Deploy beta on the mainnet GCP VM

.github/workflows/deploy-config.yml

@@ -488,6 +488,8 @@ jobs:
               }
               verify_nft_media_runtime
 
+              sudo docker network inspect doscan-beta >/dev/null 2>&1 ||
+                sudo docker network create doscan-beta >/dev/null
               cd "${EDGE_PATH}"
               sudo docker compose config -q
               if [ "${EDGE_CONFIG_CHANGED}" -eq 1 ] || [ "${EDGE_CADDY_CONFIG_CHANGED}" -eq 1 ]; then
@@ -1021,26 +1023,73 @@ jobs:
       github.ref == 'refs/heads/main' &&
       github.event_name == 'workflow_dispatch' &&
       inputs.environment == 'beta'
-    runs-on: [self-hosted, beta]
+    runs-on: ubuntu-latest
     environment: beta
     permissions:
       contents: read
-    env:
-      BETA_BLOCKSCOUT_DATABASE_URL: ${{ secrets.BETA_BLOCKSCOUT_DATABASE_URL }}
-      BETA_STATS_DATABASE_URL: ${{ secrets.BETA_STATS_DATABASE_URL }}
-      BETA_USER_OPS_DATABASE_URL: ${{ secrets.BETA_USER_OPS_DATABASE_URL }}
+      id-token: write
     steps:
-      - name: Pull latest and restart services
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Validate beta configuration
         run: |
           set -euo pipefail
-          REPO="$HOME/Projects/DOScan"
-          DEPLOY="$REPO/docker-compose"
+          secrets_file="$(mktemp)"
+          trap 'rm -f "${secrets_file}"' EXIT
+          DOSCAN_BLOCKSCOUT_SECRETS_ENV="${secrets_file}" \
+            DOSCAN_BASE_ENV_DIR="${PWD}/docker-compose/envs" \
+            docker compose -f docker-compose/docker-compose-beta.yml config -q
+          docker run --rm \
+            -v "${PWD}/docker-compose/Caddyfile-beta:/etc/caddy/Caddyfile:ro" \
+            caddy@sha256:844f60b64e4724a5aa8245e019dace0d3f199f7433ce6c57676cb30a920dbad9 \
+            caddy validate --config /etc/caddy/Caddyfile
 
-          cd "$REPO"
-          git pull --ff-only origin main
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ env.GCP_SERVICE_ACCOUNT }}
+
+      - name: Set up Google Cloud CLI
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+        with:
+          project_id: ${{ env.GCP_PROJECT_ID }}
 
-          cd "$DEPLOY"
-          docker compose -f docker-compose-beta.yml -p doscan pull
-          docker compose -f docker-compose-beta.yml -p doscan up -d --remove-orphans
+      - name: Package and upload beta configuration
+        run: |
+          set -euo pipefail
+          archive="/tmp/doscan-beta-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.tgz"
+          tar -czf "${archive}" \
+            docker-compose/docker-compose-beta.yml \
+            docker-compose/Caddyfile-beta \
+            docker-compose/envs/common-blockscout.env \
+            docker-compose/envs/common-blockscout-beta.env \
+            docker-compose/envs/common-frontend-beta.env \
+            scripts/apply-beta-on-mainnet-vm.sh
+          gcloud compute scp \
+            --project="${GCP_PROJECT_ID}" \
+            --zone="${GCP_ZONE}" \
+            --tunnel-through-iap \
+            "${archive}" \
+            "${GCP_INSTANCE}:${archive}"
+          rm -f "${archive}"
 
-          echo "Beta deployment completed"
+      - name: Apply beta configuration and verify services
+        run: |
+          set -euo pipefail
+          gcloud compute ssh "${GCP_INSTANCE}" \
+            --project="${GCP_PROJECT_ID}" \
+            --zone="${GCP_ZONE}" \
+            --tunnel-through-iap \
+            --command="
+              set -euo pipefail
+              deploy_id='${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}'
+              archive='/tmp/doscan-beta-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}.tgz'
+              src=\"\$(mktemp -d /tmp/doscan-beta-deploy.XXXXXX)\"
+              trap 'rm -rf \"\${src}\" \"\${archive}\"' EXIT
+              tar -xzf \"\${archive}\" -C \"\${src}\"
+              sudo bash \"\${src}/scripts/apply-beta-on-mainnet-vm.sh\" \"\${src}\" \"\${deploy_id}\"
+            "
+
+          curl --fail --silent --show-error --retry 12 --retry-delay 5 \
+            https://beta.doscan.io/api/v2/stats >/dev/null

docker-compose/Caddyfile-beta

@@ -1,75 +1,45 @@
-# DOS Chain Beta - Reverse Proxy
-# HTTP only - Cloudflare Tunnel handles HTTPS
-# Runs locally on WSL2, exposed via cloudflared Windows Service
+# HTTP-only origin for beta.doscan.io.
+# The VM edge Caddy terminates TLS and proxies over the shared doscan-beta network.
 
-# Stats + Viz subdomains (port 8080 — tunnel routes here)
-:8080 {
-	header Access-Control-Allow-Origin "https://beta.doscan.io"
-	header Access-Control-Allow-Methods "GET, POST, OPTIONS"
-	header Access-Control-Allow-Headers "Content-Type"
-
-	@options method OPTIONS
-	respond @options 204
-
-	@stats host beta-stats.doscan.io
-	reverse_proxy @stats stats:8050
-
-	@viz host beta-viz.doscan.io
-	reverse_proxy @viz visualizer:8050
+:80 {
+	encode zstd gzip
 
-	# Fallback
-	reverse_proxy stats:8050
-}
+	header >Cross-Origin-Opener-Policy "same-origin-allow-popups"
 
-# Main site (port 80 — beta.doscan.io + beta-api.doscan.io)
-:80 {
-	# Backend API
+	handle /api/v1/counters {
+		reverse_proxy stats:8050
+	}
+	handle /api/v1/lines {
+		reverse_proxy stats:8050
+	}
+	handle /api/v1/pages/main {
+		reverse_proxy stats:8050
+	}
 	handle /api/* {
 		reverse_proxy backend:4000
 	}
-
-	# WebSocket
 	handle /socket/* {
 		reverse_proxy backend:4000
 	}
-
-	# Sitemap
 	handle /sitemap.xml {
 		reverse_proxy backend:4000
 	}
-
-	# Auth
 	handle /auth/* {
 		reverse_proxy backend:4000
 	}
-
-	# Metrics
 	handle /metrics {
 		reverse_proxy backend:4000
 	}
-
-	# Stats API (path-based fallback)
+	handle /public-metrics {
+		reverse_proxy backend:4000
+	}
 	handle /stats-api/* {
 		uri strip_prefix /stats-api
-		header Access-Control-Allow-Origin "https://beta.doscan.io"
-		header Access-Control-Allow-Methods "GET, OPTIONS"
-		header Access-Control-Allow-Headers "Content-Type"
-		@statsoptions method OPTIONS
-		respond @statsoptions 204
 		reverse_proxy stats:8050
 	}
-
-	# Visualizer API (path-based fallback)
 	handle /visualize/* {
-		header Access-Control-Allow-Origin "https://beta.doscan.io"
-		header Access-Control-Allow-Methods "GET, POST, OPTIONS"
-		header Access-Control-Allow-Headers "Content-Type"
-		@vizpathoptions method OPTIONS
-		respond @vizpathoptions 204
 		reverse_proxy visualizer:8050
 	}
-
-	# Frontend (default)
 	handle {
 		reverse_proxy frontend:3000
 	}

docker-compose/Caddyfile-gcp-edge

@@ -1,3 +1,8 @@
+beta.doscan.io {
+	tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin-key.pem
+	reverse_proxy beta-origin:80
+}
+
 doscan.io, www.doscan.io {
 	tls /etc/caddy/certs/origin.pem /etc/caddy/certs/origin-key.pem
 	reverse_proxy doscan-l1-caddy-1:80