move to production

.github/workflows/deploy-frontend-azurepreview.yml

@@ -60,6 +60,8 @@ jobs:
       run_vertex: ${{ steps.check_files.outputs.run_vertex }}
       run_beacon: ${{ steps.check_files.outputs.run_beacon }}
       run_docs: ${{ steps.check_files.outputs.run_docs }}
+      run_nexus: ${{ steps.check_files.outputs.run_nexus }}
+
 
     steps:
       - name: check modified frontends
@@ -77,6 +79,7 @@ jobs:
           echo "run_vertex=false" >>$GITHUB_OUTPUT
           echo "run_beacon=false" >>$GITHUB_OUTPUT
           echo "run_docs=false" >>$GITHUB_OUTPUT
+          echo "run_nexus=false" >>$GITHUB_OUTPUT
 
           while IFS= read -r file
           do
@@ -87,6 +90,9 @@ jobs:
             if [[ $file == src/platform/* ]]; then
               echo "run_analytics_platform=true" >>$GITHUB_OUTPUT
             fi
+            if [[ $file == src/nexus/* ]]; then
+              echo "run_nexus=true" >>$GITHUB_OUTPUT
+            fi
             if [[ $file == src/website/* ]]; then
               echo "run_website=true" >>$GITHUB_OUTPUT
             fi
@@ -477,6 +483,134 @@ jobs:
               body: 'New azure analytics_platform changes available for preview [here](${{ needs.analytics_platform.outputs.url }})'
             })
 
+  #########################################
+  # NEXUS PREVIEW
+  #########################################
+
+  nexus:
+    name: build-push-deploy-nexus-preview
+    needs: [check, branch-name]
+    if: needs.check.outputs.run_nexus == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      url: ${{ steps.preview.outputs.url }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - run: az acr login --name airqoacr
+
+      - name: Pull secrets from Key Vault
+        run: |
+          BRANCH="${{ needs.branch-name.outputs.sanitized }}"
+          APP="${BRANCH}-nexus-preview"
+
+          DEFAULT_DOMAIN=$(az containerapp env show \
+            --name ${{ env.PR_PREVIEW_ENV }} \
+            --resource-group ${{ env.RG }} \
+            --query properties.defaultDomain -o tsv)
+
+          NEXTAUTH_URL="https://$APP.$DEFAULT_DOMAIN"
+
+          az keyvault secret show \
+            --vault-name ${{ env.KEYVAULT }} \
+            --name sta-env-nexus \
+            --query value -o tsv > secrets.json
+
+          jq -r 'to_entries | .[] | select(.key != "NEXTAUTH_URL" and .key != "NEXTAUTH_URL_INTERNAL" and .key != "NEXTAUTH_COOKIE_DOMAIN" and .key != "AUTH_URL" and .key != "AUTH_TRUST_HOST") | "\(.key)=\(.value|tojson)"' secrets.json > src/nexus/.env
+          {
+            echo "NEXTAUTH_URL=$NEXTAUTH_URL"
+            echo "NEXTAUTH_URL_INTERNAL=$NEXTAUTH_URL"
+            echo "AUTH_TRUST_HOST=true"
+          } >> src/nexus/.env
+
+      - name: Build image
+        run: |
+          docker build -t ${{ env.REGISTRY_URL }}/nexus-pr-preview:${{ github.event.pull_request.head.sha }} src/nexus
+          docker push ${{ env.REGISTRY_URL }}/nexus-pr-preview:${{ github.event.pull_request.head.sha }}
+
+      - name: Deploy Container App
+        run: |
+          BRANCH="${{ needs.branch-name.outputs.sanitized }}"
+          APP="${BRANCH}-nexus-preview"
+
+          DEFAULT_DOMAIN=$(az containerapp env show \
+            --name ${{ env.PR_PREVIEW_ENV }} \
+            --resource-group ${{ env.RG }} \
+            --query properties.defaultDomain -o tsv)
+
+          NEXTAUTH_URL="https://$APP.$DEFAULT_DOMAIN"
+
+          mapfile -t ENV_VARS < <(jq -r 'to_entries[] | select(.key != "NEXTAUTH_URL" and .key != "NEXTAUTH_URL_INTERNAL" and .key != "NEXTAUTH_COOKIE_DOMAIN" and .key != "AUTH_URL" and .key != "AUTH_TRUST_HOST") | "\(.key)=\(.value|tostring)"' secrets.json)
+          ENV_VARS+=("NEXTAUTH_URL=$NEXTAUTH_URL")
+          ENV_VARS+=("NEXTAUTH_URL_INTERNAL=$NEXTAUTH_URL")
+          ENV_VARS+=("AUTH_TRUST_HOST=true")
+
+          jq -e '((.NEXTAUTH_SECRET // .AUTH_SECRET) | length > 0)' secrets.json >/dev/null
+
+          az containerapp up \
+            --name $APP \
+            --resource-group ${{ env.RG }} \
+            --environment ${{ env.PR_PREVIEW_ENV }} \
+            --image ${{ env.REGISTRY_URL }}/nexus-pr-preview:${{ github.event.pull_request.head.sha }} \
+            --target-port 3000 \
+            --ingress external \
+            --registry-server ${{ env.REGISTRY_URL }} \
+            --registry-username airqoacr \
+            --registry-password ${{ secrets.ACR_PASSWORD }} \
+            --env-vars "${ENV_VARS[@]}"
+
+          az containerapp update \
+            --name $APP \
+            --resource-group ${{ env.RG }} \
+            --replace-env-vars "${ENV_VARS[@]}"
+
+          AUTH_STATUS=$(curl -sS -o /tmp/nextauth-providers.json -w "%{http_code}" "$NEXTAUTH_URL/api/auth/providers")
+          if [ "$AUTH_STATUS" != "200" ]; then
+            echo "NextAuth providers endpoint returned HTTP $AUTH_STATUS"
+            cat /tmp/nextauth-providers.json || true
+            az containerapp logs show \
+              --name $APP \
+              --resource-group ${{ env.RG }} \
+              --tail 80 || true
+            exit 1
+          fi
+
+      - id: preview
+        run: |
+          BRANCH="${{ needs.branch-name.outputs.sanitized }}"
+          APP="${BRANCH}-nexus-preview"
+
+          URL=$(az containerapp show \
+            --name $APP \
+            --resource-group ${{ env.RG }} \
+            --query properties.configuration.ingress.fqdn -o tsv)
+
+          echo "url=https://$URL" >> $GITHUB_OUTPUT
+
+  nexus-pr-comment:
+    needs: [check, nexus]
+    if: needs.check.outputs.run_nexus == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v6
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: 'New azure nexus changes available for preview [here](${{ needs.nexus.outputs.url }})'
+            })
+
   #########################################
   # VERTEX PREVIEW
   #########################################

.github/workflows/deploy-frontend-to-azureprod.yml

@@ -15,6 +15,10 @@ on:
         description: "Deploy Analytics Platform"
         required: false
         type: boolean
+      nexus:
+        description: "Deploy Nexus"
+        required: false
+        type: boolean  
       vertex:
         description: "Deploy vertex"
         required: false
@@ -195,6 +199,52 @@ jobs:
             token: ${{ secrets.YAML_UPDATER_TOKEN }}
             message: "Update analytics production image tag"
 
+  nexus:
+    name: build-push-nexus
+    needs: [image-tag]
+    if: inputs.nexus == true
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Azure Login
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: ACR Login
+        run: az acr login --name ${{ env.ACR_NAME }}
+
+      - name: Pull secrets from Key Vault
+        run: |
+          az keyvault secret show \
+            --vault-name ${{ env.KEYVAULT }} \
+            --name prod-env-nexus \
+            --query value -o tsv > secrets.json
+
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/nexus/.env
+
+      - name: Build and Push Docker Image
+        run: |
+          cd src/nexus/
+          docker build -t ${{ env.REGISTRY_URL }}/airqo-nexus:${{ needs.image-tag.outputs.build_id }} .
+          docker push ${{ env.REGISTRY_URL }}/airqo-nexus:${{ needs.image-tag.outputs.build_id }}
+          docker tag ${{ env.REGISTRY_URL }}/airqo-nexus:${{ needs.image-tag.outputs.build_id }} ${{ env.REGISTRY_URL }}/airqo-nexus:latest
+          docker push ${{ env.REGISTRY_URL }}/airqo-nexus:latest
+
+      - name: Update Helm values
+        uses: Wandalen/wretry.action@v1.2.0
+        with:
+          action: fjogeleit/yaml-update-action@main
+          with: |
+            valueFile: "k8s/nexus/k8s-aks/airqo-nexus/values-prod.yaml"
+            propertyPath: "image.tag"
+            value: ${{ needs.image-tag.outputs.build_id }}
+            branch: ${{ env.DEPLOY_BRANCH }}
+            token: ${{ secrets.YAML_UPDATER_TOKEN }}
+            message: "Update nexus production image tag"            
+
   vertex:
     name: build-push-vertex
     needs: [image-tag]

.github/workflows/deploy-frontend-to-azurestaging.yml

@@ -44,6 +44,7 @@ jobs:
       run_vertex: ${{ steps.check_files.outputs.run_vertex }}
       run_beacon: ${{ steps.check_files.outputs.run_beacon }}
       run_docs: ${{ steps.check_files.outputs.run_docs }}
+      run_nexus: ${{ steps.check_files.outputs.run_nexus }}
 
     runs-on: ubuntu-latest
     permissions:
@@ -65,7 +66,7 @@ jobs:
           echo "run_vertex=false" >>$GITHUB_OUTPUT
           echo "run_beacon=false" >>$GITHUB_OUTPUT
           echo "run_docs=false" >>$GITHUB_OUTPUT
-
+          echo "run_nexus=false" >>$GITHUB_OUTPUT
           while IFS= read -r file
           do
             echo $file
@@ -87,6 +88,9 @@ jobs:
             if [[ $file == src/beacon/* ]]; then
               echo "run_beacon=true" >>$GITHUB_OUTPUT
             fi
+            if [[ $file == src/nexus/* ]]; then
+              echo "run_nexus=true" >>$GITHUB_OUTPUT
+            fi
             if [[ $file == src/docs-website/* ]]; then
               echo "run_docs=true" >>$GITHUB_OUTPUT
             fi
@@ -98,6 +102,7 @@ jobs:
               echo "run_vertex=true" >>$GITHUB_OUTPUT
               echo "run_beacon=true" >>$GITHUB_OUTPUT
               echo "run_docs=true" >>$GITHUB_OUTPUT
+              echo "run_nexus=true" >>$GITHUB_OUTPUT
             fi
           done < files.txt
 
@@ -249,6 +254,52 @@ jobs:
             token: ${{ secrets.YAML_UPDATER_TOKEN }}
             message: "Update next platform staging image tag to ${{ needs.image-tag.outputs.build_id }}"
 
+  nexus:
+    name: build-push-nexus-image
+    needs: [check, image-tag]
+    if: needs.check.outputs.run_nexus == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Login to Azure
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: ACR Login
+        run: az acr login --name ${{ env.ACR_NAME }}
+
+      - name: Pull secrets from Key Vault
+        run: |
+          az keyvault secret show \
+            --vault-name ${{ env.KEYVAULT }} \
+            --name sta-env-nexus \
+            --query value -o tsv > secrets.json
+
+          jq -r 'to_entries | .[] | "\(.key)=\(.value|tojson)"' secrets.json > src/nexus/.env
+
+      - name: Build and Push Docker Image
+        run: |
+          cd src/nexus/
+          docker build --tag ${{ env.REGISTRY_URL }}/airqo-stage-nexus:${{ needs.image-tag.outputs.build_id }} .
+          docker push ${{ env.REGISTRY_URL }}/airqo-stage-nexus:${{ needs.image-tag.outputs.build_id }}
+          docker tag ${{ env.REGISTRY_URL }}/airqo-stage-nexus:${{ needs.image-tag.outputs.build_id }} ${{ env.REGISTRY_URL }}/airqo-stage-nexus:latest
+          docker push ${{ env.REGISTRY_URL }}/airqo-stage-nexus:latest
+
+      - name: Update corresponding helm values file(with retry)
+        uses: Wandalen/wretry.action@v1.2.0
+        with:
+          action: fjogeleit/yaml-update-action@main
+          with: |
+            valueFile: "k8s/nexus/k8s-aks/airqo-nexus/values-stage.yaml"
+            propertyPath: "image.tag"
+            value: ${{ needs.image-tag.outputs.build_id }}
+            branch: ${{ env.DEPLOY_BRANCH }}
+            token: ${{ secrets.YAML_UPDATER_TOKEN }}
+            message: "Update nexus staging image tag to ${{ needs.image-tag.outputs.build_id }}"            
+
   vertex:
     name: build-push-vertex-image
     needs: [check, image-tag]

.github/workflows/remove-deploy-azurepreview.yml

@@ -53,7 +53,7 @@ jobs:
         run: |
           BRANCH="${{ needs.branch-name.outputs.sanitized }}"
 
-          for SERVICE in website beacon calibrate-app analytics-p vertex docs; do
+          for SERVICE in website beacon calibrate-app analytics-p nexus vertex docs; do
             APP="${BRANCH}-${SERVICE}-preview"
             echo "Attempting to delete $APP..."
             az containerapp delete \

k8s/nexus/k8s-aks/airqo-nexus/.helmignore

@@ -0,0 +1,10 @@
+# Helm ignore patterns
+# This file is used to tell Helm which files or directories to exclude from the chart.
+*.swp
+*.swo
+*~
+.DS_Store
+.git
+.gitignore
+.helmignore
+

k8s/nexus/k8s-aks/airqo-nexus/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: airqo-nexus
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

k8s/nexus/k8s-aks/airqo-nexus/templates/NOTES.txt

@@ -0,0 +1,23 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "airqo-nexus.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch its status by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "airqo-nexus.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "airqo-nexus.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "airqo-nexus.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
+