mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
101 lines
3.2 KiB
YAML
101 lines
3.2 KiB
YAML
name: Deploy to production droplet
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch: {}
|
|
|
|
concurrency:
|
|
group: production-deployment
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out source
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install WireGuard
|
|
run: |
|
|
sudo apt-get update -y
|
|
sudo apt-get install -y wireguard-tools
|
|
|
|
# The CI peer must be configured on the droplet's wg0 interface:
|
|
# PublicKey = <public key matching CI_WG_PRIVATE_KEY>
|
|
# AllowedIPs = 10.100.2.11/32
|
|
- name: Bring up production WireGuard tunnel
|
|
env:
|
|
CI_WG_PRIVATE_KEY: ${{ secrets.CI_WG_PRIVATE_KEY }}
|
|
DROPLET_WG_PUBLIC_KEY: ${{ secrets.DROPLET_WG_PUBLIC_KEY }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
sudo mkdir -p /etc/wireguard
|
|
cat <<EOF | sudo tee /etc/wireguard/new-starr-ci.conf > /dev/null
|
|
[Interface]
|
|
PrivateKey = ${CI_WG_PRIVATE_KEY}
|
|
Address = 10.100.2.11/32
|
|
|
|
[Peer]
|
|
PublicKey = ${DROPLET_WG_PUBLIC_KEY}
|
|
Endpoint = 161.35.103.214:51820
|
|
AllowedIPs = 10.100.2.1/32
|
|
PersistentKeepalive = 25
|
|
EOF
|
|
sudo wg-quick up /etc/wireguard/new-starr-ci.conf
|
|
|
|
- name: Configure SSH
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
set -Eeuo pipefail
|
|
install -d -m 700 "$HOME/.ssh"
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/new-starr-deploy"
|
|
chmod 600 "$HOME/.ssh/new-starr-deploy"
|
|
ssh-keyscan -H 10.100.2.1 >> "$HOME/.ssh/known_hosts"
|
|
|
|
- name: Build frontend bundle
|
|
run: |
|
|
set -Eeuo pipefail
|
|
scp -i "$HOME/.ssh/new-starr-deploy" \
|
|
-o IdentitiesOnly=yes \
|
|
starr-deploy@10.100.2.1:/home/starr-deploy/new_starr/apps/web/.env \
|
|
apps/web/.env
|
|
corepack enable
|
|
corepack prepare pnpm@11.3.0 --activate
|
|
pnpm install --no-frozen-lockfile
|
|
pnpm --filter web build
|
|
|
|
- name: Upload source
|
|
run: |
|
|
set -Eeuo pipefail
|
|
tar \
|
|
--exclude=.git \
|
|
--exclude=node_modules \
|
|
--exclude='apps/api/.env' \
|
|
--exclude='apps/web/.env' \
|
|
-czf - . |
|
|
ssh -i "$HOME/.ssh/new-starr-deploy" \
|
|
-o IdentitiesOnly=yes \
|
|
starr-deploy@10.100.2.1 \
|
|
'rm -rf "$HOME/new_starr-release" && mkdir -p "$HOME/new_starr-release" && tar -xzf - -C "$HOME/new_starr-release"'
|
|
|
|
- name: Build and restart production stack
|
|
run: |
|
|
set -Eeuo pipefail
|
|
ssh -i "$HOME/.ssh/new-starr-deploy" \
|
|
-o IdentitiesOnly=yes \
|
|
starr-deploy@10.100.2.1 <<'REMOTE'
|
|
set -Eeuo pipefail
|
|
cd "$HOME/new_starr-release"
|
|
test -f "$HOME/new_starr/apps/api/.env"
|
|
test -f "$HOME/new_starr/apps/web/.env"
|
|
test -f "$HOME/new_starr/.env"
|
|
cp "$HOME/new_starr/apps/api/.env" apps/api/.env
|
|
cp "$HOME/new_starr/apps/web/.env" apps/web/.env
|
|
cp "$HOME/new_starr/.env" .env
|
|
docker compose up -d --build
|
|
docker compose ps
|
|
REMOTE
|