cleaning up old images..."
97148
sudo docker image prune -f
98-
sudo docker rmi ${{ secrets.DOCKER_USERNAME }}/ittaeok-gcp:latest || true
149+
sudo docker rmi ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE_NAME }}:latest || true
99150
sudo docker system prune -f || true
100151
101-
sudo docker pull ${{ secrets.DOCKER_USERNAME }}/ittaeok-gcp:latest --disable-content-trust
152+
echo "Pulling latest image..."
153+
sudo docker pull ${{ secrets.DOCKER_USERNAME }}/${{ secrets.DOCKER_IMAGE_NAME }}:latest --disable-content-trust
102154
155+
echo "Starting containers with updated configuration..."
103156
sudo docker-compose up -d
104157
158+
echo "Container status:"
105159
sudo docker-compose ps
106160
107-
sleep 10
108-
sudo docker-compose logs --tail=20
161+
echo "Waiting for application to start..."
162+
sleep 15
163+
164+
echo "Recent logs:"
165+
sudo docker-compose logs --tail=30
109166
110167
echo "=== Deployed Image Info ==="
111-
sudo docker images | grep ittaeok-gcp
168+
sudo docker images | grep ${{ secrets.DOCKER_IMAGE_NAME }}
112169
113170
echo "=== Container Info ==="
114171
sudo docker ps | grep ittaeok
172+
173+
echo "=== Environment Variables Verification ==="
174+
sudo docker exec ittaeok env | grep -E "(DB_URL|JWT_SECRET|REDIS_HOST)" | head -3
115175
116176
- name: Deployment completed
117177
run: |
118178
echo "Deployment completed successfully"
119179
echo "Deployed commit: ${{ github.sha }}"
120-
echo "Repository: ${{ github.repository }}"
180+
echo "Repository: ${{ github.repository }}"
181+
echo "Secret Manager values automatically updated"

โ€Ždocker-compose.ymlโ€Ž

Lines changed: 36 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ services:
4040
start_period: 30s
4141

4242
ittaeok-container:
43-
image: ${DOCKER_IMAGES_NAME} # ex: leeseojun/ittaeok:latest
43+
image: ${DOCKER_IMAGES_NAME}
4444
container_name: ittaeok
4545
restart: always
4646
depends_on:
@@ -52,20 +52,41 @@ services:
5252
- "80:80"
5353
- "443:443"
5454
environment:
55-
- SPRING_DATASOURCE_URL=jdbc:mysql://mysql-container:3306/ittaeok?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=Asia/Seoul
56-
- SPRING_DATASOURCE_USERNAME=ittaeok_user
57-
- SPRING_DATASOURCE_PASSWORD=1234
58-
59-
- SPRING_DATA_REDIS_HOST=redis-container
60-
- SPRING_DATA_REDIS_PORT=6379
61-
- SPRING_DATA_REDIS_PASSWORD=${REDIS_PASSWORD}
62-
- SPRING_DATA_REDIS_SSL_ENABLED=false
63-
64-
- GOOGLE_APPLICATION_CREDENTIALS=${GOOGLE_APPLICATION_CREDENTIALS}
65-
- GOOGLE_CLOUD_PROJECT=${GOOGLE_CLOUD_PROJECT}
66-
67-
- SPRING_CLOUD_GCP_SECRETMANAGER_ENABLED="true"
68-
- SPRING_CLOUD_GCP_PROJECT_ID=${GOOGLE_CLOUD_PROJECT}
55+
# Database
56+
- DB_URL=${DB_URL}
57+
- MYSQL_USER=${MYSQL_USER}
58+
- MYSQL_PASSWORD=${MYSQL_PASSWORD}
59+
60+
# Redis
61+
- REDIS_HOST=${REDIS_HOST}
62+
- REDIS_PORT=${REDIS_PORT}
63+
- REDIS_PASSWORD=${REDIS_PASSWORD}
64+
65+
# JWT
66+
- JWT_SECRET=${JWT_SECRET}
67+
68+
# Google
69+
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}
70+
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}
71+
- GOOGLE_API_KEY=${GOOGLE_API_KEY}
72+
- OAUTH_REDIRECT_URI=${OAUTH_REDIRECT_URI}
73+
- GOOGLE_CALENDAR_REDIRECT_URI=${GOOGLE_CALENDAR_REDIRECT_URI}
74+
75+
# Kakao
76+
- KAKAO_CLIENT_ID=${KAKAO_CLIENT_ID}
77+
- KAKAO_CLIENT_SECRET=${KAKAO_CLIENT_SECRET}
78+
- KAKAO_API_KEY=${KAKAO_API_KEY}
79+
80+
# Zoom
81+
- ZOOM_ACCOUNT_ID=${ZOOM_ACCOUNT_ID}
82+
- ZOOM_CLIENT_ID=${ZOOM_CLIENT_ID}
83+
- ZOOM_CLIENT_SECRET=${ZOOM_CLIENT_SECRET}
84+
85+
# URL
86+
- GCP_IP=${GCP_IP}
87+
- FRONT_DOMAIN_A=${FRONT_DOMAIN_A}
88+
- FRONT_DOMAIN_B=${FRONT_DOMAIN_B}
89+
- FRONT_CALLBACK=${FRONT_CALLBACK}
6990
volumes:
7091
- ./gcp-key.json:/app/gcp-key.json:ro
7192
networks:

โ€Žsrc/main/resources-env/prod/application.ymlโ€Ž

Lines changed: 25 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ server:
33

44
spring:
55
datasource:
6-
url: ${sm://db-url}
7-
username: ${sm://db-username}
8-
password: ${sm://db-password}
6+
url: ${DB_URL}
7+
username: ${MYSQL_USER}
8+
password: ${MYSQL_PASSWORD}
99
hikari:
1010
connection-timeout: 30000
1111
maximum-pool-size: 10
@@ -26,10 +26,10 @@ spring:
2626
lifecycle-management: start-only
2727
data:
2828
redis:
29-
host: ${sm://redis-host}
30-
port: ${sm://redis-port}
29+
host: ${REDIS_HOST}
30+
port: ${REDIS_PORT}
31+
password: ${REDIS_PASSWORD}
3132
username: default
32-
password: ${sm://redis-password}
3333
ssl:
3434
enabled: true
3535
security:
@@ -38,19 +38,19 @@ spring:
3838
registration:
3939
google:
4040
client-name: google
41-
client-id: ${sm://google-client-id}
42-
client-secret: ${sm://google-client-secret}
43-
redirect-uri: "https://api.ittaeok.com/login/oauth2/code/{registrationId}" # SM ๋ถ™์ด๊ธฐ
41+
client-id: ${GOOGLE_CLIENT_ID}
42+
client-secret: ${GOOGLE_CLIENT_SECRET}
43+
redirect-uri: ${OAUTH_REDIRECT_URI}
4444
authorization-grant-type: authorization_code
4545
scope:
4646
- openid
4747
- email
4848
- profile
4949
kakao:
5050
client-name: kakao
51-
client-id: ${sm://kakao-client-id}
52-
client-secret: ${sm://kakao-client-secret}
53-
redirect-uri: "https://api.ittaeok.com/login/oauth2/code/{registrationId}" # SM ๋ถ™์ด๊ธฐ
51+
client-id: ${KAKAO_CLIENT_ID}
52+
client-secret: ${KAKAO_CLIENT_SECRET}
53+
redirect-uri: ${OAUTH_REDIRECT_URI}
5454
authorization-grant-type: authorization_code
5555
client-authentication-method: client_secret_post
5656
scope:
@@ -67,22 +67,21 @@ springdoc:
6767
jwt:
6868
expiration: 604800000
6969
refresh-expiration: 704800000
70-
secret: ${sm://jwt-secret}
70+
secret: ${JWT_SECRET}
7171
google:
7272
calendar:
73-
client-id: ${sm://google-client-id}
74-
client-secret: ${sm://google-client-secret}
75-
redirect-uri: "https://api.ittaeok.com/oauth2/callback/google-calendar" # SM ๋ถ™์ด๊ธฐ
73+
client-id: ${google-client-id}
74+
client-secret: ${google-client-secret}
75+
redirect-uri: ${google-calendar_redirect_uri}
7676
api:
77-
key: ${sm://google-api-key}
77+
key: ${GOOGLE_API_KEY}
7878
zoom:
79-
client-id: ${sm://zoom-client-id}
80-
client-secret: ${sm://zoom-client-secret}
81-
redirect-uri: ${sm://zoom-redirect-uri}
82-
refresh-token: ${sm://zoom-refresh-token}
79+
account-id: ${ZOOM_ACCOUNT_ID}
80+
client-id: ${ZOOM_CLIENT_ID}
81+
client-secret: ${ZOOM_CLIENT_SECRET}
8382
kakao:
8483
middle-location:
85-
api-key: ${sm://kakao-api-key}
84+
api-key: ${KAKAO_API_KEY}
8685
logging:
8786
level:
8887
org.springframework.cloud.gcp.secretmanager: DEBUG
@@ -95,8 +94,8 @@ logging:
9594
sql: info
9695

9796
url:
98-
backend: https://api.ittaeok.com # SM ๋ถ™์ด๊ธฐ
97+
backend: ${GCP_IP}
9998
front-server:
100-
domain-A: https://ittaeok.com # SM ๋ถ™์ด๊ธฐ
101-
domain-B: https://www.ittaeok.com # SM ๋ถ™์ด๊ธฐ
102-
redirect-url: https://ittaeok.com/auth/callback # SM ๋ถ™์ด๊ธฐ
99+
domain-A: ${FRONT_DOMAIN_A}
100+
domain-B: ${FRONT_DOMAIN_B}
101+
redirect-url: ${FRONT_CALLBACK}

0 commit comments

Comments
ย (0)