mirror of
https://github.com/rgrgogu/new_starr.git
synced 2026-09-27 00:12:54 +08:00
kennethobsequio
9ec76ff64d
Yes to protected wireguard tunnels Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
name: Deploy to droplet
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# nodejs-api only accepts SSH over its WireGuard tunnel (public :22 was
|
|
# removed). This peer is scoped to AllowedIPs 10.100.1.3/32 on the
|
|
# droplet side, so it can only ever reach 10.100.1.1 — nothing else.
|
|
- name: Bring up WireGuard tunnel
|
|
run: |
|
|
sudo apt-get update -y
|
|
sudo apt-get install -y wireguard-tools
|
|
umask 077
|
|
sudo mkdir -p /etc/wireguard
|
|
cat <<EOF | sudo tee /etc/wireguard/wg0.conf > /dev/null
|
|
[Interface]
|
|
PrivateKey = ${{ secrets.CI_WG_PRIVATE_KEY }}
|
|
Address = 10.100.1.3/32
|
|
|
|
[Peer]
|
|
PublicKey = ${{ secrets.NODEJS_API_WG_PUBLIC_KEY }}
|
|
Endpoint = 68.183.239.171:51820
|
|
AllowedIPs = 10.100.1.1/32
|
|
PersistentKeepalive = 25
|
|
EOF
|
|
sudo wg-quick up wg0
|
|
|
|
# The key below is restricted server-side to only run
|
|
# /opt/new_starr/deploy.sh (see authorized_keys forced-command on the
|
|
# droplet) — it can't run arbitrary commands even if this secret leaks.
|
|
- name: Deploy via SSH
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: 10.100.1.1
|
|
username: deploy
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
script: deploy
|