Solar-App Deployment: From Node.js to Multi-Cloud CI/CD

Nimesh Kulkarni — Mon, 10 Nov 2025 11:37:19 +0000

Deployment Strategy

Introduction:
This project takes a simple Node.js “Solar System” app and turns it into a full DevSecOps pipeline. The goal wasn’t just to make the app run, but to automate everything around it builds, testing, security scans, containerization, and multi-cloud deployment. Every commit triggers checks for quality and security, builds a Docker image, and deploys it to real environments like AWS EC2, Kubernetes, and even AWS Lambda. It’s a handson journey from writing JavaScript to running a production-style CI/CD system end-to-end.

Node.js App Basics:
Create a tiny Express app with app.js (server + Mongo), app.controller.js (logic), client.js (fetch UI), and app-test.js (Mocha tests).
Run locally with npm install && npm test && npm start on port 3000; fix Mongo creds via envs if tests fail.

Containerization:
Write a Dockerfile from node:18-alpine, copy package*.json, npm install, copy source, EXPOSE 3000, CMD ["npm","start"].
Pass MONGO_URI/MONGO_USERNAME/MONGO_PASSWORD via ENV or runtime; build+run: docker build -t solar-app . && docker run -p 3000:3000 solar-app.

Standing Up Jenkins:
Verify host setup:

node -v && npm -v && systemctl status jenkins

Install NodeJS Plugin → add tool in Global Tool Configuration.

Organization Folder Automation:
Connect Jenkins to GitHub & enable auto webhooks.
Create Org Folder → auto discovers repos, branches, PRs with Jenkinsfile

Add the First Jenkinsfile:
Push branch feature/enabling-cicd with simple pipeline:

tools { nodejs 'nodejs-22-6-0' }
sh "node -v && npm -v"

Dependency Installation Stage:

npm install --no-audit

Verify node_modules exists in workspace.

Dependency Security Scans:
Critical-level npm audit + OWASP Dep-Check:

npm audit --audit-level=critical

Run both in parallel + fail build on critical issues.

Publishing Security Reports:
Publish HTML + JUnit results in Jenkins.
If styling breaks → adjust Jenkins CSP (to allow CSS).

Unit Testing Pipeline:

Set MONGO_URI and secure creds using Jenkins credentials:
npm test

Archive JUnit report: test-results.xml

Pipeline Hardening:
Global options:

disableResume()
disableConcurrentBuilds abortPrevious: true

expected:
Stage options: timestamps(), retry(2), timeout(...) **Code Coverage Stage:** npm run coverage
Wrap with:
catchError(...)
Publish coverage HTML: coverage/lcov-report/index.html:
Deployment Paths:

EC2: docker run + /live check
Kubernetes: GitOps deploy via ArgoCD
Lambda: deploy with serverless-http

Post-Build & Notifications:

Archive test, coverage, security reports
Upload artifacts to S3
Notify on Slack via webhook

Troubleshooting:
Mongo errors → check env vars + Jenkins creds
Audit fails → npm audit fix or upgrade deps
Coverage low → improve tests or adjust thresholds

Wrap-Up:

Push → test → scan → package → deploy → notify.

Next: DAST (OWASP ZAP), integration tests, policy-as-code.

Final Result
A zero-touch, security-focused pipeline delivering to:

✅ Docker
✅ AWS EC2
✅ Kubernetes + ArgoCD
✅ AWS Lambda
✅ Jenkins quality gates

PROFF IMAGES: ON GITHUB
GITHUB

LINKEDIN

GUIDE & REFERANCE

Thank You😊

DEV Community: Nimesh Kulkarni

Solar-App Deployment: From Node.js to Multi-Cloud CI/CD

Push → test → scan → package → deploy → notify.