Merge develop into main

.dockerignore

@@ -7,12 +7,18 @@ dist
 
 *.log
 .env
+local/
 
 Dockerfile*
 .dockerignore
 *compose*.yml
 .vagrant
+Vagrantfile
+provision.sh
 
 README.md
 docs/
 api-collection/
+grafana/
+prometheus/
+rabbitmq/

.env.example

@@ -23,6 +23,11 @@ WORKER_ENABLE=true
 WORKER_RETRIES=3
 WORKER_BACKOFF_S=5
 
+PROMETHEUS_PORT=9091
+GRAFANA_PORT=8000
+GRAFANA_ADMIN_USER=admin
+GRAFANA_ADMIN_PASSWORD=admin
+
 NODE_ENV=development
 API_BASE_URL=http://localhost:3000/api
 

.github/workflows/build-and-stage.yml

@@ -91,6 +91,7 @@ jobs:
         env:
           DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
           API_PORT: ${{ vars.API_PORT }}
+          GRAFANA_PORT: ${{ vars.GRAFANA_PORT }}
           # Just to be explicit about dependency on IMAGE
           IMAGE: ${{ env.IMAGE }}
           JWT_AT_SECRET: ${{ secrets.JWT_AT_SECRET }}
@@ -99,13 +100,14 @@ jobs:
           cp .env.example .env
           echo "DB_PASSWORD=$DB_PASSWORD" >> .env
           echo "API_PORT=$API_PORT" >> .env
+          echo "GRAFANA_PORT=$GRAFANA_PORT" >> .env
           echo "JWT_AT_SECRET=$JWT_AT_SECRET" >> .env
           echo "JWT_RT_SECRET=$JWT_RT_SECRET" >> .env
-          docker compose -f compose.prod.yml -p stage up -d
+          docker compose -f compose.yml --profile seed -p stage up -d
 
       - name: Post-deploy test
         uses: ./.github/actions/wait-for-health
         with:
           url: http://localhost:${{ vars.API_PORT }}/api/health
-          attempts: 8
-          sleep: 2
+          attempts: 10
+          sleep: 3

.github/workflows/deploy-prod.yml

@@ -33,20 +33,23 @@ jobs:
         env:
           DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
           API_PORT: ${{ vars.API_PORT }}
+          GRAFANA_PORT: ${{ vars.GRAFANA_PORT }}
+          # Just to be explicit about dependency on IMAGE
           IMAGE: ${{ inputs.image }}
           JWT_AT_SECRET: ${{ secrets.JWT_AT_SECRET }}
           JWT_RT_SECRET: ${{ secrets.JWT_RT_SECRET }}
         run: |
           cp .env.example .env
           echo "DB_PASSWORD=$DB_PASSWORD" >> .env
           echo "API_PORT=$API_PORT" >> .env
+          echo "GRAFANA_PORT=$GRAFANA_PORT" >> .env
           echo "JWT_AT_SECRET=$JWT_AT_SECRET" >> .env
           echo "JWT_RT_SECRET=$JWT_RT_SECRET" >> .env
-          docker compose -f compose.prod.yml -p prod up -d
+          docker compose -f compose.yml --profile seed -p prod up -d
 
       - name: Post-deploy test
         uses: ./.github/actions/wait-for-health
         with:
           url: http://localhost:${{ vars.API_PORT }}/api/health
-          attempts: 8
-          sleep: 2
+          attempts: 10
+          sleep: 3

README.md

@@ -12,18 +12,44 @@ NestJS backend API for an e-commerce order-processing flow. The project is built
 - Health checks:
   - https://c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org/api/health
   - https://stage.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org/api/health
+- Grafana UI:
+  - https://grafana.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org
+  - https://grafana-stage.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org
 
 The public VM uses Caddy as a reverse proxy in front of two Docker Compose deployments:
 
 ```caddyfile
 c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org {
-	encode zstd gzip
-	reverse_proxy 127.0.0.1:3001
+    encode zstd gzip
+
+    @metrics path /api/metrics
+    respond @metrics 403
+
+    reverse_proxy 127.0.0.1:3001
 }
 
 stage.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org {
-	encode zstd gzip
-	reverse_proxy 127.0.0.1:3000
+    encode zstd gzip
+
+    @metrics path /api/metrics
+    respond @metrics 403
+
+    reverse_proxy 127.0.0.1:3000
+}
+
+# Grafana
+grafana.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org {
+    basic_auth {
+        reviewer <hashed-pass>
+    }
+    reverse_proxy 127.0.0.1:8001
+}
+
+grafana-stage.c94f026a9d5e40278b2265f2fc8d3d56.dpdns.org {
+    basic_auth {
+        reviewer <hashed-pass>
+    }
+    reverse_proxy 127.0.0.1:8000
 }
 ```
 
@@ -95,8 +121,8 @@ npm run compose:down
 One-off jobs:
 
 ```bash
-docker compose run --rm migrate
-docker compose --profile seed run --rm seed
+docker compose -f compose.yml -f compose.dev.yml run --rm migrate
+docker compose -f compose.yml -f compose.dev.yml --profile seed run --rm seed
 ```
 
 The default seed creates:
@@ -189,8 +215,8 @@ docker compose logs -f rabbitmq
 For deployed environments, inspect logs on the VM with the matching Compose project:
 
 ```bash
-docker compose -f compose.prod.yml -p stage logs -f api
-docker compose -f compose.prod.yml -p prod logs -f api
+docker compose -f compose.yml -p stage logs -f api
+docker compose -f compose.yml -p prod logs -f api
 ```
 
 ## CI/CD

compose.dev.yml

@@ -1,6 +1,7 @@
 services:
   api:
     build:
+      context: .
       target: dev
     command: npm run start:dev:docker
     environment:
@@ -13,6 +14,16 @@ services:
     stdin_open: true
     init: true
 
+  migrate:
+    build:
+      context: .
+      target: prod
+
+  seed:
+    build:
+      context: .
+      target: prod
+
   postgres:
     ports:
       - "${DB_PORT:-5432}:5432"
@@ -22,6 +33,10 @@ services:
       - "${RABBITMQ_PORT:-5672}:5672"
       - "${RABBITMQ_WEB_PORT:-15672}:15672"
 
+  prometheus:
+    ports:
+      - "${PROMETHEUS_PORT:-9091}:9090"
+
 volumes:
   node_modules: