From 9ec76ff64d6715d8dbeee3e266cfefada3924333 Mon Sep 17 00:00:00 2001 From: Kenneth Obsequio Date: Thu, 13 Aug 2026 20:28:41 +0800 Subject: [PATCH] updated git workflow per deployment Yes to protected wireguard tunnels Signed-off-by: Kenneth Obsequio --- .github/workflows/deploy.yml | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5c70149..40bb840 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -9,13 +9,35 @@ jobs: deploy: runs-on: ubuntu-latest steps: + # nodejs-api only accepts SSH over its WireGuard tunnel (public :22 was + # removed). This peer is scoped to AllowedIPs 10.100.1.3/32 on the + # droplet side, so it can only ever reach 10.100.1.1 — nothing else. + - name: Bring up WireGuard tunnel + run: | + sudo apt-get update -y + sudo apt-get install -y wireguard-tools + umask 077 + sudo mkdir -p /etc/wireguard + cat < /dev/null + [Interface] + PrivateKey = ${{ secrets.CI_WG_PRIVATE_KEY }} + Address = 10.100.1.3/32 + + [Peer] + PublicKey = ${{ secrets.NODEJS_API_WG_PUBLIC_KEY }} + Endpoint = 68.183.239.171:51820 + AllowedIPs = 10.100.1.1/32 + PersistentKeepalive = 25 + EOF + sudo wg-quick up wg0 + # The key below is restricted server-side to only run # /opt/new_starr/deploy.sh (see authorized_keys forced-command on the # droplet) — it can't run arbitrary commands even if this secret leaks. - name: Deploy via SSH uses: appleboy/ssh-action@v1 with: - host: ${{ secrets.DEPLOY_HOST }} + host: 10.100.1.1 username: deploy key: ${{ secrets.DEPLOY_SSH_KEY }} script: deploy