Deploy to prod

.docker-hub/print/Dockerfile

@@ -1,6 +1,6 @@
 # build stage
-FROM node:24.8.0 AS build-stage
+FROM node:24.10.0 AS build-stage
 ARG SENTRY_AUTH_TOKEN
 ARG SENTRY_ORG
 ARG SENTRY_PRINT_PROJECT
 ARG SENTRY_RELEASE_NAME
@@ -11,7 +11,7 @@
 
 COPY print/package*.json ./
 
 ENV NUXT_SENTRY_AUTH_TOKEN=$SENTRY_AUTH_TOKEN
 ENV NUXT_SENTRY_ORG=$SENTRY_ORG
 ENV NUXT_SENTRY_PROJECT=$SENTRY_PRINT_PROJECT
 ENV NUXT_SENTRY_RELEASE_NAME=$SENTRY_RELEASE_NAME
@@ -22,13 +22,13 @@
 RUN npm run build
 
 # production stage
-FROM node:24.8.0 AS production-stage
+FROM node:24.10.0 AS production-stage
 WORKDIR /app
 
 COPY --from=build-stage /app/.output ./.output
 
 ENV NITRO_HOST 0.0.0.0
 ENV NITRO_PORT 80
 
 EXPOSE 80
 CMD node ./.output/server/index.mjs

.github/workflows/check-dependencies.yml

@@ -26,7 +26,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: xdebug
 

.github/workflows/continuous-integration-optional.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: xdebug
 
@@ -36,7 +36,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: xdebug
 
@@ -66,7 +66,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: xdebug
 
@@ -114,7 +114,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: xdebug
 

.github/workflows/continuous-integration.yml

@@ -91,7 +91,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           tools: composer:2.8.0
           coverage: none
 
@@ -124,7 +124,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -153,7 +153,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -182,7 +182,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -214,7 +214,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -264,7 +264,7 @@ jobs:
 
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4.12'
+          php-version: '8.4.13'
           extensions: intl-73.1
           tools: composer:2.8.0
           coverage: pcov
@@ -353,7 +353,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -396,7 +396,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -435,7 +435,7 @@ jobs:
 
       - uses: actions/setup-node@v5
         with:
-          node-version: '24.8.0'
+          node-version: '24.10.0'
 
       - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
@@ -530,7 +530,7 @@ jobs:
       - workflow-success
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3
+      - uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4
         with:
           event-type: ci-passed
           client-payload: '{"ref": "${{ github.ref }}", "sha": "${{ github.sha }}"}'

.helm/ecamp3/templates/_helpers.tpl

@@ -56,6 +56,19 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end }}
 {{- end }}
 
+{{/*
+Name for all print+browserless resources.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "print-browserless.name" -}}
+{{- $name := default .Chart.Name .Values.chartNameOverride }}
+{{- if contains $name (include "app.name" .) }}
+{{- printf "%s-print-browserless" (include "app.name" .) | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s-print-browserless" (include "app.name" .) $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
 {{/*
 Name for all dummy-mailserver-related resources.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -266,3 +279,28 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{/*
+Reuse existing secret value, else generate new one
+Parameters:
+- namespace
+- secretName: name of the secret to lookup
+- key: the key within the secret to retrieve/generate
+*/}}
+{{- define "gen.secret" }}
+{{- $namespace := .namespace }}
+{{- $secretName := .secretName }}
+{{- $key := .key }}
+{{- $secret := lookup "v1" "Secret" $namespace $secretName }}
+{{- if $secret -}}
+{{/*
+   Reusing existing secret data
+*/}}
+{{- $key }}: {{ index $secret.data $key }}
+{{- else -}}
+{{/*
+    Generate new data
+*/}}
+{{- $key }}: {{ randAlphaNum 20 | b64enc }}
+{{- end -}}
+{{- end -}}

.helm/ecamp3/templates/browserless_configmap.yaml

@@ -6,6 +6,6 @@ metadata:
     {{- include "browserless.selectorLabels" . | nindent 4 }}
     {{- include "app.commonLabels" . | nindent 4 }}
 data:
-  MAX_CONCURRENT_SESSIONS: {{ .Values.browserless.maxConcurrentSessions | quote }}
-  CONNECTION_TIMEOUT: {{ .Values.browserless.connectionTimeout | quote }}
-  MAX_QUEUE_LENGTH: {{ .Values.browserless.maxQueueLength | quote }}
+  CONCURRENT: {{ .Values.browserless.maxConcurrentSessions | quote }}
+  TIMEOUT: {{ .Values.browserless.connectionTimeout | quote }}
+  QUEUED: {{ .Values.browserless.maxQueueLength | quote }}

.helm/ecamp3/templates/browserless_deployment.yaml

@@ -35,18 +35,20 @@ spec:
               containerPort: 3000
               protocol: TCP
           readinessProbe:
-            httpGet:
-              scheme: HTTP
-              path: /pressure
-              port: 3000
+            exec:
+              command:
+                - sh
+                - "-c"
+                - "curl --fail -q localhost:3000/pressure?token=${TOKEN}"
             initialDelaySeconds: 20
             periodSeconds: 10
             timeoutSeconds: 5
           livenessProbe:
-            httpGet:
-              scheme: HTTP
-              path: /pressure
-              port: 3000
+            exec:
+              command:
+                - sh
+                - "-c"
+                - "curl --fail -q localhost:3000/pressure?token=${TOKEN}"
             initialDelaySeconds: 20
             periodSeconds: 10
             timeoutSeconds: 5
@@ -56,14 +58,9 @@ spec:
             - configMapRef:
                 name: {{ include "browserless.name" . }}-configmap
           env:
-            - name: PREBOOT_CHROME
-              value: "true"
-            - name: KEEP_ALIVE
-              value: "true"
-            - name: ENABLE_DEBUGGER
-              value: "false"
-            - name: FUNCTION_ENABLE_INCOGNITO_MODE
-              value: "true"
-            - name: DISABLED_FEATURES
-              value: '["downloadEndpoint","functionEndpoint","pdfEndpoint","screencastEndpoint","scrapeEndpoint","statsEndpoint","workspaces"]'
-{{- end }}
+            - name: TOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: BROWSERLESS_TOKEN
+                  name: {{ include "print-browserless.name" . }}
+{{- end }}

.helm/ecamp3/templates/print_browserless_secrets.yaml

@@ -0,0 +1,11 @@
+{{ $secretName := include "print-browserless.name" . }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "print.selectorLabels" . | nindent 4 }}
+    {{- include "app.commonLabels" . | nindent 4 }}
+type: Opaque
+data:
+  {{- include "gen.secret" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "BROWSERLESS_TOKEN") | nindent 2 }}

.helm/ecamp3/templates/print_deployment.yaml

@@ -72,6 +72,11 @@ spec:
                 secretKeyRef:
                   name: {{ include "print.name" . }}
                   key: browser-ws-endpoint
+            - name: NUXT_BROWSERLESS_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "print-browserless.name" . }}
+                  key: BROWSERLESS_TOKEN
             - name: NITRO_PORT
               value: "3003"
             {{- if and .Values.ingress.enabled .Values.ingress.basicAuth.enabled }}

.helm/ecamp3/values.yaml

@@ -112,10 +112,10 @@ browserless:
   enabled: true
   domain:
   image:
-    repository: "docker.io/browserless/chrome"
+    repository: "ghcr.io/browserless/chrome"
     pullPolicy: IfNotPresent
-    # renovate: datasource=docker depName=browserless/chrome
-    tag: "1.61.1-puppeteer-21.4.1"
+    # renovate: datasource=docker depName=ghcr.io/browserless/chrome
+    tag: "v2.34.1"
   service:
     type: ClusterIP
     port: 3000

.nvmrc

@@ -1 +1 @@
-24.9.0
+24.10.0

.ops/aws-setup/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   aws-setup:
-    image: pulumi/pulumi-nodejs:3.197.0
+    image: pulumi/pulumi-nodejs:3.203.0
     container_name: 'ecamp3-aws-setup'
     volumes:
       - ../../.prettierrc:/.prettierrc:delegated
@@ -13,7 +13,7 @@ services:
       - AWS_DEFAULT_REGION=eu-west-3
 
   aws-cli:
-    image: amazon/aws-cli:2.31.2
+    image: amazon/aws-cli:2.31.22
     container_name: 'ecamp3-aws-cli'
     volumes:
       - ./.aws:/root/.aws:delegated