1. Add a new asset directory where we can place the generated asset files.
2. Add a task to Gradle that generates the asset files.
3. Add dependencies to the Task to ensure that it is called automatically.

First we register the output directory of our asset generation task as a new asset directory. This ensures, that its contents are picked up by the mergeDebugAssets and mergeReleaseAssets tasks and included in the output apk file.

sourceSets["main"].assets.srcDir(
    layout.buildDirectory.dir("generated/dependencyAssets/"))

Next, we need to tell Gradle, how the asset files should be generated. This is done for each build variant independently, because the asset files we generate might differ between variants:

applicationVariants.configureEach {
    val variant = this

    // New tasks are configured here.
}

For each variant we create a new task to generate the asset files. In my case this generation task simply copies the output of a Gradle plugin that walks the dependency tree and collects all license files.

val copyArtifactsTask =
    tasks.register<Copy>("copy${variant.name.capitalize()}ArtifactList") {
        from(
            project.extensions.getByType(ReportingExtension::class.java)
                .file("licensee/${variant.name}/artifacts.json")
        )
        into(layout.buildDirectory.dir("generated/dependencyAssets/"))
    }

For cases where you have more complex asset generation code you can create a task that executes arbitrary Kotlin code, for example as follows:

val customTask = tasks.register("generate${variant.name.capitalize()}AssetFiles") {
    doLast {
        // Write your code here.
    }
}

Finally, we need to ensure, that the task of ours is actually called before the assets are merged. This can be done with the dependsOn function of the task class. We want to execute our task prior to the merge{variant}Assets tasks. This can be done with the following line:

tasks["merge${variant.name.capitalize()}Assets"].dependsOn(copyArtifactsTask)

If your asset generation depends on some other output you need to declare this dependency, too. In this example, the dependency report needs to be generated prior to copying it, so we need to add a dependency to our task as follows:

copyArtifactsTask.dependsOn("licensee${variant.name.capitalize()}")

The full example follows:

android {
    
    // ... Your other build stuff

    // Register our custom output directory as an asset folder that will be
    // used for asset merging.
    sourceSets["main"].assets.srcDir(
        layout.buildDirectory.dir("generated/dependencyAssets/"))

    // Individual tasks for release and debug builds
    applicationVariants.configureEach {
        val variant = this

        // Define a new task to generate the asset files. Here the file is only
        // copied, but you could do anything else instead.
        val copyArtifactsTask =
            tasks.register<Copy>("copy${variant.name.capitalize()}ArtifactList") {
                from(
                    project.extensions.getByType(ReportingExtension::class.java)
                        .file("licensee/${variant.name}/artifacts.json")
                )
                into(layout.buildDirectory.dir("generated/dependencyAssets/"))
            }

        // This dependency is only necessary if the asset generation depends on
        // something else, the output of the licensee plugin in my case.
        copyArtifactsTask.dependsOn("licensee${variant.name.capitalize()}")

        // Add a dependency between the asset merging and our generation task.
        // This is necessary to ensure that the assets are generated prior to
        // the merging step.
        tasks["merge${variant.name.capitalize()}Assets"].dependsOn(copyArtifactsTask)
    }
}

Useful links

• Licensee: https://github.com/cashapp/licensee

It assumes, that you’ve already set up your server and can establish an SSH connection. My server is running CentOS, so you’ll have to replace yum with the appropriate package manager for your system, for Ubuntu this it is apt-get.

If you haven’t installed Certbot go to https://certbot.eff.org/ and follow the instructions.

Cloudflare-DNS plugin for Certbot

Next, we’ll need to install the Cloudflare DNS plugin for Certbot:

First, we need the Python package manager PIP.

sudo yum install python-pip

which we can use to install the Certbot plugin

sudo pip install certbot-dns-cloudflare

Set up the credentials file

Create a new file cloudflare.ini in ~/.secrets/certbot/cloudflare.ini and write your Cloudflare account credentials down as follows:

# Cloudflare API credentials used by Certbot
dns_cloudflare_email = <your-email-address>
dns_cloudflare_api_key = <your-api-key>

You can find your Cloudflare API key by logging into Cloudflare, and then going to My Profile. There you can copy the Global API Key.

Because these credentials can be used to perform arbitrary actions on your Cloudflare account, it is essential to set the correct access permissions. You can restrict the access to your account by running chmod 600 ~/.secrets/certbot/cloudflare.ini. This will also remove write permission for you, so make sure to finish editing beforehand.

Issuing the certificate

If you are using Certbot / LetsEncrypt for the first time, you’ll be asked to create an account in the next step. Just follow the steps and everything should work.

To issue the certificate one command is sufficient:

sudo certbot certonly \
    --dns-cloudflare \
    --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini \
    --preferred-challenges dns-01 \
    -d <cert-names>

Replace the last line with all names you want to be included in the certificate. You can separate multiple entries with ,.

Example: example.com, www.example.com, something.example.com

A wildcard can be used by including an * in the name: *.example.com.

The active certificate will be linked into /etc/letsencrypt/live. You can now configure your server to use the certificate.

Automatic renewal

Because LetsEncrypt certificates are valid for only 90 days, it is a good idea to schedule the certificate renewal automatically, such that there is always a valid certificate available. This can be done for example by creating a cron job:

Run crontab -e and then enter the following line:

0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew

Useful links

• LetsEncrypt: https://letsencrypt.org/
• Certbot: https://certbot.eff.org/
• Cloudflare DNS plugin: https://certbot-dns-cloudflare.readthedocs.io/en/stable/
• Test your SSL configuration: https://www.ssllabs.com/ssltest/

Configure nginx

To configure nginx add the following server declaration to your /etc/nginx/conf.d/nginx.conf file.

server {
        listen 80;
        listen [::]:80;

        server_name <your-domain>;

        location / {
             proxy_pass http://localhost:8080/;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header X-Forwarded-Port $server_port;
        }
}

This will pass the traffic through to the locally running app server.

Then test the configuration and restart nginx.

sudo nginx -t # test the new configuration for valid syntax
sudo systemctl restart nginx

Configure deployment in Gradle

First off, we need to define the server information and credentials. Log into the server and create a user deployment. Assign the sudo privilege to the newly created user. Then generate a SSH key deployment locally and add it to the allowed keys on the server.

Edit the user gradle.properties file at ~/.gradle/gradle.properties (or create it if it doesn’t exist) and add the following:

server_key_deployment_passphrase=<deployment-ssh-key-passphrase>
server_user_deployment_passphrase=<deployment-user-passphrase>

Now we need to set up Gradle to deploy the application. To do so we add the org.hidetake.ssh plugin which allows us to perform SSH operations:

plugins {
    id 'org.hidetake.ssh' version '2.9.0'
}

Then we configure our server access properties:

remotes {
    webServer {
        host = '<your-ip>'
        user = 'deployment'
        port = <your-ssh-port>
        identity = file("${System.properties['user.home']}/.ssh/deployment")
        passphrase = server_key_deployment_passphrase
        sudoPassword = server_user_deployment_passphrase
        errorStream = System.err
        outputStream = System.out
    }
}

Note how the passphrases are loaded from the properties file, such that they do not end up in version control by accident.

Next we define the build and deployment directories:

def remote_dir = '/var/www/<yourapp>'        // server deployment location
def local_dir = 'build/libs'                 // local artefact output directory
def deploy_file = "<yourapp>-${version}.jar" // artefact name

Now we add a new task to perform the deployment. The task requires that the artefact is build and checked (i.e. test cases are ran). Then it connects to the server and pushes the newly built file. The deployed application versions exist all side by side. The currently active one is linked to <yourapp>.jar. Then the app server is restarted.

task('deploy') {
  dependsOn build, test, check
  doLast {
    ssh.run {
      session(remotes.webServer) {
        put from: "${projectDir}/${local_dir}/${deploy_file}", into: remote_dir
        execute "ln -sf ${remote_dir}/${deploy_file} ${remote_dir}/<yourapp>.jar"
        executeSudo('systemctl restart <yourapp>.service', pty: true)
      }
    }
  }
}

Register the application with systemd

The new application needs to be registered with systemd such that it can be controlled easily. To do so, create a unit file at /etc/systemd/system/<yourapp>.service and write the following content inside.

[Unit]
Description=Spring Boot Application
After=syslog.target
After=network.target[Service]
User=<serveruser>
Type=simple

[Service]
ExecStart=/usr/bin/java -jar /var/www/<yourapp>/<yourapp>.jar
Restart=always
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=<yourapp>

[Install]
WantedBy=multi-user.target

Then start the app server:

sudo systemctl start <yourapp>
sudo systemctl status <yourapp>

Perform a local test

Build the uber-jar containing all of the necessary jars, including the app server (e.g. Tomcat) by invoking

./gradlew build

Now run it with java -jar <yourapp>.jar and test it.

Perform the deployment

To perform a deployment to the server you need to invoke the new Gradle task deploy:

./gradlew deploy

References

• Deploy Spring Boot Applications with an NGINX Reverse Proxy

You’ll need:

1. The library identifier: <your-group-id>:<your-artifact-id>:<your-version-number> example: com.example.test:mylibrary:1.0.0
2. An Artifactory server with a repository: https://<your-server>/<your-base-path>/<your-repository> example: https://example.com/artifactory/gradle-release-local
3. A user account with sufficient access rights consisting of <your-username> and <your-password>.

Producer and Consumer

Both, producer and consumer must create a properties file containing the Artifactory username and password. The file should be created as ~/.gradle/gradle.properties. The content should be:

artifactory_username=<your-username>
artifactory_password=<your-password>

Producer side

Project level build.gradle file:

buildscript {
    dependencies {
        classpath "org.jfrog.buildinfo:build-info-extractor-gradle:4.7.1"
    }
}

Module level build.gradle file:

apply plugin: 'com.jfrog.artifactory'
apply plugin: 'maven-publish'
apply plugin: 'com.android.library'

// define name and version
def libraryGroupId = '<your-group-id>'
def libraryArtifactId = '<your-artifact-id>'
def libraryVersion = '<your-version-number>'

// add the android and dependencies sections here...

publishing {
    publications {
        aar(MavenPublication) {
            groupId libraryGroupId
            version id.libraryVersion
            artifactId libraryArtifactId

            artifact("$buildDir/outputs/aar/${artifactId}-release.aar")

            // Build a pom file which will be published, so the consumer does not
            // need to declare all dependencies manually.
            pom.withXml {
                final dependenciesNode = asNode().appendNode('dependencies')

                ext.addDependency = { Dependency dep, String scope ->
                    if (dep.group == null || dep.version == null || dep.name == null || dep.name == "unspecified")
                        return // ignore invalid dependencies

                    final dependencyNode = dependenciesNode.appendNode('dependency')
                    dependencyNode.appendNode('groupId', dep.group)
                    dependencyNode.appendNode('artifactId', dep.name)
                    dependencyNode.appendNode('version', dep.version)
                    dependencyNode.appendNode('scope', scope)

                    if (!dep.transitive) {
                        // If this dependency is transitive, we should force exclude
                        // all of its dependencies from the POM
                        final exclusionNode = dependencyNode.appendNode('exclusions').appendNode('exclusion')
                        exclusionNode.appendNode('groupId', '*')
                        exclusionNode.appendNode('artifactId', '*')
                    } else if (!dep.properties.excludeRules.empty) {
                        // Otherwise add specified exclude rules
                        final exclusionNode = dependencyNode.appendNode('exclusions').appendNode('exclusion')
                        dep.properties.excludeRules.each { ExcludeRule rule ->
                            exclusionNode.appendNode('groupId', rule.group ?: '*')
                            exclusionNode.appendNode('artifactId', rule.module ?: '*')
                        }
                    }
                }
                // Map all gradle dependencies to maven dependencies (the compile dependency of gradle is only
                // present to support legacy gradle build files)
                configurations.compile       .getAllDependencies().each { dep -> addDependency(dep, "compile") }
                configurations.api           .getAllDependencies().each { dep -> addDependency(dep, "compile") }
                configurations.implementation.getAllDependencies().each { dep -> addDependency(dep, "runtime") }
            }
        }
    }
}

artifactory {
    contextUrl = 'https://<your-server>/<your-base-path>'
    publish {
        repository {
            repoKey = '<your-repository>'

            username = artifactory_username
            password = artifactory_password
        }
        defaults {
            publications('aar')
            publishArtifacts = true

            properties = [
                'qa.level': 'basic',
                'q.os'    : 'android',
                'dev.team': 'core']
            publishPom = true
        }
    }
}

Deploying the artifact is only a matter of invoking gradlew assembleRelease artifactoryPublish.

Consumer side

Add the repository to the repositories section:

repositories {
    google()
    jcenter()
    maven {
        url "https://<your-server>:443/<your-base-path>/<your-repository>"
        credentials {
            username = "${artifactory_username}"
            password = "${artifactory_password}"
        }
    }
}

Add the library with its given Maven coordinates to the dependencies section:

dependencies {
    implementation '<your-group-id>:<your-artifact-id>:<your-version-number>'
}

App setup

Install Python 3 with the following commands:

sudo yum -y update
sudo yum -y install yum-utils
sudo yum -y groupinstall development
sudo yum -y install https://centos7.iuscommunity.org/ius-release.rpm # community repo
sudo yum -y install python36u # use whatever version fits your needs
sudo yum -y install python36u-pip
sudo yum -y install python36u-devel

Create a virtual environment and install dependencies as well as Gunicorn:

python3.6 -m venv <appdir-name>
source <appdir-name>/bin/activate # enable the environment
# if you have requirements.txt use it, otherwise install the dependencies manually
pip install -r <appdir-name>/requirements.txt
pip install gunicorn
deactivate # quit the virtual environment

Configure Nginx

Edit your nginx configuration (most likely in /etc/nginx/conf.d/nginx.conf) and add the following server:

server {
    listen 80;
    client_max_body_size 4G;

    server_name <your-domain> www.<your-domain>;

    keepalive_timeout 5;

    root <path-to-app>/static; # path to wherever you keep static files

    location / {
        # serve static files directly and use app as fallback if not found
        try_files $uri @proxy_to_app;
    }

    location @proxy_to_app {
        # setup reverse proxy to gunicorn
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://unix:/run/gunicorns/socket;
    }

    # serve error pages from static files
    error_page 500 502 503 504 /500.html;
    location = /500.html {
        root <path-to-app>/static;
    }
}

Configure systemd

Create a new systemd socket file at /etc/systemd/system/gunicorn.socket with the following content.

[Unit]
Desctiption=gunicorn socket

[Socket]
ListenStream=/run/gunicorns/socket

[Install]
WantedBy=sockets.target

Now create the systemd service file at /etc/systemd/system/gunicorn.service and add the following content:

[Unit]
Description=gunicorn daemon
Requires=gunicorn.socket
After=network.target

[Service]
PIDFile=/run/gunicorn/pid
User=<server-user>
Group=<server-group>
RuntimeDirectory=gunicorn
WorkingDirectory=<path-to-app>
ExecStart=<path-to-app>/bin/gunicorn  app:app  \
        --pid /run/gunicorn/pid   \
        --bind unix:/run/gunicorns/socket
ExecReload=/bin/kill -s HUP $MAINPID
ExecStop=/bin/kill -s TERM $MAINPID
PrivateTmp=true

[Install]
WantedBy=multi-user.target

Start and enable Gunicorn:

sudo systemctl start gunicorn.socket
sudo systemctl enable gunicorn.socket

Gunicorn logs

You can display the logs with sudo journalctl -u gunicorn.

References

• How To Install Python 3 and Set Up a Local Programming Environment on CentOS 7
• How To Set Up Django with Postgres, Nginx, and Gunicorn on Ubuntu 18.04
• Deploying Gunicorn