Add Jenkins pipeline and VM deploy script for Azure MVP.

baasith6 · cursoragent · baasith6 · commit 6a4ee536fb56 · 2026-07-29T14:15:54.000+05:30
Enables CI, tarball deploy to /opt/onevo/app, and smoke tests from local Jenkins.

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/.github/workflows/deploy-mvp.yml b/.github/workflows/deploy-mvp.yml
@@ -2,7 +2,7 @@ name: Deploy MVP (Azure)
 
 on:
   push:
-    branches: [main]
+    branches: [main, azure-mvp-deploy]
   workflow_dispatch:
 
 concurrency:
@@ -11,6 +11,7 @@ concurrency:
 
 env:
   IMAGE_TAG: ${{ github.sha }}
+  ONEVO_APP_DIR: /opt/onevo/app
 
 jobs:
   build-push:
@@ -100,7 +101,8 @@ jobs:
             --exclude node_modules \
             --exclude dashboard/dist \
             --exclude connector/dist/build \
-            -e ssh ./ "${VM_USER}@${VM_HOST}:/opt/onevo/"
+            --exclude "installer-site/*.exe" \
+            -e ssh ./ "${VM_USER}@${VM_HOST}:${ONEVO_APP_DIR}/"
 
       - name: Write production .env and deploy
         env:
@@ -110,7 +112,7 @@ jobs:
           DASHBOARD_IMAGE: ${{ needs.build-push.outputs.dashboard_image }}
           CLOUD_AI_IMAGE: ${{ needs.build-push.outputs.cloud_ai_image }}
         run: |
-          ssh "${VM_USER}@${VM_HOST}" "mkdir -p /opt/onevo/connector/dist"
+          ssh "${VM_USER}@${VM_HOST}" "mkdir -p ${ONEVO_APP_DIR}/installer-site ${ONEVO_APP_DIR}/connector/dist"
           printf '%s\n' "${{ secrets.PRODUCTION_ENV }}" > /tmp/onevo.env
           {
             echo ""
@@ -121,8 +123,8 @@ jobs:
             echo "ACR_USERNAME=${{ secrets.ACR_USERNAME }}"
             echo "ACR_PASSWORD=${{ secrets.ACR_PASSWORD }}"
           } >> /tmp/onevo.env
-          scp /tmp/onevo.env "${VM_USER}@${VM_HOST}:/opt/onevo/.env"
-          ssh "${VM_USER}@${VM_HOST}" "chmod +x /opt/onevo/infra/mvp/deploy.sh && /opt/onevo/infra/mvp/deploy.sh"
+          scp /tmp/onevo.env "${VM_USER}@${VM_HOST}:${ONEVO_APP_DIR}/.env"
+          ssh "${VM_USER}@${VM_HOST}" "chmod +x ${ONEVO_APP_DIR}/infra/mvp/deploy.sh && ONEVO_DIR=${ONEVO_APP_DIR} USE_GPU=false DEPLOY_MODE=acr ${ONEVO_APP_DIR}/infra/mvp/deploy.sh"
 
       - name: Smoke test (public API)
         env:
@@ -168,7 +170,7 @@ jobs:
           pip install -r connector/requirements-build.txt
           $url = "${{ secrets.BACKEND_PUBLIC_URL }}"
           if (-not $url) { throw "Set BACKEND_PUBLIC_URL secret (https://api.yourdomain.example)" }
-          ./scripts/build-installer.ps1 -BackendUrl $url
+          ./scripts/build-installer.ps1 -BackendUrl $url -AllowHttp
 
       - name: Upload installer artifact
         uses: actions/upload-artifact@v4
@@ -188,5 +190,7 @@ jobs:
           if (-not $exe) { throw "Installer EXE not found" }
           $keyPath = "$env:RUNNER_TEMP/deploy_key"
           Set-Content -Path $keyPath -Value $env:VM_SSH_KEY -NoNewline
-          scp -i $keyPath -o StrictHostKeyChecking=no $exe.FullName "${env:VM_USER}@${env:VM_HOST}:/opt/onevo/connector/dist/"
-          ssh -i $keyPath -o StrictHostKeyChecking=no "${env:VM_USER}@${env:VM_HOST}" "ls -la /opt/onevo/connector/dist/"
+          $appDir = "/opt/onevo/app"
+          scp -i $keyPath -o StrictHostKeyChecking=no $exe.FullName "${env:VM_USER}@${env:VM_HOST}:${appDir}/installer-site/"
+          scp -i $keyPath -o StrictHostKeyChecking=no $exe.FullName "${env:VM_USER}@${env:VM_HOST}:${appDir}/connector/dist/"
+          ssh -i $keyPath -o StrictHostKeyChecking=no "${env:VM_USER}@${env:VM_HOST}" "ls -la ${appDir}/installer-site/"
diff --git a/Jenkinsfile b/Jenkinsfile
@@ -0,0 +1,89 @@
+pipeline {
+  agent any
+
+  parameters {
+    string(name: 'VM_HOST', defaultValue: '20.193.69.220', description: 'Azure VM public IP')
+    string(name: 'VM_USER', defaultValue: 'azureuser', description: 'SSH user on VM')
+    string(name: 'BACKEND_URL', defaultValue: 'http://20.193.69.220:8081', description: 'Public API URL (installer bake + smoke)')
+    booleanParam(name: 'SKIP_INSTALLER', defaultValue: false, description: 'Skip Windows connector EXE build/upload')
+    booleanParam(name: 'SKIP_CI', defaultValue: false, description: 'Skip CI build/test stages')
+    booleanParam(name: 'USE_GPU', defaultValue: false, description: 'Include docker-compose.gpu.yml (requires NVIDIA on VM)')
+  }
+
+  environment {
+    VM_APP_DIR = '/opt/onevo/app'
+  }
+
+  stages {
+    stage('CI') {
+      when { expression { !params.SKIP_CI } }
+      parallel {
+        stage('Backend') {
+          steps {
+            dir('backend') {
+              bat 'dotnet restore Onevo.Api.csproj'
+              bat 'dotnet build Onevo.Api.csproj -c Release --no-restore'
+            }
+          }
+        }
+        stage('Dashboard') {
+          steps {
+            dir('dashboard') {
+              bat 'npm ci'
+              bat 'npm run build'
+            }
+          }
+        }
+        stage('Connector tests') {
+          steps {
+            dir('connector') {
+              bat 'pip install -r requirements.txt pytest'
+              bat 'set PYTHONPATH=.&& python -m pytest tests/ -q'
+            }
+          }
+        }
+      }
+    }
+
+    stage('Deploy to VM') {
+      steps {
+        script {
+          def extra = ''
+          if (params.SKIP_INSTALLER) { extra += ' -SkipInstaller' }
+          if (params.USE_GPU) { extra += ' -UseGpu' }
+          withCredentials([sshUserPrivateKey(
+            credentialsId: 'onevo-vm-ssh-key',
+            keyFileVariable: 'SSH_KEY',
+            usernameVariable: 'SSH_USER'
+          )]) {
+            bat """
+              powershell -ExecutionPolicy Bypass -File scripts/deploy-vm.ps1 ^
+                -VmHost ${params.VM_HOST} ^
+                -VmUser ${params.VM_USER} ^
+                -BackendUrl ${params.BACKEND_URL} ^
+                -SshKeyPath %SSH_KEY%${extra}
+            """
+          }
+        }
+      }
+    }
+
+    stage('Smoke test') {
+      steps {
+        bat """
+          curl -sf ${params.BACKEND_URL}/api/health
+          curl -sf -o NUL -w "Dashboard HTTP %%{http_code}\\n" http://${params.VM_HOST}:4200/
+        """
+      }
+    }
+  }
+
+  post {
+    success {
+      echo "ONEVO deploy succeeded — dashboard http://${params.VM_HOST}:4200"
+    }
+    failure {
+      echo 'Deploy failed — check Jenkins console and VM docker compose logs.'
+    }
+  }
+}
diff --git a/docs/AZURE_MVP_DEPLOY.md b/docs/AZURE_MVP_DEPLOY.md
@@ -8,9 +8,9 @@ Deploy ONEVO to a **single GPU Azure VM** with **Docker Compose**, built and rel
 |-----------|----------------|
 | Backend, dashboard, cloud-ai, Postgres, Redis, MinIO | Azure GPU VM (Docker Compose) |
 | Windows connector | **Shop PCs** — downloaded from dashboard after login |
-| CI/CD | GitHub Actions → ACR → SSH deploy to VM |
+| CI/CD | GitHub Actions or **Jenkins** → ACR or VM build → SSH deploy to VM |
 
-Shop staff download `ONEVO-Connector-Setup-*.exe` from **Get started / Admin / Setup** in the dashboard. The backend serves the file from `/opt/onevo/connector/dist/` on the VM (mounted into the backend container). The connector service itself does **not** run in Azure.
+Shop staff download `ONEVO-Connector-Setup-*.exe` from **Get started / Admin / Setup** in the dashboard. The backend serves the file from `/opt/onevo/app/installer-site/` on the VM (mounted into the backend container). The connector service itself does **not** run in Azure.
 
 ## 1. Provision Azure (one time)
 
@@ -33,8 +33,8 @@ SSH to the VM and bootstrap:
 
 ```bash
 ssh azureuser@<VM_PUBLIC_IP>
-git clone <your-repo-url> /opt/onevo
-cd /opt/onevo
+git clone <your-repo-url> /opt/onevo/app
+cd /opt/onevo/app
 sudo ACR_LOGIN_SERVER=<acr>.azurecr.io bash infra/mvp/vm-setup.sh
 ```
 
@@ -47,8 +47,8 @@ sudo certbot --nginx -d app.yourdomain.example -d api.yourdomain.example
 Copy and fill secrets:
 
 ```bash
-cp infra/mvp/.env.production.example /opt/onevo/.env
-nano /opt/onevo/.env
+cp infra/mvp/.env.production.example /opt/onevo/app/.env
+nano /opt/onevo/app/.env
 ```
 
 ## 2. GitHub secrets
@@ -128,7 +128,7 @@ Manual deploy: Actions → **Deploy MVP (Azure)** → Run workflow.
 |-------|-----|
 | GPU quota denied | Use CPU VM or request quota increase; set `CLOUD_AI_DEVICE=cpu` in `.env` |
 | ACR pull 401 on VM | Check `ACR_*` in `.env`; run `docker login` manually on VM |
-| Installer 404 | Ensure `build-installer` job succeeded and EXE exists in `/opt/onevo/connector/dist/` |
+| Installer 404 | Ensure `build-installer` job succeeded and EXE exists in `/opt/onevo/app/installer-site/` |
 | CORS errors | Set `CORS_ORIGINS=https://app.yourdomain.example` in `.env` |
 | Deploy SSH fails | Verify `VM_SSH_KEY`, NSG allows SSH from GitHub Actions IPs (or use self-hosted runner in same VNet) |
 | Clip upload timeout (`:9000`) | NSG must allow **9000**; set `S3_PUBLIC_ENDPOINT=http://<VM_IP>:9000` in `.env`; test `curl http://<VM_IP>:9000/minio/health/live` from shop PC |
@@ -140,7 +140,10 @@ Manual deploy: Actions → **Deploy MVP (Azure)** → Run workflow.
 |------|---------|
 | [`infra/mvp/provision-azure.sh`](../infra/mvp/provision-azure.sh) | Create RG, ACR, VM |
 | [`infra/mvp/vm-setup.sh`](../infra/mvp/vm-setup.sh) | Docker, NVIDIA toolkit, nginx on VM |
-| [`infra/mvp/deploy.sh`](../infra/mvp/deploy.sh) | Pull ACR images and restart compose |
+| [`infra/mvp/deploy.sh`](../infra/mvp/deploy.sh) | Pull ACR images or local build; restart compose |
+| [`scripts/deploy-vm.ps1`](../scripts/deploy-vm.ps1) | Jenkins / manual deploy from Windows |
+| [`Jenkinsfile`](../Jenkinsfile) | Jenkins pipeline definition |
+| [`docs/JENKINS_DEPLOY.md`](JENKINS_DEPLOY.md) | Jenkins setup on Windows |
 | [`infra/mvp/nginx-host.conf`](../infra/mvp/nginx-host.conf) | Host TLS reverse proxy template |
 | [`infra/mvp/.env.production.example`](../infra/mvp/.env.production.example) | Production env template |
 | [`docker-compose.acr.yml`](../docker-compose.acr.yml) | Use pre-built images from ACR |
diff --git a/docs/JENKINS_DEPLOY.md b/docs/JENKINS_DEPLOY.md
@@ -0,0 +1,99 @@
+# Jenkins CI/CD on Windows
+
+Deploy ONEVO to the Azure MVP VM from your local Windows PC using the root [`Jenkinsfile`](../Jenkinsfile) and [`scripts/deploy-vm.ps1`](../scripts/deploy-vm.ps1).
+
+## Why Jenkins here
+
+- Builds the **Windows connector installer** on the same machine (Inno Setup + PyInstaller).
+- SSH/SCP to the VM already works from your dev PC.
+- Avoids GitHub Actions secret/path drift while the pilot is active.
+
+## Prerequisites
+
+1. [Jenkins LTS](https://www.jenkins.io/download/) installed on Windows.
+2. **Git** and **OpenSSH client** (Windows 10+ optional feature or Git for Windows).
+3. **.NET 8 SDK**, **Node.js 20**, **Python 3.11+** on the Jenkins agent (same PC).
+4. **Inno Setup 6** + PyInstaller deps for connector installer (see [`connector/installer/INSTALL.md`](../connector/installer/INSTALL.md)).
+5. SSH private key that can log in as `azureuser@20.193.69.220`.
+
+## Jenkins plugins
+
+- Pipeline
+- Git
+- Credentials Binding
+- SSH Agent (optional)
+
+## Credentials (Jenkins → Manage Credentials)
+
+| ID | Type | Value |
+|----|------|--------|
+| `onevo-vm-ssh-key` | SSH Username with private key | User `azureuser`, paste private key |
+
+## Create the pipeline job
+
+1. **New Item** → name `onevo-deploy` → **Pipeline**.
+2. **Pipeline** → Definition: **Pipeline script from SCM**.
+3. SCM: **Git**, repository URL, branch `azure-mvp-deploy` or `main`.
+4. Script Path: `Jenkinsfile`.
+5. Save → **Build with Parameters**.
+
+### Parameters (defaults)
+
+| Parameter | Default |
+|-----------|---------|
+| `VM_HOST` | `20.193.69.220` |
+| `VM_USER` | `azureuser` |
+| `BACKEND_URL` | `http://20.193.69.220:8081` |
+| `SKIP_INSTALLER` | false |
+| `SKIP_CI` | false |
+| `USE_GPU` | false (CPU VM) |
+
+## Manual deploy (without Jenkins)
+
+From repo root in PowerShell:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts/deploy-vm.ps1 `
+  -VmHost 20.193.69.220 `
+  -BackendUrl http://20.193.69.220:8081
+```
+
+Skip installer rebuild:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts/deploy-vm.ps1 -SkipInstaller
+```
+
+## Auto-trigger on git push
+
+**Option A — Poll SCM** (simplest): In job config, **Build Triggers** → **Poll SCM** → `H/5 * * * *` (every 5 minutes).
+
+**Option B — GitHub webhook**: Install **GitHub plugin**, add webhook pointing to `http://<your-jenkins>:8080/github-webhook/`.
+
+## Pipeline stages
+
+1. **CI** — `dotnet build`, `npm run build`, `pytest` (parallel).
+2. **Deploy to VM** — tarball → SCP → extract under `/opt/onevo/app` → `docker compose build` + `up`.
+3. **Smoke test** — `GET /api/health` and dashboard HTTP 200.
+
+## VM layout (canonical)
+
+| Path | Purpose |
+|------|---------|
+| `/opt/onevo/app/` | Git repo + docker-compose project |
+| `/opt/onevo/app/.env` | Production secrets |
+| `/opt/onevo/app/installer-site/` | Connector EXE served by backend |
+
+## Troubleshooting
+
+| Issue | Fix |
+|-------|-----|
+| SSH permission denied | Check `onevo-vm-ssh-key` credential; test `ssh azureuser@20.193.69.220` from Jenkins service account |
+| GPU compose error | Keep `USE_GPU=false` on CPU VM |
+| Installer build fails | Install Inno Setup; run `scripts/build-installer.ps1` manually once |
+| Backend unhealthy after deploy | SSH to VM: `cd /opt/onevo/app && docker compose logs backend --tail 50` |
+
+## Related
+
+- [`docs/AZURE_MVP_DEPLOY.md`](AZURE_MVP_DEPLOY.md) — Azure + GitHub Actions
+- [`infra/mvp/deploy.sh`](../infra/mvp/deploy.sh) — VM-side deploy (ACR pull or local build)
diff --git a/infra/mvp/PROVISIONED.md b/infra/mvp/PROVISIONED.md
@@ -56,10 +56,10 @@ Also create `AZURE_CREDENTIALS` service principal JSON (see [AZURE_MVP_DEPLOY.md
 
 ```bash
 ssh azureuser@20.193.69.220
-git clone <your-github-repo-url> /opt/onevo
-cd /opt/onevo
+git clone <your-github-repo-url> /opt/onevo/app
+cd /opt/onevo/app
 sudo ACR_LOGIN_SERVER=onevoacrmvp.azurecr.io bash infra/mvp/vm-setup.sh
-cp infra/mvp/.env.production.example /opt/onevo/.env
+cp infra/mvp/.env.production.example /opt/onevo/app/.env
 # Edit .env — set CLOUD_AI_DEVICE=cpu, passwords, JWT, SMTP
 ```
 
@@ -73,4 +73,4 @@ Azure portal: [Quota increase](https://aka.ms/ProdportalCRP/#blade/Microsoft_Azu
 
 ## Installer download
 
-Unchanged: shops download the Windows EXE from the **dashboard** after login. The deploy pipeline copies the built EXE to `/opt/onevo/connector/dist/` on this VM.
+Unchanged: shops download the Windows EXE from the **dashboard** after login. The deploy pipeline copies the built EXE to `/opt/onevo/app/installer-site/` on this VM (mounted as `/app/connector-dist` in the backend container).
diff --git a/infra/mvp/deploy.sh b/infra/mvp/deploy.sh
@@ -1,10 +1,23 @@
 #!/usr/bin/env bash
-# ONEVO MVP — pull ACR images and restart the stack on the GPU VM.
-# Invoked by GitHub Actions over SSH or manually on the VM.
+# ONEVO MVP — pull ACR images and restart the stack on the Azure VM.
+# Invoked by GitHub Actions, Jenkins, or manually on the VM.
+#
+# Env:
+#   ONEVO_DIR     — app root (default /opt/onevo/app)
+#   USE_GPU       — "true" to include docker-compose.gpu.yml (default false on CPU VM)
+#   DEPLOY_MODE   — "acr" (pull pre-built images) or "local" (build on VM)
 set -euo pipefail
 
-ONEVO_DIR="${ONEVO_DIR:-/opt/onevo}"
-COMPOSE_FILES="-f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.gpu.yml -f docker-compose.acr.yml"
+ONEVO_DIR="${ONEVO_DIR:-/opt/onevo/app}"
+DEPLOY_MODE="${DEPLOY_MODE:-acr}"
+
+COMPOSE_FILES="-f docker-compose.yml -f docker-compose.prod.yml"
+if [[ "${USE_GPU:-false}" == "true" ]]; then
+  COMPOSE_FILES+=" -f docker-compose.gpu.yml"
+fi
+if [[ "$DEPLOY_MODE" == "acr" ]]; then
+  COMPOSE_FILES+=" -f docker-compose.acr.yml"
+fi
 
 cd "$ONEVO_DIR"
 
@@ -18,19 +31,27 @@ set -a
 source .env
 set +a
 
-: "${ONEVO_BACKEND_IMAGE:?Set ONEVO_BACKEND_IMAGE}"
-: "${ONEVO_DASHBOARD_IMAGE:?Set ONEVO_DASHBOARD_IMAGE}"
-: "${ONEVO_CLOUD_AI_IMAGE:?Set ONEVO_CLOUD_AI_IMAGE}"
+if [[ "$DEPLOY_MODE" == "acr" ]]; then
+  : "${ONEVO_BACKEND_IMAGE:?Set ONEVO_BACKEND_IMAGE}"
+  : "${ONEVO_DASHBOARD_IMAGE:?Set ONEVO_DASHBOARD_IMAGE}"
+  : "${ONEVO_CLOUD_AI_IMAGE:?Set ONEVO_CLOUD_AI_IMAGE}"
 
-if [[ -n "${ACR_LOGIN_SERVER:-}" && -n "${ACR_USERNAME:-}" && -n "${ACR_PASSWORD:-}" ]]; then
-  echo "$ACR_PASSWORD" | docker login "$ACR_LOGIN_SERVER" -u "$ACR_USERNAME" --password-stdin
-fi
+  if [[ -n "${ACR_LOGIN_SERVER:-}" && -n "${ACR_USERNAME:-}" && -n "${ACR_PASSWORD:-}" ]]; then
+    echo "$ACR_PASSWORD" | docker login "$ACR_LOGIN_SERVER" -u "$ACR_USERNAME" --password-stdin
+  fi
+
+  echo "==> Pulling images from ACR..."
+  docker compose $COMPOSE_FILES pull backend dashboard cloud-ai
 
-echo "==> Pulling images..."
-docker compose $COMPOSE_FILES pull backend dashboard cloud-ai
+  echo "==> Starting stack (ACR images)..."
+  docker compose $COMPOSE_FILES up -d --no-build --remove-orphans
+else
+  echo "==> Building images on VM..."
+  docker compose $COMPOSE_FILES build backend dashboard cloud-ai
 
-echo "==> Starting stack..."
-docker compose $COMPOSE_FILES up -d --no-build --remove-orphans
+  echo "==> Starting stack (local build)..."
+  docker compose $COMPOSE_FILES up -d --remove-orphans
+fi
 
 echo "==> Waiting for backend health..."
 for i in $(seq 1 30); do
diff --git a/scripts/deploy-vm.ps1 b/scripts/deploy-vm.ps1
