Lesson 12.16 — Capstone: Deploying & Operating a Real-World Cloud Application

[Users on Internet] (Browser / Mobile App) | v HTTPS (Port 443) via DNS (example.com) +-----------------------------------------------------------------------+ | Cloud Virtual Machine (Ubuntu 24.04 LTS) | | | | [Host Nginx Reverse Proxy] <--- Certbot SSL Auto-Renew (/etc/letsencrypt) | | | | v Reverse Proxy (127.0.0.1:8080) | | +-----------------------------------------------------------------+ | | | Docker Compose Network (Isolated Bridge: backend) | | | | | | | | +------------------+ +-------------------------------+ | | | | | Container: web | --TCP-> | Container: app | | | | | | (Nginx Frontend) | :9000 | (PHP-FPM Laravel 11 Core) | | | | | +------------------+ +-------------------------------+ | | | | | | | | | +-------------+-------------+ | | | | v v | | | | +-----------------------+ +-------------+ | | | | | Container: db | | Container: | | | | | | (MySQL 8.4 Engine) | | redis (7) | | | | | | Vol: mysql_data | | Vol: r_data | | | | | +-----------------------+ +-------------+ | | | | ^ | | | | +-----------------------------+ | | | | | | Container: worker | -----------------------+ | | | | | (php artisan queue:work) | (Consumes async jobs) | | | | +-----------------------------+ | | | +-----------------------------------------------------------------+ | +-----------------------------------------------------------------------+ ^ | SSH Deploy over Key (Strict Known Hosts) [GitHub Actions CI/CD Pipeline] (Builds & pushes image to GHCR)

services:
  # 1. Laravel PHP 8.3-FPM Application Core
  app:
    image: ghcr.io/byteionlab/myapp-php:${IMAGE_TAG}
    restart: unless-stopped
    env_file:
      - .env.production
    expose:
      - "9000"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    volumes:
      - laravel_storage:/var/www/html/storage
    networks:
      - backend

  # 2. Container Nginx Web Server
  web:
    image: ghcr.io/byteionlab/myapp-nginx:${IMAGE_TAG}
    restart: unless-stopped
    ports:
      - "127.0.0.1:8080:80"  # Bound exclusively to host loopback interface
    depends_on:
      - app
    networks:
      - backend

  # 3. Laravel Background Queue Worker
  worker:
    image: ghcr.io/byteionlab/myapp-php:${IMAGE_TAG}
    restart: unless-stopped
    env_file:
      - .env.production
    command: ["php", "artisan", "queue:work", "--sleep=3", "--tries=3", "--timeout=90"]
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started
    volumes:
      - laravel_storage:/var/www/html/storage
    networks:
      - backend

  # 4. MySQL 8.4 Relational Database Server
  db:
    image: mysql:8.4
    restart: unless-stopped
    env_file:
      - .env.mysql
    volumes:
      - mysql_data:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -u root -p$$MYSQL_ROOT_PASSWORD --silent"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - backend

  # 5. Redis In-Memory Cache & Queue Store
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes:
      - redis_data:/data
    networks:
      - backend

volumes:
  mysql_data:
  redis_data:
  laravel_storage:

networks:
  backend:
    driver: bridge

server {
    listen 80;
    server_name _;
    root /var/www/html/public;
    index index.php index.html;

    client_max_body_size 64M;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass app:9000;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        fastcgi_read_timeout 60;
    }

    # Deny access to hidden dotfiles (.env, .git)
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

server {
    listen 80;
    server_name example.com www.example.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# .github/workflows/deploy.yml
name: Build, Test & Deploy to Production

on:
  push:
    branches: [ main ]

jobs:
  # 1. Automated Test Quality Gate
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup PHP & Composer
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          extensions: mbstring, pdo_mysql, redis
      - run: composer install --no-progress --prefer-dist
      - run: php artisan test

  # 2. Multi-stage Docker Build & GHCR Publish
  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build & Push App Image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/php/Dockerfile
          push: true
          tags: ghcr.io/byteionlab/myapp-php:${{ github.sha }}

      - name: Build & Push Nginx Image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: docker/nginx/Dockerfile
          push: true
          tags: ghcr.io/byteionlab/myapp-nginx:${{ github.sha }}

  # 3. Zero-Touch SSH Remote Deploy
  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Execute Remote SSH Deployment
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /opt/myapp
            ./deploy.sh ${{ github.sha }}

#!/usr/bin/env bash
set -euo pipefail

RELEASE_TAG="${1:?Release SHA required}"
export IMAGE_TAG="$RELEASE_TAG"

echo "=== [Deploying Release: $IMAGE_TAG] ==="

# 1. Pull new immutable image tags
docker compose pull app web worker

# 2. Run safe database migrations
docker compose run --rm --no-deps app php artisan migrate --force

# 3. Update active containers
docker compose up -d --remove-orphans

# 4. Warm caches and restart queue workers
docker compose exec -T app php artisan optimize
docker compose exec -T app php artisan queue:restart

# 5. Live smoke test
echo "Checking Application Health..."
curl -fsS --retry 3 --retry-delay 2 http://127.0.0.1:8080/up

echo "=== [Deployment Succeeded Seamlessly!] ==="