Internal Coderise project · DevOps / Cloud
Automated Spring Boot and Angular deployments on AWS
How we replaced manual releases with a controlled GitLab CI/CD pipeline — from tests and a Docker image to backups, smoke tests, rollback and IndexNow.
- Verifybackend + frontend
passed - ImageDocker → AWS ECR
sha256 - Deploybackup + recreate
passed - Notifysitemap → IndexNow
202
- OIDC
- AWS access without permanent keys in GitLab
- 5
- most recent images retained in AWS ECR
- Rollback
- automatic response to a failed smoke test
Starting point
The deployment worked but depended on manual sequencing.
The Coderise app combines an Angular frontend with a Spring Boot backend and runs in a container on AWS Lightsail. Previously, releasing a new version required connecting to the server, downloading the changes and manually restoring the container. This process allowed the application to be implemented, but did not guarantee an identical course every time.
The problem was particularly noticeable after changing the secret value in AWS Secrets Manager. Spring reads the configuration at startup, so simply writing the new secret value did not update the running process. A controlled recovery of the application was needed, without accidentally stopping the database.
Process architecture
One path from code to verified production.
Pipeline separates artifact building from deployment decisions. Production is a protected, manually approved step, and all operations are performed by a script with limited permissions on the runner assigned to the project.
- 01
Verification
Maven tests, lint and the production build of the Angular application are run before packaging.
verify - 02
Common package
The pre-rendered frontend goes to Spring Boot resources, making the release consistent.
package - 03
Docker image
The image is published to AWS ECR and pointed to with an immutable address with a SHA-256 digest.
publish - 04
OIDC authorization
GitLab receives short-lived access via AWS STS instead of storing permanent keys.
authorize - 05
Controlled deployment
A database dump and a copy of the configuration are created, and only the application container is recreated.
deploy - 06
Test and report
A public smoke test confirms the build, and upon success, the addresses from the sitemap go to IndexNow.
notify
Key decisions
Security comes from the entire flow, not from one tool.
We know exactly what image is sent to the server.
The deployment job only accepts the address of an image with a Coderise repository and a full SHA-256 digest.
Access to AWS is short-lived.
The IAM role trusts the specific project token and protected branch, so there is no need to rotate the access key in CI.
The current configuration is loaded when the application starts.
The current value from Secrets Manager does not go into the image. Recreating the application causes Spring to reload it at startup.
A failed smoke test triggers a rollback.
The script restores the previous image and environment file, and the entire deployment is marked as failed in GitLab.
Implementation resilience
Error should lead to a known state, not improvisation.
Before changing the version, a PostgreSQL dump and a copy of the release configuration are created. After starting the container, the pipeline repeatedly checks the public endpoint that controls the state of the application. Only a positive response completes the implementation successfully.
Result
Release has become a repeatable process.
One criterion for completing the implementation
Success means not only a running container, but also a positive internet accessibility test.
Predictable rollback to the previous version
The image and configuration from before the implementation are known, so the response to an error does not depend on the memory of the person performing the implementation.
Up-to-date configuration with every deployment
Recreating the container loads the current secret and eliminates a separate manual restart after a configuration change.
Conscious boundaries
The solution is adapted to the current scale.
Production currently runs on a single application container, so restoring it may result in short-term unavailability. When zero downtime implementations are required, a natural step will be to launch a parallel instance and switch traffic only after a health check.
Rollback restores the application image and configuration, but does not intentionally undo the database migration. Schema changes must therefore be backward compatible. A self-maintained runner also requires regular updates and monitoring.
Technologies
Each tool is responsible for a specific stage of the process.
- Angular 20
- Nx
- Spring Boot
- Maven
- Docker Compose
- PostgreSQL
- GitLab CI/CD
- GitLab Runner
- AWS ECR
- AWS Lightsail
- AWS Secrets Manager
- AWS STS / OIDC
- IndexNow
Next step
Do you want to organize the implementation of your own application?
We can start with the current process, risks and accessibility requirements.