feat: 운영 서비스 1차 Observability 구축

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test-and-package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v6
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-provider: basic
+          validate-wrappers: true
+
+      - name: Test and package
+        run: ./gradlew clean test bootJar --no-daemon
+
+      - name: Validate Grafana Alloy configuration
+        run: deploy/observability/alloy/validate.sh
+
+      - name: Validate operations scripts
+        run: |
+          bash -n deploy/observability/alloy/validate.sh
+          bash -n deploy/observability/update-api.sh
+          test -x deploy/observability/alloy/validate.sh
+          test -x deploy/observability/update-api.sh
+
+      - name: Validate Grafana resource sources
+        run: |
+          jq empty deploy/observability/grafana/mapleland-production-overview.json
+          jq empty deploy/observability/grafana/alert-rules.json

.github/workflows/deploy-oci.yml

@@ -3,6 +3,10 @@ name: Deploy Spring Boot App to Oracle Cloud
 on:
   workflow_dispatch:
 
+concurrency:
+  group: deploy-oci
+  cancel-in-progress: false
+
 permissions:
   contents: read
   packages: write
@@ -11,18 +15,24 @@ permissions:
 jobs:
   build-and-publish:
     runs-on: ubuntu-24.04-arm
+    outputs:
+      image_ref: ${{ steps.published_image.outputs.image_ref }}
     env:
       IMAGE_NAME: ghcr.io/team-maple/mls-be/mapleland-api
-      IMAGE_TAG: latest-arm64
+      IMAGE_TAG: ${{ github.sha }}-${{ github.run_id }}-${{ github.run_attempt }}-arm64
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Restore FCM key file
+        env:
+          FIREBASE_KEY: ${{ secrets.FIREBASE_KEY }}
         run: |
+          umask 077
           mkdir -p src/main/resources/firebase
-          echo '${{ secrets.FIREBASE_KEY }}' > src/main/resources/firebase/maple-9f1a7-firebase-adminsdk-fbsvc-7c3b6fc032.json
+          printf '%s' "$FIREBASE_KEY" \
+            > src/main/resources/firebase/maple-9f1a7-firebase-adminsdk-fbsvc-7c3b6fc032.json
 
       - name: Set up JDK 21
         uses: actions/setup-java@v4
@@ -54,15 +64,29 @@ jobs:
             --platform linux/arm64 \
             --publish
 
+      - name: Resolve published manifest digest
+        id: published_image
+        shell: bash
+        run: |
+          set -euo pipefail
+          image_tag="${IMAGE_NAME}:${IMAGE_TAG}"
+          digest="$(docker buildx imagetools inspect "$image_tag" \
+            --format '{{json .Manifest}}' | jq -er '.digest')"
+          if [[ ! $digest =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "invalid published image digest" >&2
+            exit 1
+          fi
+          docker buildx imagetools inspect "${IMAGE_NAME}@${digest}" >/dev/null
+          printf 'image_ref=%s@%s\n' "$IMAGE_NAME" "$digest" >> "$GITHUB_OUTPUT"
+
   deploy:
     needs: build-and-publish
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
     env:
-      IMAGE_NAME: ghcr.io/team-maple/mls-be/mapleland-api
-      IMAGE_TAG: latest-arm64
+      IMAGE_REF: ${{ needs['build-and-publish'].outputs.image_ref }}
 
     steps:
       - name: Connect to Tailscale
@@ -79,4 +103,5 @@ jobs:
           username: ubuntu
           key: ${{ secrets.ORACLE_SSH_KEY }}
           script: |
-            /opt/mapleland/update-api.sh
+            sudo /opt/mapleland/update-api.sh \
+              "${{ env.IMAGE_REF }}"

.gitignore

@@ -39,4 +39,11 @@ out/
 ### Jenv ###
 .java-version
 
-resouces/firebase
+### Runtime secrets ###
+.env
+.env.*
+*.env
+!.env.example
+!*.env.example
+
+src/main/resources/firebase/

build.gradle

@@ -31,6 +31,7 @@ dependencies {
   implementation 'org.springframework.boot:spring-boot-starter-web'
   implementation 'org.springframework.boot:spring-boot-starter-actuator'
   implementation 'org.springframework.boot:spring-boot-starter-validation'
+  runtimeOnly 'io.micrometer:micrometer-registry-prometheus'
 
   implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.7.0'
 
@@ -52,9 +53,6 @@ dependencies {
   // JSoup
   implementation 'org.jsoup:jsoup:1.17.2'
 
-  // logging
-  implementation 'com.github.loki4j:loki-logback-appender:2.0.1'
-
   // QueryDSL
   implementation 'com.querydsl:querydsl-jpa:5.1.0:jakarta'
   annotationProcessor "com.querydsl:querydsl-apt:5.1.0:jakarta"

deploy/observability/alloy/alloy.env.example

@@ -0,0 +1,17 @@
+# Install as /etc/alloy/alloy.env, owned by root:root with mode 0600.
+# Do not commit the populated file. Use two minimum-scope access-policy tokens:
+# metrics:write for metrics and logs:write for logs.
+
+ALLOY_HOST_NAME=mapleland-oci-1
+
+# Set this to the same long, random value injected into the Spring container.
+# It protects the management scrape even from peers on shared Docker networks.
+MANAGEMENT_SCRAPE_TOKEN=replace-with-long-random-management-scrape-token
+
+GRAFANA_CLOUD_METRICS_URL=https://prometheus-prod-49-prod-ap-northeast-0.grafana.net/api/prom/push
+GRAFANA_CLOUD_METRICS_USERNAME=replace-with-metrics-instance-id
+GRAFANA_CLOUD_METRICS_API_TOKEN=replace-with-metrics-write-token
+
+GRAFANA_CLOUD_LOGS_URL=https://logs-prod-030.grafana.net/loki/api/v1/push
+GRAFANA_CLOUD_LOGS_USERNAME=replace-with-logs-instance-id
+GRAFANA_CLOUD_LOGS_API_TOKEN=replace-with-logs-write-token