Build & Deploy Pipeline

Local prerequisites (macOS)

• Run ./scripts/install-mac-prereqs.sh to install dev/test tools via Homebrew (Node 20, envsubst/gettext, kubectl, sops, Trivy, Docker Desktop).
• Requires Homebrew pre-installed; set SKIP_TRIVY=1 and/or SKIP_SOPS=1 to avoid optional security tools.
• After install, open Docker.app once so the daemon is running before you build or run ZAP/Trivy scans.

Pipeline at a glance

flowchart LR
    Dev["Developer"] -->|"npm run lint"| Lint
    Dev --> Build["./deploy/build.sh"]
    Lint --> Build
    Build --> Docker["Docker buildx\nmulti-stage"]
    Docker --> Image["registry.halla-aho.net/thalla/lomavuokraus-web"]
    Image --> Push["./deploy/push.sh"]
    Push --> DeployStg["./deploy/deploy-staging.sh"]
    Push --> DeployProd["./deploy/deploy-prod.sh"]
    DeployStg --> RolloutStg["kubectl apply + rollout\n(staging)"]
    DeployProd --> RolloutProd["kubectl apply + rollout\n(prod)"]
          

Build Inputs

• Source: Next.js app with TypeScript and Prisma.
• Env: .env (local), K8s Secret lomavuokraus-web-secrets in cluster.
• Local secrets: creds/secrets.env (dotenv) loadable via scripts/load-secrets.sh.
• Prisma schema: prisma/schema.prisma, migrations in prisma/migrations/.

NPM Scripts

• npm run lint → next lint
• npm run build → next build (used inside Docker and locally)

Docker Image

• Multi-stage Dockerfile:
  • deps: npm ci
  • builder: copy source, npx prisma generate, npm run build
  • runner: Node 20 bookworm-slim, copy standalone + static
• Tags: numeric (git SHA-derived) + :latest.
• Scan: Trivy runs post-build if available.

Deploy Scripts

• deploy/build.sh → build image, write deploy/.last-image.
• deploy/push.sh → push image.
• deploy/deploy.sh → envsubst k8s/app.yaml, kubectl apply, rollout.
• Environment wrappers:
  • deploy/deploy-staging.sh
  • deploy/deploy-prod.sh
  • deploy/deploy-test.sh
• DNS helpers: deploy/update-test-dns.sh updates test.lomavuokraus.fi + apitest.lomavuokraus.fi via Joker DYNDNS.

Config & Env Vars

• From ConfigMap (public): NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_API_BASE, APP_ENV.
• From Secret: DB URL, AUTH_SECRET, SMTP, DKIM, etc. (materialize from creds/secrets.env).
• App env resolution: process.env.* in Next server code.
• n8n billing assistant: N8N_BILLING_API_KEY or file creds/n8n-billing.key protects /api/integrations/billing/verify.