Kotlin＋Spring Bootのアプリを GitLab CI/CD によるDockerデプロイまで全手順

# apt update
# apt install -y apt-transport-https ca-certificates software-properties-common
# curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
# add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
# apt update
# apt install -y docker-ce
# docker -v
Docker version 20.10.17, build 100c701

# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
# chmod +x /usr/local/bin/docker-compose
# docker-compose --version
docker-compose version 1.29.2, build 5becea4c

# mkdir /home/admin/gitlab
# cd /home/admin/gitlab
# vi docker-compose.yml

services:
  web:
    image: 'gitlab/gitlab-ce:latest' # gitlab/gitlab-ceイメージ最新バージョンをDocker Hubからpull
    restart: 'always' # 自動起動on
    hostname: 'gitlab-ci.example.com' # GitLabサーバーホスト名
    environment:
      # /etc/gitlab/gitlab.rbの設定を環境変数GITLAB_OMNIBUS_CONFIGに記述
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab-ci.example.com' # GitLabのURL
        registry_external_url 'https://gitlab-ci.example.com:5005' # GitLabのコンテナレジストリAPI URL
        gitlab_rails['gitlab_ssh_host'] = '192.168.11.6' # GitLab sshホスト名（本記事では使わない。）
        gitlab_rails['initial_root_password'] = 'adminadmin' # rootユーザーパスワード（後から変更可）
        gitlab_rails['registry_enabled'] = true # GitLab Container Registry を有効化
        nginx['redirect_http_to_https'] = true # http://で来たら、https://にリダイレクト
        nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab-ci.example.com.crt" # ssl証明書
        nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab-ci.example.com.key" # ssl秘密鍵
    ports:
      - '80:80'
      - '443:443'
      - '2222:22' # sshポート（Ubuntu標準の22ポートと被るため、2222に変更）
      - '5005:5005' # GitLab Container Registryポート（registry_external_urlに合わせる。）
    volumes:
      # 永続化したいデータとSSL証明書関係をホスト側で共有
      - './config:/etc/gitlab'
      - './logs:/var/log/gitlab'
      - './data:/var/opt/gitlab'
      - './ca.crt:/etc/gitlab/ssl/gitlab-ci.example.com.crt'
      - './ca.key:/etc/gitlab/ssl/gitlab-ci.example.com.key'
      - './ca.csr:/etc/gitlab/ssl/gitlab-ci.example.com.csr'
    shm_size: '256m' # コンテナが使用する共有メモリサイズ（適当。）

# openssl genrsa -out ca.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
................................................................................................................................................+++++
.............................+++++
e is 65537 (0x010001)

# openssl req -new -key ca.key -out ca.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:Aichi
Locality Name (eg, city) [Default City]:Toyota
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:gitlab-ci.example.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# echo "subjectAltName=DNS:*.example.com,IP:192.168.11.6" > san.txt
# openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt -extfile san.txt
Signature ok
subject=C = JP, ST = Aichi, L = Toyota, O = Default Company Ltd, CN = gitlab-ci.example.com
Getting Private key

# lsof -i :80
apache2  947     root    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
apache2 1101 www-data    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
apache2 1102 www-data    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
apache2 1103 www-data    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
apache2 1105 www-data    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
apache2 1108 www-data    4u  IPv6  44939      0t0  TCP *:http (LISTEN)
# apt list --installed | grep ^apache2-
apache2-bin/now 2.4.41-4ubuntu3.1 amd64 [installed,upgradable to: 2.4.41-4ubuntu3.11]
apache2-data/now 2.4.41-4ubuntu3.1 all [installed,upgradable to: 2.4.41-4ubuntu3.11]
apache2-utils/now 2.4.41-4ubuntu3.1 amd64 [installed,upgradable to: 2.4.41-4ubuntu3.11]
# apt update
# apt -y remove apache2-*
# lsof -i :80

# docker-compose up -d

# vi /etc/hosts

127.0.0.1 gitlab-ci.example.com

# cd /home/admin/gitlab
# mkdir -p /etc/docker/certs.d/gitlab-ci.example.com:5005
# cp -p ca.crt /etc/docker/certs.d/gitlab-ci.example.com:5005/ca.crt

# docker login gitlab-ci.example.com:5005
Username: root
Password: adminadmin
Authenticating with existing credentials...
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

$ git config --global http.sslVerify false

# mkdir /home/admin/gitlab-runner
# cd /home/admin/gitlab-runner
# vi docker-compose.yml

version: '3'
services:
  runner:
    image: 'gitlab/gitlab-runner:latest' # gitlab/gitlab-runnerイメージ最新バージョンをDocker Hubからpull
    restart: 'always' # 自動起動on
    # 環境変数でgitlab-runner registerのオプション設定
    environment:
      - CI_SERVER_URL=${CI_SERVER_URL} # CI/CDをしたいリポジトリがあるサーバー e.g. https://gitlab-ci.example.com
      - REGISTRATION_TOKEN=${REGISTRATION_TOKEN} # GitLabが発行したトークン（後述）
      - RUNNER_EXECUTOR=docker # Gitlab Runnerの実行方式（後述）
      - RUNNER_TAG_LIST=${RUNNER_TAG_LIST} # Gitlab Runnerのタグ（パイプライン設定で紐付けに使うもの。）
      - RUNNER_NAME=${RUNNER_NAME} # Gitlab Runnerの名前（パイプライン設定では使わない。画面に表示されるもの。）
      - DOCKER_IMAGE=docker:stable # Gitlab Runnerの中で使うdocker。dockerイメージ安定版をDocker Hubからpull
      - DOCKER_VOLUMES=/var/run/docker.sock:/var/run/docker.sock # DooD(Docker outside of Docker)でホスト側dockerdを使うため、ホストのソケットと共有（後述）
      - DOCKER_EXTRA_HOSTS=${DOCKER_EXTRA_HOSTS} # GitLabのコンテナレジストリ名前解決用設定 e.g. gitlab-ci.example.com:192.168.11.6
    volumes:
      - ./etc/gitlab-runner/config:/etc/gitlab-runner # 設定が ./etc/gitlab-runner/config/config.toml に永続保存される。
      - /var/run/docker.sock:/var/run/docker.sock # ホストのソケットと共有（上記のDOCKER_VOLUMES設定に関連）
      - ./certs:/etc/gitlab-runner/certs # Gitlab Runnerが使う証明書置き場

$ sudo gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.com/" \
  --registration-token "PROJECT_REGISTRATION_TOKEN" \
・・・

$ docker run --rm -v /srv/gitlab-runner/config:/etc/gitlab-runner gitlab/gitlab-runner register \
  --non-interactive \
  --executor "docker" \
  --docker-image alpine:latest \
・・・

# vi .env

CI_SERVER_URL=https://gitlab-ci.example.com
REGISTRATION_TOKEN="GR1348941qvyWnPYzWbj7-2rFkdyB"
RUNNER_TAG_LIST=runner1
RUNNER_NAME="GitLab CI/CD Sample Runner"
DOCKER_EXTRA_HOSTS=gitlab-ci.example.com:192.168.11.6

# mkdir certs
# cp -p /etc/docker/certs.d/gitlab-ci.example.com:5005/ca.crt certs/

# docker-compose up -d

# vi /etc/hosts

192.168.11.6 gitlab-ci.example.com

# docker-compose exec runner gitlab-runner register --non-interactive

tags:
  - runner1

workflow:
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_PIPELINE_SOURCE == "push"

variables:
  IMAGE_OPENJDK_GRADLE: gradle:7.3.3-jdk17-alpine

stages:
  - clean
  - build
  - test
  - build-image
  - publish-image
  - deploy

.tags_template:
  tags:
    - runner1

clean job:
  extends: .tags_template
  image: $IMAGE_OPENJDK_GRADLE
  stage: clean
  script:
    - echo "Cleaning leftovers from previous builds"
    - sh $CI_PROJECT_DIR/gradlew clean

build job:
  extends: .tags_template
  image: $IMAGE_OPENJDK_GRADLE
  stage: build
  script:
    - echo "Compiling the code..."
    - sh $CI_PROJECT_DIR/gradlew bootJar
    - mkdir -p build/dependency
    - cd build/dependency
    - jar -xf ../libs/*.jar
  artifacts:
    paths:
      - build/dependency

test:
  extends: .tags_template
  image: $IMAGE_OPENJDK_GRADLE
  stage: test
  script:
    - echo "Running unit tests..."
    - sh $CI_PROJECT_DIR/gradlew test

build image job:
  extends: .tags_template
  stage: build-image
  script:
    - echo "Building Docker Image..."
    - docker build --build-arg DEPENDENCY=build/dependency -t $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID .
    - docker build --build-arg DEPENDENCY=build/dependency -t $CI_REGISTRY_IMAGE:latest .

.docker-login: &docker-login-command
  - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER $CI_REGISTRY --password-stdin

.docker-deploy: &docker-deploy-command
  - docker rm -f spring-boot-kotlin || true
  - docker run -d --name spring-boot-kotlin -p 8080:8080 --restart always $CI_REGISTRY_IMAGE:latest

publish image job:
  extends: .tags_template
  stage: publish-image
  script:
    - echo "Publishing Docker Image..."
    - *docker-login-command
    - docker push $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
    - docker push $CI_REGISTRY_IMAGE:latest

deploy review job:
  extends: .tags_template
  stage: deploy
  script:
    - echo "Deploying Review App...."
    - *docker-deploy-command
  environment:
    name: review
    url: http://192.168.11.6:8080/api

deploy production job:
  stage: deploy
  script:
    - echo "Deploying Production App...."
    - *docker-login-command
    - *docker-deploy-command
  tags:
    - runner2
  environment:
    name: production
    url: http://192.168.11.9:8080/api
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual

# apt update
# apt install -y apt-transport-https ca-certificates curl software-properties-common
# curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
# add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"
# apt update
# apt install -y docker-ce
# curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
# chmod +x /usr/local/bin/docker-compose
# docker-compose --version
docker-compose version 1.29.2, build 5becea4c
# vi /etc/hosts

192.168.11.6 gitlab-ci.example.com

# mkdir /home/admin/gitlab-runner
# cd /home/admin/gitlab-runner
# vi .env

CI_SERVER_URL=https://gitlab-ci.example.com
REGISTRATION_TOKEN="GR1348941qvyWnPYzWbj7-2rFkdyB"
RUNNER_TAG_LIST=runner2
RUNNER_NAME="GitLab CI/CD Sample Runner2"
DOCKER_EXTRA_HOSTS=gitlab-ci.example.com:192.168.11.6

# vi docker-compose.yml

version: '3'
services:
  runner:
    image: 'gitlab/gitlab-runner:latest'
    restart: always
    environment:
      - CI_SERVER_URL=${CI_SERVER_URL}
      - REGISTRATION_TOKEN=${REGISTRATION_TOKEN}
      - RUNNER_EXECUTOR=docker
      - RUNNER_TAG_LIST=${RUNNER_TAG_LIST}
      - RUNNER_NAME=${RUNNER_NAME}
      - DOCKER_IMAGE=docker:stable
      - DOCKER_VOLUMES=/var/run/docker.sock:/var/run/docker.sock
      - DOCKER_EXTRA_HOSTS=${DOCKER_EXTRA_HOSTS}
    volumes:
      - ./etc/gitlab-runner/config:/etc/gitlab-runner
      - /var/run/docker.sock:/var/run/docker.sock
      - ./certs:/etc/gitlab-runner/certs

# scp -rp admin@192.168.11.6:/home/admin/gitlab-runner/certs .
# mkdir -p /etc/docker/certs.d/gitlab-ci.example.com:5005
# cp -p /home/admin/gitlab-runner/certs/ca.crt /etc/docker/certs.d/gitlab-ci.example.com:5005/ca.crt
# docker-compose up -d
# docker-compose exec runner gitlab-runner register --non-interactive

rules:
  - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

$ curl http://localhost:8080/api
Hello GitLab CI/CD world!

rules:
  - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    when: manual

$ curl http://192.168.11.9:8080/api
Hello GitLab CI/CD world!