mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
kennethobsequioandClaude Sonnet 5
832c8e078b
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
name: Deploy to droplet
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'apps/api/**'
|
|
- 'docker-compose.yml'
|
|
- 'pnpm-workspace.yaml'
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# nodejs-api only accepts SSH over its WireGuard tunnel (public :22 was
|
|
# removed). This peer is scoped to AllowedIPs 10.100.1.3/32 on the
|
|
# droplet side, so it can only ever reach 10.100.1.1 — nothing else.
|
|
- name: Bring up WireGuard tunnel
|
|
run: |
|
|
sudo apt-get update -y
|
|
sudo apt-get install -y wireguard-tools
|
|
umask 077
|
|
sudo mkdir -p /etc/wireguard
|
|
cat <<EOF | sudo tee /etc/wireguard/wg0.conf > /dev/null
|
|
[Interface]
|
|
PrivateKey = ${{ secrets.CI_WG_PRIVATE_KEY }}
|
|
Address = 10.100.1.3/32
|
|
|
|
[Peer]
|
|
PublicKey = ${{ secrets.NODEJS_API_WG_PUBLIC_KEY }}
|
|
Endpoint = 68.183.239.171:51820
|
|
AllowedIPs = 10.100.1.1/32
|
|
PersistentKeepalive = 25
|
|
EOF
|
|
sudo wg-quick up wg0
|
|
|
|
# The key below is restricted server-side to only run
|
|
# /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
|
|
# droplet) — it can't run arbitrary commands even if this secret leaks.
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: 10.100.1.1
|
|
username: deploy
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: deploy
|