jkuijperm/expenses_manager
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: jkuijperm:eff68a0083731cc860c8eb1b32217a29d9b48b64
Branches Tags
jkuijperm:main
jkuijperm:dev
..
compare: jkuijperm:514a1bd75cba7efc56828d87387e23cfc9a7c1e3
Branches Tags
jkuijperm:dev
jkuijperm:main

No commits in common. "eff68a0083731cc860c8eb1b32217a29d9b48b64" and "514a1bd75cba7efc56828d87387e23cfc9a7c1e3" have entirely different histories.
eff68a0083 ... 514a1bd75c

7 changed files with 123 additions and 219 deletions
Show Stats Expand all files Collapse all files

2
.dockerignore
View File

@ -26,6 +26,8 @@
# CI and test configuration, not needed at runtime.
**/Jenkinsfile
**/pytest.ini
**/tests/
# Documentation and planning, not needed at runtime.
**/*.md

30
Dockerfile
View File

@ -1,37 +1,31 @@
FROM python:3.11-slim AS runtime
FROM python:3.11-slim
# Fail fast and log straight to stdout, so `docker-compose logs` is useful.
ENV PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1
WORKDIR /app
# Dependencies first: this layer is cached and only rebuilt when
# requirements.txt changes, not on every code change.
COPY expenses_manager/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
# Copy the Django project itself, not the repository root, so that /app is
# the directory holding manage.py. The previous version copied the repo root
# into /app/expenses_manager, which left manage.py and wsgi.py one level
# deeper than the gunicorn command expected.
COPY expenses_manager/ .
# Collect static files at build time so the running container never needs to
# write to its own filesystem. SECRET_KEY is required by settings.py when
# DEBUG is False, but collectstatic never uses it, so a throwaway value is
# enough — the real one comes from the environment at runtime.
RUN SECRET_KEY=build-time-placeholder \
DEBUG=False \
ALLOWED_HOSTS=localhost \
python manage.py collectstatic --noinput
# Run as an unprivileged account. /app must belong to it: gunicorn writes its
# control socket there, and pytest its cache in the test image.
RUN useradd --create-home --uid 1000 appuser \
&& chown -R appuser:appuser /app
USER appuser
EXPOSE 8000
CMD ["gunicorn", "expenses_manager.wsgi:application", "--bind", "0.0.0.0:8000"]
# The production image plus the test-only dependencies.
FROM runtime AS test
# pip writes to the system site-packages, so the install runs as root and the
# image then drops back to the unprivileged account.
USER root
RUN pip install --no-cache-dir -r requirements-dev.txt
USER appuser

272
expenses_manager/Jenkinsfile vendored
View File

@ -4,8 +4,13 @@ pipeline {
agent none
environment {
// Everything Docker-related happens on the NAS over SSH: Jenkins has no
// daemon of its own. Absolute paths are required — the remote
DEBUG = 'True'
SECRET_KEY = 'ci-only-value-never-used-in-production'
DJANGO_SETTINGS_MODULE = 'expenses_manager.settings'
PYTHONUNBUFFERED = '1'
// Jenkins has no Docker daemon, so everything Docker-related happens on
// the NAS over SSH. Absolute paths are required: the remote
// non-interactive PATH does not include /usr/local/bin.
NAS_HOST = '192.168.1.140'
NAS_USER = 'jenkins-ci'
@ -26,139 +31,81 @@ pipeline {
stages {
// Nested stages share one agent allocation.
// Nested stages share one agent allocation, so the venv built in the
// first stage is still there for the ones that follow.
stage('CI') {
agent any
options { timeout(time: 40, unit: 'MINUTES') }
options { timeout(time: 30, unit: 'MINUTES') }
stages {
stage('Build images') {
stage('Setup Python') {
steps {
sshagent(credentials: ['nas-ssh']) {
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
TAG=$(echo "${BRANCH_NAME}" | tr '/' '-')
# Ship the workspace rather than cloning again on the
# NAS: what gets built is then provably the same code
# this build checked out.
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"rm -rf ${CI_DIR} && mkdir -p ${CI_DIR}"
tar -czf - --exclude=./.git . \
| ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"tar -xzf - -C ${CI_DIR}"
# The test image is the runtime image plus test
# dependencies, so the second build reuses every layer
# of the first.
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
--target runtime \
-t ${IMAGE}:${SHA} -t ${IMAGE}:${TAG} ."
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
--target test \
-t ${IMAGE}-test:${SHA} ."
'''
}
sh '''
cd expenses_manager
python --version
python -m venv venv
venv/bin/pip install --upgrade pip
venv/bin/pip install -r requirements.txt
'''
}
}
// Catches models changed without generating the migration. This
// never touches a database, so SQLite is enough here.
// Catches models changed without generating the migration.
stage('Check migrations') {
steps {
sshagent(credentials: ['nas-ssh']) {
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} run --rm \
-e SECRET_KEY=ci-only-value \
-e DEBUG=False \
-e ALLOWED_HOSTS=localhost,testserver \
-e DJANGO_SETTINGS_MODULE=expenses_manager.settings_test \
-e DB_ENGINE=sqlite3 \
${IMAGE}-test:${SHA} \
python manage.py makemigrations --check --dry-run"
'''
}
sh '''
cd expenses_manager
venv/bin/python manage.py makemigrations --check --dry-run
'''
}
}
stage('Run tests') {
steps {
sshagent(credentials: ['nas-ssh']) {
// Tests run against PostgreSQL, the engine production
// uses. SQLite is only a local-development convenience
// and the two have already differed once (default
// ordering), so a green SQLite run proves little.
sh '''
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} network create ci-net-${BUILD_NUMBER} \
&& sudo ${NAS_DOCKER} run -d \
--name ci-db-${BUILD_NUMBER} \
--network ci-net-${BUILD_NUMBER} \
-e POSTGRES_DB=ci \
-e POSTGRES_USER=ci \
-e POSTGRES_PASSWORD=ci-only-password \
postgres:15"
'''
sh '''
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do \
sudo ${NAS_DOCKER} exec ci-db-${BUILD_NUMBER} \
pg_isready -U ci -d ci > /dev/null 2>&1 && exit 0; \
sleep 2; \
done; \
echo 'Postgres no arranco a tiempo'; exit 1"
'''
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} run --rm \
--network ci-net-${BUILD_NUMBER} \
-e SECRET_KEY=ci-only-value \
-e DEBUG=False \
-e ALLOWED_HOSTS=localhost,testserver \
-e DJANGO_SETTINGS_MODULE=expenses_manager.settings_test \
-e DB_ENGINE=postgresql \
-e DB_NAME=ci \
-e DB_USER=ci \
-e DB_PASSWORD=ci-only-password \
-e DB_HOST=ci-db-${BUILD_NUMBER} \
-e DB_PORT=5432 \
${IMAGE}-test:${SHA} \
sh -c 'pytest --cov --junitxml=/tmp/junit.xml >&2; \
rc=\\$?; cat /tmp/junit.xml; exit \\$rc'" \
> junit.xml
'''
}
sh '''
cd expenses_manager
venv/bin/pytest --cov --junitxml=junit.xml
'''
}
post {
always {
// allowEmptyResults: false is deliberate. A build where
// pytest died before collecting anything produces no XML,
// and that must fail rather than pass quietly.
junit allowEmptyResults: false, testResults: 'junit.xml'
// The throwaway database goes away whatever happened, so a
// failed build does not leave containers behind.
sshagent(credentials: ['nas-ssh']) {
sh '''
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} rm -f ci-db-${BUILD_NUMBER} > /dev/null 2>&1; \
sudo ${NAS_DOCKER} network rm ci-net-${BUILD_NUMBER} > /dev/null 2>&1; \
exit 0"
'''
}
junit allowEmptyResults: false,
testResults: 'expenses_manager/junit.xml'
}
}
}
stage('Build image') {
steps {
sshagent(credentials: ['nas-ssh']) {
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
TAG=$(echo "${BRANCH_NAME}" | tr '/' '-')
# Ship the workspace that was just tested rather than
# cloning again: what gets built is then provably the
# same code the tests ran against.
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"rm -rf ${CI_DIR} && mkdir -p ${CI_DIR}"
tar -czf - --exclude=./expenses_manager/venv \
--exclude=./.git . \
| ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"tar -xzf - -C ${CI_DIR}"
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"cd ${CI_DIR} && sudo ${NAS_DOCKER} build \
-t ${IMAGE}:${SHA} -t ${IMAGE}:${TAG} ."
'''
}
}
}
// A successful build only proves the Dockerfile is syntactically
// sound. Django's own checks prove the image can actually start.
stage('Smoke test image') {
steps {
sshagent(credentials: ['nas-ssh']) {
@ -173,46 +120,22 @@ pipeline {
${IMAGE}:${SHA} python manage.py check"
'''
// A migrations directory without __init__.py is a namespace
// package, and Django deliberately ignores those: the app
// then appears to have no migrations at all, migrate --check
// always reports nothing pending, and a real migration would
// silently never be applied.
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} run --rm \
-e SECRET_KEY=smoke-test-only \
-e DEBUG=False \
-e ALLOWED_HOSTS=localhost \
-e DB_ENGINE=sqlite3 \
${IMAGE}:${SHA} python manage.py showmigrations expenses" \
| grep -q '0001_initial'
'''
}
}
}
stage('Prune old images') {
steps {
sshagent(credentials: ['nas-ssh']) {
// docker images lists newest first, so anything past the
// fifth is an older build. Branch tags are kept because
// they always point at a recent image, and the image the
// running container uses cannot be removed anyway.
sh '''
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"for repo in ${IMAGE} ${IMAGE}-test; do \
sudo ${NAS_DOCKER} images \\$repo --format '{{.Repository}}:{{.Tag}}' \
| grep -v ':dev' | grep -v ':main' | grep -v '<none>' \
| tail -n +6 \
| while read img; do \
sudo ${NAS_DOCKER} rmi \\$img > /dev/null 2>&1; \
done; \
done; \
sudo ${NAS_DOCKER} image prune -f > /dev/null; \
exit 0"
'''
// A migrations directory without __init__.py is a namespace
// package, and Django deliberately ignores those: the app then
// appears to have no migrations at all, migrate --check always
// reports nothing pending, and a real migration would silently
// never be applied. This is what .gitignore line 6 caused.
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sudo ${NAS_DOCKER} run --rm \
-e SECRET_KEY=smoke-test-only \
-e DEBUG=False \
-e ALLOWED_HOSTS=localhost \
-e DB_ENGINE=sqlite3 \
${IMAGE}:${SHA} python manage.py showmigrations expenses" \
| grep -q '0001_initial'
'''
}
}
}
@ -241,8 +164,8 @@ pipeline {
if (rc != 0) {
// Printing the plan also proves the database is reachable.
// If the non-zero status above was a connection failure
// rather than pending migrations, this fails loudly instead
// of asking for approval on a false premise.
// rather than pending migrations, this fails loudly
// instead of asking for approval on a false premise.
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
@ -266,8 +189,6 @@ pipeline {
}
}
steps {
notifyTelegram("⏸️ Esperando aprobacion",
"Hay migraciones pendientes. Entra desde el enlace para revisar el plan y aprobar el despliegue. Si no respondes en 2 horas, el despliegue se cancela.")
timeout(time: 2, unit: 'HOURS') {
input message: 'Hay migraciones pendientes. Revisa el plan en el log del stage anterior.',
ok: 'Migrar y desplegar'
@ -284,8 +205,8 @@ pipeline {
sh '''
SHA=$(echo "${GIT_COMMIT}" | cut -c1-7)
# Always back up, even with no migrations pending: this is the
# restore point for this particular deployment.
# Always back up, even with no migrations pending: this is
# the restore point for this particular deployment.
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} "sudo ${NAS_BACKUP}"
# Migrate with the new image before the running container is
@ -297,20 +218,21 @@ pipeline {
--env-file ${APP_ENV} \
${IMAGE}:${SHA} python manage.py migrate --noinput"
# Point compose at the image that was just tested, then swap the
# container. Writing the tag to .env leaves a readable record of
# what is deployed and makes rollback a one-line edit.
# Point compose at the image that was just tested, then swap
# the container. Writing the tag to .env leaves a readable
# record of what is deployed, and makes rollback a one-line
# edit plus "docker-compose up -d web".
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"echo WEB_IMAGE=${IMAGE}:${SHA} > ${COMPOSE_DIR}/.env \
&& cd ${COMPOSE_DIR} \
&& sudo ${NAS_COMPOSE} up -d web"
&& cd ${COMPOSE_DIR} \
&& sudo ${NAS_COMPOSE} up -d web"
'''
script {
// The Host header must match ALLOWED_HOSTS or Django answers 400
// regardless of health. A 301 is expected: SECURE_SSL_REDIRECT
// sends plain HTTP to HTTPS, and reaching that redirect already
// proves the app processed the request.
// The Host header must match ALLOWED_HOSTS or Django answers
// 400 regardless of health. A 301 is the expected reply here:
// SECURE_SSL_REDIRECT sends plain HTTP to HTTPS, and reaching
// that redirect already proves the app processed the request.
def code = sh(returnStdout: true, script: '''
ssh ${SSH_OPTS} ${NAS_USER}@${NAS_HOST} \
"sleep 10 && curl -s -o /dev/null -w '%{http_code}' \
@ -327,24 +249,23 @@ pipeline {
}
post {
success {
notifyTelegram("🚀 Desplegado", "")
notifyTelegram("🚀 Desplegado")
}
}
}
}
post {
failure { notifyTelegram("❌ FALLO", "") }
fixed { notifyTelegram("✅ Recuperado", "") }
aborted { notifyTelegram("⚠️ Abortado", "") }
failure { notifyTelegram("❌ FALLO") }
fixed { notifyTelegram("✅ Recuperado") }
aborted { notifyTelegram("⚠️ Abortado") }
}
}
// Sends a one-line build summary to Telegram, with an optional extra paragraph.
// The node block is required because the pipeline declares "agent none", so post
// actions have no workspace of their own. Both parameters are mandatory to avoid
// Groovy default arguments, which Jenkins' CPS interpreter handles poorly.
void notifyTelegram(String status, String extra) {
// Sends a one-line build summary to Telegram. The node block is required because
// the pipeline declares "agent none", so post actions have no workspace of their
// own. Credentials come from the Jenkins store, never from the repository.
void notifyTelegram(String status) {
node {
withCredentials([
string(credentialsId: 'telegram-bot-token', variable: 'TG_TOKEN'),
@ -355,8 +276,7 @@ void notifyTelegram(String status, String extra) {
--data-urlencode "chat_id=\${TG_CHAT}" \
--data-urlencode "text=${status} ${env.JOB_NAME} #${env.BUILD_NUMBER}
Rama: ${env.BRANCH_NAME ?: 'main'}
${env.BUILD_URL}
${extra}" > /dev/null
${env.BUILD_URL}" > /dev/null
"""
}
}

11
expenses_manager/expenses_manager/settings_test.py
View File

@ -1,11 +0,0 @@
"""Settings for the test suite.
Inherits the production configuration so tests exercise what actually runs on
the NAS — DEBUG off, secure cookies, WhiteNoise storage — and turns off only
what makes Django's test client unusable: SECURE_SSL_REDIRECT answers every
request with a 301 before the view is ever reached.
"""
from .settings import * # noqa: F401,F403
SECURE_SSL_REDIRECT = False

2
expenses_manager/pytest.ini
View File

@ -1,3 +1,3 @@
[pytest]
DJANGO_SETTINGS_MODULE = expenses_manager.settings_test
DJANGO_SETTINGS_MODULE = expenses_manager.settings
python_files = tests.py test_*.py *_tests.py

11
expenses_manager/requirements-dev.txt
View File

@ -1,11 +0,0 @@
-r requirements.txt
colorama==0.4.6
coverage==7.13.1
iniconfig==2.3.0
pluggy==1.6.0
Pygments==2.19.2
pytest==9.0.2
pytest-cov>=4.0
pytest-django==4.11.1
toml==0.10.2

10
expenses_manager/requirements.txt
View File

@ -1,11 +1,21 @@
asgiref==3.11.0
colorama==0.4.6
coverage==7.13.1
Django==5.2.10
gunicorn==25.1.0
iniconfig==2.3.0
packaging==25.0
pluggy==1.6.0
psycopg==3.3.2
psycopg-binary==3.3.2
Pygments==2.19.2
pytest==9.0.2
pytest-cov>=4.0
pytest-django==4.11.1
python-dotenv==1.2.1
sqlparse==0.5.5
toml==0.10.2
typing_extensions==4.15.0
tzdata==2025.3
whitenoise==6.12.0