susu10-10/online-boutique-pf
GitHub: susu10-10/online-boutique-pf
在 DigitalOcean 单节点上以 Terraform + Docker Compose + GitHub Actions 实现 Google Online Boutique 微服务演示项目的自动化部署，并在 CI/CD 全流程中内置了安全扫描与容器加固。
Stars: 0 | Forks: 0
# Online Boutique：DevSecOps 部署
本仓库在单个 DigitalOcean Droplet 上使用 Docker Compose 部署 Google Cloud Platform 的“Online Boutique”微服务演示项目，并通过自动化 CI/CD pipeline 从第一天起就强化了安全性。
工具：`Terraform` + `Docker Compose` + `Caddy` + `DigitalOcean Container Registry`
CI/CD：`GitHub Actions`（构建 → 扫描 → 推送 → 拉取 → 部署）
安全：`Hadolint`、`Trivy`、`non-root containers`、`TLS`、`网络隔离`、`资源限制`
```
flowchart TD
%% Base Theme Styling
classDef gitops fill:#e6f4ea,stroke:#137333,stroke-width:1px,color:#137333;
classDef security fill:#fce8e6,stroke:#c5221f,stroke-width:1px,color:#c5221f;
classDef cloud fill:#e8f0fe,stroke:#1a73e8,stroke-width:1px,color:#1a73e8;
classDef app fill:#f1f3f4,stroke:#5f6368,stroke-width:1px,color:#3c4043;
classDef infra fill:#fef7e0,stroke:#b06000,stroke-width:1px,color:#b06000;
%% GitHub & Trigger Layer
subgraph GitHub ["📦 GitOps Core"]
REPO["📁 online-boutique-pf
(Source Repository)"] ACTIONS["🚀 GitHub Actions
(CI/CD Orchestration)"] end class GitHub,REPO,ACTIONS gitops; %% Infrastructure Pipeline subgraph Pipeline_TF ["🛠️ IaC Stage (terraform.yml)"] TF_INIT["terraform init"] TF_PLAN["terraform plan"] TF_APPLY["terraform apply"] TF_INIT --> TF_PLAN --> TF_APPLY end class Pipeline_TF,TF_INIT,TF_PLAN,TF_APPLY cloud; %% Build & Security Pipeline subgraph Pipeline_Build ["🔒 Build & Security Stage (build.yml)"] SEC["🛡️ Hadolint + Trivy IaC
(Static Linting)"] BUILD["📦 docker compose build
(Multi-service Build)"] TRIVY["🔍 Trivy Container Scan
(CVE Block Gate)"] PUSH["📤 docker compose push
(Image Upload)"] SEC --> BUILD --> TRIVY --> PUSH end class Pipeline_Build,BUILD,PUSH cloud; class SEC,TRIVY security; %% CD Deployment Pipeline subgraph Pipeline_Deploy ["🚚 CD Target Stage (deploy.yml)"] DEPLOY["🔀 SSH Target Run
(compose pull && up -d)"] HEALTH["🚦 Zero-Downtime Test
(curl frontend healthcheck)"] DEPLOY --> HEALTH end class Pipeline_Deploy,DEPLOY,HEALTH cloud; %% Cloud Infrastructure Providers subgraph DigitalOcean ["☁️ DigitalOcean Managed Infrastructure"] SPACES[("🗄️ DO Spaces
(Remote S3 TF State)")] DOCR[("🐳 DO Container Registry
(Secure Private Registry)")] FIREWALL["🔒 DO Cloud Firewall
(Ingress: 22, 80, 443)"] DNS["🌐 DO DNS
(suworks.me Mapping)"] subgraph Compute ["Compute Nodes"] DROPLET["🐧 Ubuntu Droplet
(nyc3 | s-2vcpu-4gb)"] end end class DigitalOcean,SPACES,DOCR,FIREWALL,DNS,Compute infra; %% Container Runtime Application Architecture subgraph Runtime ["🐋 Production Docker Application Stack"] CADDY["🛡️ Caddy Reverse Proxy
(Automatic TLS / Headers)"] FRONTEND["🌐 Frontend Web Engine
(HTTP :8080 Target)"] SERVICES["⚙️ Microservices Core
(10x gRPC Backend Apps)"] REDIS[("💾 Redis In-Memory
(Stateful Cart Cache)")] CADDY --> FRONTEND --> SERVICES --> REDIS end ``` class Runtime,CADDY,FRONTEND,SERVICES,REDIS app; %% Structural Triggers and State Relations REPO -->|"terraform/** changes"| ACTIONS REPO -->|"src/** or deploy/** changes"| ACTIONS REPO -->|"Manual Dispatch Run"| ACTIONS ACTIONS -->|"1. Provisions"| Pipeline_TF ACTIONS -->|"2. Validates"| Pipeline_Build ACTIONS -->|"3. Executes"| Pipeline_Deploy TF_INIT -.->|Remote State Lock| SPACES TF_APPLY -->|Deploys / Modifies| Compute TF_APPLY -->|Configures Rules| FIREWALL TF_APPLY -->|Binds Records| DNS PUSH -->|Artifact Delivery| DOCR DEPLOY -->|Fetch Secure Images| DOCR FIREWALL -.->|Protects| Compute DNS -.->|Routes Traffic To| CADDY CADDY -.->|Hosts On| DROPLET ```
(Source Repository)"] ACTIONS["🚀 GitHub Actions
(CI/CD Orchestration)"] end class GitHub,REPO,ACTIONS gitops; %% Infrastructure Pipeline subgraph Pipeline_TF ["🛠️ IaC Stage (terraform.yml)"] TF_INIT["terraform init"] TF_PLAN["terraform plan"] TF_APPLY["terraform apply"] TF_INIT --> TF_PLAN --> TF_APPLY end class Pipeline_TF,TF_INIT,TF_PLAN,TF_APPLY cloud; %% Build & Security Pipeline subgraph Pipeline_Build ["🔒 Build & Security Stage (build.yml)"] SEC["🛡️ Hadolint + Trivy IaC
(Static Linting)"] BUILD["📦 docker compose build
(Multi-service Build)"] TRIVY["🔍 Trivy Container Scan
(CVE Block Gate)"] PUSH["📤 docker compose push
(Image Upload)"] SEC --> BUILD --> TRIVY --> PUSH end class Pipeline_Build,BUILD,PUSH cloud; class SEC,TRIVY security; %% CD Deployment Pipeline subgraph Pipeline_Deploy ["🚚 CD Target Stage (deploy.yml)"] DEPLOY["🔀 SSH Target Run
(compose pull && up -d)"] HEALTH["🚦 Zero-Downtime Test
(curl frontend healthcheck)"] DEPLOY --> HEALTH end class Pipeline_Deploy,DEPLOY,HEALTH cloud; %% Cloud Infrastructure Providers subgraph DigitalOcean ["☁️ DigitalOcean Managed Infrastructure"] SPACES[("🗄️ DO Spaces
(Remote S3 TF State)")] DOCR[("🐳 DO Container Registry
(Secure Private Registry)")] FIREWALL["🔒 DO Cloud Firewall
(Ingress: 22, 80, 443)"] DNS["🌐 DO DNS
(suworks.me Mapping)"] subgraph Compute ["Compute Nodes"] DROPLET["🐧 Ubuntu Droplet
(nyc3 | s-2vcpu-4gb)"] end end class DigitalOcean,SPACES,DOCR,FIREWALL,DNS,Compute infra; %% Container Runtime Application Architecture subgraph Runtime ["🐋 Production Docker Application Stack"] CADDY["🛡️ Caddy Reverse Proxy
(Automatic TLS / Headers)"] FRONTEND["🌐 Frontend Web Engine
(HTTP :8080 Target)"] SERVICES["⚙️ Microservices Core
(10x gRPC Backend Apps)"] REDIS[("💾 Redis In-Memory
(Stateful Cart Cache)")] CADDY --> FRONTEND --> SERVICES --> REDIS end ``` class Runtime,CADDY,FRONTEND,SERVICES,REDIS app; %% Structural Triggers and State Relations REPO -->|"terraform/** changes"| ACTIONS REPO -->|"src/** or deploy/** changes"| ACTIONS REPO -->|"Manual Dispatch Run"| ACTIONS ACTIONS -->|"1. Provisions"| Pipeline_TF ACTIONS -->|"2. Validates"| Pipeline_Build ACTIONS -->|"3. Executes"| Pipeline_Deploy TF_INIT -.->|Remote State Lock| SPACES TF_APPLY -->|Deploys / Modifies| Compute TF_APPLY -->|Configures Rules| FIREWALL TF_APPLY -->|Binds Records| DNS PUSH -->|Artifact Delivery| DOCR DEPLOY -->|Fetch Secure Images| DOCR FIREWALL -.->|Protects| Compute DNS -.->|Routes Traffic To| CADDY CADDY -.->|Hosts On| DROPLET ```
标签：DevSecOps, EVTX分析, Python工具, 上游代理, 安全左移, 容器编排, 搜索引擎查询, 版权保护, 特权提升, 自动化部署, 静态应用安全测试