Blog CMS
A headless CMS shipped by a full CI/CD pipeline, from commit to server.
- Role
- Solo project: NestJS backend, Next.js frontend, GitHub Actions pipelines, Terraform and Ansible infrastructure, Prometheus and Grafana monitoring
- Year
- 2026
- Stack
- NestJS
- Next.js
- PostgreSQL
- Docker
- GitHub Actions
- Terraform
- Ansible
Overview
Context
A CI/CD course project at Ynov, built alone in a few days. The brief asked for a containerised application deployed automatically. I used the blog as a pretext to build the whole chain: a NestJS backend laid out in Clean Architecture, a server-rendered Next.js frontend, and above all everything that happens between a push and the running container.
Challenges
- 01
A CI that actually blocks
Six jobs run in parallel: lint, hadolint across the four Dockerfiles, dependency audit, Snyk scan, unit tests, and integration tests that spin up a real PostgreSQL and a real Redis through Testcontainers. They all converge on a final job, the single required check on the protected branch, so no regression slips through quietly. Husky and commitlint hold the same line before the push even happens.
- 02
From commit to server, hands off
The CD pipeline only starts once CI is green on main. It builds the images in multi-stage, pushes them to GHCR under an immutable SHA tag, scans them, deploys over SSH, then runs a smoke test. If that test fails, the deployment rolls itself back to the previous tag, and a manual workflow can replay any SHA already published.
- 03
A server described, never hand-configured
Terraform creates the machine, the private network and the firewall; Ansible provisions and deploys it through three roles, and Traefik terminates TLS. The backend exposes its health, with one indicator per dependency, and its metrics: Prometheus scrapes them, Grafana renders them on a dashboard provisioned alongside the infrastructure, Alertmanager raises the alarm. The server is disposable and rebuildable from the repository.
Outcome
A complete chain from commit to monitored container. Sixteen unit test files sitting next to the services, guards, interceptors and repositories, two integration suites on Testcontainers and two Playwright journeys. Three GitHub Actions workflows, a reproducible infrastructure, and eight technical documents backing the architecture decisions.
Next project