Pending → ContainerInit → Running → Succeeded/Failed

apiVersion: apps/v1
kind: Deployment
metadata:
  name: java-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: java-app
  template:
    metadata:
      labels:
        app: java-app
    spec:
      containers:

      - name: app
        image: my-java-app:1.0
        ports:

        - containerPort: 8080
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 1024Mi

apiVersion: v1
kind: Service
metadata:
  name: java-app-service
spec:
  type: ClusterIP
  selector:
    app: java-app
  ports:

  - protocol: TCP
    port: 80
    targetPort: 8080

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:

      - name: postgres
        image: postgres:13
        ports:

        - containerPort: 5432
        volumeMounts:

        - name: postgres-storage
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:

  - metadata:
      name: postgres-storage
    spec:
      accessModes:

      - ReadWriteOnce
      resources:
        requests:
          storage: 10Gi

kubectl create namespace production
kubectl apply -f deployment.yaml -n production

metadata:
  labels:
    app: java-app
    environment: production
    version: "1.0"
    team: backend

spec:
  selector:
    app: java-app
    environment: production

resources:
  requests:
    cpu: 500m        # Гарантированно получит
    memory: 512Mi
  limits:
    cpu: 1000m       # Максимум не превышает
    memory: 1024Mi

livenessProbe:
  httpGet:
    path: /health/live
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
  
readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 5

spec:
  terminationGracePeriodSeconds: 60

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: production
data:
  LOG_LEVEL: "INFO"
  DATABASE_POOL_SIZE: "20"
  application.properties: |
    server.port=8080
    spring.application.name=my-app

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=  # base64-encoded
  password: cGFzc3dvcmQxMjM=

resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1024Mi

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "10"
    requests.memory: "20Gi"
    limits.cpu: "20"
    limits.memory: "40Gi"
    pods: "100"

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:

  - max:
      memory: "1Gi"
      cpu: "500m"
    default:
      memory: "512Mi"
      cpu: "250m"
    type: Container

startupProbe:
  httpGet:
    path: /health/startup
    port: 8080
  failureThreshold: 30
  periodSeconds: 10
  
livenessProbe:
  httpGet:
    path: /health/live
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
  
readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
  initialDelaySeconds: 10
  periodSeconds: 5

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: java-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: java-app
  minReplicas: 2
  maxReplicas: 10
  metrics:

  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:

      - type: Percent
        value: 50
        periodSeconds: 15
    scaleUp:
      stabilizationWindowSeconds: 0
      policies:

      - type: Percent
        value: 100
        periodSeconds: 15

metrics:

- type: Pods
  pods:
    metric:
      name: queue_length
    target:
      type: AverageValue
      averageValue: "100"

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: java-app-vpa
spec:
  targetRef:
    apiVersion: "apps/v1"
    kind: Deployment
    name: java-app
  updatePolicy:
    updateMode: "Auto"  # Auto, Recreate, Initial, Off

spec:
  initContainers:

  - name: migration
    image: my-app-migration:latest
    command: ["./migrate.sh"]
  containers:

  - name: app
    image: my-app:latest

spec:
  terminationGracePeriodSeconds: 60
  containers:

  - name: app
    image: my-app:latest

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: java-app-pdb
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: java-app

-XX:+UseContainerSupport
-XX:MaxRAMPercentage=75.0

-Xms512m  # Initial heap
-Xmx768m  # Maximum heap (должен быть < 75% от memory limit)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: quarkus-app
spec:
  replicas: 3
  template:
    spec:
      containers:

      - name: app
        image: my-quarkus-app:latest
        resources:
          requests:
            cpu: 100m
            memory: 64Mi
          limits:
            cpu: 250m
            memory: 128Mi

FROM ghcr.io/graalvm/native-image:latest as builder
COPY . /app
WORKDIR /app
RUN native-image -jar app.jar

FROM frolvlad/alpine-glibc
COPY --from=builder /app/app /app
ENTRYPOINT ["/app"]

env:

- name: LOG_LEVEL
  value: "DEBUG"
- name: DATABASE_URL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: database.url
- name: DB_PASSWORD
  valueFrom:
    secretKeyRef:
      name: app-secrets
      key: password

envFrom:

- configMapRef:
    name: app-config
- secretRef:
    name: app-secrets

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:

- apiGroups: [""]
  resources: ["pods", "pods/logs"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:

- kind: ServiceAccount
  name: my-app
  namespace: default

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}
  policyTypes:

  - Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-from-frontend
spec:
  podSelector:
    matchLabels:
      tier: backend
  policyTypes:

  - Ingress
  ingress:

  - from:

    - podSelector:
        matchLabels:
          tier: frontend
    - namespaceSelector:
        matchLabels:
          name: production
    ports:

    - protocol: TCP
      port: 8080

apiVersion: v1
kind: Namespace
metadata:
  name: secure-namespace
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

spec:
  securityContext:
    runAsUser: 1000
    runAsNonRoot: true
    fsGroup: 2000
  containers:

  - name: app
    image: my-app:latest
    securityContext:
      capabilities:
        drop:

        - ALL
        add:

        - NET_BIND_SERVICE
      allowPrivilegeEscalation: false

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-reader
rules:

- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["my-app-secret"]
  verbs: ["get"]

imagePullSecrets:

- name: regcred

kubectl get rolebindings --all-namespaces
kubectl get clusterrolebindings

apiVersion: apps/v1
kind: Deployment
metadata:
  name: java-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    # pod template

kubectl rollout status deployment/java-app
kubectl rollout history deployment/java-app
kubectl rollout undo deployment/java-app

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: java-app
spec:
  hosts:

  - java-app
  http:

  - match:

    - uri:
        prefix: /
    route:

    - destination:
        host: java-app-v1
      weight: 90
    - destination:
        host: java-app-v2
      weight: 10

my-app-chart/
├── Chart.yaml
├── values.yaml
├── values-prod.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    └── configmap.yaml

apiVersion: v2
name: my-app
description: Java backend application
version: 1.0.0
appVersion: "1.0"

replicaCount: 3

image:
  repository: my-registry.com/my-app
  tag: "1.0"
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 500m
    memory: 512Mi
  limits:
    cpu: 1000m
    memory: 1024Mi

service:
  type: ClusterIP
  port: 80
  targetPort: 8080

# Создать package
helm package my-app-chart/

# Установить chart
helm install my-release my-app-chart/

# Обновить deployment
helm upgrade my-release my-app-chart/

# Просмотреть history
helm history my-release

# Откатиться
helm rollback my-release 1

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: java-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/k8s-manifests
    targetRevision: HEAD
    path: java-app
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

pipeline {
  agent {
    kubernetes {
      yaml '''
        apiVersion: v1
        kind: Pod
        spec:
          containers:

          - name: docker
            image: docker:latest
            command:

            - cat
            tty: true
            volumeMounts:

            - name: docker-sock
              mountPath: /var/run/docker.sock
          volumes:

          - name: docker-sock
            hostPath:
              path: /var/run/docker.sock
      '''
    }
  }
  stages {
    stage('Build') {
      steps {
        container('docker') {
          sh 'docker build -t my-app:${BUILD_NUMBER} .'
          sh 'docker push registry.com/my-app:${BUILD_NUMBER}'
        }
      }
    }
    stage('Deploy') {
      steps {
        sh 'kubectl set image deployment/java-app app=my-app:${BUILD_NUMBER}'
      }
    }
  }
}

stages:

  - build
  - test
  - deploy

build_image:
  stage: build
  image: docker:latest
  script:

    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

deploy_to_k8s:
  stage: deploy
  image: bitnami/kubectl:latest
  script:

    - kubectl set image deployment/java-app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  only:

    - main

apiVersion: database.example.com/v1
kind: PostgreSQL
metadata:
  name: my-database
spec:
  version: "13"
  replicas: 3
  storage: 100Gi

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: postgresdatabases.database.example.com
spec:
  names:
    kind: PostgreSQL
    plural: postgresdatabases
  scope: Namespaced
  versions:

  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          spec:
            type: object
            properties:
              version:
                type: string
              replicas:
                type: integer
              storage:
                type: string

myapp:2.3.1
  ↓   ↓  ↓
  │   │  └─ PATCH: исправления ошибок
  │   └───── MINOR: новые функции, обратно совместимые
  └───────── MAJOR: breaking changes

docker tag myapp:latest myapp:stable
docker tag myapp:latest myapp:v2.3.1
docker tag myapp:latest myapp:prod-ready

# История releases
helm history my-app

# Откат на конкретную версию
helm rollback my-app 3

# Просмотр версий Chart'а
helm search repo my-app --versions

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: java-app
spec:
  replicas: 3
  strategy:
    canary:
      steps:

      - setWeight: 10
      - pause: {duration: 5m}
      - setWeight: 50
      - pause: {duration: 5m}
  selector:
    matchLabels:
      app: java-app
  template:
    # pod template

imagePullSecrets:

- name: registry-credentials

containers:

- name: app
  image: my-registry.com/my-app:1.0

# Build и tag образ
docker build -t myapp:latest .
docker tag myapp:latest myapp:${GIT_COMMIT_SHA:0:8}
docker tag myapp:latest myapp:${VERSION}

# Push все tags
docker push myapp:latest
docker push myapp:${GIT_COMMIT_SHA:0:8}
docker push myapp:${VERSION}

# Суммарная скорость HTTP запросов за 5 минут
sum(rate(http_requests_total{namespace="production"}[5m]))

# CPU utilization по pod'ам
sum(rate(container_cpu_usage_seconds_total[5m])) by (pod_name)

# Memory usage в percentage
(container_memory_usage_bytes / container_spec_memory_limit_bytes) * 100

apiVersion: v1
kind: PrometheusRule
metadata:
  name: app-alerts
spec:
  groups:

  - name: java-app
    rules:

    - alert: HighCPUUsage
      expr: (sum(rate(container_cpu_usage_seconds_total[5m])) by (pod)) > 0.9
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "High CPU usage on {{ $labels.pod }}"
    
    - alert: HighErrorRate
      expr: (rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m])) > 0.05
      for: 5m
      labels:
        severity: critical

{
  "timestamp": "2025-01-15T10:30:45.123Z",
  "level": "ERROR",
  "logger": "com.example.service",
  "message": "Database connection failed",
  "correlationId": "req-123-456",
  "service": "user-service",
  "span_id": "span-789",
  "trace_id": "trace-123"
}

apiVersion: v1
kind: ConfigMap
metadata:
  name: loki-config
data:
  loki-config.yaml: |
    auth_enabled: false
    ingester:
      chunk_idle_period: 3m
    limits_config:
      enforce_metric_name: false
      reject_old_samples: true
      reject_old_samples_max_age: 168h

// Spring Boot with OpenTelemetry
implementation 'io.opentelemetry.instrumentation:opentelemetry-spring-boot-starter'

apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-collector-config
data:
  config.yaml: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
    exporters:
      jaeger:
        endpoint: jaeger-collector:14250
    service:
      pipelines:
        traces:
          receivers: [otlp]
          exporters: [jaeger]

# Проверить статус Pod'ов
kubectl get pods -o wide

# Подробная информация о Pod'е (events, conditions)
kubectl describe pod <pod-name>

# Логи контейнера
kubectl logs <pod-name>
kubectl logs -f <pod-name>  # tail -f
kubectl logs <pod-name> --previous  # логи crashed контейнера

# Interactive shell в контейнере
kubectl exec -it <pod-name> -- /bin/bash

# Информация о узле
kubectl describe node <node-name>

# Check node pressure
kubectl top nodes

# Logs from node
kubectl get events -n kube-system | grep <node-name>

# Backup etcd
ETCDCTL_API=3 etcdctl --endpoints=https://localhost:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  snapshot save /backup/etcd-backup.db

# Restore etcd
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-backup.db \
  --data-dir=/var/lib/etcd-restored

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:

      - name: postgres
        image: postgres:13
        ports:

        - containerPort: 5432
        volumeMounts:

        - name: postgres-storage
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:

  - metadata:
      name: postgres-storage
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 100Gi

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: postgres-cluster
spec:
  instances: 3
  storage:
    size: 100Gi

# Drain узла (переместить pods)
kubectl drain <node> --ignore-daemonsets --delete-emptydir-data

# Upgrade компонентов на узле
# (kubeadm upgrade, kubelet, etc.)

# Возвращение узла в service
kubectl uncordon <node>

apiVersion: velero.io/v1
kind: Backup
metadata:
  name: daily-backup
spec:
  ttl: 720h0m0s
  includedNamespaces:

  - production
  includedResources:

  - deployments
  - services
  - persistentvolumes

-XX:+UseContainerSupport
-XX:MaxRAMPercentage=75.0
-XX:+UseG1GC
-XX:MaxGCPauseMillis=200

server:
  shutdown: graceful
spring:
  lifecycle:
    timeout-per-shutdown-phase: 30s

- name: Install nginx
  apt:
    name: nginx
    state: present

- name: This will always report changed
  shell: echo "hello"

- name: Create file if it doesn't exist
  shell: touch /tmp/myfile
  args:
    creates: /tmp/myfile

[webservers]
web1.example.com
web2.example.com ansible_port=2222

[databases]
db1.example.com ansible_user=dbadmin

[all:vars]
ansible_user=ubuntu
ansible_private_key_file=~/.ssh/id_rsa

all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
          ansible_port: 2222
    databases:
      hosts:
        db1.example.com:
          ansible_user: dbadmin
  vars:
    ansible_user: ubuntu
    ansible_private_key_file: ~/.ssh/id_rsa

webserver1:
  ansible_host: 192.168.1.10
  ansible_user: deploy
  app_port: 8080

all:
  vars:
    ntp_server: ntp.ubuntu.com

---
- name: Deploy web application
  hosts: webservers
  become: yes
  gather_facts: yes
  vars:
    app_version: "1.0.0"
  tasks:

    - name: Install dependencies
      apt:
        name: "{{ item }}"
        state: present
      loop:

        - nginx
        - curl
    
    - name: Copy application config
      template:
        src: app.conf.j2
        dest: /etc/app/config.conf
      notify: restart app
  
  handlers:

    - name: restart app
      service:
        name: app
        state: restarted

- name: Install Java
  apt:
    name: openjdk-17-jdk
    state: present

- name: Copy application jar
  copy:
    src: target/app.jar
    dest: /opt/app/app.jar
    owner: app
    group: app
    mode: '0755'

- name: Generate application.properties
  template:
    src: application.properties.j2
    dest: /opt/app/application.properties
  notify: restart app

- name: Start nginx
  service:
    name: nginx
    state: started
    enabled: yes

- name: Get Java version
  command: java -version
  register: java_version
  changed_when: false

- name: Run database migrations
  shell: |
    cd /opt/app
    ./gradlew migrate
  environment:
    DB_URL: "{{ database_url }}"

- name: Run application container
  docker_container:
    name: myapp
    image: myapp:latest
    state: started
    ports:

      - "8080:8080"
    env:
      LOG_LEVEL: INFO

- name: Download JAR
  get_url:
    url: https://repo.example.com/app-1.0.jar
    dest: /opt/app/app.jar
    checksum: "sha256:abc123..."

- name: Show facts
  debug:
    var: ansible_facts

- name: Install nginx (Ubuntu)
  apt:
    name: nginx
    state: present
  when: ansible_os_family == "Debian"

- name: Install nginx (CentOS)
  yum:
    name: nginx
    state: present
  when: ansible_os_family == "RedHat"

- name: Check if app is running
  command: systemctl is-active myapp
  register: app_status
  changed_when: false
  failed_when: false

- name: Restart app if not running
  service:
    name: myapp
    state: restarted
  when: app_status.rc != 0

ansible-playbook site.yml
ansible-playbook site.yml --inventory hosts.ini
ansible-playbook site.yml -i hosts.ini -e "env=prod"

ansible webservers -m apt -a "name=curl state=present" -b
ansible all -m setup

ansible-playbook site.yml --check --diff

[defaults]
log_path = /var/log/ansible.log

- name: Debug variables
  debug:
    msg: "App version: {{ app_version }}"

ansible-playbook site.yml -vvv

ansible-playbook site.yml --check --diff --limit db1.example.com

inventory/
├── dev
│   ├── hosts.yml
│   └── group_vars/
├── stage
│   ├── hosts.yml
│   └── group_vars/
└── prod
    ├── hosts.yml
    └── group_vars/

ansible-playbook deploy.yml -i inventory/dev/hosts.yml
ansible-playbook deploy.yml -i inventory/stage/hosts.yml
ansible-playbook deploy.yml -i inventory/prod/hosts.yml

---
- name: Example hierarchy
  hosts: webservers
  vars:
    timeout: 30
  tasks:

    - name: Set fact
      set_fact:
        timeout: 60

    - name: Print timeout
      debug:
        msg: "Timeout: {{ timeout }}"
      vars:
        timeout: 90

all:
  children:
    webservers:
      hosts:
        web1.example.com:
        web2.example.com:
    databases:
      hosts:
        db1.example.com:
          ansible_host: 10.0.1.5
        db2.example.com:
          ansible_host: 10.0.1.6
    cache:
      hosts:
        redis1.example.com:
    monitoring:
      hosts:
        prometheus.example.com:

- name: Deploy web app
  hosts: webservers
  tasks:

    - name: Install web server
      apt:
        name: nginx
        state: present

- name: Configure database
  hosts: databases
  tasks:

    - name: Install PostgreSQL
      apt:
        name: postgresql
        state: present

ansible-playbook site.yml --limit webservers
ansible-playbook site.yml --limit web1.example.com

inventory/prod/
├── hosts.yml
└── group_vars/
    ├── webservers.yml
    ├── databases.yml
    └── all.yml

# Переменные для всех хостов в группе webservers
app_user: deploy
app_group: deploy
app_port: 8080
nginx_worker_processes: 4
log_level: info

postgres_version: 14
postgres_max_connections: 200
backup_retention_days: 30

# Глобальные переменные для всех хостов
environment: prod
ntp_server: ntp.ubuntu.com
syslog_server: logs.example.com

inventory/prod/
├── hosts.yml
└── host_vars/
    ├── web1.example.com.yml
    ├── web2.example.com.yml
    └── db1.example.com.yml

# Специфичные переменные для конкретного хоста
ansible_port: 2222
app_instance_id: web1
custom_flag: true
local_disk_size: 500GB

- name: Configure web server to know about database
  hosts: webservers
  tasks:

    - name: Generate database connection string
      set_fact:
        db_host: "{{ groups['databases'][0] }}"
    
    - name: Create app config
      template:
        src: app.conf.j2
        dest: /etc/app/app.conf
      vars:
        database_hosts: "{{ groups['databases'] }}"
        redis_host: "{{ groups['cache'][0] }}"

- name: Apply monitoring configuration
  hosts: all
  tasks:

    - name: Install Prometheus node exporter
      apt:
        name: prometheus-node-exporter
        state: present
      when: inventory_hostname in groups['monitoring']

#!/usr/bin/env python3
import json
import sys

# Здесь код для получения хостов (запрос к облаку, БД и т.д.)
inventory = {
    "all": {
        "hosts": [
            "web1.example.com",
            "web2.example.com"
        ],
        "vars": {
            "ansible_user": "ubuntu"
        }
    },
    "webservers": {
        "hosts": [
            "web1.example.com",
            "web2.example.com"
        ]
    },
    "databases": {
        "hosts": [
            "db1.example.com"
        ]
    }
}

if len(sys.argv) > 1 and sys.argv[1] == '--list':
    print(json.dumps(inventory))
elif len(sys.argv) > 1 and sys.argv[1] == '--host':
    host = sys.argv[2]
    print(json.dumps({}))
else:
    print(json.dumps({"error": "Usage: inventory.py --list or --host <hostname>"}))
    sys.exit(1)

chmod +x inventory.py

ansible-playbook deploy.yml -i ./inventory.py

ansible/
├── ansible.cfg
├── inventories/
│   ├── dev/
│   │   ├── hosts.yml
│   │   └── group_vars/
│   ├── stage/
│   │   ├── hosts.yml
│   │   └── group_vars/
│   └── prod/
│       ├── hosts.yml
│       └── group_vars/
├── roles/
│   ├── common/
│   ├── webserver/
│   └── database/
├── site.yml
├── deploy.yml
└── maintenance.yml

---
- name: Configure common settings
  hosts: all
  roles:

    - common

- name: Configure web servers
  hosts: webservers
  roles:

    - webserver

- name: Configure databases
  hosts: databases
  roles:

    - database

---
- name: Deploy application
  hosts: webservers
  vars:
    app_version: "{{ version }}"
  roles:

    - deploy

ansible-playbook site.yml -i inventories/dev
ansible-playbook deploy.yml -i inventories/stage -e "version=1.2.0"
ansible-playbook deploy.yml -i inventories/prod -e "version=1.2.0"

ansible-playbook deploy.yml -e "env=prod app_version=1.2.3"

ansible-playbook deploy.yml -e @vars.json

{
  "app_version": "1.2.3",
  "replicas": 3,
  "log_level": "info"
}

- name: Load environment-specific variables
  include_vars:
    file: "vars/{{ env }}.yml"
    name: env_vars

- name: Show loaded variables
  debug:
    var: env_vars

---
- name: Deploy application
  hosts: webservers
  vars_files:

    - "vars/common.yml"
    - "vars/{{ env }}.yml"
  tasks:

    - name: Install app
      apt:
        name: myapp
        state: present

vars/
├── common.yml
├── dev.yml
├── stage.yml
└── prod.yml

- name: Install Docker
  hosts: webservers
  tasks:

    - name: Add Docker repository (Ubuntu)
      apt_repository:
        repo: ppa:docker/ubuntu
        state: present
      when: ansible_distribution == "Ubuntu"

    - name: Add Docker repository (CentOS)
      yum_repository:
        name: docker-ce
        baseurl: https://download.docker.com/linux/centos/
        gpgcheck: yes
      when: ansible_os_family == "RedHat"

    - name: Install Docker
      package:
        name: docker-ce
        state: present

- name: Show all variables
  debug:
    var: hostvars[inventory_hostname]

- name: Show app configuration
  debug:
    msg: |
      App: {{ app_name }}
      Version: {{ app_version }}
      Port: {{ app_port }}
      Environment: {{ environment }}

ansible-playbook site.yml -vvv

name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v2
      - name: Deploy to staging
        run: |
          ansible-playbook deploy.yml \
            -i inventories/stage \
            -e "version=${{ github.sha }}" \
            --vault-password-file vault-pass.txt

      - name: Add SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/id_rsa
          chmod 600 ~/.ssh/id_rsa

roles/
└── webserver/
    ├── tasks/
    │   └── main.yml           # Основные задачи
    ├── handlers/
    │   └── main.yml           # Обработчики (перезагрузка сервисов)
    ├── templates/
    │   ├── nginx.conf.j2      # Jinja2-шаблоны
    │   └── app.conf.j2
    ├── files/
    │   └── security.conf      # Статичные файлы
    ├── vars/
    │   └── main.yml           # Переменные роли
    ├── defaults/
    │   └── main.yml           # Значения по умолчанию
    ├── meta/
    │   └── main.yml           # Зависимости, метаинформация
    └── README.md              # Документация

app_name: myapp
app_version: 1.0.0
app_user: appuser
app_group: appuser
app_home: /opt/myapp
app_port: 8080
app_jvm_memory: 1024m
log_level: INFO

app_jar_url: "https://repo.example.com/{{ app_name }}-{{ app_version }}.jar"
app_service_name: "{{ app_name }}"
systemd_unit: "/etc/systemd/system/{{ app_service_name }}.service"

---
dependencies:

  - role: java
    vars:
      java_version: 17
  - role: common

---
- name: Create application user
  user:
    name: "{{ app_user }}"
    group: "{{ app_group }}"
    home: "{{ app_home }}"
    shell: /bin/false
    system: yes
  register: app_user_info

- name: Create application directories
  file:
    path: "{{ item }}"
    state: directory
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0755'
  loop:

    - "{{ app_home }}"
    - "{{ app_home }}/bin"
    - "{{ app_home }}/config"
    - "{{ app_home }}/logs"

- name: Download application JAR
  get_url:
    url: "{{ app_jar_url }}"
    dest: "{{ app_home }}/bin/{{ app_name }}.jar"
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0755'
  notify: restart app

- name: Create application config from template
  template:
    src: application.properties.j2
    dest: "{{ app_home }}/config/application.properties"
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0644'
  notify: restart app

- name: Create systemd unit file
  template:
    src: app.service.j2
    dest: "{{ systemd_unit }}"
    mode: '0644'
  notify: systemd daemon reload

- name: Enable and start application service
  service:
    name: "{{ app_service_name }}"
    enabled: yes
    state: started

- name: Wait for application to be ready
  wait_for:
    port: "{{ app_port }}"
    delay: 2
    timeout: 30

---
- name: restart app
  service:
    name: "{{ app_service_name }}"
    state: restarted

- name: systemd daemon reload
  systemd:
    daemon_reload: yes

- name: Install nginx
  apt:
    name: nginx
    state: present
  notify: restart nginx

- name: Update nginx config
  template:
    src: nginx.conf.j2
    dest: /etc/nginx/nginx.conf
  notify: reload nginx

---
- name: restart nginx
  service:
    name: nginx
    state: restarted

- name: reload nginx
  service:
    name: nginx
    state: reloaded

- name: Restart web services
  listen: restart web
  service:
    name: "{{ item }}"
    state: restarted
  loop:

    - nginx
    - php-fpm

- name: Check web services
  listen: restart web
  wait_for:
    port: 80
    delay: 2
    timeout: 10

- name: Update web config
  template:
    src: web.conf.j2
    dest: /etc/web/config.conf
  notify: restart web

---
- name: Deploy application
  hosts: webservers
  force_handlers: yes
  tasks:

    - name: Stop old service
      service:
        name: myapp
        state: stopped
      notify: restart app
    # Если следующая задача упадёт, handler всё равно запустится
    - name: Deploy new version
      copy:
        src: myapp.jar
        dest: /opt/myapp/

---
dependencies:

  - role: java
    vars:
      java_version: 17
  - role: docker
    vars:
      docker_version: latest
  - role: postgresql
    vars:
      postgres_version: 14

---
- name: Deploy application
  hosts: webservers
  pre_tasks:

    - name: Check connectivity
      ping:

    - name: Get system info
      setup:
        filter: ansible_os_family

  roles:

    - java
    - postgresql
    - webserver

  post_tasks:

    - name: Run tests
      shell: curl http://localhost:8080/health

    - name: Notify team
      mail:
        host: smtp.example.com
        to: team@example.com
        subject: "Deployment completed"

- name: Include common tasks
  include_tasks: common_setup.yml

- name: Configure firewall
  include_tasks: firewall.yml
  vars:
    firewall_ports:

      - 8080
      - 8443

ansible-playbooks/
├── ansible.cfg                    # Конфигурация Ansible
├── .gitignore
├── inventories/                   # Инвентари по окружениям
│   ├── dev/
│   │   ├── hosts.yml
│   │   └── group_vars/
│   ├── stage/
│   └── prod/
├── roles/                         # Роли для переиспользования
│   ├── common/
│   ├── java/
│   ├── docker/
│   ├── postgresql/
│   ├── webserver/
│   └── monitoring/
├── site.yml                       # Основной playbook для конфигурации
├── deploy.yml                     # Playbook для развёртывания
├── maintenance.yml                # Playbook для поддержки
├── group_vars/                    # Глобальные переменные для групп
│   └── all.yml
├── host_vars/                     # Переменные для хостов
├── library/                       # Кастомные модули
├── plugins/                       # Плагины
├── README.md
└── requirements.yml               # Зависимости (ansible-galaxy)

[defaults]
inventory = inventories/dev
roles_path = ./roles
host_key_checking = False
retry_files_enabled = False
log_path = /var/log/ansible.log

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=60s
pipelining = True

- name: Install dependencies
  apt:
    name: "{{ item }}"
    state: present
  loop:

    - nginx
    - curl
  tags:

    - install

- name: Configure application
  template:
    src: app.conf.j2
    dest: /etc/app/config.conf
  tags:

    - configure
    - deploy

- name: Start services
  service:
    name: "{{ item }}"
    state: started
  loop:

    - nginx
    - app
  tags:

    - deploy

ansible-playbook site.yml --tags install
ansible-playbook deploy.yml --tags deploy
ansible-playbook site.yml --skip-tags install

ansible-playbook site.yml --check

ansible-playbook deploy.yml --check --diff

ansible-playbook site.yml --start-at-task "Task name"

---
collections:

  - name: community.docker
    version: ">=1.9.0"
  - name: ansible.posix
    version: ">=1.2.0"

roles:

  - name: geerlingguy.java
    version: 1.10.0
  - name: geerlingguy.postgresql
    version: 3.4.0

ansible-galaxy install -r requirements.yml

- name: Verify application is running
  assert:
    that:

      - app_status.rc == 0
      - app_version.stdout == expected_version
    fail_msg: "Application verification failed"
    success_msg: "Application is healthy"

- name: Try to deploy
  block:

    - name: Copy application
      copy:
        src: app.jar
        dest: /opt/app/

    - name: Start service
      service:
        name: app
        state: started
  
  rescue:

    - name: Rollback previous version
      command: /opt/app/scripts/rollback.sh

    - name: Notify team about failure
      mail:
        host: smtp.example.com
        to: team@example.com
        subject: "Deployment failed and rolled back"

- name: Generate application config
  template:
    src: application.properties.j2
    dest: /etc/app/application.properties
    owner: app
    group: app
    mode: '0600'

# application.properties.j2
app.name={{ app_name }}
app.version={{ app_version }}
app.port={{ app_port }}

{% if environment == "prod" %}
app.debug=false
log.level=ERROR
{% elif environment == "stage" %}
app.debug=false
log.level=INFO
{% else %}
app.debug=true
log.level=DEBUG
{% endif %}

# nginx-upstream.conf.j2
upstream backend {
{% for host in groups['webservers'] %}
    server {{ host }}:{{ app_port }};
{% endfor %}
}

# Преобразование строк
app.name.uppercase={{ app_name | upper }}
app.name.lowercase={{ app_name | lower }}

# JSON-кодирование
database.config={{ db_config | to_json }}

# Стандартные фильтры
list.count={{ items | length }}
first.item={{ items[0] | default('none') }}

# Соединение элементов списка
allowed.hosts={{ allowed_hosts | join(', ') }}

{% set app_url = "http://" + app_host + ":" + app_port | string %}
app.url={{ app_url }}

# Spring Boot Configuration
spring.application.name={{ app_name }}
server.port={{ app_port }}
server.servlet.context-path=/api

# Database Configuration
spring.datasource.url=jdbc:postgresql://{{ db_host }}:{{ db_port }}/{{ db_name }}
spring.datasource.username={{ db_user }}
spring.datasource.password={{ db_password }}
spring.jpa.hibernate.ddl-auto={{ db_ddl_auto | default('validate') }}

# Logging
logging.level.root={{ log_level | default('INFO') }}
logging.level.com.myapp={{ app_log_level | default('DEBUG') }}
logging.file.name={{ app_home }}/logs/application.log

# Server Configuration
server.tomcat.threads.max={{ tomcat_max_threads | default('200') }}
server.connection-timeout=20000

# Application-specific
app.environment={{ environment }}
app.version={{ app_version }}
app.replicas={{ groups['webservers'] | length }}

# Cache Configuration
{% if enable_cache %}
spring.cache.type=redis
spring.redis.host={{ redis_host }}
spring.redis.port={{ redis_port }}
{% else %}
spring.cache.type=simple
{% endif %}

# Monitoring
management.endpoints.web.exposure.include=health,metrics,info
management.endpoint.health.show-details=when-authorized

- name: Deploy Java application
  hosts: webservers
  vars:
    app_name: myapp
    app_port: 8080
    db_host: "{{ groups['databases'][0] }}"
    db_port: 5432
    db_name: myapp_db
    db_user: appuser
    log_level: INFO
    enable_cache: yes
    redis_host: "{{ groups['cache'][0] }}"
  tasks:

    - name: Generate application properties
      template:
        src: application.properties.j2
        dest: "{{ app_home }}/config/application.properties"
      notify: restart app

version: '3.8'

services:
  app:
    image: {{ docker_registry }}/{{ app_name }}:{{ app_version }}
    container_name: {{ app_name }}
    ports:

      - "{{ app_port }}:8080"
    environment:

      - APP_ENV={{ environment }}
      - LOG_LEVEL={{ log_level }}
      - DB_HOST={{ db_host }}
      - DB_PORT={{ db_port }}
      - DB_NAME={{ db_name }}
      - DB_USER={{ db_user }}
      - DB_PASSWORD={{ db_password }}
      - CACHE_HOST={{ redis_host }}
    volumes:

      - {{ app_home }}/config:/app/config:ro
      - {{ app_home }}/logs:/app/logs
    depends_on:
{% for service in docker_dependencies %}
      - {{ service }}
{% endfor %}
    restart: always
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 10s
      timeout: 5s
      retries: 3

{% if enable_postgresql %}
  postgres:
    image: postgres:{{ postgres_version }}
    container_name: {{ app_name }}-db
    environment:

      - POSTGRES_DB={{ db_name }}
      - POSTGRES_USER={{ db_user }}
      - POSTGRES_PASSWORD={{ db_password }}
    volumes:

      - postgres_data:/var/lib/postgresql/data
    restart: always
{% endif %}

{% if enable_redis %}
  redis:
    image: redis:{{ redis_version }}-alpine
    container_name: {{ app_name }}-cache
    ports:

      - "{{ redis_port }}:6379"
    restart: always
{% endif %}

volumes:
{% if enable_postgresql %}
  postgres_data:
{% endif %}

[Unit]
Description={{ app_description | default(app_name ~ ' application') }}
After=network.target
Wants=network-online.target

[Service]
Type=simple
User={{ app_user }}
Group={{ app_group }}
WorkingDirectory={{ app_home }}

# Переменные окружения
EnvironmentFile=-{{ app_home }}/config/env
Environment="APP_HOME={{ app_home }}"
Environment="LOG_LEVEL={{ log_level }}"
Environment="JAVA_OPTS=-Xmx{{ app_jvm_memory }} -Xms{{ app_jvm_memory }}"

# Запуск приложения
ExecStart={{ java_bin | default('/usr/bin/java') }} \
    -Xmx{{ app_jvm_memory }} \
    -Xms{{ app_jvm_memory }} \
    -Dspring.config.location=file:{{ app_home }}/config/application.properties \
    -jar {{ app_home }}/bin/{{ app_name }}.jar

# Политика перезагрузки
Restart=on-failure
RestartSec=10
StartLimitInterval=60
StartLimitBurst=3

# Логирование
StandardOutput=journal
StandardError=journal
SyslogIdentifier={{ app_name }}

# Безопасность
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths={{ app_home }}

[Install]
WantedBy=multi-user.target

ansible-vault create inventories/prod/group_vars/all/secrets.yml

---
db_password: "superSecurePassword123!"
redis_password: "redisPassword"
api_key: "sk-1234567890abcdef"
ssl_certificate: |
  -----BEGIN CERTIFICATE-----
  MIIDXTCCAkWgAwIBAgIJAJL3...
  -----END CERTIFICATE-----

- name: Configure database
  postgresql_query:
    db: "{{ db_name }}"
    login_user: "{{ db_user }}"
    login_password: "{{ db_password }}"  # из secrets.yml
    query: "..."

ansible-playbook site.yml --ask-vault-pass

ansible-playbook site.yml --vault-password-file ~/.vault_pass

ansible-vault view secrets.yml

ansible-vault edit secrets.yml

ansible-vault encrypt vars.yml

ansible-vault decrypt secrets.yml

inventories/
├── dev/
│   └── group_vars/
│       ├── all.yml
│       └── all/
│           └── secrets.yml
├── stage/
│   └── group_vars/
│       ├── all.yml
│       └── all/
│           └── secrets.yml
└── prod/
    └── group_vars/
        ├── all.yml
        └── all/
            └── secrets.yml

---
db_password: "dev_password_123"
redis_password: "dev_redis_pass"
api_key: "dev_api_key"

---
db_password: "prod_complex_password_xyz789"
redis_password: "prod_redis_secure_pass"
api_key: "prod_api_key_secret"

---
db_user: appuser
db_host: "{{ groups['databases'][0] }}"
# db_password загружается из secrets.yml

redis_host: "{{ groups['cache'][0] }}"
# redis_password загружается из secrets.yml

ansible-playbook deploy.yml \
  -i inventories/prod \
  -e "db_password=$DB_PASSWORD" \
  -e "api_key=$API_KEY" \
  --vault-password-file ~/.vault_pass

- name: Deploy with secrets
  run: |
    ansible-playbook deploy.yml \
      -i inventories/prod \
      -e "db_password=${{ secrets.DB_PASSWORD }}" \
      -e "api_key=${{ secrets.API_KEY }}" \
      --vault-password-file $VAULT_PASS_FILE
  env:
    VAULT_PASS_FILE: /tmp/vault_pass

      - name: Create vault password file
        run: |
          echo "${{ secrets.VAULT_PASSWORD }}" > /tmp/vault_pass
          chmod 600 /tmp/vault_pass

ansible-playbook site.yml --syntax-check

ansible-lint site.yml

pip install ansible-lint

port_number={{ app_port | int }}
flag_value={{ enable_feature | bool }}

first_host={{ groups['webservers'] | first }}
last_host={{ groups['webservers'] | last }}
random_host={{ groups['webservers'] | random }}
sorted_hosts={{ groups['webservers'] | sort }}
unique_ids={{ all_ids | unique }}

joined_hosts={{ groups['webservers'] | join(', ') }}
base64_encoded={{ secret_key | b64encode }}
base64_decoded={{ encoded_key | b64decode }}

sum_values={{ [1, 2, 3, 4] | sum }}
max_value={{ metrics | max }}
min_value={{ metrics | min }}

java_version: 17
docker_version: latest
docker_compose_version: latest
system_packages:

  - build-essential
  - curl
  - wget
  - git
  - htop
  - net-tools
  - vim
  - unzip
  - jq
timezone: UTC
swap_size_gb: 2

---
- name: Update system packages
  apt:
    update_cache: yes
    cache_valid_time: 3600

- name: Install system packages
  apt:
    name: "{{ system_packages }}"
    state: present

- name: Set timezone
  timezone:
    name: "{{ timezone }}"

- name: Configure swap
  block:

    - name: Check if swap file exists
      stat:
        path: /swapfile
      register: swap_file

    - name: Create swap file
      command: dd if=/dev/zero of=/swapfile bs=1G count={{ swap_size_gb }}
      when: not swap_file.stat.exists

    - name: Set swap file permissions
      file:
        path: /swapfile
        mode: '0600'

    - name: Make swap
      command: mkswap /swapfile
      when: not swap_file.stat.exists

    - name: Mount swap
      command: swapon /swapfile
      when: not swap_file.stat.exists

    - name: Add swap to fstab
      lineinfile:
        path: /etc/fstab
        line: "/swapfile swap swap defaults 0 0"
        state: present

- name: Install OpenJDK {{ java_version }}
  apt:
    name: "openjdk-{{ java_version }}-jdk"
    state: present

- name: Set JAVA_HOME environment variable
  lineinfile:
    path: /etc/environment
    line: 'JAVA_HOME="/usr/lib/jvm/java-{{ java_version }}-openjdk-amd64"'
    state: present

- name: Install Docker prerequisites
  apt:
    name:

      - apt-transport-https
      - ca-certificates
      - curl
      - gnupg
      - lsb-release
    state: present

- name: Add Docker GPG key
  apt_key:
    url: https://download.docker.com/linux/ubuntu/gpg
    state: present

- name: Add Docker repository
  apt_repository:
    repo: "deb [arch=amd64] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
    state: present

- name: Install Docker
  apt:
    name: "docker-ce"
    state: present

- name: Install Docker Compose
  get_url:
    url: "https://github.com/docker/compose/releases/latest/download/docker-compose-Linux-x86_64"
    dest: /usr/local/bin/docker-compose
    mode: '0755'

- name: Add current user to docker group
  user:
    name: "{{ ansible_user_id }}"
    groups: docker
    append: yes

- name: Enable Docker service
  systemd:
    name: docker
    enabled: yes
    state: started

- name: Verify Java installation
  command: java -version
  register: java_check
  changed_when: false

- name: Verify Docker installation
  command: docker --version
  register: docker_check
  changed_when: false

- name: Show installation summary
  debug:
    msg: |
      Java installation: {{ java_check.stderr_lines[0] }}
      Docker: {{ docker_check.stdout }}

---
- name: Prepare server for Java application
  hosts: webservers
  become: yes
  roles:

    - prepare_java_server

app_name: myapp
app_version: 1.0.0
app_user: appuser
app_group: appuser
app_home: /opt/myapp
app_port: 8080
app_jvm_memory: 1024m
artifact_repository: "https://repo.example.com/releases"
log_level: INFO
health_check_url: "http://localhost:{{ app_port }}/actuator/health"
health_check_timeout: 30

---
- name: Create application user
  user:
    name: "{{ app_user }}"
    group: "{{ app_group }}"
    home: "{{ app_home }}"
    shell: /bin/false
    system: yes
  register: app_user_info

- name: Create application directories
  file:
    path: "{{ item }}"
    state: directory
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0755'
  loop:

    - "{{ app_home }}"
    - "{{ app_home }}/bin"
    - "{{ app_home }}/config"
    - "{{ app_home }}/logs"
    - "{{ app_home }}/previous"

- name: Check current version
  stat:
    path: "{{ app_home }}/bin/{{ app_name }}.jar"
  register: current_jar

- name: Backup current version
  copy:
    src: "{{ app_home }}/bin/{{ app_name }}.jar"
    dest: "{{ app_home }}/previous/{{ app_name }}.jar.{{ ansible_date_time.iso8601_basic_short }}"
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    remote_src: yes
  when: current_jar.stat.exists

- name: Stop application for update
  systemd:
    name: "{{ app_name }}"
    state: stopped
  ignore_errors: yes
  when: current_jar.stat.exists

- name: Download new application version
  get_url:
    url: "{{ artifact_repository }}/{{ app_name }}-{{ app_version }}.jar"
    dest: "{{ app_home }}/bin/{{ app_name }}.jar"
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0755'
  register: download_result

- name: Generate application configuration
  template:
    src: application.properties.j2
    dest: "{{ app_home }}/config/application.properties"
    owner: "{{ app_user }}"
    group: "{{ app_group }}"
    mode: '0640'
  register: config_result

- name: Create systemd service unit
  template:
    src: app.service.j2
    dest: "/etc/systemd/system/{{ app_name }}.service"
    mode: '0644'
  register: service_result

- name: Reload systemd daemon
  systemd:
    daemon_reload: yes
  when: service_result.changed

- name: Start application service
  systemd:
    name: "{{ app_name }}"
    enabled: yes
    state: started

- name: Wait for application to be healthy
  uri:
    url: "{{ health_check_url }}"
    method: GET
    status_code: 200
  register: health_check
  until: health_check.status == 200
  retries: 10
  delay: 3
  ignore_errors: yes

- name: Health check result
  debug:
    msg: "Application health check: {{ health_check.status | default('failed') }}"

- name: Verify service is running
  command: systemctl is-active {{ app_name }}
  register: service_status
  changed_when: false

- name: Show deployment summary
  debug:
    msg: |
      Application: {{ app_name }}:{{ app_version }}
      Location: {{ app_home }}
      Service: {{ app_name }}
      User: {{ app_user }}
      Port: {{ app_port }}
      Status: {{ service_status.stdout }}
      Health: {{ health_check.status | default('unknown') }}

# Application Configuration
spring.application.name={{ app_name }}
server.port={{ app_port }}

# Database
spring.datasource.url={{ db_url }}
spring.datasource.username={{ db_user }}
spring.datasource.password={{ db_password }}

# Logging
logging.level.root={{ log_level }}
logging.file.name={{ app_home }}/logs/application.log
logging.pattern.file=%d{yyyy-MM-dd HH:mm:ss} [%thread] %-5level %logger{36} - %msg%n

# Actuator (Health & Metrics)
management.endpoints.web.exposure.include=health,metrics,info
management.endpoint.health.show-details=when-authorized

[Unit]
Description={{ app_name }} Application
After=network.target

[Service]
Type=simple
User={{ app_user }}
Group={{ app_group }}
WorkingDirectory={{ app_home }}

ExecStart=/usr/bin/java \
    -Xmx{{ app_jvm_memory }} \
    -Xms{{ app_jvm_memory }} \
    -Dspring.config.location=file:{{ app_home }}/config/application.properties \
    -jar {{ app_home }}/bin/{{ app_name }}.jar

Restart=on-failure
RestartSec=10

StandardOutput=journal
StandardError=journal
SyslogIdentifier={{ app_name }}

[Install]
WantedBy=multi-user.target

---
- name: Deploy Spring Boot application
  hosts: webservers
  become: yes
  vars:
    app_name: myapp
    app_version: "{{ deploy_version }}"
    db_url: "jdbc:postgresql://{{ groups['databases'][0] }}:5432/myapp_db"
    db_user: appuser
    db_password: "{{ vault_db_password }}"
  roles:

    - deploy_spring_boot

ansible-playbook deploy.yml \
  -i inventories/prod \
  -e "deploy_version=1.2.3" \
  --vault-password-file ~/.vault_pass

app_name: microservice
docker_registry: registry.example.com
app_version: latest
compose_dir: /opt/docker-compose
services:

  - app
  - postgres
  - redis

---
- name: Create compose directory
  file:
    path: "{{ compose_dir }}"
    state: directory
    mode: '0755'

- name: Stop running containers
  docker_compose:
    project_src: "{{ compose_dir }}"
    state: absent
  ignore_errors: yes

- name: Generate docker-compose.yml
  template:
    src: docker-compose.yml.j2
    dest: "{{ compose_dir }}/docker-compose.yml"
    mode: '0644'

- name: Create .env file with configuration
  template:
    src: .env.j2
    dest: "{{ compose_dir }}/.env"
    mode: '0600'

- name: Pull latest images
  docker_image:
    name: "{{ docker_registry }}/{{ app_name }}"
    tag: "{{ app_version }}"
    source: pull
    force_source: yes

- name: Start services with docker-compose
  docker_compose:
    project_src: "{{ compose_dir }}"
    state: present
    pull: yes
    recreate: smart

- name: Wait for services to be ready
  pause:
    seconds: 5

- name: Verify containers are running
  docker_container_info:
    name: "{{ compose_dir.split('/')[-1] }}_{{ item }}_1"
  register: container_status
  loop: "{{ services }}"
  failed_when: container_status.containers | length == 0 or not container_status.containers[0].State.Running

- name: Health check
  uri:
    url: "http://localhost:{{ app_port }}/health"
    status_code: 200
  retries: 5
  delay: 2
  ignore_errors: yes

- name: Show deployment status
  debug:
    msg: |
      Services deployed: {{ services | join(', ') }}
      Location: {{ compose_dir }}
      Docker Compose file updated

version: '3.8'

services:
  app:
    image: {{ docker_registry }}/{{ app_name }}:{{ app_version }}
    container_name: {{ app_name }}
    ports:

      - "{{ app_port }}:8080"
    environment:

      - APP_ENV={{ environment }}
      - DB_HOST=postgres
      - REDIS_HOST=redis
    depends_on:

      - postgres
      - redis
    restart: unless-stopped

  postgres:
    image: postgres:14-alpine
    container_name: {{ app_name }}-db
    environment:

      - POSTGRES_DB={{ db_name }}
      - POSTGRES_USER={{ db_user }}
      - POSTGRES_PASSWORD={{ db_password }}
    volumes:

      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: {{ app_name }}-cache
    restart: unless-stopped

volumes:
  postgres_data:

---
- name: Debug and verify configuration
  hosts: webservers
  gather_facts: yes
  tasks:

    - name: Show system information
      debug:
        msg: |
          OS: {{ ansible_distribution }} {{ ansible_distribution_version }}
          Kernel: {{ ansible_kernel }}
          Architecture: {{ ansible_machine }}
          Python: {{ ansible_python_version }}

    - name: Check connectivity to database
      wait_for:
        host: "{{ db_host }}"
        port: 5432
        timeout: 5
      ignore_errors: yes
      register: db_check

    - name: Database connectivity result
      debug:
        msg: "Database accessible: {{ db_check is succeeded }}"

    - name: Check application service status
      service_facts:

    - name: Show service status
      debug:
        var: ansible_facts.services["{{ app_name }}.service"]

    - name: Get application logs
      command: "journalctl -u {{ app_name }} -n 50 --no-pager"
      register: app_logs

    - name: Show recent logs
      debug:
        msg: "{{ app_logs.stdout_lines }}"

    - name: Check disk space
      shell: df -h | grep -E "/$|/opt|/var"
      register: disk_space

    - name: Show disk usage
      debug:
        msg: "{{ disk_space.stdout_lines }}"

    - name: Check memory usage
      shell: free -h
      register: memory

    - name: Show memory
      debug:
        msg: "{{ memory.stdout_lines }}"

ansible-playbook maintenance.yml -i inventories/prod --limit web1.example.com -vvv

# Синтаксис
ansible-playbook deploy.yml --syntax-check

# Dry-run с diff
ansible-playbook deploy.yml -i inventories/stage --check --diff

# Lint
ansible-lint deploy.yml

# Запуск на одном хосте
ansible-playbook deploy.yml -i inventories/prod --limit web1.example.com

# Логирование
ansible-playbook deploy.yml -i inventories/prod -vvv > deploy.log

---
- name: Rollback application
  hosts: webservers
  become: yes
  tasks:

    - name: Find previous version
      find:
        paths: "{{ app_home }}/previous"
        patterns: "{{ app_name }}.jar.*"
      register: previous_versions

    - name: Get latest backup
      set_fact:
        latest_backup: "{{ previous_versions.files | sort(attribute='mtime', reverse=true) | first }}"

    - name: Stop current service
      systemd:
        name: "{{ app_name }}"
        state: stopped

    - name: Restore previous version
      copy:
        src: "{{ latest_backup.path }}"
        dest: "{{ app_home }}/bin/{{ app_name }}.jar"
        owner: "{{ app_user }}"
        group: "{{ app_group }}"
        remote_src: yes

    - name: Start application
      systemd:
        name: "{{ app_name }}"
        state: started

    - name: Verify rollback
      uri:
        url: "http://localhost:{{ app_port }}/health"
        status_code: 200
      retries: 5
      delay: 2

Trigger (push, PR, manual)
  ↓
Checkout → получение кода из репозитория
  ↓
Build → компиляция, сборка артефакта или jar/war
  ↓
Unit Tests → тестирование отдельных компонентов
  ↓
Code Quality → статический анализ (SonarQube, linters)
  ↓
Integration Tests → тестирование взаимодействия компонентов
  ↓
Build Docker Image → упаковка приложения в контейнер
  ↓
Push to Registry → публикация образа в Docker Registry/ECR/GCR
  ↓
Deploy to Dev/Stage → разворачивание в тестовую среду (опционально)
  ↓
Deploy to Production → разворачивание в боевую среду (опционально, часто вручную)

./gradlew clean build  # или mvn clean install

project-root/
├── src/main/java (или src/main/kotlin)
├── src/test/java (или src/test/kotlin)
├── build.gradle (или pom.xml)
├── Dockerfile (для сборки образа)
├── .github/workflows/ (GitHub Actions)
├── .gitlab-ci.yml (GitLab CI)
├── Jenkinsfile (Jenkins)
└── docker-compose.yml (локальная разработка)

./gradlew test                    # только unit тесты
./gradlew integrationTest         # интеграционные тесты

version = '1.2.3'

VERSION="1.2.3+git.${GIT_SHA:0:7}"

# application.properties
app.name=${APP_NAME:my-service}
app.port=${APP_PORT:8080}
db.url=${DB_URL:localhost:5432}

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:

    - cron: '0 2 * * *'  # каждый день в 02:00 UTC
  workflow_dispatch:  # ручной запуск

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    
    steps:

      - uses: actions/checkout@v3
      
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle  # кеширование gradle зависимостей
      
      - name: Build with Gradle
        run: ./gradlew clean build -x test
      
      - name: Run unit tests
        run: ./gradlew test
      
      - name: Run integration tests
        run: ./gradlew integrationTest
      
      - name: SonarQube scan
        run: ./gradlew sonarqube
        env:
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
          SONAR_LOGIN: ${{ secrets.SONAR_LOGIN }}
      
      - name: Upload test results
        if: always()  # выполнить даже если тесты упали
        uses: actions/upload-artifact@v3
        with:
          name: test-results
          path: build/test-results/
      
      - name: Publish to artifact repository
        if: github.ref == 'refs/heads/main'
        run: ./gradlew publish
        env:
          NEXUS_URL: ${{ secrets.NEXUS_URL }}
          NEXUS_USERNAME: ${{ secrets.NEXUS_USERNAME }}
          NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}

  docker-build:
    needs: build
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    
    steps:

      - uses: actions/checkout@v3
      
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      
      - name: Log in to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      
      - name: Extract version
        id: version
        run: |
          VERSION=$(cat build.gradle | grep "version = " | sed "s/.*version = '\([^']*\)'.*/\1/")
          echo "version=$VERSION" >> $GITHUB_OUTPUT
      
      - name: Build and push Docker image
        uses: docker/build-push-action@v4
        with:
          context: .
          push: true
          tags: |
            ${{ secrets.DOCKER_USERNAME }}/my-service:${{ steps.version.outputs.version }}
            ${{ secrets.DOCKER_USERNAME }}/my-service:latest
          cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/my-service:buildcache
          cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/my-service:buildcache,mode=max

variables:
  GRADLE_OPTS: "-Dorg.gradle.daemon=false"
  DOCKER_DRIVER: overlay2
  DOCKER_BUILDKIT: 1

stages:

  - build
  - test
  - quality
  - package
  - deploy

build:
  stage: build
  image: gradle:7.6-jdk17
  script:

    - ./gradlew clean build -x test
  artifacts:
    paths:

      - build/libs/
      - build/classes/
    expire_in: 1 hour
  cache:
    key: gradle-cache
    paths:

      - .gradle/
  only:

    - main
    - develop
    - merge_requests

unit_tests:
  stage: test
  image: gradle:7.6-jdk17
  script:

    - ./gradlew test
  artifacts:
    reports:
      junit: build/test-results/test/*.xml
    paths:

      - build/reports/tests/test/
    expire_in: 30 days
  cache:
    key: gradle-cache
    paths:

      - .gradle/
  coverage: '/Test execution finished with \d+ failures, \d+ skipped. Total coverage: ([0-9.]+)%/'
  dependencies:

    - build

integration_tests:
  stage: test
  image: gradle:7.6-jdk17
  services:

    - postgres:14
    - redis:7
  variables:
    POSTGRES_DB: test_db
    POSTGRES_USER: test_user
    POSTGRES_PASSWORD: test_password
    REDIS_HOST: redis
  script:

    - ./gradlew integrationTest
  artifacts:
    reports:
      junit: build/test-results/integrationTest/*.xml
    paths:

      - build/reports/tests/integrationTest/
    expire_in: 30 days
  cache:
    key: gradle-cache
    paths:

      - .gradle/
  dependencies:

    - build
  only:

    - main
    - merge_requests

sonarqube:
  stage: quality
  image: gradle:7.6-jdk17
  script:

    - ./gradlew sonarqube -Dsonar.host.url=$SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN
  cache:
    key: gradle-cache
    paths:

      - .gradle/
  dependencies:

    - build
    - unit_tests
  only:

    - main
    - merge_requests
  allow_failure: true

docker_build:
  stage: package
  image: docker:20.10
  services:

    - docker:20.10-dind
  before_script:

    - echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin
  script:

    - VERSION=$(cat build.gradle | grep "version = " | sed "s/.*version = '\([^']*\)'.*/\1/")
    - docker build -t $DOCKER_USERNAME/my-service:$VERSION .
    - docker tag $DOCKER_USERNAME/my-service:$VERSION $DOCKER_USERNAME/my-service:latest
    - docker push $DOCKER_USERNAME/my-service:$VERSION
    - docker push $DOCKER_USERNAME/my-service:latest
  dependencies:

    - build
  only:

    - main

deploy_dev:
  stage: deploy
  image: alpine:latest
  before_script:

    - apk add --no-cache openssh-client
    - mkdir -p ~/.ssh
    - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_rsa
    - chmod 600 ~/.ssh/id_rsa
    - ssh-keyscan -H $DEV_SERVER_HOST >> ~/.ssh/known_hosts
  script:

    - VERSION=$(cat build.gradle | grep "version = " | sed "s/.*version = '\([^']*\)'.*/\1/")
    - ssh $DEV_USER@$DEV_SERVER_HOST "docker pull $DOCKER_USERNAME/my-service:$VERSION && docker-compose -f /opt/services/docker-compose.yml up -d my-service"
  dependencies:

    - docker_build
  only:

    - main
  environment:
    name: development
    url: https://dev.example.com

# GitHub Actions
- name: Run Checkstyle
  run: ./gradlew checkstyleMain

- name: Run SpotBugs
  run: ./gradlew spotbugsMain

- name: Run ktlint
  run: ./gradlew ktlintCheck

# GitLab CI
lint:
  stage: quality
  image: gradle:7.6-jdk17
  script:

    - ./gradlew checkstyleMain spotbugsMain ktlintCheck
  cache:
    key: gradle-cache
    paths:

      - .gradle/

// build.gradle
sourceSets {
    integrationTest {
        java {
            compileClasspath += main.output + test.output
            runtimeClasspath += main.output + test.output
        }
    }
}

task integrationTest(type: Test) {
    testClassesDirs = sourceSets.integrationTest.output.classesDirs
    classpath = sourceSets.integrationTest.runtimeClasspath
}

- name: Publish
  if: github.event_name == 'push' && github.ref == 'refs/heads/main'
  run: ./gradlew publish

publish:
  stage: package
  script:

    - ./gradlew publish
  only:

    - main
  except:

    - schedules

strategy:
  matrix:
    java-version: [11, 17, 21]
steps:

  - uses: actions/setup-java@v3
    with:
      java-version: ${{ matrix.java-version }}

.test_template: &test_template
  image: gradle:7.6-jdk${JAVA_VERSION}
  script:

    - ./gradlew test

test_jdk11:
  <<: *test_template
  variables:
    JAVA_VERSION: "11"

test_jdk17:
  <<: *test_template
  variables:
    JAVA_VERSION: "17"

test_jdk21:
  <<: *test_template
  variables:
    JAVA_VERSION: "21"

# GitLab CI
services:

  - name: postgres:14
    alias: postgres
  - name: redis:7
    alias: redis

variables:
  POSTGRES_DB: test_db
  POSTGRES_USER: test_user
  POSTGRES_PASSWORD: password
  POSTGRES_HOST_AUTH_METHOD: trust
  REDIS_HOST: redis

script:

  - ./gradlew integrationTest

# GitHub Actions
services:
  postgres:
    image: postgres:14
    env:
      POSTGRES_DB: test_db
      POSTGRES_USER: test_user
      POSTGRES_PASSWORD: password
    options: >-
      --health-cmd pg_isready
      --health-interval 10s
      --health-timeout 5s
      --health-retries 5
  redis:
    image: redis:7
    options: >-
      --health-cmd "redis-cli ping"
      --health-interval 10s
      --health-timeout 5s
      --health-retries 5

- id: version
  run: echo "version=$(cat build.gradle | grep version | sed ...)" >> $GITHUB_OUTPUT
- uses: docker/build-push-action@v4
  with:
    tags: myrepo/myapp:${{ steps.version.outputs.version }}

pipeline {
    agent { /* где выполнять */ }
    
    options { /* глобальные опции */ }
    
    parameters { /* входные параметры */ }
    
    environment { /* переменные окружения */ }
    
    stages {
        stage('Stage Name') {
            when { /* условие */ }
            steps {
                // команды и действия
            }
            post {
                success { }
                failure { }
                always { }
            }
        }
    }
    
    post {
        success { /* если всё ок */ }
        failure { /* если ошибка */ }
        always { /* всегда */ }
    }
}

// На любом доступном agent'е
agent any

// На конкретном agent'е по label'у
agent {
    label 'linux && java17'
}

// В Docker контейнере
agent {
    docker {
        image 'gradle:7.6-jdk17'
        args '-v /var/run/docker.sock:/var/run/docker.sock'  // доступ к Docker daemon'у
    }
}

// Kubernetes pod (если Jenkins работает в K8s)
agent {
    kubernetes {
        yaml '''
apiVersion: v1
kind: Pod
spec:
  containers:

  - name: gradle
    image: gradle:7.6-jdk17
    command: ['cat']
    tty: true
        '''
    }
}

// Без agent (используется controller)
agent none

pipeline {
    agent {
        docker {
            image 'gradle:7.6-jdk17'
            args '-v /var/run/docker.sock:/var/run/docker.sock -e GRADLE_OPTS="-Dorg.gradle.daemon=false"'
        }
    }

    options {
        timestamps()  // добавить временные метки к логам
        timeout(time: 1, unit: 'HOURS')  // максимальное время выполнения
        disableConcurrentBuilds()  // не запускать несколько build'ов параллельно
        buildDiscarder(logRotator(numToKeepStr: '30'))  // хранить только 30 последних build'ов
    }

    parameters {
        booleanParam(
            name: 'SKIP_TESTS',
            defaultValue: false,
            description: 'Skip unit and integration tests'
        )
        choice(
            name: 'DEPLOY_ENV',
            choices: ['dev', 'staging', 'production'],
            description: 'Deploy environment'
        )
    }

    environment {
        GRADLE_HOME = "${env.WORKSPACE}/.gradle"
        APP_VERSION = sh(script: "cat build.gradle | grep version | sed \"s/.*version = '\\([^']*\\)'.*/\\1/\"", returnStdout: true).trim()
        DOCKER_REGISTRY = 'docker.io'
        DOCKER_IMAGE = "${DOCKER_REGISTRY}/mycompany/my-service"
        NEXUS_URL = credentials('nexus-url')
        NEXUS_CREDENTIALS = credentials('nexus-credentials')
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
                script {
                    echo "Repository: ${env.GIT_URL}"
                    echo "Branch: ${env.GIT_BRANCH}"
                    echo "Commit: ${env.GIT_COMMIT}"
                }
            }
        }

        stage('Compile') {
            steps {
                script {
                    echo "Building with Gradle ${APP_VERSION}"
                    sh './gradlew clean build -x test --no-daemon'
                }
            }
        }

        stage('Unit Tests') {
            when {
                expression { params.SKIP_TESTS == false }
            }
            steps {
                script {
                    echo "Running unit tests"
                    sh './gradlew test --no-daemon'
                }
            }
            post {
                always {
                    junit 'build/test-results/test/*.xml'
                    publishHTML([
                        reportDir: 'build/reports/tests/test',
                        reportFiles: 'index.html',
                        reportName: 'Unit Test Report'
                    ])
                }
            }
        }

        stage('Code Quality Analysis') {
            when {
                expression { params.SKIP_TESTS == false }
            }
            steps {
                script {
                    echo "Running Checkstyle, SpotBugs, and ktlint"
                    sh './gradlew checkstyleMain spotbugsMain ktlintCheck --no-daemon'
                }
            }
            post {
                always {
                    checkstyle(
                        pattern: 'build/reports/checkstyle/main.xml'
                    )
                    recordIssues(
                        enabledForFailure: true,
                        tool: spotBugs(
                            pattern: 'build/reports/spotbugs/main.xml'
                        )
                    )
                }
            }
        }

        stage('Integration Tests') {
            when {
                expression { params.SKIP_TESTS == false }
            }
            steps {
                script {
                    echo "Running integration tests"
                    sh './gradlew integrationTest --no-daemon'
                }
            }
            post {
                always {
                    junit 'build/test-results/integrationTest/*.xml'
                    publishHTML([
                        reportDir: 'build/reports/tests/integrationTest',
                        reportFiles: 'index.html',
                        reportName: 'Integration Test Report'
                    ])
                }
            }
        }

        stage('SonarQube Analysis') {
            when {
                expression { params.SKIP_TESTS == false && env.GIT_BRANCH == 'main' }
            }
            steps {
                script {
                    withSonarQubeEnv('SonarQube') {
                        sh './gradlew sonarqube'
                    }
                }
            }
        }

        stage('Build Artifact') {
            steps {
                script {
                    echo "Publishing artifact to Nexus"
                    sh './gradlew publish --no-daemon'
                }
            }
        }

        stage('Build Docker Image') {
            when {
                expression { env.GIT_BRANCH == 'main' || env.GIT_BRANCH == 'develop' }
            }
            steps {
                script {
                    echo "Building Docker image: ${DOCKER_IMAGE}:${APP_VERSION}"
                    sh '''
                        docker build \
                            --build-arg VERSION=${APP_VERSION} \
                            -t ${DOCKER_IMAGE}:${APP_VERSION} \
                            -t ${DOCKER_IMAGE}:latest \
                            .
                    '''
                }
            }
        }

        stage('Push to Registry') {
            when {
                expression { env.GIT_BRANCH == 'main' || env.GIT_BRANCH == 'develop' }
            }
            steps {
                script {
                    withCredentials([usernamePassword(
                        credentialsId: 'docker-registry-credentials',
                        usernameVariable: 'DOCKER_USER',
                        passwordVariable: 'DOCKER_PASS'
                    )]) {
                        sh '''
                            echo "$DOCKER_PASS" | docker login -u "$DOCKER_USER" --password-stdin
                            docker push ${DOCKER_IMAGE}:${APP_VERSION}
                            docker push ${DOCKER_IMAGE}:latest
                        '''
                    }
                }
            }
        }

        stage('Deploy to Dev') {
            when {
                expression { env.GIT_BRANCH == 'develop' && currentBuild.result != 'FAILURE' }
            }
            steps {
                script {
                    echo "Deploying to Dev environment"
                    sh '''
                        ansible-playbook \
                            -i inventories/dev \
                            -e docker_image=${DOCKER_IMAGE}:${APP_VERSION} \
                            playbooks/deploy.yml
                    '''
                }
            }
        }

        stage('Deploy to Staging') {
            when {
                expression { env.GIT_BRANCH == 'main' && params.DEPLOY_ENV in ['staging', 'production'] }
            }
            input {
                message "Deploy to Staging?"
                ok "Deploy"
                submitter "admin,devops"
            }
            steps {
                script {
                    echo "Deploying to Staging"
                    sh '''
                        ansible-playbook \
                            -i inventories/staging \
                            -e docker_image=${DOCKER_IMAGE}:${APP_VERSION} \
                            playbooks/deploy.yml
                    '''
                }
            }
        }

        stage('Deploy to Production') {
            when {
                expression { env.GIT_BRANCH == 'main' && params.DEPLOY_ENV == 'production' }
            }
            input {
                message "Deploy to Production? This is a critical action!"
                ok "Deploy to Prod"
                submitter "admin"
            }
            steps {
                script {
                    echo "Deploying to Production"
                    sh '''
                        ansible-playbook \
                            -i inventories/production \
                            -e docker_image=${DOCKER_IMAGE}:${APP_VERSION} \
                            playbooks/deploy.yml
                    '''
                }
            }
        }
    }

    post {
        always {
            // Архивировать логи
            archiveArtifacts artifacts: 'build/logs/**/*.log', allowEmptyArchive: true
            
            // Очистить рабочую директорию
            cleanWs()
        }
        success {
            script {
                echo "Pipeline completed successfully"
                // Отправить уведомление в Slack
                slackSend(
                    channel: '#ci-notifications',
                    color: 'good',
                    message: "✅ Build #${env.BUILD_NUMBER} Success\nService: ${DOCKER_IMAGE}\nVersion: ${APP_VERSION}\n${env.BUILD_URL}"
                )
            }
        }
        failure {
            script {
                echo "Pipeline failed"
                slackSend(
                    channel: '#ci-notifications',
                    color: 'danger',
                    message: "❌ Build #${env.BUILD_NUMBER} Failed\n${env.BUILD_URL}"
                )
            }
        }
    }
}

// Username/Password
withCredentials([usernamePassword(
    credentialsId: 'my-credentials',
    usernameVariable: 'USERNAME',
    passwordVariable: 'PASSWORD'
)]) {
    sh 'echo $USERNAME:$PASSWORD'
}

// Secret text
withCredentials([string(
    credentialsId: 'api-token',
    variable: 'API_TOKEN'
)]) {
    sh 'curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com'
}

// SSH Key
withCredentials([file(
    credentialsId: 'deploy-ssh-key',
    variable: 'SSH_KEY'
)]) {
    sh 'ssh -i $SSH_KEY user@host "docker pull..."'
}

// Встроенные credentials (для SonarQube, Maven Repository и т.п.)
withSonarQubeEnv('SonarQube') {
    sh './gradlew sonarqube'
}

// Environment credentials (для REST API)
withEnv(['NEXUS_URL=' + credentials('nexus-url')]) {
    sh './gradlew publish'
}

// Jenkinsfile в каждой ветке разный, Jenkins автоматически запускает нужный
// При push в main → запускается Jenkinsfile из main ветки
// При push в feature/x → запускается Jenkinsfile из feature/x ветки

stage('Deploy') {
    when {
        // Выполнить только на main ветке
        branch 'main'
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить на main или develop
        branch pattern: "^(main|develop)$", comparator: "REGEXP"
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить только если предыдущий stage успешен
        expression { currentBuild.result == null || currentBuild.result == 'SUCCESS' }
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить только если параметр равен определённому значению
        expression { params.DEPLOY_ENV == 'production' }
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить только если tag
        tag "v*"
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить только если это не Pull Request
        not { changeRequest() }
    }
    steps { sh 'deploy.sh' }
}

stage('Deploy') {
    when {
        // Выполнить если были изменения в определённых файлах
        changeset "src/main/**"
    }
    steps { sh 'deploy.sh' }
}

parameters {
    string(
        name: 'ENVIRONMENT',
        defaultValue: 'dev',
        description: 'Target deployment environment'
    )
    
    choice(
        name: 'LOG_LEVEL',
        choices: ['DEBUG', 'INFO', 'WARN', 'ERROR'],
        description: 'Application log level'
    )
    
    booleanParam(
        name: 'RUN_TESTS',
        defaultValue: true,
        description: 'Run tests during build'
    )
    
    text(
        name: 'ADDITIONAL_FLAGS',
        defaultValue: '',
        description: 'Additional Gradle flags'
    )
}

stages {
    stage('Build') {
        steps {
            sh '''
                ./gradlew clean build \
                    -Dlog.level=${LOG_LEVEL} \
                    ${ADDITIONAL_FLAGS}
            '''
        }
    }
}

stage('Test') {
    steps {
        retry(3) {  // переповторить до 3 раз при ошибке
            sh './gradlew test'
        }
    }
}

stage('Deploy') {
    steps {
        timeout(time: 30, unit: 'MINUTES') {  // таймаут для step'а
            sh './deploy.sh'
        }
    }
}

stage('Network call') {
    steps {
        catchError(buildResult: 'SUCCESS', stageResult: 'UNSTABLE') {
            // Ошибка не остановит pipeline, но отметит stage как UNSTABLE
            sh 'curl -f https://unreliable-api.com'
        }
    }
}

environment {
    NEXUS_URL = credentials('nexus-url')
    NEXUS_CREDENTIALS = credentials('nexus-credentials')
}

stages {
    stage('Publish') {
        steps {
            sh '''
                ./gradlew publish \
                    -Pnexus.url=${NEXUS_URL} \
                    -Pnexus.username=${NEXUS_CREDENTIALS_USR} \
                    -Pnexus.password=${NEXUS_CREDENTIALS_PSW}
            '''
        }
    }
}

# Kubernetes Rolling Deployment (по умолчанию)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # на 1 pod больше во время обновления
      maxUnavailable: 0    # всегда минимум replicas доступны
  selector:
    matchLabels:
      app: my-service
  template:
    metadata:
      labels:
        app: my-service
    spec:
      containers:

      - name: my-service
        image: docker.io/mycompany/my-service:v2.0.0
        livenessProbe:
          httpGet:
            path: /actuator/health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /actuator/ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5

#!/bin/bash
# Пример Blue-Green деплоя на Docker Compose

# 1. Текущая версия (Blue)
docker-compose -f docker-compose.blue.yml up -d

# 2. Развернуть новую версию (Green)
docker-compose -f docker-compose.green.yml up -d

# 3. Проверить здоровье нового сервиса
health_check() {
    for i in {1..30}; do
        if curl -f http://localhost:8081/actuator/health > /dev/null 2>&1; then
            echo "Green is ready"
            return 0
        fi
        sleep 2
    done
    echo "Green failed health check"
    return 1
}

if health_check; then
    # 4. Переключить nginx/load balancer на Green
    sed -i 's/upstream backend { server localhost:8080; }/upstream backend { server localhost:8081; }/' /etc/nginx/nginx.conf
    nginx -s reload
    echo "Switched to Green (port 8081)"
    
    # 5. Можно остановить Blue после промежутка времени
    sleep 300
    docker-compose -f docker-compose.blue.yml down
else
    # Откатиться: остановить Green
    docker-compose -f docker-compose.green.yml down
    exit 1
fi

# Kubernetes Canary с Argo Rollouts или Flagger
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: my-service
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-service
  progressDeadlineSeconds: 60
  service:
    port: 8080
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:

    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
  skipAnalysis: false

# Собрать образ
docker build -t docker.io/mycompany/my-service:1.2.3 .
docker tag docker.io/mycompany/my-service:1.2.3 docker.io/mycompany/my-service:latest

# Залогиниться в registry
docker login docker.io -u $USERNAME -p $PASSWORD

# Отправить в registry
docker push docker.io/mycompany/my-service:1.2.3
docker push docker.io/mycompany/my-service:latest

# Использовать Docker Buildx для мультиплатформенных образов
docker buildx build \
    --platform linux/amd64,linux/arm64 \
    -t docker.io/mycompany/my-service:1.2.3 \
    --push .

#!/bin/bash
# deploy.sh

set -e

DOCKER_IMAGE="docker.io/mycompany/my-service:${VERSION}"
DEPLOY_HOST="deploy@app.example.com"
DEPLOY_PATH="/opt/services"

echo "Deploying $DOCKER_IMAGE to $DEPLOY_HOST"

# 1. SSH на сервер и обновить образ
ssh $DEPLOY_HOST "cd $DEPLOY_PATH && docker pull $DOCKER_IMAGE"

# 2. Остановить старый контейнер и запустить новый
ssh $DEPLOY_HOST "
    docker stop my-service || true
    docker rm my-service || true
    docker run -d \
        --name my-service \
        -p 8080:8080 \
        -e JAVA_OPTS='-Xmx512m -Xms256m' \
        -e APP_ENV=production \
        -e LOG_LEVEL=INFO \
        --restart unless-stopped \
        --health-cmd='curl -f http://localhost:8080/actuator/health || exit 1' \
        --health-interval=30s \
        --health-timeout=3s \
        --health-retries=3 \
        $DOCKER_IMAGE
"

# 3. Проверить здоровье
ssh $DEPLOY_HOST "
    for i in {1..30}; do
        if curl -f http://localhost:8080/actuator/health; then
            echo 'Service is healthy'
            exit 0
        fi
        sleep 2
    done
    echo 'Service failed health check'
    exit 1
"

echo "Deployment successful"

# playbooks/deploy.yml
---
- hosts: app_servers
  become: yes
  vars:
    docker_image: "{{ docker_image }}"
    app_version: "{{ docker_image | regex_search(':(.+)$', '\\1') }}"
    app_port: 8080
    app_env: "{{ deploy_env | default('dev') }}"
  
  tasks:

    - name: Create app directory
      file:
        path: /opt/my-service
        state: directory
        mode: '0755'
    
    - name: Copy docker-compose.yml
      template:
        src: docker-compose.yml.j2
        dest: /opt/my-service/docker-compose.yml
        mode: '0644'
    
    - name: Pull latest image
      shell: docker pull {{ docker_image }}
      register: pull_result
    
    - name: Stop current service
      shell: |
        cd /opt/my-service
        docker-compose down --remove-orphans
      ignore_errors: yes
    
    - name: Start service with new image
      shell: |
        cd /opt/my-service
        docker-compose up -d
    
    - name: Wait for service to be healthy
      uri:
        url: "http://localhost:{{ app_port }}/actuator/health"
        status_code: 200
      register: result
      until: result.status == 200
      retries: 30
      delay: 2
    
    - name: Run smoke tests
      shell: |
        curl -f http://localhost:{{ app_port }}/api/test || exit 1
      register: smoke_test
      changed_when: false
    
    - name: Rollback on failure
      shell: |
        cd /opt/my-service
        docker-compose down
        docker-compose up -d
      when: smoke_test.rc != 0
      failed_when: true

# docker-compose.yml.j2
version: '3.9'
services:
  my-service:
    image: {{ docker_image }}
    container_name: my-service
    ports:

      - "{{ app_port }}:{{ app_port }}"
    environment:
      JAVA_OPTS: "-Xmx512m -Xms256m -XX:+UseG1GC"
      APP_ENV: {{ app_env }}
      LOG_LEVEL: INFO
      DB_URL: "jdbc:postgresql://postgres-db.example.com:5432/{{ app_env }}_db"
      REDIS_HOST: "redis.example.com"
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:{{ app_port }}/actuator/health"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 30s
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "5"
    networks:

      - app-network

networks:
  app-network:
    driver: bridge

version: '3.9'

services:
  my-service:
    image: docker.io/mycompany/my-service:${SERVICE_VERSION}
    container_name: my-service
    ports:

      - "8080:8080"
    environment:
      JAVA_OPTS: "-Xmx1g -Xms512m -XX:+UseG1GC"
      SPRING_DATASOURCE_URL: jdbc:postgresql://${DB_HOST}:5432/${DB_NAME}
      SPRING_DATASOURCE_USERNAME: ${DB_USER}
      SPRING_DATASOURCE_PASSWORD: ${DB_PASSWORD}
      REDIS_HOST: ${REDIS_HOST}
      REDIS_PORT: ${REDIS_PORT}
      LOG_LEVEL: INFO
    depends_on:

      - db
      - redis
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/actuator/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s
    volumes:

      - /var/log/my-service:/var/log
    networks:

      - app-network
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"
  
  db:
    image: postgres:14-alpine
    environment:
      POSTGRES_DB: ${DB_NAME}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:

      - pg-data:/var/lib/postgresql/data
    restart: unless-stopped
    networks:

      - app-network
  
  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:

      - redis-data:/data
    networks:

      - app-network

volumes:
  pg-data:
  redis-data:

networks:
  app-network:
    driver: bridge

# argocd-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-service
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/mycompany/my-service-deployment.git
    targetRevision: main
    path: kubernetes/
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true      # удалить ресурсы, которые удалены из Git
      selfHeal: true   # автоматически синхронизировать, если кластер отличается от Git
    syncOptions:

      - CreateNamespace=true
  revisionHistoryLimit: 10

# kubernetes/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-service
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: my-service
    spec:
      serviceAccountName: my-service
      containers:

      - name: my-service
        image: docker.io/mycompany/my-service:1.2.3  # версия обновляется здесь
        ports:

        - containerPort: 8080
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
        livenessProbe:
          httpGet:
            path: /actuator/health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /actuator/ready
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: production
spec:
  type: LoadBalancer
  ports:

  - port: 80
    targetPort: 8080
  selector:
    app: my-service

# Обновить версию в deployment.yaml
sed -i "s|image:.*|image: docker.io/mycompany/my-service:${VERSION}|" kubernetes/deployment.yaml
git commit -m "Update my-service to ${VERSION}"
git push origin main

# .github/workflows/ci.yml (GitHub Actions)
name: CI-Pipeline

on:
  push:
    branches: [main, develop, 'release/**']
  pull_request:
    branches: [main, develop]

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    
    steps:

      - uses: actions/checkout@v3
        with:
          fetch-depth: 0  # для правильного определения версии
      
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Cache SonarQube packages
        uses: actions/cache@v3
        with:
          path: ~/.sonar/cache
          key: ${{ runner.os }}-sonar
      
      - name: Build application
        run: ./gradlew clean assemble -x test --no-daemon
        env:
          ORG_GRADLE_PROJECT_version: ${{ github.sha }}
      
      - name: Run unit tests
        run: ./gradlew test --no-daemon
      
      - name: Run code analysis
        run: ./gradlew checkstyleMain spotbugsMain ktlintCheck --no-daemon
        continue-on-error: true  # не падать, если анализ нашёл проблемы
      
      - name: Run integration tests
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: ./gradlew integrationTest --no-daemon
      
      - name: Generate coverage report
        run: ./gradlew jacocoTestReport --no-daemon
      
      - name: Publish test results
        if: always()
        uses: EnricoMi/publish-unit-test-result-action@v2
        with:
          files: build/test-results/**/*.xml
      
      - name: SonarQube analysis
        if: github.event_name == 'push'
        run: |
          ./gradlew sonarqube \
            -Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }} \
            -Dsonar.host.url=${{ secrets.SONAR_HOST_URL }} \
            -Dsonar.login=${{ secrets.SONAR_TOKEN }} \
            --no-daemon
        continue-on-error: true
      
      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        with:
          files: ./build/reports/jacoco/test/jacocoTestReport.xml
          fail_ci_if_error: false
      
      - name: Build Docker image
        if: github.event_name == 'push'
        run: |
          VERSION=$(cat build.gradle | grep "version =" | head -1 | sed "s/.*= '\([^']*\)'.*/\1/")
          docker build -t localhost/my-service:${VERSION} -t localhost/my-service:latest .
      
      - name: Push to Docker registry
        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
        run: |
          VERSION=$(cat build.gradle | grep "version =" | head -1 | sed "s/.*= '\([^']*\)'.*/\1/")
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          docker tag localhost/my-service:${VERSION} docker.io/mycompany/my-service:${VERSION}
          docker tag localhost/my-service:latest docker.io/mycompany/my-service:latest
          docker push docker.io/mycompany/my-service:${VERSION}
          docker push docker.io/mycompany/my-service:latest

  security-scan:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    timeout-minutes: 15
    
    steps:

      - uses: actions/checkout@v3
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
      
      - name: Run OWASP Dependency-Check
        run: |
          mkdir -p build/reports
          ./gradlew dependencyCheck --no-daemon
        continue-on-error: true

monorepo/
├── services/
│   ├── user-service/
│   │   ├── build.gradle
│   │   ├── Dockerfile
│   │   └── src/
│   ├── order-service/
│   │   ├── build.gradle
│   │   ├── Dockerfile
│   │   └── src/
│   └── payment-service/
├── shared-lib/
├── build.gradle (root)
└── gradle.properties

# .github/workflows/ci-microservices.yml
name: CI-Microservices

on:
  push:
    branches: [main, develop]
    paths:

      - 'services/**'
      - 'shared-lib/**'
      - '.github/workflows/ci-microservices.yml'
  pull_request:
    branches: [main, develop]

jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      user-service: ${{ steps.changes.outputs.user-service }}
      order-service: ${{ steps.changes.outputs.order-service }}
      payment-service: ${{ steps.changes.outputs.payment-service }}
    
    steps:

      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      
      - uses: dorny/paths-filter@v2
        id: changes
        with:
          filters: |
            user-service:

              - 'services/user-service/**'
              - 'shared-lib/**'
            order-service:

              - 'services/order-service/**'
              - 'shared-lib/**'
            payment-service:

              - 'services/payment-service/**'
              - 'shared-lib/**'

  build-user-service:
    needs: changes
    if: needs.changes.outputs.user-service == 'true'
    runs-on: ubuntu-latest
    
    steps:

      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Build and test user-service
        run: ./gradlew :services:user-service:build --no-daemon
      
      - name: Build Docker image
        run: |
          cd services/user-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker build -t docker.io/mycompany/user-service:${VERSION} .
      
      - name: Push to registry
        if: github.event_name == 'push'
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          cd services/user-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker push docker.io/mycompany/user-service:${VERSION}

  build-order-service:
    needs: changes
    if: needs.changes.outputs.order-service == 'true'
    runs-on: ubuntu-latest
    
    steps:

      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Build and test order-service
        run: ./gradlew :services:order-service:build --no-daemon
      
      - name: Build Docker image
        run: |
          cd services/order-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker build -t docker.io/mycompany/order-service:${VERSION} .
      
      - name: Push to registry
        if: github.event_name == 'push'
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          cd services/order-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker push docker.io/mycompany/order-service:${VERSION}

  build-payment-service:
    needs: changes
    if: needs.changes.outputs.payment-service == 'true'
    runs-on: ubuntu-latest
    
    steps:

      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Build and test payment-service
        run: ./gradlew :services:payment-service:build --no-daemon
      
      - name: Build Docker image
        run: |
          cd services/payment-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker build -t docker.io/mycompany/payment-service:${VERSION} .
      
      - name: Push to registry
        if: github.event_name == 'push'
        run: |
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          cd services/payment-service
          VERSION=$(grep "version =" build.gradle | sed "s/.*= '\([^']*\)'.*/\1/")
          docker push docker.io/mycompany/payment-service:${VERSION}

  integration-tests:
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    
    services:
      postgres:
        image: postgres:14
        env:
          POSTGRES_DB: integration_test
          POSTGRES_PASSWORD: password
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    
    steps:

      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Run integration tests
        run: ./gradlew integrationTest --no-daemon
        env:
          DATABASE_URL: jdbc:postgresql://postgres:5432/integration_test
          DATABASE_USER: postgres
          DATABASE_PASSWORD: password

# .github/workflows/pr-checks.yml
name: PR Checks

on:
  pull_request:
    branches: [main, develop]

jobs:
  quick-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    
    steps:

      - uses: actions/checkout@v3
      
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Compile
        run: ./gradlew compileJava compileKotlin --no-daemon
      
      - name: Lint
        run: ./gradlew checkstyleMain ktlintCheck --no-daemon
        continue-on-error: true
      
      - name: Unit tests (fast path)
        run: ./gradlew test --no-daemon -x integrationTest
        timeout-minutes: 10
      
      - name: Comment PR with results
        if: always()
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '✅ PR checks completed'
            })

# .github/workflows/main-deploy.yml
name: Main Deploy

on:
  push:
    branches: [main]
    tags: [v*]

jobs:
  full-ci:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    
    steps:

      - uses: actions/checkout@v3
      
      - uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: gradle
      
      - name: Full build with all tests
        run: ./gradlew build --no-daemon
      
      - name: Code quality checks
        run: ./gradlew checkstyleMain spotbugsMain ktlintCheck --no-daemon
        continue-on-error: true
      
      - name: SonarQube analysis
        run: |
          ./gradlew sonarqube \
            -Dsonar.projectKey=my-service \
            -Dsonar.host.url=${{ secrets.SONAR_HOST_URL }} \
            -Dsonar.login=${{ secrets.SONAR_TOKEN }} \
            --no-daemon
        continue-on-error: true
      
      - name: Build and push Docker image
        run: |
          VERSION=$(cat build.gradle | grep "version =" | sed "s/.*= '\([^']*\)'.*/\1/")
          TAG="${{ github.ref_type == 'tag' && github.ref_name || 'latest' }}"
          
          docker build -t docker.io/mycompany/my-service:${VERSION} .
          docker tag docker.io/mycompany/my-service:${VERSION} docker.io/mycompany/my-service:${TAG}
          
          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
          docker push docker.io/mycompany/my-service:${VERSION}
          docker push docker.io/mycompany/my-service:${TAG}
      
      - name: Update ArgoCD manifest
        run: |
          VERSION=$(cat build.gradle | grep "version =" | sed "s/.*= '\([^']*\)'.*/\1/")
          sed -i "s|image:.*my-service.*|image: docker.io/mycompany/my-service:${VERSION}|" kubernetes/deployment.yaml
          
          git config user.email "ci@example.com"
          git config user.name "CI Bot"
          git add kubernetes/deployment.yaml
          git commit -m "chore: update image to ${VERSION}"
          git push origin main

// vars/standardCIPipeline.groovy
def call(Map config) {
    pipeline {
        agent {
            docker {
                image config.javaImage ?: 'gradle:7.6-jdk17'
                args '-v /var/run/docker.sock:/var/run/docker.sock'
            }
        }
        
        options {
            timestamps()
            timeout(time: config.timeout ?: 60, unit: 'MINUTES')
            buildDiscarder(logRotator(numToKeepStr: '20'))
        }
        
        environment {
            GRADLE_HOME = "${env.WORKSPACE}/.gradle"
            APP_VERSION = sh(script: "cat build.gradle | grep version | sed \"s/.*= '\\([^']*\\)'.*/\\1/\"", returnStdout: true).trim()
        }
        
        stages {
            stage('Checkout') {
                steps {
                    checkout scm
                }
            }
            
            stage('Build') {
                steps {
                    sh './gradlew clean build -x test --no-daemon'
                }
            }
            
            stage('Unit Tests') {
                steps {
                    sh './gradlew test --no-daemon'
                }
                post {
                    always {
                        junit 'build/test-results/test/*.xml'
                    }
                }
            }
            
            stage('Code Quality') {
                steps {
                    sh './gradlew checkstyleMain spotbugsMain ktlintCheck --no-daemon'
                }
                post {
                    always {
                        checkstyle pattern: 'build/reports/checkstyle/*.xml'
                    }
                }
            }
            
            stage('Build Docker') {
                when {
                    branch pattern: "^(main|develop)$", comparator: "REGEXP"
                }
                steps {
                    sh '''
                        docker build -t ${DOCKER_REPO}/${APP_NAME}:${APP_VERSION} .
                        docker tag ${DOCKER_REPO}/${APP_NAME}:${APP_VERSION} ${DOCKER_REPO}/${APP_NAME}:latest
                    '''
                }
            }
            
            stage('Push Docker') {
                when {
                    branch pattern: "^(main|develop)$", comparator: "REGEXP"
                }
                steps {
                    script {
                        withCredentials([usernamePassword(
                            credentialsId: 'docker-credentials',
                            usernameVariable: 'DOCKER_USER',
                            passwordVariable: 'DOCKER_PASS'
                        )]) {
                            sh '''
                                echo $DOCKER_PASS | docker login -u $DOCKER_USER --password-stdin
                                docker push ${DOCKER_REPO}/${APP_NAME}:${APP_VERSION}
                                docker push ${DOCKER_REPO}/${APP_NAME}:latest
                            '''
                        }
                    }
                }
            }
            
            stage('Deploy') {
                when {
                    branch pattern: "^(main|develop)$", comparator: "REGEXP"
                    expression { config.deployEnabled ?: false }
                }
                steps {
                    script {
                        String env = env.BRANCH_NAME == 'main' ? 'staging' : 'dev'
                        sh '''
                            ansible-playbook \
                                -i inventories/${ENV_NAME} \
                                -e docker_image=${DOCKER_REPO}/${APP_NAME}:${APP_VERSION} \
                                playbooks/deploy.yml
                        '''
                    }
                }
            }
        }
        
        post {
            always {
                archiveArtifacts artifacts: 'build/**/*.jar', allowEmptyArchive: true
                cleanWs()
            }
            success {
                echo "Pipeline succeeded"
            }
            failure {
                echo "Pipeline failed"
            }
        }
    }
}

// Jenkinsfile использует shared library
@Library('shared-pipeline-library') _

standardCIPipeline {
    javaImage = 'gradle:7.6-jdk17'
    timeout = 60
    deployEnabled = true
}

# Базовый образ
FROM openjdk:17-jdk-slim

# Метаданные
LABEL maintainer="developer@company.com"
LABEL version="1.0"
LABEL description="Spring Boot application"

# Рабочая директория
WORKDIR /app

# Копирование файлов
COPY target/myapp.jar app.jar

# Переменные окружения
ENV SPRING_PROFILES_ACTIVE=docker
ENV SERVER_PORT=8080

# Открытие порта
EXPOSE 8080

# Команда запуска
CMD ["java", "-jar", "app.jar"]

# Официальный OpenJDK образ
FROM openjdk:17-jdk-slim

# Многоступенчатая сборка
FROM maven:3.8-openjdk-17 AS build
FROM openjdk:17-jre-slim AS runtime

WORKDIR /app
# Все последующие команды выполняются в /app

# COPY - простое копирование (рекомендуется)
COPY src/ /app/src/
COPY target/app.jar app.jar

# ADD - расширенное копирование (автоматическая распаковка архивов)
ADD https://example.com/file.tar.gz /tmp/
ADD archive.tar.gz /extracted/  # Автоматически распакует

# Установка зависимостей
RUN apt-get update && apt-get install -y \
    curl \
    vim \
    && rm -rf /var/lib/apt/lists/*

# Создание пользователя
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Maven сборка
RUN mvn clean package -DskipTests

ENV JAVA_OPTS="-Xmx512m -Xms256m"
ENV DATABASE_URL="jdbc:postgresql://db:5432/myapp"
ENV SPRING_PROFILES_ACTIVE="docker"

EXPOSE 8080 8443  # HTTP и HTTPS порты
# Не открывает порты, только документирует

# Создание non-root пользователя для безопасности
RUN addgroup --system appuser && adduser --system --group appuser
USER appuser

# CMD - команда по умолчанию (можно переопределить)
CMD ["java", "-jar", "app.jar"]

# ENTRYPOINT - точка входа (нельзя переопределить)
ENTRYPOINT ["java", "-jar", "app.jar"]

# Комбинация ENTRYPOINT + CMD
ENTRYPOINT ["java"]
CMD ["-jar", "app.jar"]  # Можно переопределить параметры

# === BUILD STAGE ===
FROM maven:3.8-openjdk-17-slim AS build

# Копируем pom.xml для dependency caching
COPY pom.xml .
RUN mvn dependency:go-offline -B

# Копируем исходники и собираем
COPY src src
RUN mvn clean package -DskipTests

# === RUNTIME STAGE ===
FROM openjdk:17-jre-slim AS runtime

# Создаем non-root пользователя
RUN addgroup --system appuser && adduser --system --group appuser

# Рабочая директория
WORKDIR /app

# Копируем только JAR из build stage
COPY --from=build target/*.jar app.jar

# Переключаемся на non-root пользователя
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:8080/actuator/health || exit 1

EXPOSE 8080

ENTRYPOINT ["java", "-jar", "app.jar"]

# === BUILD STAGE ===
FROM node:18-alpine AS build

WORKDIR /app

# Package files для dependency caching
COPY package*.json ./
RUN npm ci --only=production

# Исходники и сборка
COPY . .
RUN npm run build

# === RUNTIME STAGE ===
FROM node:18-alpine AS runtime

# Безопасность
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001

WORKDIR /app

# Копируем production dependencies
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
COPY --from=build /app/package.json ./package.json

USER nextjs

EXPOSE 3000

CMD ["npm", "start"]

# === DEPENDENCIES STAGE ===
FROM maven:3.8-openjdk-17-slim AS deps

WORKDIR /app
COPY pom.xml .

# Загружаем зависимости (кешируется если pom.xml не изменился)
RUN mvn dependency:go-offline -B

# === BUILD STAGE ===
FROM deps AS build

# Копируем исходники
COPY src src

# Сборка приложения
RUN mvn clean package -DskipTests -o  # -o = offline mode

# === TEST STAGE (опционально) ===
FROM build AS test
RUN mvn test

# === RUNTIME STAGE ===
FROM gcr.io/distroless/java17-debian11 AS runtime

WORKDIR /app

# Копируем только JAR файл
COPY --from=build /app/target/*.jar app.jar

EXPOSE 8080

ENTRYPOINT ["java", "-jar", "app.jar"]

# ❌ Плохо - пересборка всего при изменении кода
FROM maven:3.8-openjdk-17-slim
COPY . /app
WORKDIR /app
RUN mvn clean package

# ✅ Хорошо - кеширование зависимостей
FROM maven:3.8-openjdk-17-slim
WORKDIR /app

# 1. Копируем dependency файлы (изменяются редко)
COPY pom.xml .
RUN mvn dependency:go-offline -B

# 2. Копируем исходники (изменяются часто)
COPY src src
RUN mvn clean package -DskipTests -o

# Версионирование
.git
.gitignore
.github

# IDE файлы
.idea
.vscode
*.iml
.settings
.project
.classpath

# Build артефакты
target/
build/
*.jar
*.war

# OS файлы
.DS_Store
Thumbs.db

# Logs
*.log
logs/

# Временные файлы
*.tmp
*.temp
*.cache

# Dependencies (для Node.js)
node_modules/
npm-debug.log

# Documentation
README.md
docs/
*.md

# Docker файлы
Dockerfile
docker-compose.yml
.dockerignore

# Environment файлы (безопасность)
.env
.env.local
secrets/

# Full OS images (избегайте в production)
ubuntu:20.04           # ~72MB
centos:8              # ~200MB

# Slim variants (хороший баланс)
openjdk:17-jdk-slim   # ~400MB
node:18-slim          # ~180MB
python:3.9-slim       # ~45MB

# Alpine variants (минимальный размер)
openjdk:17-jdk-alpine # ~350MB
node:18-alpine        # ~110MB
python:3.9-alpine     # ~25MB

# Distroless (максимальная безопасность)
gcr.io/distroless/java17  # ~250MB
gcr.io/distroless/nodejs  # ~150MB

# ❌ Плохо - много слоев
RUN apt-get update
RUN apt-get install -y curl
RUN apt-get install -y vim
RUN apt-get clean
RUN rm -rf /var/lib/apt/lists/*

# ✅ Хорошо - один слой
RUN apt-get update && \
    apt-get install -y \
        curl \
        vim && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# ❌ Плохо - оставляет кеш в слое
RUN wget https://example.com/large-file.tar.gz && \
    tar -xzf large-file.tar.gz && \
    rm large-file.tar.gz  # Файл все еще в слое!

# ✅ Хорошо - очистка в том же слое
RUN wget https://example.com/large-file.tar.gz && \
    tar -xzf large-file.tar.gz && \
    rm large-file.tar.gz

# Просмотр слоев образа
docker history myapp:latest

# Анализ размера с помощью dive
docker run --rm -it \
  -v /var/run/docker.sock:/var/run/docker.sock \
  wagoodman/dive:latest myapp:latest

# Сравнение размеров
docker images | grep myapp

version: '3.8'

services:
  app:
    build: .
    ports:

      - "8080:8080"
    environment:

      - SPRING_PROFILES_ACTIVE=docker
    depends_on:

      - db
      - redis
    networks:

      - app-network

  db:
    image: postgres:14-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    ports:

      - "5432:5432"
    volumes:

      - postgres_data:/var/lib/postgresql/data
    networks:

      - app-network

volumes:
  postgres_data:

networks:
  app-network:
    driver: bridge

version: '3.8'

services:
  # === DATABASES ===
  postgres:
    image: postgres:14-alpine
    environment:
      POSTGRES_DB: userdb
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
    ports:

      - "5432:5432"
    volumes:

      - postgres_data:/var/lib/postgresql/data
      - ./docker/postgres/init.sql:/docker-entrypoint-initdb.d/init.sql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  mysql:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: orderdb
      MYSQL_USER: user
      MYSQL_PASSWORD: password
    ports:

      - "3306:3306"
    volumes:

      - mysql_data:/var/lib/mysql
      - ./docker/mysql/conf.d:/etc/mysql/conf.d
    command: --default-authentication-plugin=mysql_native_password

  # === MESSAGE BROKERS ===
  rabbitmq:
    image: rabbitmq:3.11-management-alpine
    environment:
      RABBITMQ_DEFAULT_USER: admin
      RABBITMQ_DEFAULT_PASS: admin
    ports:

      - "5672:5672"   # AMQP port
      - "15672:15672" # Management UI
    volumes:

      - rabbitmq_data:/var/lib/rabbitmq

  kafka:
    image: confluentinc/cp-kafka:latest
    depends_on:

      - zookeeper
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
    ports:

      - "9092:9092"

  zookeeper:
    image: confluentinc/cp-zookeeper:latest
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000

  # === CACHING ===
  redis:
    image: redis:7-alpine
    ports:

      - "6379:6379"
    volumes:

      - redis_data:/data
    command: redis-server --appendonly yes --requirepass redis123

  # === MONITORING ===
  prometheus:
    image: prom/prometheus:latest
    ports:

      - "9090:9090"
    volumes:

      - ./docker/prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
      - prometheus_data:/prometheus

  grafana:
    image: grafana/grafana:latest
    ports:

      - "3000:3000"
    environment:
      GF_SECURITY_ADMIN_PASSWORD: admin
    volumes:

      - grafana_data:/var/lib/grafana
      - ./docker/grafana/dashboards:/etc/grafana/provisioning/dashboards

  # === SEARCH ===
  elasticsearch:
    image: elasticsearch:8.8.0
    environment:

      - discovery.type=single-node
      - xpack.security.enabled=false
      - "ES_JAVA_OPTS=-Xms512m -Xmx512m"
    ports:

      - "9200:9200"
    volumes:

      - elasticsearch_data:/usr/share/elasticsearch/data

  # === TESTING TOOLS ===
  wiremock:
    image: wiremock/wiremock:latest
    ports:

      - "8090:8080"
    volumes:

      - ./docker/wiremock/mappings:/home/wiremock/mappings
      - ./docker/wiremock/__files:/home/wiremock/__files

volumes:
  postgres_data:
  mysql_data:
  rabbitmq_data:
  redis_data:
  prometheus_data:
  grafana_data:
  elasticsearch_data:

networks:
  default:
    name: microservices-network

# docker-compose.yml
version: '3.8'

services:
  app:
    build: .
    profiles: ["app"]
    depends_on:

      - db

  db:
    image: postgres:14-alpine
    # Всегда включен (без profile)
    
  redis:
    image: redis:7-alpine
    profiles: ["cache"]

  monitoring:
    image: prometheus:latest
    profiles: ["monitoring"]

# Запуск разных комбинаций
# docker-compose up                    # Только db
# docker-compose --profile app up      # db + app  
# docker-compose --profile cache up    # db + redis
# docker-compose --profile monitoring up # db + monitoring

# docker-compose.override.yml (автоматически применяется)
version: '3.8'

services:
  app:
    environment:

      - DEBUG=true
      - LOG_LEVEL=debug
    volumes:

      - .:/app  # Live reload для разработки

# docker-compose.prod.yml
version: '3.8'

services:
  app:
    image: myapp:latest  # Pre-built образ
    restart: unless-stopped
    environment:

      - SPRING_PROFILES_ACTIVE=production

# Запуск с specific файлом
# docker-compose -f docker-compose.yml -f docker-compose.prod.yml up

# В Dockerfile
ENV DATABASE_PASSWORD=default_password
ENV API_KEY=placeholder

# В docker-compose.yml
services:
  app:
    environment:

      - DATABASE_PASSWORD=${DB_PASSWORD:-default}
      - API_KEY=${API_KEY}
    env_file:

      - .env
      - .env.local

# .env файл
DB_PASSWORD=secret123
API_KEY=abc123def456
SPRING_PROFILES_ACTIVE=docker

# docker-compose.yml для Docker Swarm
version: '3.8'

services:
  app:
    image: myapp:latest
    secrets:

      - db_password
      - api_key
    environment:

      - DATABASE_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    file: ./secrets/db_password.txt
  api_key:
    external: true  # Управляется через Docker CLI

# Создание secret
# echo "my_secret_password" | docker secret create db_password -

// Чтение secret в приложении
@Component
public class SecretManager {
    
    public String getSecret(String secretName) {
        try {
            Path secretPath = Paths.get("/run/secrets/" + secretName);
            return Files.readString(secretPath).trim();
        } catch (IOException e) {
            throw new RuntimeException("Failed to read secret: " + secretName, e);
        }
    }
}

services:
  app:
    volumes:

      - secrets_volume:/app/secrets:ro  # Read-only mount
    environment:

      - SECRETS_PATH=/app/secrets

volumes:
  secrets_volume:
    driver: local
    driver_opts:
      type: tmpfs  # В памяти, не на диске
      device: tmpfs
      o: size=100m,uid=1000

// Чтение секретов из volume
@ConfigurationProperties(prefix = "app")
public class AppConfig {
    
    @Value("${secrets.path:/app/secrets}")
    private String secretsPath;
    
    @PostConstruct
    public void loadSecrets() {
        try {
            Path dbPasswordFile = Paths.get(secretsPath, "db_password");
            if (Files.exists(dbPasswordFile)) {
                String password = Files.readString(dbPasswordFile).trim();
                System.setProperty("spring.datasource.password", password);
            }
        } catch (IOException e) {
            log.error("Failed to load secrets", e);
        }
    }
}

# docker-compose.yml с Vault
services:
  vault:
    image: vault:latest
    ports:

      - "8200:8200"
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: myroot
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
    cap_add:

      - IPC_LOCK

  app:
    depends_on:

      - vault
    environment:

      - VAULT_ADDR=http://vault:8200
      - VAULT_TOKEN=${VAULT_TOKEN}

// Spring Cloud Vault интеграция
@Configuration
@VaultPropertySource("secret/myapp")
public class VaultConfig {
    
    @Bean
    public VaultTemplate vaultTemplate() {
        VaultEndpoint endpoint = new VaultEndpoint();
        endpoint.setHost("vault");
        endpoint.setPort(8200);
        endpoint.setScheme("http");
        
        TokenAuthentication auth = new TokenAuthentication(vaultToken);
        
        return new VaultTemplate(endpoint, auth);
    }
}

services:
  secret-fetcher:
    image: vault:latest
    command: |
      sh -c "
        vault auth -method=aws
        vault read -field=password secret/db > /shared/db_password
        vault read -field=key secret/api > /shared/api_key
      "
    volumes:

      - shared_secrets:/shared
    environment:

      - VAULT_ADDR=https://vault.company.com

  app:
    depends_on:

      - secret-fetcher
    volumes:

      - shared_secrets:/app/secrets:ro

volumes:
  shared_secrets:
    driver: tmpfs

# Создание dedicated пользователя
FROM openjdk:17-jre-slim

# Создаем группу и пользователя
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Создаем директории с правильными permissions
RUN mkdir -p /app/data && chown -R appuser:appuser /app

WORKDIR /app

# Копируем файлы под root
COPY --chown=appuser:appuser target/app.jar app.jar

# Переключаемся на non-root пользователя
USER appuser

CMD ["java", "-jar", "app.jar"]

# .github/workflows/security.yml
name: Container Security Scan

on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:

      - uses: actions/checkout@v2
      
      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'

# docker-compose.yml с security constraints
services:
  app:
    image: myapp:latest
    security_opt:

      - no-new-privileges:true  # Запрет privilege escalation
    cap_drop:

      - ALL                     # Убираем все capabilities
    cap_add:

      - NET_BIND_SERVICE        # Добавляем только необходимые
    read_only: true             # Read-only root filesystem
    tmpfs:

      - /tmp                    # Writable tmpfs для временных файлов
      - /var/cache
    ulimits:
      memlock: -1
      nofile: 65536

# === ОБРАЗЫ ===
# Сборка образа
docker build -t myapp:latest .
docker build -t myapp:v1.0 --target production .  # Multi-stage

# Просмотр образов
docker images
docker image ls --filter "reference=myapp*"

# Удаление образов
docker rmi myapp:latest
docker image prune  # Удаление неиспользуемых образов

# === КОНТЕЙНЕРЫ ===
# Запуск контейнера
docker run -d --name myapp -p 8080:8080 myapp:latest
docker run -it --rm myapp:latest bash  # Интерактивный режим

# Просмотр контейнеров
docker ps          # Запущенные
docker ps -a       # Все

# Логи контейнера
docker logs myapp
docker logs -f myapp  # Follow режим

# Выполнение команд в контейнере
docker exec -it myapp bash
docker exec myapp cat /app/config.properties

# Остановка и удаление
docker stop myapp
docker rm myapp
docker container prune  # Удаление остановленных контейнеров

# === СИСТЕМНЫЕ КОМАНДЫ ===
# Использование дискового пространства
docker system df

# Очистка всего неиспользуемого
docker system prune -a --volumes

# Информация о Docker
docker info
docker version

# === УПРАВЛЕНИЕ SERVICES ===
# Запуск всех services
docker-compose up
docker-compose up -d  # Detached режим

# Запуск specific services
docker-compose up db redis
docker-compose up --scale app=3  # Масштабирование

# Остановка
docker-compose stop
docker-compose down          # Остановка и удаление
docker-compose down -v       # + удаление volumes

# === СБОРКА ===
# Пересборка образов
docker-compose build
docker-compose up --build    # Сборка и запуск

# Сборка без cache
docker-compose build --no-cache

# === ЛОГИ И МОНИТОРИНГ ===
# Просмотр логов
docker-compose logs
docker-compose logs -f app   # Follow конкретного service

# Статус services
docker-compose ps
docker-compose top           # Процессы в контейнерах

# === ВЫПОЛНЕНИЕ КОМАНД ===
# Выполнение команды в service
docker-compose exec app bash
docker-compose exec db psql -U postgres

# Одноразовый контейнер
docker-compose run --rm app bash

# === CI/CD PIPELINE ===
# Сборка для production
docker build -t myapp:${BUILD_NUMBER} \
  --target production \
  --build-arg VERSION=${BUILD_NUMBER} .

# Тегирование
docker tag myapp:${BUILD_NUMBER} myapp:latest
docker tag myapp:${BUILD_NUMBER} registry.company.com/myapp:${BUILD_NUMBER}

# Push в registry
docker push registry.company.com/myapp:${BUILD_NUMBER}
docker push registry.company.com/myapp:latest

# === DEPLOYMENT ===
# Pull на production сервере
docker pull registry.company.com/myapp:${BUILD_NUMBER}

# Rolling update
docker service update --image registry.company.com/myapp:${BUILD_NUMBER