chore: Docker migration TODO 🦭

[mcdurdin]

Outstanding work that needs to be completed for the Docker-based/k8s-based website host transfer:

help.keyman.com

• http -> https upgrade on staging and production -- verify no needless .htaccess rules ➡ chore: Remove redirect for live site 🦭 help.keyman.com#876
• verify TIER on k8s ➡ chore: provide tier info in _control/info 🦭 help.keyman.com#877
• staging: Use fleet to automatically deploy
• staging: Use pinned Docker images ➡fix: Pin sha of php:7.4-apache 🦭 help.keyman.com#890
• remove legacy resources/kubectl folder (help.keyman.com repo) ➡ chore: Remove legacy k8s files 🦭 help.keyman.com#883
• api/deploy
  • rename api/deploy to _control/webhook/deploy (site-kubernetes-config repo) ➡ keymanapp/site-kubernetes-config#2
  • serialized git pull -- preventing parallel git pulls/deploys
  • don't forget post-pull tasks such as
    • generating kbd index in init-container.sh
    • CDN refresh in init-container.sh ➡ fix: Add cdnrefresh to init-container.sh help.keyman.com#911
  • update webhook endpoint on github
  • Verify that rolling updates incl. timeouts etc is working well with keyman-staging
• production: Deploy
  • Use fleet to automatically deploy (in site-kubernetes-config / rancher) @tim-eves
  • point production cluster to staging branch initially (in site-kubernetes-config) @tim-eves
  • Test locally @tim-eves
  • RAM limits @tim-eves
  • Turn off Azure deployment
  • ensure *.keyman.com, keymanweb.com is in the CF origin cert loaded onto the production cluster
  • Add production deploy webhook endpoint on github
  • Merge staging -> master (in help.keyman.com repo)
  • Swap production cluster to master branch (in site-kubernetes-config repo)
  • Test locally
  • webhook on github (production)
  • Update DNS for help.keyman.com (on Cloudflare)
  • Remove from Azure

Post-Deployment:

• staging: for backend, use api-keyman-com.keyman to bypass Cloudflare
• production: for backend, use api-keyman-com.keyman to bypass Cloudflare

keyman.com

• /.well-known/web.config chore: test .well-known and keyboard language landing links 🦭 #404
  • remove let's encrypt bits
  • test remaining rules in .htaccess
• verify TIER on k8s ➡ chore: add control/info #405
• http -> https upgrade on staging and production
• _control/webhook/deploy
  • webhook on github (staging)
  • test
• staging: Use pinned Docker images ➡fix: Pin sha of php:7.4-apache 🦭 #406
• k8s configuration
• staging: Use fleet to automatically deploy
• production: Deploy (copy from help.keyman.com)

Post-Deployment:

• staging: for backend, use api-keyman-com.keyman to bypass Cloudflare
• production: for backend, use api-keyman-com.keyman to bypass Cloudflare

api.keyman.com + database

• Sort out TIER for k8s sites
• verify TIER on k8s ➡ chore: _control/info api.keyman.com#216
• http -> https upgrade on staging and production
• _control/webhook/deploy
  • webhook on github (staging)
  • test
• staging: Use pinned Docker images ➡ fix: Pin sha of server:2022-latest 🦭 api.keyman.com#217, fix: Pin sha of php:7.4-apache 🦭 api.keyman.com#218
• handle database rebuild requests for staging and production bug: TC build fail notification not working on staging api.keyman.com#203
• staging: verify that database is persisting over rebuilds and deployments
• staging: bring up api.keyman-staging.com (DNS update on CloudFlare)
• staging: Use fleet to automatically deploy feat: Deploy staging site with Kubernetes 🦭 api.keyman.com#205
• production: Deploy (copy from help.keyman.com)
• production: import statistics from existing Azure api db
• production: verify that database is persisting over rebuilds and deployments
• production: update "Notify api.keyman.com of updated keyboards" similar to staging
• bug(common): keyman-touch-layout schema has restrictive id pattern that some keyboards do not match keyman#9843 blocks

Post-Deployment (if necessary?):

• staging: for backend, use api-keyman-com.keyman to bypass Cloudflare
• production: for backend, use api-keyman-com.keyman to bypass Cloudflare

keymanweb.com

• k8s configuration ➡ keymanapp/site-kubernetes-config#10, keymanapp/site-kubernetes-config#20
• http -> https upgrade on staging and production
• _control/webhook/deploy
  • webhook on github (staging)
  • test
• staging: Use fleet to automatically deploy
• staging: Use pinned Docker images ➡fix: Pin sha of php:7.4-apache 🦭 keymanweb.com#91
• staging: bring up web.keyman-staging.com (DNS update on CloudFlare)
• production: Deploy (copy from help.keyman.com)

Post-Deployment:

• staging: for backend, use api-keyman-com.keyman to bypass Cloudflare
• production: for backend, use api-keyman-com.keyman to bypass Cloudflare

s.keyman.com

• k8s configuration
• Sort out TIER for k8s sites
• verify TIER on k8s (_control/info.php as used on other sites)
• http -> https upgrade on staging and production
• _control/webhook/deploy
  • webhook on github (staging)
  • test
• staging: Use fleet to automatically deploy
• staging: Use pinned Docker images ➡fix: Pin sha of php:7.4-apache 🦭 s.keyman.com#154
• staging: bring up s.keyman-staging.com (DNS update on CloudFlare)
• production: Deploy (copy from help.keyman.com)

shared-sites

• merge v0.4, new tag, update all dep sites to use the tag
• Refactor environment getenv() calls into module so we have a single global KeymanSiteEnvironment class

reverse-proxy

• Future: let users choose which sites they want to host locally, and munge internal links accordingly

site-kubernetes-config

• merge staging to main (and update rancher config accordingly), using /production and /staging folders in main ➡ https://github.com/keymanapp/site-kubernetes-config/pull/4

General

• Stop using keyman.com.local and keyman-local.com, and always use keyman.com.localhost
• Update https://github.com/keymanapp/keyman/tree/master/docs/websites#how-to-set-up-a-local-web-server-for-the-keyman-web-pages ➡ docs: Update websites README.md keyman#10566
• Move legacy sites
  • https://blog.tavultesoft.com/
  • https://keymankeyboards.com/
  • https://r.keymanweb.com/
  • https://tavultesoft.com/

Note: legacy Keyman Sites Migration Google Doc

[darcywong00]

I'm making a separate bullet point for /_control/ready.php here rather than splicing into the big checklist at the top.
Based on Jan 22 discussions, we want each site to have a unique /_control/ready probe that k8s can test:

/_control/ready probe

• api.keyman.com ➡ chore: Add /_control/ready api.keyman.com#223

  • test db connection, build status, as well as web server ready, and _common files, vendor files ready
  • .htaccess rewrite from /_control/ready to /_control/ready.php

• keymanweb.com ➡ chore: Add _control/ready keymanweb.com#97

  • test web server ready, and _common files, vendor files ready
  • .htaccess rewrite from /_control/ready to /_control/ready.php

• keyman.com ➡ chore: Add _control/ready #412

  • test web server ready, and _common files, vendor files ready
  • .htaccess rewrite from /_control/ready to /_control/ready.php

• help.keyman.com ➡ chore: Add _control/ready help.keyman.com#951

  • test web server ready, and _common files, vendor files ready
  • .htaccess rewrite from /_control/ready to /_control/ready.php

• s.keyman.com ➡ chore: Add _control/ready s.keyman.com#219

  • plain text file (don't use _common) test web server ready
  • .htaccess rewrite?

[darcywong00]

Making a separate bullet point for creating production branches off of `staging for each site.

• api.keyman.com
• keymanweb.com
• keyman.com
• help.keyman.com
• s.keyman.com

I'll also add branch protection rules for production for the sites that already have rules for staging.