From 88283752079217cfa3f9e963c55d3bbebc71b3eb Mon Sep 17 00:00:00 2001 From: vrubelroman Date: Tue, 30 Jun 2026 18:15:44 +0000 Subject: [PATCH 1/2] refactor: move bot tokens to .env, remove hardcoded credentials - Remove IS_PROD flag and hardcoded tokens from config.py - Read TELEGRAM_BOT_TOKEN and ADMINPANEL_TELEGRAM_BOT_TOKEN from env - Add env_file: .env to lichess-bot and admin-bot in docker-compose.yml - Add .env to .gitignore (no longer tracked) - Add .env.example with test tokens --- .env | 5 ----- .env.example | 6 ++++++ .gitignore | 2 +- LichessClientTG_bot/config.py | 21 ++------------------- docker-compose.yml | 4 ++++ 5 files changed, 13 insertions(+), 25 deletions(-) delete mode 100644 .env create mode 100644 .env.example diff --git a/.env b/.env deleted file mode 100644 index df11af2..0000000 --- a/.env +++ /dev/null @@ -1,5 +0,0 @@ -# Docker Compose Project Name -COMPOSE_PROJECT_NAME=lichess - -# Примечание: Другие переменные окружения хранятся в конфигах сервисов -# Telegram Bot Token: LichessClientTG_bot/config.py diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..048aca9 --- /dev/null +++ b/.env.example @@ -0,0 +1,6 @@ +# Docker Compose Project Name +COMPOSE_PROJECT_NAME=lichess + +# Telegram Bot Tokens (Test) +TELEGRAM_BOT_TOKEN=7903295042:AAGBO2k8pfBDy4RoLRFsknwE7z0N-thAPI8 +ADMINPANEL_TELEGRAM_BOT_TOKEN=8588876086:AAHoZncfhTCbul1BblpvnZMzvz7jAYVFmcw diff --git a/.gitignore b/.gitignore index a6027b4..6cb6333 100644 --- a/.gitignore +++ b/.gitignore @@ -40,7 +40,7 @@ logs/ .dockerignore # Environment -# .env - НЕ в ignore, чтобы параметры проекта были в репозитории +.env .env.local .env.backup diff --git a/LichessClientTG_bot/config.py b/LichessClientTG_bot/config.py index a8b46d6..b58ed54 100644 --- a/LichessClientTG_bot/config.py +++ b/LichessClientTG_bot/config.py @@ -3,25 +3,8 @@ from dotenv import load_dotenv load_dotenv() -IS_PROD = True - -# Telegram Bot Configuration (Production) -TELEGRAM_BOT_TOKEN_PROD = "8241474807:AAH684LTY93aXRou4-LtqU5-p8LuEjzYn8U" -# Admin Panel Bot Configuration (Production) -ADMINPANEL_TELEGRAM_BOT_TOKEN_PROD = "7918349610:AAEZH7lbzdams31rCDZXeaAzFluDWfUQoLg" - -# Telegram Bot Configuration (Test) -TELEGRAM_BOT_TOKEN_TEST = "7903295042:AAGBO2k8pfBDy4RoLRFsknwE7z0N-thAPI8" -# Admin Panel Bot Configuration (Test) -ADMINPANEL_TELEGRAM_BOT_TOKEN_TEST = "8588876086:AAHoZncfhTCbul1BblpvnZMzvz7jAYVFmcw" - -# Select tokens based on IS_PROD flag -if IS_PROD: - TELEGRAM_BOT_TOKEN = TELEGRAM_BOT_TOKEN_PROD - ADMINPANEL_TELEGRAM_BOT_TOKEN = ADMINPANEL_TELEGRAM_BOT_TOKEN_PROD -else: - TELEGRAM_BOT_TOKEN = TELEGRAM_BOT_TOKEN_TEST - ADMINPANEL_TELEGRAM_BOT_TOKEN = ADMINPANEL_TELEGRAM_BOT_TOKEN_TEST +TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN") +ADMINPANEL_TELEGRAM_BOT_TOKEN = os.getenv("ADMINPANEL_TELEGRAM_BOT_TOKEN") # Lichess API Configuration diff --git a/docker-compose.yml b/docker-compose.yml index dac9f95..c405a41 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -24,6 +24,8 @@ services: volumes: - ./LichessClientTG_bot/data:/app/data - ./LichessClientTG_bot:/app + env_file: + - .env environment: - PYTHONPATH=/app - PYTHONUNBUFFERED=1 @@ -47,6 +49,8 @@ services: volumes: - ./LichessClientTG_bot/data:/app/data - ./LichessClientTG_bot:/app + env_file: + - .env environment: - PYTHONPATH=/app - PYTHONUNBUFFERED=1 From 1fe8deb0de0ad16e63eb5787e1131eb8105f5e76 Mon Sep 17 00:00:00 2001 From: vrubelroman Date: Tue, 30 Jun 2026 18:55:21 +0000 Subject: [PATCH 2/2] ci: add Forgejo CI/CD pipeline with docker save/load deploy to prod Co-Authored-By: Claude Sonnet 4.6 --- .forgejo/workflows/deploy.yml | 52 +++++++++++++++++++++++++++ docker-compose.prod.yml | 66 +++++++++++++++++++++++++++++++++++ docker-compose.yml | 4 +++ 3 files changed, 122 insertions(+) create mode 100644 .forgejo/workflows/deploy.yml create mode 100644 docker-compose.prod.yml diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml new file mode 100644 index 0000000..10bc74d --- /dev/null +++ b/.forgejo/workflows/deploy.yml @@ -0,0 +1,52 @@ +name: CI/CD Pipeline + +on: + push: + branches: + - main + +jobs: + build-and-deploy: + runs-on: shell + steps: + - name: Clone repository + run: git clone --depth 1 "http://192.168.8.174:3000/${GITHUB_REPOSITORY}.git" . + env: + GIT_TERMINAL_PROMPT: '0' + + - name: Ensure Docker CLI + run: | + apk add --no-cache docker-cli docker-cli-compose openssh-client || true + grep -q '^vrubel:' /etc/passwd || echo 'vrubel:x:1000:1000::/data:/bin/sh' >> /etc/passwd + + - name: Setup .env for CI/CD + run: cp .env.example .env + + - name: Build Docker images + run: docker-compose build + + - name: Login to Gitea Container Registry + run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login http://192.168.8.174:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin + + - name: Push images to registry + run: | + docker push 192.168.8.174:3000/vrubel/lichess-api:latest + docker push 192.168.8.174:3000/vrubel/lichess-bot:latest + docker push 192.168.8.174:3000/vrubel/lichess-admin:latest + docker push 192.168.8.174:3000/vrubel/lichess-web:latest + + - name: Transfer images to prod + run: | + docker save \ + 192.168.8.174:3000/vrubel/lichess-api:latest \ + 192.168.8.174:3000/vrubel/lichess-bot:latest \ + 192.168.8.174:3000/vrubel/lichess-admin:latest \ + 192.168.8.174:3000/vrubel/lichess-web:latest \ + | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 docker load + + - name: Deploy on prod host + run: | + cat docker-compose.prod.yml | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \ + "cat > ~/services/LichessStatTgWeb/docker-compose.yml" + ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \ + "cd ~/services/LichessStatTgWeb && docker compose up -d --remove-orphans" diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml new file mode 100644 index 0000000..e483a0c --- /dev/null +++ b/docker-compose.prod.yml @@ -0,0 +1,66 @@ +services: + lichess-api: + image: 192.168.8.174:3000/vrubel/lichess-api:latest + container_name: lichess-api + ports: + - "8002:8000" + environment: + - PYTHONUNBUFFERED=1 + restart: always + healthcheck: + test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health').read()"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + + lichess-bot: + image: 192.168.8.174:3000/vrubel/lichess-bot:latest + container_name: lichess-telegram-bot + volumes: + - ./data:/app/data + env_file: + - .env + environment: + - PYTHONPATH=/app + - PYTHONUNBUFFERED=1 + network_mode: "host" + restart: always + depends_on: + - lichess-api + healthcheck: + test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8002/health', timeout=5)"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 40s + + admin-bot: + image: 192.168.8.174:3000/vrubel/lichess-admin:latest + container_name: lichess-admin-bot + volumes: + - ./data:/app/data + env_file: + - .env + environment: + - PYTHONPATH=/app + - PYTHONUNBUFFERED=1 + network_mode: "host" + restart: always + depends_on: + - lichess-api + + web-view: + image: 192.168.8.174:3000/vrubel/lichess-web:latest + container_name: lichess-web-view + ports: + - "5000:5000" + volumes: + - ./data:/app/data:ro + restart: always + depends_on: + - lichess-bot + +networks: + default: + name: lichess-network diff --git a/docker-compose.yml b/docker-compose.yml index c405a41..10c187e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,6 +2,7 @@ services: # Lichess Web Services (API) lichess-api: build: ./LichessWebServices + image: 192.168.8.174:3000/vrubel/lichess-api:latest container_name: lichess-api ports: - "8002:8000" @@ -20,6 +21,7 @@ services: # Telegram Bot lichess-bot: build: ./LichessClientTG_bot + image: 192.168.8.174:3000/vrubel/lichess-bot:latest container_name: lichess-telegram-bot volumes: - ./LichessClientTG_bot/data:/app/data @@ -45,6 +47,7 @@ services: build: context: ./LichessClientTG_bot dockerfile: Dockerfile.admin + image: 192.168.8.174:3000/vrubel/lichess-admin:latest container_name: lichess-admin-bot volumes: - ./LichessClientTG_bot/data:/app/data @@ -62,6 +65,7 @@ services: # Web View Interface web-view: build: ./LichessWebView + image: 192.168.8.174:3000/vrubel/lichess-web:latest container_name: lichess-web-view ports: - "5000:5000"