SpongePowered / SpongeAuth / 38098594181

96%

push

github

feat(deploy): various small changes to enable k8s deployments (#1994)

* feat(core): add /healthz, stderr logging, proxy TLS

- Add GET /healthz returning 200 "ok" without touching the DB or redis,
 for k8s liveness/readiness probes; a test enforces the no-DB rule
- Send Django's own log output to stderr via a root console handler;
 previously app log messages only reached Sentry
- Set SECURE_PROXY_SSL_HEADER so request.is_secure() follows the
 ingress's X-Forwarded-Proto. Absolute URLs built from the request
 (verification/reset emails, the API's avatar_url) become https://.SSO
 payloads contain no URLs, so DiscourseConnect is unchanged.

* feat(entrypoint): add RUN_MIGRATIONS, exec gunicorn

- Skip `migrate` when RUN_MIGRATIONS=false, enables migrations to run as
 an init container or Job
- Pass --noinput to migrate
- Exec gunicorn so it runs as PID 1 and receives SIGTERM for pod
 shutdown handling

* fix(nginx): adapt config for k8s sidecar

- Proxy to the app at 127.0.0.1:8080; docker-compose.yml runs nginx in
  the app container's network namespace so the same config works there
- Log to stdout/stderr, cap uploads at 10M, cache avatars under
  /var/cache/nginx/avatar, drop the missing dynamic-module include
- Pass the ingress's X-Forwarded-Proto through to the app
- Take the client IP from X-Forwarded-For, trusting only the proxies
  in NGINX_TRUSTED_PROXIES; nginx-trusted-proxies.sh renders them at
  startup from /docker-entrypoint.d/ and rejects malformed entries

Signed-off-by: Gabriel Harris-Rouquette <gabizou@me.com>

* feat(ci): add release workflow

---------

Signed-off-by: Gabriel Harris-Rouquette <gabizou@me.com>

340 of 372 branches covered (91.4%)

Branch coverage included in aggregate %.

1621 of 1667 relevant lines covered (97.24%)

0.97 hits per line