Kamal v2

.dockerignore

@@ -11,6 +11,8 @@
 /.env*
 !/.env*.erb
 
+/.kamal/secrets*
+
 # Ignore all default key files.
 /config/master.key
 /config/credentials/*.key

.github/workflows/deploy.yml

@@ -18,6 +18,12 @@ on:
         required: true
       AWS_SECRET_ACCESS_KEY:
         required: true
+      RAILS_MASTER_KEY:
+        required: true
+      DATABASE_URL:
+        required: true
+      SECRET_KEY_BASE:
+        required: true
 
 jobs:
   deploy:
@@ -55,5 +61,13 @@ jobs:
       - name: Expose GitHub Runtime for cache
         uses: crazy-max/ghaction-github-runtime@v3
 
+      - name: Generate kamal secrets
+        run: |
+          cat <<EOT >> .kamal/secrets.${{ inputs.destination }}
+            RAILS_MASTER_KEY=${{secrets.RAILS_MASTER_KEY}}
+            DATABASE_URL=${{secrets.DATABASE_URL}}
+            SECRET_KEY_BASE=${{secrets.SECRET_KEY_BASE}}
+          EOT
+
       - name: Run deploy command
         run: bundle exec kamal deploy -d ${{ inputs.destination }}

.github/workflows/production_deploy.yml

@@ -21,3 +21,6 @@ jobs:
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
       AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      RAILS_MASTER_KEY: ${{ secrets.PRODUCTION_RAILS_MASTER_KEY }}
+      DATABASE_URL: ${{ secrets.PRODUCTION_DATABASE_URL }}
+      SECRET_KEY_BASE: ${{ secrets.PRODUCTION_SECRET_KEY_BASE }}

.github/workflows/staging_deploy.yml

@@ -24,3 +24,6 @@ jobs:
       SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
       AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      RAILS_MASTER_KEY: ${{ secrets.PRODUCTION_RAILS_MASTER_KEY }}
+      DATABASE_URL: ${{ secrets.PRODUCTION_DATABASE_URL }}
+      SECRET_KEY_BASE: ${{ secrets.PRODUCTION_SECRET_KEY_BASE }}

.gitignore

@@ -11,6 +11,8 @@
 /.env*
 !/.env*.erb
 
+/.kamal/secrets*
+
 # Ignore all logfiles and tempfiles.
 /log/*
 /tmp/*

Gemfile

@@ -19,7 +19,7 @@ gem 'stimulus-rails', '~> 1.3'
 gem 'turbo-rails', '~> 2.0'
 
 group :development, :deploy do
-  gem 'kamal', '~> 1.8'
+  gem 'kamal'
 end
 
 group :development, :test do

Gemfile.lock

@@ -106,7 +106,7 @@ GEM
       responders
       warden (~> 1.2.3)
     diff-lcs (1.5.1)
-    dotenv (2.8.1)
+    dotenv (3.1.4)
     drb (2.2.1)
     ed25519 (1.3.0)
     erubi (1.13.0)
@@ -138,16 +138,16 @@ GEM
     json (2.7.2)
     jwt (2.9.0)
       base64
-    kamal (1.8.3)
+    kamal (2.0.0)
       activesupport (>= 7.0)
       base64 (~> 0.2)
       bcrypt_pbkdf (~> 1.0)
       concurrent-ruby (~> 1.2)
-      dotenv (~> 2.8)
+      dotenv (~> 3.1)
       ed25519 (~> 1.2)
       net-ssh (~> 7.0)
       sshkit (>= 1.23.0, < 2.0)
-      thor (~> 1.2)
+      thor (~> 1.3)
       zeitwerk (~> 2.5)
     language_server-protocol (3.17.0.3)
     launchy (3.0.0)
@@ -391,7 +391,7 @@ DEPENDENCIES
   devise (~> 4.9)
   factory_bot_rails (~> 6.4)
   importmap-rails (~> 2.0)
-  kamal (~> 1.8)
+  kamal
   letter_opener (~> 1.10)
   omniauth (~> 2.1)
   omniauth-google-oauth2 (~> 1.2)

config/deploy.production.yml

@@ -1,13 +1,11 @@
+proxy:
+  host: micarrera.uy,fing.micarrera.uy,www.micarrera.uy
+  app_port: 3000
+
 servers:
   web:
     hosts:
       - 3.233.189.168
-    labels:
-      traefik.http.routers.micarrera-web-production.rule: Host(`micarrera.uy`) || Host(`fing.micarrera.uy`) || Host(`www.micarrera.uy`)
-      traefik.http.routers.micarrera_secure-web-production.entrypoints: websecure
-      traefik.http.routers.micarrera_secure-web-production.rule: Host(`micarrera.uy`) || Host(`fing.micarrera.uy`) || Host(`www.micarrera.uy`)
-      traefik.http.routers.micarrera_secure-web-production.tls: true
-      traefik.http.routers.micarrera_secure-web-production.tls.certresolver: letsencrypt
     options:
       memory: 500MiB
 

config/deploy.staging.yml

@@ -1,13 +1,11 @@
+proxy:
+  host: staging.micarrera.uy
+  app_port: 3000
+
 servers:
   web:
     hosts:
       - 3.233.189.168
-    labels:
-      traefik.http.routers.micarrera-web-staging.rule: Host(`staging.micarrera.uy`)
-      traefik.http.routers.micarrera_secure-web-staging.entrypoints: websecure
-      traefik.http.routers.micarrera_secure-web-staging.rule: Host(`staging.micarrera.uy`)
-      traefik.http.routers.micarrera_secure-web-staging.tls: true
-      traefik.http.routers.micarrera_secure-web-staging.tls.certresolver: letsencrypt
     options:
       memory: 250MiB
 

config/deploy.yml

@@ -15,29 +15,7 @@ env:
 ssh:
   user: ubuntu
 
-healthcheck:
-  interval: 30s
-  max_attempts: 14
-
 builder:
-  multiarch: false
+  arch: amd64
   cache:
     type: gha
-
-traefik:
-  options:
-    publish:
-      - "443:443"
-    volume:
-      - "/home/ubuntu/letsencrypt/acme.json:/letsencrypt/acme.json"
-  args:
-    accesslog: true
-    entryPoints.web.address: ":80"
-    entryPoints.websecure.address: ":443"
-    entryPoints.web.http.redirections.entryPoint.to: websecure
-    entryPoints.web.http.redirections.entryPoint.scheme: https
-    entryPoints.web.http.redirections.entrypoint.permanent: true
-    certificatesResolvers.letsencrypt.acme.email: "letsencrypt@cedarcode.com"
-    certificatesResolvers.letsencrypt.acme.storage: "/letsencrypt/acme.json"
-    certificatesResolvers.letsencrypt.acme.httpchallenge: true
-    certificatesResolvers.letsencrypt.acme.httpchallenge.entrypoint: web