GitHub Actions + Docker 全自动容器化部署（Docker篇）

开发者本地 (Local)
↓ [git push]
GitHub 仓库 (Repository)
↓ [触发]
GitHub Actions (CI/CD 管道)
   ├─ 构建 Docker 镜像
   └─ 推送到阿里云 ACR
阿里云容器镜像服务 (ACR)
↓ [docker pull]
阿里云服务器 (ECS)
   ├─ 运行 Docker Compose
   └─ Caddy 反向代理 + HTTPS
用户访问 (HTTPS Website)

# 构建阶段
FROM node:24-alpine AS builder

# 接收构建参数（用于客户端环境变量）
ARG NUXT_PUBLIC_SITE_URL
ENV NUXT_PUBLIC_SITE_URL=$NUXT_PUBLIC_SITE_URL

WORKDIR /app

# 安装 pnpm（如使用 npm 则无需此行）
RUN corepack enable && corepack prepare pnpm@latest --activate

# 复制依赖文件并安装
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

# 复制源代码并构建
COPY . .
RUN pnpm run build

# 运行阶段
FROM node:24-alpine

WORKDIR /app

# 复制构建产物
COPY --from=builder /app/.output /app/.output
COPY --from=builder /app/node_modules /app/node_modules
COPY --from=builder /app/package.json /app/package.json

EXPOSE 3000

CMD ["node", ".output/server/index.mjs"]

node_modules
.git
.env
.github

name: Deploy with Docker

on:
  push:
    branches: [ main ]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    env:
      NUXT_PUBLIC_SITE_URL: ${{ secrets.NUXT_PUBLIC_SITE_URL }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Aliyun ACR
        uses: docker/login-action@v3
        with:
          registry: ${{ secrets.ACR_REGISTRY }}
          username: ${{ secrets.ACR_USERNAME }}
          password: ${{ secrets.ACR_PASSWORD }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          build-args: |
            NUXT_PUBLIC_SITE_URL=${{ env.NUXT_PUBLIC_SITE_URL }}
          tags: |
            ${{ secrets.ACR_REGISTRY }}/moongate/moongate-blog:latest
            ${{ secrets.ACR_REGISTRY }}/moongate/moongate-blog:${{ github.sha }}

      - name: Deploy to Server via SSH
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /var/www/my-site
            # 写入环境变量（应用运行时所需）
            cat > .env << EOF
            NUXT_PUBLIC_SITE_URL=${{ secrets.NUXT_PUBLIC_SITE_URL }}
            # 添加其他环境变量
            EOF

            # 登录 ACR（确保服务器能拉取私有镜像）
            echo "${{ secrets.ACR_PASSWORD }}" | docker login ${{ secrets.ACR_REGISTRY }} -u "${{ secrets.ACR_USERNAME }}" --password-stdin

            # 拉取最新镜像
            docker compose pull nuxt-app

            # 重启容器（如果服务定义无变化，仅重启）
            docker compose up -d --no-deps nuxt-app

            # 清理旧镜像
            docker image prune -f

# 1. 卸载可能存在的旧版本（避免冲突）
sudo apt remove docker.io docker-compose docker-compose-v2 docker-doc podman-docker containerd runc

# 2. 更新包索引并安装依赖
sudo apt update
sudo apt install ca-certificates curl

# 3. 创建 keyrings 目录并添加 Docker 官方 GPG 密钥
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# 4. 添加 Docker 仓库（使用官方推荐的 deb822 格式）
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

# 5. 更新包索引并安装 Docker 引擎及相关组件
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# 6. 验证安装（运行 hello-world 容器）
sudo docker run hello-world

# 7. 将当前用户加入 docker 组（避免每次使用 sudo）
sudo usermod -aG docker $USER
# 注意：需要重新登录或执行 newgrp docker 使组变更生效

mkdir -p /var/www/my-site
cd /var/www/my-site

version: '3.8'

services:
  nuxt-app:
    image: crpi-xxxx.cn-beijing.personal.cr.aliyuncs.com/moongate/moongate-blog:latest   # 替换为你的完整镜像地址
    container_name: nuxt-app
    restart: always
    ports:
      - "3000:3000"
    env_file:
      - .env
    networks:
      - app-network

networks:
  app-network:
    driver: bridge

pm2 stop moongate
pm2 delete moongate

docker login crpi-xxxx.cn-beijing.personal.cr.aliyuncs.com -u '你的阿里云邮箱'
# 输入固定密码
docker pull crpi-xxxx.cn-beijing.personal.cr.aliyuncs.com/moongate/moongate-blog:latest

git add Dockerfile .github/workflows/deploy.yml
git commit -m "ci: migrate to Docker deployment"
git push origin main

cd /var/www/my-site
docker compose ps
docker compose logs nuxt-app

# 查看 Caddy 日志
sudo journalctl -u caddy -f

# 查看容器日志
docker compose logs -f nuxt-app