Merge remote-tracking branch 'origin/main'

.gitea/workflows/itam_production_deploy.yml

@@ -71,6 +71,11 @@ jobs:
           PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
           PROD_BACKUP_ROOT: ${{ vars.PROD_BACKUP_ROOT }}
           PROD_GIT_URL: ${{ vars.PROD_GIT_URL }}
+          DB_HOST: ${{ vars.PROD_DB_HOST }}
+          DB_PORT: ${{ vars.PROD_DB_PORT }}
+          DB_USER: ${{ vars.PROD_DB_USER }}
+          DB_PASS: ${{ secrets.PROD_DB_PASS }}
+          DB_NAME: ${{ vars.PROD_DB_NAME }}
           TARGET_BRANCH: ${{ github.event.inputs.target_branch }}
         run: |
           set -euo pipefail
@@ -78,7 +83,7 @@ jobs:
 
           ssh "${PROD_USER}@${PROD_HOST}" "mkdir -p '${PROD_DEPLOY_PATH}'"
 
-          EFFECTIVE_BACKUP_ROOT="${PROD_BACKUP_ROOT:-${PROD_DEPLOY_PATH%/}_backups}"
+          EFFECTIVE_BACKUP_ROOT="${PROD_BACKUP_ROOT:-/home/user/dachs_backups}"
 
           ssh "${PROD_USER}@${PROD_HOST}" "export DEPLOY_PATH='${PROD_DEPLOY_PATH}' BACKUP_ROOT='${EFFECTIVE_BACKUP_ROOT}'; sh -eu -s" <<'REMOTE_BACKUP'
           case "$BACKUP_ROOT" in
@@ -90,12 +95,12 @@ jobs:
 
           if [ -d "$DEPLOY_PATH/.git" ]; then
             mkdir -p "$BACKUP_ROOT"
+            echo "Starting pre-deploy backup..."
             cd "$DEPLOY_PATH"
-
             if [ -f Makefile ] && [ -f scripts/backup.sh ]; then
-              make predeploy-backup BACKUP_ROOT="$BACKUP_ROOT"
+              make predeploy-backup ENV_FILE=.env BACKUP_ROOT="$BACKUP_ROOT"
             else
-              echo "Skipping pre-deploy backup because current deployed revision does not contain Makefile backup tooling."
+              echo "Skipping pre-deploy backup because current deployed revision does not contain backup tooling."
             fi
           else
             echo "Skipping pre-deploy backup because no existing deployment was found."
@@ -128,9 +133,8 @@ jobs:
           PROD_DEPLOY_PATH: ${{ vars.PROD_DEPLOY_PATH }}
         run: |
           set -euo pipefail
-          ssh "${PROD_USER}@${PROD_HOST}" "curl -fsS http://localhost/health"
-          ssh "${PROD_USER}@${PROD_HOST}" "curl -fsS http://localhost/ > /dev/null"
-          ssh "${PROD_USER}@${PROD_HOST}" "cd '${PROD_DEPLOY_PATH}' && docker compose -f docker-compose.prod.yaml exec -T backend curl -fsS http://localhost:3000/ready"
+          ssh "${PROD_USER}@${PROD_HOST}" "curl -fsS http://localhost:9090/health"
+          ssh "${PROD_USER}@${PROD_HOST}" "cd '${PROD_DEPLOY_PATH}' && docker compose -f docker-compose.prod.yaml exec -T backend curl -fsS http://localhost:3000/health"
 
       - name: Cleanup generated env file
         if: ${{ always() }}

Dockerfile.backend.prod

@@ -8,7 +8,7 @@ ENV NODE_ENV=production
 WORKDIR /app
 
 # Install curl for health checks and dumb-init for proper signal handling
-RUN apk add --no-cache curl dumb-init
+RUN apk add --no-cache curl dumb-init mysql-client
 
 # Copy package files
 COPY package*.json ./

docker-compose.prod.yaml

@@ -38,7 +38,7 @@ services:
     image: nginx:stable-alpine
     container_name: itam-nginx
     ports:
-      - "80:80"
+      - "9090:80"
     volumes:
       - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
       - ./logs/nginx:/var/log/nginx

scripts/backup.sh

@@ -21,6 +21,10 @@ require_command() {
   command -v "$1" >/dev/null 2>&1 || fail "Required command not found: $1"
 }
 
+has_command() {
+  command -v "$1" >/dev/null 2>&1
+}
+
 load_env() {
   [ -f "$ENV_FILE" ] || fail "Env file not found: $ENV_FILE"
 
@@ -37,7 +41,6 @@ load_env() {
 }
 
 db_dump() {
-  require_command mysqldump
   require_command gzip
   load_env
 
@@ -45,15 +48,22 @@ db_dump() {
   output_path="$BACKUP_ROOT/db/${DB_NAME}_${TIMESTAMP}.sql.gz"
 
   log "Creating DB dump: $output_path"
-  MYSQL_PWD="$DB_PASS" mysqldump \
-    --host="$DB_HOST" \
-    --port="$DB_PORT" \
-    --user="$DB_USER" \
-    --single-transaction \
-    --quick \
-    --routines \
-    --triggers \
-    "$DB_NAME" | gzip > "$output_path"
+
+  if has_command mysqldump; then
+    MYSQL_PWD="$DB_PASS" mysqldump \
+      --host="$DB_HOST" \
+      --port="$DB_PORT" \
+      --user="$DB_USER" \
+      --single-transaction \
+      --quick \
+      --routines \
+      --triggers \
+      "$DB_NAME" | gzip > "$output_path"
+  elif has_command docker; then
+    docker exec itam-backend sh -lc "MYSQL_PWD=\"$DB_PASS\" exec mysqldump --host=\"$DB_HOST\" --port=\"$DB_PORT\" --user=\"$DB_USER\" --single-transaction --quick --routines --triggers \"$DB_NAME\"" | gzip > "$output_path"
+  else
+    fail "Required command not found: mysqldump (and docker fallback unavailable)"
+  fi
 
   log "DB dump completed: $output_path"
 }