Deploying Applications with Jenkins

# CHAPTER 12

Deploying Applications with Jenkins #

1. Introduction #

2. Learning Objectives #

• Understand the risks associated with live production deployments.

• Configure Jenkins to securely transfer files to a remote server using SCP/SSH.

• Execute remote shell commands on a production server via Jenkins.

• Understand the concept of "Zero-Downtime" (Blue/Green) deployments.

• Conceptualize a basic automated rollback strategy.

3. Beginner-Friendly Explanation #

• The Bad Deployment (Downtime): You stop the car in the middle of the road (Turn off the web server), rip the old engine out (Delete old code), put the new engine in (Copy new code), and start the car again. For 5 minutes, traffic is blocked, and customers are angry.

• The Good Deployment (Zero-Downtime): You build a second, identical car with the new engine next to it. While both cars are driving, you instantly teleport the driver from the old car to the new car. The driver never even notices the switch.

Jenkins automates the process of building the second car and flipping the switch instantly.

4. Traditional Deployments (SSH/SCP) #

1. 1. SCP (Secure Copy Protocol): Jenkins takes the zipped code and securely transfers it to the production server.

1. 2. SSH (Secure Shell): Jenkins logs into the production server remotely and runs commands (e.g., unzip app.zip, systemctl restart nginx).

To do this securely, Jenkins uses plugins like "Publish Over SSH" or the sshagent block, which securely injects private SSH keys without exposing them.

5. Zero-Downtime Deployments (Symlink Swap) #

1. 1. Jenkins SSH's into the server and creates a new folder named with the timestamp: /var/www/releases/2026-10-21-1200

1. 2. Jenkins copies all the new code into this new folder. The live website is still running from the old folder, so users are unaffected.

1. 3. Once the files are fully copied, Jenkins runs a single, instantaneous Linux command to update a "shortcut" (Symlink). The shortcut /var/www/html suddenly points to the new timestamp folder.

1. 4. The deployment is instant. Zero downtime.

6. Mini Project: Deploy a PHP App Automatically #

Step-by-Step Pipeline Concept:

pipeline {
    agent any
    environment {
        PROD_SERVER = 'user@192.168.1.50'
        WEB_DIR = '/var/www/html/myapp'
    }
    stages {
        stage('Build & Test') {
            steps {
                echo 'Code compiled and tested successfully...'
                sh 'tar -czf app.tar.gz ./src'
            }
        }
        stage('Deploy to Production') {
            steps {
                // We use an SSH Agent to securely provide the private key for login
                sshagent(['production-ssh-key-id']) {
                    
                    echo 'Transferring files to production...'
                    sh "scp -o StrictHostKeyChecking=no app.tar.gz ${PROD_SERVER}:/tmp/"
                    
                    echo 'Running deployment script on production server...'
                    sh """
                    ssh -o StrictHostKeyChecking=no ${PROD_SERVER} '
                        cd /tmp
                        tar -xzf app.tar.gz
                        rsync -a ./src/ ${WEB_DIR}/
                        rm app.tar.gz
                        sudo systemctl reload nginx
                    '
                    """
                }
            }
        }
    }
}

7. Real-World Scenarios #

8. Best Practices #

• Rollbacks: If your new code crashes the database immediately after deployment, how fast can you undo it? Your pipeline architecture must include a fast rollback mechanism. Using the Symlink strategy, a rollback is as simple as running a script to point the symlink back to the previous timestamp folder.

9. Security Recommendations #

• Strict Host Key Checking: In the mini-project above, we used -o StrictHostKeyChecking=no to bypass SSH prompts. In a true production environment, you should pre-configure the knownhosts file on the Jenkins server to prevent Man-in-the-Middle (MITM) attacks during deployment.

• SSH Key Permissions: The most common deployment failure is "Permission denied (publickey)". This means the private SSH key stored in Jenkins does not match the public key stored in the ~/.ssh/authorizedkeys file on the production server.

11. Exercises #

1. 1. Explain why deploying files directly into the live web directory (/var/www/html) using a slow file transfer protocol is a bad architectural decision.

1. 2. Describe the concept of a "Rollback" and why it is a critical requirement for a CI/CD deployment pipeline.

12. FAQs #

13. Interview Questions #

• Q: Describe the mechanics of a Zero-Downtime deployment using the Symlink swapping strategy on a Linux web server. How does this strategy facilitate instantaneous rollbacks?

• Q: Your pipeline needs to execute a restart command (systemctl restart nginx) on a remote production server via SSH. How do you configure the remote server to allow the Jenkins user to execute this specific command without granting it full root sudo privileges?

14. Summary #

15. Next Chapter Recommendation #