Skip to content

Commit c7dd101

Browse files
adskyiprogeradskyiproger
committed
testing
1 parent 2efefd5 commit c7dd101

File tree

19 files changed

+611
-261
lines changed

19 files changed

+611
-261
lines changed

‎.github/workflows/deploy-dependencies.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010
type: choice
1111
options:
1212
- demo
13+
- demo-prod
1314
- dev
1415
- dev-stg
1516
jobs:

‎.github/workflows/deploy-opencrvs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ on:
3030
type: choice
3131
options:
3232
- demo
33+
- demo-prod
3334
- dev
3435
- dev-stg
3536
reset:

‎.github/workflows/k8s-reset-data.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ on:
1515
type: choice
1616
options:
1717
- demo
18+
- demo-prod
1819
- dev
1920
- dev-stg
2021
workflow_call:

‎.github/workflows/k8s-seed-data.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010
type: choice
1111
options:
1212
- demo
13+
- demo-prod
1314
- dev
1415
- dev-stg
1516
workflow_call:

‎.github/workflows/provision.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010
type: choice
1111
options:
1212
- dev
13+
- demo-prod
1314
- demo
1415
tags:
1516
description: 'Tags to apply to the provisioned resources'
@@ -27,8 +28,7 @@ on:
2728
- decrypt-on-boot
2829
- checks
2930
- containerd-setup
30-
- kubernetes-installation
31-
- join-workers
31+
- k8s
3232
- system-preparation
3333
jobs:
3434
provision:
@@ -62,7 +62,6 @@ jobs:
6262
smtp_from: "[email protected]"
6363
smtp_password: ${{ secrets.SMTP_PASSWORD }}
6464
alert_email: ${{ secrets.ALERT_EMAIL }}
65-
6665
- name: checkout repository
6766
uses: actions/checkout@v5
6867
- name: Run Ansible Playbook

‎environments/demo-prod/dependencies/values.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
storage_type: host_path
2+
3+
ingress:
4+
tls_resolver: letsencrypt
5+
6+
minio:
7+
use_default_credentials: false
8+
9+
elasticsearch:
10+
use_default_credentials: false
11+
12+
mongodb:
13+
use_default_credentials: false
14+
15+
postgres:
16+
use_default_credentials: false
17+
18+
monitoring:
19+
enabled: true
20+
21+
elastalert:
22+
env:
23+
HTTP_POST2_ALERT_URL: http://countryconfig.opencrvs-demo-prod.svc.cluster.local:3040

‎environments/demo-prod/mosip-api/values.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ingress:
2+
ssl_enabled: true

‎environments/demo-prod/opencrvs-services/values.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
########################################################################################
2+
# Initial configuration file for OpenCRVS installation
3+
########################################################################################
4+
# Some properties are not defined in this file and should be provided as key/value at
5+
# installation time:
6+
# - hostname: valid DNS name for opencrvs
7+
# - countryconfig.image.name: Countryconfig image repository
8+
# - countryconfig.image.tag: Countryconfig image tag
9+
ingress:
10+
tls_resolver: letsencrypt
11+
12+
hpa:
13+
enabled: false
14+
15+
env:
16+
APN_SERVICE_URL: "http://apm-server.opencrvs-deps-demo-prod.svc.cluster.local:8200"
17+
18+
influxdb:
19+
host: influxdb-0.influxdb.opencrvs-deps-demo-prod.svc.cluster.local
20+
elasticsearch:
21+
auth_mode: auto
22+
host: elasticsearch.opencrvs-deps-demo-prod.svc.cluster.local
23+
24+
25+
minio:
26+
auth_mode: use_secret
27+
host: minio-0.minio.opencrvs-deps-demo-prod.svc.cluster.local
28+
external_hostname: minio.test-k8s.opencrvs.dev
29+
30+
mongodb:
31+
auth_mode: auto
32+
host: mongodb-0.mongodb.opencrvs-deps-demo-prod.svc.cluster.local
33+
34+
redis:
35+
auth_mode: acl
36+
host: redis-0.redis.opencrvs-deps-demo-prod.svc.cluster.local
37+
38+
postgres:
39+
auth_mode: auto
40+
host: postgres-0.postgres.opencrvs-deps-demo-prod.svc.cluster.local
41+
42+
imagePullSecrets:
43+
# Default value for credentials created while yarn environment:init
44+
- name: dockerhub-credentials
45+
46+
countryconfig:
47+
smtp-config:
48+
- ALERT_EMAIL
49+
- SENDER_EMAIL_ADDRESS
50+
- SMTP_HOST
51+
- SMTP_PASSWORD
52+
- SMTP_PORT
53+
- SMTP_SECURE
54+
- SMTP_USERNAME

‎environments/demo-prod/traefik/values.yaml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Overwriting https://github.com/traefik/traefik-helm-chart/blob/master/traefik/values.yaml
2+
namespaceOverride: "traefik"
3+
logs:
4+
general:
5+
# "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL", "PANIC"
6+
level: "INFO"
7+
# format: "common" # For local environment
8+
format: "json" # For server environment
9+
access:
10+
# -- To enable access logs
11+
enabled: true
12+
format: "json"
13+
ingressRoute:
14+
dashboard:
15+
enabled: false
16+
17+
# Be explicit that we only use CRDs, not ingress/gw support
18+
providers:
19+
kubernetesCRD:
20+
enabled: true
21+
kubernetesIngress:
22+
enabled: true
23+
kubernetesGateway:
24+
enabled: false
25+
26+
service:
27+
enabled: true
28+
single: false
29+
type: NodePort
30+
31+
ports:
32+
web:
33+
port: 8000
34+
hostPort: 80
35+
protocol: TCP
36+
nodePort: 30080
37+
websecure:
38+
port: 8443
39+
nodePort: 30443
40+
hostPort: 443
41+
protocol: TCP
42+
43+
certificatesResolvers:
44+
letsencrypt:
45+
acme:
46+
tlsChallenge: false
47+
httpChallenge:
48+
entryPoint: web
49+
email: [email protected]
50+
# Storage for production certificates:
51+
# storage: /data/acme.json
52+
# Storage for staging certificates:
53+
storage: /data/acme-staging.json
54+
# Staging server
55+
caServer: https://acme-staging-v02.api.letsencrypt.org/directory
56+
# Production server
57+
# caServer: https://acme-v02.api.letsencrypt.org/directory
58+
59+
# Additional arguments
60+
additionalArguments:
61+
- "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
62+
- "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
63+
- "--certificatesresolvers.letsencrypt.acme.email=vadym@opencrvs.org"
64+
# Storage for staging certificates:
65+
- "--certificatesresolvers.letsencrypt.acme.storage=/data/acme-staging.json"
66+
# Storage for staging certificates:
67+
# - "--certificatesresolvers.letsencrypt.acme.storage=/data/acme.json"
68+
69+
deployment:
70+
hostNetwork: true
71+
additionalVolumes:
72+
- name: acme
73+
hostPath:
74+
path: /data/traefik

‎examples/dev/README.md‎

Lines changed: 64 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -6,40 +6,8 @@ OpenCRVS can be deployed either:
66

77
* **Manually** (using Helm and CLI commands), see [README-on-existing-cluster](README-on-existing-cluster.md) or
88
* **Automatically** (using the provided GitHub Action Workflows).
9-
109
---
1110

12-
# Prerequisites
13-
14-
Before starting the deployment, ensure the following requirements are met:
15-
16-
**1. Virtual Machine resources**
17-
18-
* Minimum: **8 CPU cores, 16 GB RAM, 50 GB SSD**.
19-
20-
**2. Operating System**
21-
22-
* VM is running **Ubuntu 24.04 LTS**.
23-
24-
**3. Networking and Domain Configuration**
25-
26-
* The VM must have a **public IP address** and (or) ports **80** and **443** must be accessible.
27-
* A **valid domain name** must be configured and point to the VM.
28-
* Required DNS records:
29-
30-
* An **A record** pointing the primary domain to the VM IP (e.g., `opencrvs.example.com`).
31-
* A **wildcard A record** (e.g., `*.opencrvs.example.com`) or individual subdomains pointing to the same VM IP.
32-
* These settings are required for **Traefik** to issue valid SSL certificates using Let’s Encrypt (`http-01` challenge).
33-
34-
> See the [OpenCRVS documentation on DNS setup](https://documentation.opencrvs.org/setup/3.-installation/3.3-set-up-a-server-hosted-environment/3.3.5-setup-dns-a-records#domain-a-records) for details.
35-
36-
> If you don't have public IP Address please follow guide "How to run traefik with self-signed SSL Certificate", see [TODO](#link-goes-here)
37-
38-
**4. Create provisioning User**
39-
40-
* The VM must be provisioned with an SSH user account according to [Provision Your Server Nodes with SSH Access](https://documentation.opencrvs.org/setup/3.-installation/3.3-set-up-a-server-hosted-environment/3.3.1-provision-your-server-nodes-with-ssh-access).
41-
42-
---
4311

4412
# Deployment Package Contents
4513

@@ -73,6 +41,35 @@ The deployment package includes the following components:
7341
* MOSIP integration version: `latest`
7442

7543

44+
---
45+
46+
# Prerequisites
47+
48+
Before starting the deployment, ensure the following requirements are met:
49+
50+
**1. Virtual Machine resources**
51+
52+
* Minimum: **8 CPU cores, 16 GB RAM, 50 GB SSD**.
53+
54+
**2. Operating System**
55+
56+
* VM is running **Ubuntu 24.04 LTS**.
57+
58+
**3. Networking and Domain Configuration**
59+
60+
* The VM must have a **public IP address** and (or) ports **80** and **443** must be accessible.
61+
* A **valid domain name** must be configured and point to the VM.
62+
* Required DNS records:
63+
64+
* An **A record** pointing the primary domain to the VM IP (e.g., `opencrvs.example.com`).
65+
* A **wildcard A record** (e.g., `*.opencrvs.example.com`) or individual subdomains pointing to the same VM IP.
66+
* These settings are required for **Traefik** to issue valid SSL certificates using Let’s Encrypt (`http-01` challenge).
67+
68+
> See the [OpenCRVS documentation on DNS setup](https://documentation.opencrvs.org/setup/3.-installation/3.3-set-up-a-server-hosted-environment/3.3.5-setup-dns-a-records#domain-a-records) for details.
69+
70+
> If you don't have public IP Address please follow guide "How to run traefik with self-signed SSL Certificate", see [TODO](#link-goes-here)
71+
72+
---
7673

7774
# Deploy OpenCRVS with GitHub Actions Workflows
7875

@@ -88,27 +85,8 @@ You will need to provide the following values while installation multiple times:
8885
* Environment name: `<env name>`
8986
---
9087

91-
## 1. Bootstrap GitHub Self-Hosted Runner
92-
93-
The self-hosted runner must be installed on the single VM (or master node).
94-
95-
1. Login as `provision` user
96-
97-
2. Run the following command on the VM:
98-
```bash
99-
curl -s https://raw.githubusercontent.com/opencrvs/infrastructure/refs/heads/develop/github-runner/node-runner.sh -o runner.sh && bash runner.sh
100-
```
101-
102-
**Verify runner is available**
103-
104-
1. If successful, you will see a confirmation message:
105-
```
106-
✅ Runner '....-runner' is installed and started!
107-
```
108-
2. In your GitHub repository, navigate to **Settings → Actions → Runners** and verify that the runner appears as a self-hosted runner.
109-
11088
---
111-
## 2. Create a GitHub environment
89+
## 1. Create a GitHub environment
11290

11391
* Checkout forked repository into any folder on your laptop
11492
```
@@ -122,8 +100,36 @@ The self-hosted runner must be installed on the single VM (or master node).
122100
```
123101
yarn environment:init
124102
```
103+
* Go to GitHub and verify the newly created environment
104+
105+
106+
## 2.1. Bootstrap GitHub Self-Hosted Runner
107+
108+
The self-hosted runner must be installed on the single VM (master node). The VM must be provisioned with an SSH user account according to [Provision Your Server Nodes with SSH Access](https://documentation.opencrvs.org/setup/3.-installation/3.3-set-up-a-server-hosted-environment/3.3.1-provision-your-server-nodes-with-ssh-access).
109+
110+
> NOTE: On previous step environment configuration script left correct command as output.
111+
112+
1. Login as any user with sudo or root access
113+
114+
2. Run the following command on the VM:
115+
```bash
116+
curl -sfL https://raw.githubusercontent.com/opencrvs/infrastructure/refs/heads/ocrvs-9792/scripts/bootstrap/opencrvs-bootstrap.sh -o opencrvs-bootstrap.sh | \
117+
bash opencrvs-bootstrap.sh --owner <org name> \
118+
--repo <repo name> \
119+
--env <env name> \
120+
--token <github token> \
121+
--enable-runner
122+
```
123+
124+
**Verify runner is available**
125+
126+
1. If successful, you will see a confirmation message:
127+
```
128+
✅ Runner '....-runner' is installed and started!
129+
```
130+
2. In your GitHub repository, navigate to **Settings → Actions → Runners** and verify that the runner appears as a self-hosted runner.
125131

126-
### 2.1 Update infrastructure configuration
132+
### 2.2 Update infrastructure configuration
127133

128134
* Navigate to the `infrastructure/server-setup/inventory` folder.
129135
* Open a configuration file for your environment, see example.
@@ -173,12 +179,12 @@ all:
173179
ansible_connection: local
174180
```
175181

176-
### 2.2 Update OpenCRVS environment configuration files
182+
### 2.3 Update OpenCRVS helm chart values
177183

178-
At environment creation phase environment files are stored into `environments/<env name>` folder. Navigate to this folder and update files one by one. Folder contains configuration for the following helm charts:
179-
- traefik, Usually helm chart doesn't require updates.
180-
- opencrvs dependencies, Usually helm chart doesn't require updates.
181-
- opencrvs application, Usually helm chart doesn't require updates.
184+
At environment creation phase helm chart values files are stored into `environments/<env name>` folder. Usually default configuration properties are sufficient for first deployment:
185+
- traefik
186+
- dependencies
187+
- opencrvs-services
182188

183189
Commit your changes.
184190

0 commit comments

Comments
 (0)