# Dockerfile
 
# ============================================
# Stage 1: Dependencies
# ============================================
FROM node:18-alpine AS deps
 
RUN apk add --no-cache libc6-compat
 
WORKDIR /app
 
# Copy package files
COPY package.json package-lock.json* ./
 
# Install dependencies
RUN npm ci --only=production
 
# ============================================
# Stage 2: Builder
# ============================================
FROM node:18-alpine AS builder
 
WORKDIR /app
 
COPY package.json package-lock.json* ./
RUN npm ci
 
COPY . .
 
# Generate Prisma client (if using)
RUN npx prisma generate
 
# Build application
RUN npm run build
 
# ============================================
# Stage 3: Runner (minimal production image)
# ============================================
FROM node:18-alpine AS runner
 
# Create non-root user for security
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 appuser
 
WORKDIR /app
 
# Set NODE_ENV
ENV NODE_ENV=production
ENV PORT=3000
 
# Copy dependencies from deps stage
COPY --from=deps /app/node_modules ./node_modules
 
# Copy built application from builder stage
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json ./
 
# Set correct permissions
RUN chown -R appuser:nodejs /app
 
USER appuser
 
# Expose port
EXPOSE 3000
 
# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {process.exit(r.statusCode === 200 ? 0 : 1)})"
 
# Start application
CMD ["node", "dist/index.js"]

# docker-compose.yml
 
version: '3.8'
 
services:
  app:
    build:
      context: .
      target: runner
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://postgres:postgres@db:5432/myapp
      - REDIS_URL=redis://redis:6379
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    volumes:
      - .:/app
      - /app/node_modules
    command: npm run dev
 
  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: myapp
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5
 
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
 
volumes:
  postgres_data:
  redis_data:

# docker-compose.prod.yml
 
version: '3.8'
 
services:
  app:
    image: ghcr.io/your-org/your-app:latest
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DATABASE_URL=${DATABASE_URL}
      - REDIS_URL=${REDIS_URL}
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 512M
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
 
  # Optional: Multiple replicas behind load balancer
  app-2:
    extends:
      file: docker-compose.prod.yml
      service: app

# Docker installation
docker pull cloudflare/cloudflared:latest
 
# Or direct installation
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# Login to Cloudflare
cloudflared tunnel login
 
# This opens a browser and creates a certificate at ~/.cloudflared/cert.pem

# Create tunnel
cloudflared tunnel create --name myapp
 
# This creates a tunnel ID and credentials file
# Save the tunnel ID: XXXXXXXXXXXXXXXXXXXXXXXXXXXX

# config.yml
 
tunnel: myapp
credentials-file: /root/.cloudflared/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.json
 
ingress:
  # Route main domain to app
  - hostname: app.example.com
    service: http://localhost:3000
  
  # Route API subdomain
  - hostname: api.example.com
    service: http://localhost:3000
  
  # Health check endpoint (public)
  - hostname: health.example.com
    service: http://localhost:3000/health
  
  # Catch-all: return 404
  - service: http_status:404

# Install as systemd service
sudo cloudflared service install
 
# Or run in Docker
docker run -d \
  --name cloudflared \
  -v ~/.cloudflared:/etc/cloudflared \
  cloudflare/cloudflared tunnel run myapp

# docker-compose.yml with cloudflared
 
version: '3.8'
 
services:
  app:
    image: ghcr.io/your-org/your-app:latest
    expose:
      - "3000"
    environment:
      - NODE_ENV=production
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
 
  cloudflared:
    image: cloudflare/cloudflared:latest
    command: tunnel run
    environment:
      - TUNNEL_ID=${CLOUDFLARE_TUNNEL_ID}
    volumes:
      - ./cloudflared:/etc/cloudflared
    depends_on:
      app:
        condition: service_healthy
    restart: unless-stopped

#!/bin/bash
# scripts/deploy-blue-green
 
set -e
 
IMAGE_TAG=$1
CURRENT_COLOR=$(cat .current-color 2>/dev/null || echo "blue")
NEW_COLOR=$([ "$CURRENT_COLOR" = "blue" ] && echo "green" || echo "blue")
 
echo "🔄 Current environment: $CURRENT_COLOR"
echo "🔄 Deploying to: $NEW_COLOR"
 
# Build and push new image
docker build -t myapp:$IMAGE_TAG .
docker push myapp:$IMAGE_TAG
 
# Deploy to inactive environment
echo "📦 Deploying to $NEW_COLOR environment..."
docker-compose -f docker-compose.$NEW_COLOR.yml up -d
 
# Wait for health check
echo "⏳ Waiting for health check..."
for i in {1..30}; do
  if curl -f http://localhost:300${CURRENT_COLOR: -1}/health > /dev/null 2>&1; then
    echo "✅ Health check passed"
    break
  fi
  echo "⏳ Attempt $i/30..."
  sleep 10
done
 
# Switch Cloudflare tunnel to new environment
echo "🔀 Switching traffic to $NEW_COLOR..."
sed -i "s/service: http:\/\/localhost:300[0-9]/service: http:\/\/localhost:300${NEW_COLOR: -1}/" config.yml
cloudflared tunnel reload
 
# Update current color
echo "$NEW_COLOR" > .current-color
 
# Stop old environment after delay
echo "⏳ Waiting 5 minutes before stopping old environment..."
sleep 300
docker-compose -f docker-compose.$CURRENT_COLOR.yml down
 
echo "✅ Deployment complete! Active: $NEW_COLOR"

#!/bin/bash
# scripts/deploy-rolling
 
set -e
 
IMAGE_TAG=$1
REPLICAS=3
 
echo "🚀 Starting rolling deployment with $REPLICAS replicas"
 
# Build and push
docker build -t myapp:$IMAGE_TAG .
docker push myapp:$IMAGE_TAG
 
for i in $(seq 1 $REPLICAS); do
  echo "📦 Updating replica $i/$REPLICAS"
  
  # Stop old container
  docker stop myapp-$i || true
  docker rm myapp-$i || true
  
  # Start new container
  docker run -d \
    --name myapp-$i \
    --label "version=$IMAGE_TAG" \
    --health-cmd "curl -f http://localhost:3000/health" \
    -p "300$((i-1)):3000" \
    myapp:$IMAGE_TAG
  
  # Wait for health check
  echo "⏳ Waiting for replica $i to be healthy..."
  for j in {1..30}; do
    if docker inspect --format='{{.State.Health.Status}}' myapp-$i | grep -q "healthy"; then
      echo "✅ Replica $i healthy"
      break
    fi
    sleep 5
  done
  
  # Verify new replica is serving
  if ! curl -f http://localhost:300$((i-1))/health > /dev/null 2>&1; then
    echo "❌ Replica $i failed health check"
    exit 1
  fi
done
 
# Update load balancer / Cloudflare config
echo "🔄 Updating traffic routing..."
# (Update your load balancer configuration here)
 
echo "✅ Rolling deployment complete"

# Using nginx for traffic splitting
 
upstream myapp {
  # 90% to stable
  server localhost:3000 weight=9;
  # 10% to canary
  server localhost:3001 weight=1;
}
 
server {
  listen 80;
  server_name app.example.com;
  
  location / {
    proxy_pass http://myapp;
  }
}

#!/bin/bash
# scripts/deploy-canary
 
set -e
 
IMAGE_TAG=$1
 
echo "🚀 Starting canary deployment"
 
# Deploy canary instance
docker run -d \
  --name myapp-canary \
  -p 3001:3000 \
  myapp:$IMAGE_TAG
 
# Wait for health
sleep 30
 
# Configure 10% traffic
echo "📊 Routing 10% traffic to canary..."
update-nginx-config --canary-weight 1
 
# Monitor for 15 minutes
echo "⏳ Monitoring canary for 15 minutes..."
sleep 900
 
# Check metrics
ERROR_RATE=$(curl -s http://localhost:3001/metrics | grep error_rate)
LATENCY=$(curl -s http://localhost:3001/metrics | grep p95_latency)
 
if (( $(echo "$ERROR_RATE < 0.01" | bc -l) )) && (( $(echo "$LATENCY < 500" | bc -l) )); then
  echo "✅ Canary metrics look good"
  
  # Increase to 50%
  echo "📊 Increasing to 50% traffic..."
  update-nginx-config --canary-weight 5
  
  sleep 300
  
  # Full rollout
  echo "📊 Rolling out to 100%..."
  docker stop myapp-stable
  docker rename myapp-canary myapp-stable
  update-nginx-config --canary-weight 0
  
  echo "✅ Deployment complete"
else
  echo "❌ Canary metrics failed, rolling back"
  docker stop myapp-canary
  docker rm myapp-canary
  exit 1
fi

// src/health.ts
import { Router } from 'express';
import { db } from './database';
import { redis } from './cache';
import { externalServices } from './services';
 
const router = Router();
 
interface HealthStatus {
  status: 'healthy' | 'degraded' | 'unhealthy';
  checks: Record<string, {
    status: 'up' | 'down' | 'degraded';
    responseTime?: number;
    message?: string;
  }>;
  uptime: number;
  timestamp: string;
}
 
router.get('/health', async (req, res) => {
  const startTime = Date.now();
  const checks: HealthStatus['checks'] = {};
  
  // Database check
  try {
    const dbStart = Date.now();
    await db.query('SELECT 1');
    checks.database = {
      status: 'up',
      responseTime: Date.now() - dbStart,
    };
  } catch (error) {
    checks.database = {
      status: 'down',
      message: error.message,
    };
  }
  
  // Redis check
  try {
    const redisStart = Date.now();
    await redis.ping();
    checks.redis = {
      status: 'up',
      responseTime: Date.now() - redisStart,
    };
  } catch (error) {
    checks.redis = {
      status: 'down',
      message: error.message,
    };
  }
  
  // External services check
  try {
    const servicesStart = Date.now();
    await externalServices.healthCheck();
    checks.externalServices = {
      status: 'up',
      responseTime: Date.now() - servicesStart,
    };
  } catch (error) {
    checks.externalServices = {
      status: 'degraded',
      message: error.message,
    };
  }
  
  // Determine overall status
  const statuses = Object.values(checks).map(c => c.status);
  let status: HealthStatus['status'] = 'healthy';
  
  if (statuses.includes('down')) {
    status = 'unhealthy';
  } else if (statuses.includes('degraded')) {
    status = 'degraded';
  }
  
  const httpStatus = status === 'healthy' ? 200 : status === 'degraded' ? 200 : 503;
  
  res.status(httpStatus).json({
    status,
    checks,
    uptime: process.uptime(),
    timestamp: new Date().toISOString(),
  } as HealthStatus);
});
 
// Readiness probe (is the app ready to receive traffic?)
router.get('/ready', async (req, res) => {
  const isReady = db.isConnected() && redis.isConnected();
  
  if (isReady) {
    res.status(200).json({ ready: true });
  } else {
    res.status(503).json({ ready: false });
  }
});
 
// Liveness probe (is the app stuck?)
router.get('/live', (req, res) => {
  res.status(200).json({ live: true });
});
 
export default router;

HEALTHCHECK \
  --interval=30s \
  --timeout=10s \
  --start-period=60s \
  --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

services:
  app:
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    
    # Restart policy based on health
    restart: unless-stopped
    
    # Dependency health checks
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy

#!/bin/bash
# scripts/deploy
 
set -euo pipefail
 
# ============================================
# Configuration
# ============================================
IMAGE_NAME="myapp"
VERSION=${1:-$(git rev-parse --short HEAD)}
ENVIRONMENT=${2:-production}
REGISTRY="ghcr.io/$(gh api user | jq -r .login)"
 
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color
 
log_info() { echo -e "${GREEN}ℹ️  $1${NC}"; }
log_warn() { echo -e "${YELLOW}⚠️  $1${NC}"; }
log_error() { echo -e "${RED}❌ $1${NC}"; }
 
# ============================================
# Pre-deployment Checks
# ============================================
log_info "Starting deployment of $IMAGE_NAME:$VERSION to $ENVIRONMENT"
 
# Check if on main branch
if [ "$ENVIRONMENT" = "production" ]; then
  CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
  if [ "$CURRENT_BRANCH" != "main" ]; then
    log_error "Production deployments must be from main branch"
    exit 1
  fi
fi
 
# Run tests
log_info "Running tests..."
if ! npm test; then
  log_error "Tests failed, aborting deployment"
  exit 1
fi
 
# Check for uncommitted changes
if [ -n "$(git status --porcelain)" ]; then
  log_warn "Uncommitted changes detected"
  read -p "Continue anyway? (y/n): " confirm
  if [ "$confirm" != "y" ]; then
    exit 1
  fi
fi
 
# ============================================
# Build and Push
# ============================================
log_info "Building Docker image..."
docker build -t $REGISTRY/$IMAGE_NAME:$VERSION .
 
log_info "Pushing to registry..."
docker push $REGISTRY/$IMAGE_NAME:$VERSION
 
if [ "$ENVIRONMENT" = "production" ]; then
  # Also tag as latest for production
  docker tag $REGISTRY/$IMAGE_NAME:$VERSION $REGISTRY/$IMAGE_NAME:latest
  docker push $REGISTRY/$IMAGE_NAME:latest
fi
 
# ============================================
# Deploy
# ============================================
log_info "Deploying to $ENVIRONMENT..."
 
case $ENVIRONMENT in
  staging)
    ssh staging "docker pull $REGISTRY/$IMAGE_NAME:$VERSION && docker-compose up -d"
    ;;
  production)
    # Blue-green deployment
    ./scripts/deploy-blue-green $VERSION
    ;;
  *)
    log_error "Unknown environment: $ENVIRONMENT"
    exit 1
    ;;
esac
 
# ============================================
# Post-deployment Verification
# ============================================
log_info "Running post-deployment checks..."
 
# Wait for deployment
sleep 30
 
# Health check
for i in {1..10}; do
  if curl -f https://$ENVIRONMENT.example.com/health > /dev/null 2>&1; then
    log_info "Health check passed"
    break
  fi
  if [ $i -eq 10 ]; then
    log_error "Health check failed after 10 attempts"
    exit 1
  fi
  log_warn "Health check attempt $i/10 failed, retrying..."
  sleep 10
done
 
# Smoke tests
log_info "Running smoke tests..."
if ! npm run test:smoke -- --environment $ENVIRONMENT; then
  log_error "Smoke tests failed"
  # Auto-rollback for production
  if [ "$ENVIRONMENT" = "production" ]; then
    log_info "Initiating rollback..."
    ./scripts/rollback
  fi
  exit 1
fi
 
# ============================================
# Notifications
# ============================================
log_info "Sending notifications..."
 
# Slack notification
curl -X POST $SLACK_WEBHOOK \
  -H 'Content-Type: application/json' \
  -d "{
    \"text\": \"✅ Deployment Successful\",
    \"blocks\": [
      {
        \"type\": \"section\",
        \"text\": {
          \"type\": \"mrkdwn\",
          \"text\": \"*Deployment to $ENVIRONMENT Successful*\\nVersion: \`$VERSION\`\\nDeployed by: $(whoami)\"
        }
      }
    ]
  }"
 
log_info "✅ Deployment complete!"
echo ""
echo "📊 Application: https://$ENVIRONMENT.example.com"
echo "🔍 Health: https://$ENVIRONMENT.example.com/health"
echo "📝 Logs: ./scripts/logs $ENVIRONMENT"

#!/bin/bash
# scripts/rollback
 
set -euo pipefail
 
ENVIRONMENT=${1:-production}
 
echo "⚠️  Rolling back $ENVIRONMENT deployment"
read -p "Are you sure? (yes/no): " confirm
 
if [ "$confirm" != "yes" ]; then
  echo "❌ Rollback cancelled"
  exit 1
fi
 
# Get previous version
PREVIOUS_VERSION=$(docker ps --format "{{.Label \"version\"}}" | head -n1)
 
if [ -z "$PREVIOUS_VERSION" ]; then
  echo "❌ Could not determine previous version"
  exit 1
fi
 
echo "🔄 Rolling back to version: $PREVIOUS_VERSION"
 
# Execute rollback
case $ENVIRONMENT in
  production)
    # Blue-green rollback
    CURRENT_COLOR=$(cat .current-color)
    NEW_COLOR=$([ "$CURRENT_COLOR" = "blue" ] && echo "green" || echo "blue")
    
    docker-compose -f docker-compose.$NEW_COLOR.yml up -d
    
    # Wait for health
    sleep 30
    
    # Switch traffic back
    sed -i "s/service: http:\/\/localhost:300[0-9]/service: http:\/\/localhost:300${NEW_COLOR: -1}/" config.yml
    cloudflared tunnel reload
    
    echo "$NEW_COLOR" > .current-color
    ;;
  staging)
    docker-compose pull
    docker-compose up -d
    ;;
esac
 
# Notify
curl -X POST $SLACK_WEBHOOK \
  -H 'Content-Type: application/json' \
  -d "{
    \"text\": \"⚠️ Rollback Completed\",
    \"blocks\": [
      {
        \"type\": \"section\",
        \"text\": {
          \"type\": \"mrkdwn\",
          \"text\": \"*Rollback to $ENVIRONMENT*\\nVersion: \`$PREVIOUS_VERSION\`\\nRolled back by: $(whoami)\"
        }
      }
    ]
  }"
 
echo "✅ Rollback complete"

// src/metrics/deployment.ts
import { Counter, Histogram } from 'prom-client';
 
// Deployment frequency
export const deploymentCounter = new Counter({
  name: 'deployments_total',
  help: 'Total number of deployments',
  labelNames: ['environment', 'status'],
});
 
// Deployment duration
export const deploymentDuration = new Histogram({
  name: 'deployment_duration_seconds',
  help: 'Time taken for deployments',
  labelNames: ['environment', 'strategy'],
  buckets: [30, 60, 120, 300, 600],
});
 
// Rollback rate
export const rollbackCounter = new Counter({
  name: 'rollbacks_total',
  help: 'Total number of rollbacks',
  labelNames: ['environment', 'reason'],
});
 
// Health check failures
export const healthCheckFailures = new Counter({
  name: 'health_check_failures_total',
  help: 'Total health check failures',
  labelNames: ['check', 'environment'],
});

# grafana-dashboard.yml
apiVersion: 1
 
dashboards:
  - title: "Deployment Metrics"
    panels:
      - title: "Deployment Frequency"
        type: graph
        targets:
          - expr: rate(deployments_total[24h])
      
      - title: "Deployment Success Rate"
        type: stat
        targets:
          - expr: sum(rate(deployments_total{status="success"}[7d])) / sum(rate(deployments_total[7d]))
      
      - title: "Average Deployment Duration"
        type: stat
        targets:
          - expr: rate(deployment_duration_seconds_sum[7d]) / rate(deployment_duration_seconds_count[7d])
      
      - title: "Rollback Rate"
        type: gauge
        targets:
          - expr: sum(rollbacks_total) / sum(deployments_total) * 100

-- Phase 1: Add new column (non-breaking)
ALTER TABLE users ADD COLUMN new_email VARCHAR(255);
 
-- Deploy app that writes to both columns
-- Deploy this first, let it run for a while
 
-- Phase 2: Backfill data (can be slow)
UPDATE users SET new_email = email WHERE new_email IS NULL;
 
-- Phase 3: Switch reads to new column
-- Deploy app change
 
-- Phase 4: Remove old column (non-breaking)
ALTER TABLE users DROP COLUMN email;

// Use Redis for sessions
import RedisStore from 'connect-redis';
import { createClient } from 'redis';
 
const redisClient = createClient({ url: process.env.REDIS_URL });
await redisClient.connect();
 
app.use(
  session({
    store: new RedisStore({ client: redisClient }),
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
  })
);

// Check ALL dependencies
async function isReady(): Promise<boolean> {
  const checks = await Promise.all([
    db.isConnected(),
    redis.isConnected(),
    externalServices.healthy(),
    migrations.completed(),
  ]);
  
  return checks.every(c => c);
}