98 lines
3.6 KiB
YAML
98 lines
3.6 KiB
YAML
name: Deploy im-server production
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- pro
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: production-im-server
|
|
cancel-in-progress: false
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
REGISTRY: git.olns.shop
|
|
IMAGE: git.olns.shop/pro/im_server
|
|
SERVICE: im-server
|
|
DEPLOY_HOST: 145.223.69.9
|
|
DEPLOY_USER: olns-deploy
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: deploy-host
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Log in to Gitea Container Registry
|
|
env:
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u admin --password-stdin
|
|
|
|
- name: Build and push image
|
|
env:
|
|
GITHUB_SHA: ${{ github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
SHORT_SHA="$(printf '%.12s' "$GITHUB_SHA")"
|
|
docker build -f docker/tinode/Dockerfile.build \
|
|
-t "${IMAGE}:pro" -t "${IMAGE}:${SHORT_SHA}" .
|
|
docker push "$IMAGE:pro"
|
|
docker push "$IMAGE:$SHORT_SHA"
|
|
|
|
- name: Deploy Compose service
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
|
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -d -m 700 "$HOME/.ssh"
|
|
KEY_FILE="$(mktemp "$HOME/.ssh/olns-deploy.XXXXXX")"
|
|
cleanup() {
|
|
shred -u "$KEY_FILE" 2>/dev/null || true
|
|
}
|
|
trap cleanup EXIT
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
|
|
chmod 600 "$KEY_FILE"
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
|
chmod 600 "$HOME/.ssh/known_hosts"
|
|
SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
|
|
printf '%s' "$REGISTRY_TOKEN" | ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"docker login git.olns.shop -u admin --password-stdin"
|
|
ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" \
|
|
"cd /opt/olns && docker compose pull im-server && docker compose up -d --no-deps --wait im-server"
|
|
|
|
- name: Ensure production IM CORS routing
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
|
run: |
|
|
set -euo pipefail
|
|
install -d -m 700 "$HOME/.ssh"
|
|
KEY_FILE="$(mktemp "$HOME/.ssh/olns-cors.XXXXXX")"
|
|
cleanup() {
|
|
shred -u "$KEY_FILE" 2>/dev/null || true
|
|
}
|
|
trap cleanup EXIT
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$KEY_FILE"
|
|
chmod 600 "$KEY_FILE"
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
|
chmod 600 "$HOME/.ssh/known_hosts"
|
|
SSH_ARGS=(-i "$KEY_FILE" -o BatchMode=yes -o StrictHostKeyChecking=yes)
|
|
ssh "${SSH_ARGS[@]}" "$DEPLOY_USER@$DEPLOY_HOST" '
|
|
set -euo pipefail
|
|
cd /opt/olns
|
|
cp Caddyfile "config-backups/Caddyfile.$(date -u +%Y%m%dT%H%M%SZ).before-im-cors"
|
|
perl -0pi -e '"'"'s/\n[ \t]*header \{\n[ \t]*Access-Control-Allow-Origin "https:\/\/im\.yuexuan\.shop"\n[ \t]*Vary "Origin"\n[ \t]*\}\n/\n/'"'"' Caddyfile
|
|
count="$(grep -A20 -F "im-api.yuexuan.shop {" Caddyfile | grep -Fc '"'"'Access-Control-Allow-Origin "https://im.yuexuan.shop"'"'"' || true)"
|
|
test "$count" -eq 1
|
|
docker compose exec -T caddy caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
docker compose exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
|
|
'
|