How to Deploy a Zero-Downtime Production Website with Docker, Caddy v2 & GitHub Actions on Netcup

# 1. Verify A and AAAA records against an external resolver before starting Caddy
dig +short A app.example.com @1.1.1.1
dig +short AAAA app.example.com @1.1.1.1

# 2. Tune UDP socket buffers for HTTP/3 (QUIC) and enable TCP BBR congestion control
sudo tee /etc/sysctl.d/99-netcup-web-tuning.conf > /dev/null <<'EOF'
# Increase UDP receive/send buffers to ~7.5 MB for high-throughput HTTP/3 QUIC
net.core.rmem_max = 7500000
net.core.wmem_max = 7500000
net.core.rmem_default = 1048576
net.core.wmem_default = 1048576

# Enable BBR congestion control & raise listen backlog for burst web traffic
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
net.core.somaxconn = 8192
net.ipv4.tcp_max_syn_backlog = 8192
EOF

sudo sysctl --system

# 3. Allow HTTP, HTTPS (TCP), and HTTP/3 QUIC (UDP 443) in UFW
sudo ufw allow 80/tcp comment 'HTTP ACME & Redirect'
sudo ufw allow 443/tcp comment 'HTTPS TLS 1.3'
sudo ufw allow 443/udp comment 'HTTP/3 QUIC'
sudo ufw status numbered

* Applying /etc/sysctl.d/99-netcup-web-tuning.conf ...
net.core.rmem_max = 7500000
net.ipv4.tcp_congestion_control = bbr

sudo mkdir -p /opt/stacks/prod-web/{caddy,postgres,secrets,logs}
sudo chmod 0700 /opt/stacks/prod-web/secrets
openssl rand -base64 32 | tr -d '\n' | sudo tee /opt/stacks/prod-web/secrets/db_password.txt > /dev/null
sudo chmod 0400 /opt/stacks/prod-web/secrets/db_password.txt

sudo tee /opt/stacks/prod-web/.env > /dev/null <<'EOF'
COMPOSE_PROJECT_NAME=prod_web
DOMAIN_NAME=app.example.com
ACME_EMAIL=ops@example.com
APP_IMAGE=ghcr.io/your-org/production-web:2026.11.1
POSTGRES_DB=prod_app
POSTGRES_USER=prod_user
EOF
sudo chmod 0600 /opt/stacks/prod-web/.env

name: ${COMPOSE_PROJECT_NAME:-prod_web}

x-logging: &default-logging
  driver: "json-file"
  options:
    max-size: "20m"
    max-file: "5"
    compress: "true"

services:
  caddy:
    image: caddy:2.8-alpine
    container_name: prod_web_caddy
    restart: unless-stopped
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
      - "443:443/udp"
    environment:
      DOMAIN_NAME: ${DOMAIN_NAME}
      ACME_EMAIL: ${ACME_EMAIL}
    volumes:
      - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
      - caddy_config:/config
      - ./logs:/var/log/caddy
    networks:
      - edge_net
    depends_on:
      app:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: "0.75"
          memory: 384M
    security_opt:
      - no-new-privileges:true
    logging: *default-logging

  app:
    image: ${APP_IMAGE}
    restart: unless-stopped
    expose:
      - "3000"
    environment:
      NODE_ENV: production
      PORT: "3000"
      DB_HOST: postgres
      DB_PORT: "5432"
      DB_NAME: ${POSTGRES_DB}
      DB_USER: ${POSTGRES_USER}
      DB_PASSWORD_FILE: /run/secrets/db_password
      REDIS_URL: redis://redis:6379/0
    secrets:
      - db_password
    networks:
      - edge_net
      - db_net
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3000/healthz > /dev/null || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 15s
    deploy:
      resources:
        limits:
          cpus: "1.50"
          memory: 1536M
    security_opt:
      - no-new-privileges:true
    logging: *default-logging

  postgres:
    image: postgres:16.4-alpine3.20
    container_name: prod_web_postgres
    restart: unless-stopped
    shm_size: 256mb
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - pg_data:/var/lib/postgresql/data
      - ./postgres/postgresql.conf:/etc/postgresql/postgresql.conf:ro
    command: ["postgres", "-c", "config_file=/etc/postgresql/postgresql.conf"]
    networks:
      - db_net
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB} -h 127.0.0.1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s
    deploy:
      resources:
        limits:
          cpus: "1.50"
          memory: 3072M
    security_opt:
      - no-new-privileges:true
    logging: *default-logging

  redis:
    image: redis:7.4-alpine
    container_name: prod_web_redis
    restart: unless-stopped
    command:
      - "redis-server"
      - "--appendonly"
      - "yes"
      - "--maxmemory"
      - "512mb"
      - "--maxmemory-policy"
      - "allkeys-lru"
    volumes:
      - redis_data:/data
    networks:
      - db_net
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 3s
      retries: 5
    deploy:
      resources:
        limits:
          cpus: "0.50"
          memory: 768M
    security_opt:
      - no-new-privileges:true
    logging: *default-logging

secrets:
  db_password:
    file: ./secrets/db_password.txt

volumes:
  caddy_data:
  caddy_config:
  pg_data:
  redis_data:

networks:
  edge_net:
    driver: bridge
  db_net:
    driver: bridge
    internal: true

{
    email {$ACME_EMAIL}
    servers {
        protocols h1 h2 h3
        trusted_proxies static private_ranges
    }
}

www.{$DOMAIN_NAME} {
    redir https://{$DOMAIN_NAME}{uri} permanent
}

{$DOMAIN_NAME} {
    encode zstd gzip

    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "SAMEORIGIN"
        Referrer-Policy "strict-origin-when-cross-origin"
        Permissions-Policy "accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=()"
        -Server
    }

    reverse_proxy app:3000 {
        lb_policy round_robin
        lb_try_duration 10s
        lb_try_interval 250ms

        health_uri /healthz
        health_interval 5s
        health_timeout 2s
        health_status 200

        fail_duration 15s
        max_fails 2

        header_up X-Real-IP {remote_host}
    }

    log {
        output file /var/log/caddy/access.log {
            roll_size 50MiB
            roll_keep 5
            roll_keep_for 720h
        }
        format json
    }
}

# Connection & Authentication
listen_addresses = '*'
max_connections = 100
password_encryption = scram-sha-256

# Memory Allocation (Tuned for 3 GB Postgres Container on 8 GB Netcup Node)
shared_buffers = 768MB
effective_cache_size = 2048MB
work_mem = 16MB
maintenance_work_mem = 192MB
huge_pages = try

# Netcup Enterprise NVMe I/O & Planner Cost Tuning
random_page_cost = 1.1
seq_page_cost = 1.0
effective_io_concurrency = 200

# Write-Ahead Log (WAL) & Checkpoints
wal_level = replica
max_wal_size = 2GB
min_wal_size = 512MB
checkpoint_completion_target = 0.9
wal_compression = zstd

# Observability & Slow Query Logging
logging_collector = off
log_min_duration_statement = 200
log_checkpoints = on
log_lock_waits = on

#!/usr/bin/env bash
set -euo pipefail

STACK_DIR="/opt/stacks/prod-web"
NEW_IMAGE="${1:-}"

cd "$STACK_DIR"

if [[ -n "$NEW_IMAGE" ]]; then
  sed -i "s|^APP_IMAGE=.*|APP_IMAGE=${NEW_IMAGE}|" .env
fi

echo "==> [1/4] Pulling new application image..."
docker compose pull app

echo "==> [2/4] Scaling app to 2 instances and waiting for /healthz..."
docker compose up -d --no-deps --scale app=2 --no-recreate app

# Wait up to 30 seconds for all app containers to report healthy
for i in {1..15}; do
  UNHEALTHY=$(docker compose ps app --format json | grep -v '"Health":"healthy"' || true)
  if [[ -z "$UNHEALTHY" ]]; then
    echo "==> Both app instances are healthy!"
    break
  fi
  sleep 2
done

echo "==> [3/4] Draining old container and scaling back to 1 instance..."
OLD_CONTAINER=$(docker compose ps -q app | head -n 1)
docker stop -t 15 "$OLD_CONTAINER"
docker rm "$OLD_CONTAINER"
docker compose up -d --no-deps --scale app=1 --no-recreate app

echo "==> [4/4] Pruning dangling images..."
docker image prune -f
echo "==> Zero-downtime rollout complete!"

name: Build & Deploy to Netcup Production

on:
  push:
    branches: ["main"]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push Immutable SHA Image
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

      - name: Trigger Zero-Downtime Rollout on Netcup Server
        uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{ secrets.NETCUP_SSH_HOST }}
          port: ${{ secrets.NETCUP_SSH_PORT }}
          username: ${{ secrets.NETCUP_SSH_USER }}
          key: ${{ secrets.NETCUP_SSH_PRIVATE_KEY }}
          script: |
            sudo /opt/stacks/prod-web/rollout.sh "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}"