114 lines
4.2 KiB
YAML
114 lines
4.2 KiB
YAML
name: Deploy to Production
|
|
|
|
# Manual production deploy — pulls pre-built images from the registry
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
image_tag:
|
|
description: "Docker image tag to deploy (commit SHA or version tag, e.g. v1.0.0)"
|
|
required: true
|
|
default: "latest"
|
|
type: string
|
|
|
|
env:
|
|
FRONTEND_IMAGE: git.koppkb.com/kopkb/my-kopkb-fe
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: mykopkb-production
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ inputs.image_tag }}
|
|
|
|
- name: Verify image exists in registry
|
|
run: |
|
|
set -e
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | \
|
|
docker login git.koppkb.com \
|
|
-u "${{ secrets.REGISTRY_USERNAME }}" \
|
|
--password-stdin
|
|
|
|
IMAGE="${FRONTEND_IMAGE}:${{ inputs.image_tag }}"
|
|
echo "Checking if image exists: ${IMAGE}"
|
|
docker manifest inspect "${IMAGE}" > /dev/null
|
|
echo "✓ ${IMAGE} found"
|
|
|
|
- name: Deploy over SSH
|
|
env:
|
|
PROD_HOST: ${{ secrets.PROD_HOST }}
|
|
PROD_USER: ${{ secrets.PROD_USER }}
|
|
PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
|
|
PROD_DEPLOY_DIR: ${{ secrets.PROD_DEPLOY_DIR }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
IMAGE_TAG: ${{ inputs.image_tag }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! command -v ssh >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y openssh-client
|
|
fi
|
|
|
|
mkdir -p ~/.ssh
|
|
umask 077
|
|
# Gitea often stores a multiline key as one line. Prefer a base64
|
|
# secret (one line). A raw key that still contains BEGIN is accepted too.
|
|
if printf '%s' "$PROD_SSH_KEY" | grep -q -- '-----BEGIN'; then
|
|
printf '%b\n' "$PROD_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
|
|
else
|
|
printf '%s' "$PROD_SSH_KEY" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_ed25519
|
|
fi
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null; then
|
|
echo "ERROR: PROD_SSH_KEY is not a readable private key."
|
|
echo "On the runner, run: base64 -w0 ~/.ssh/mykopkb_prod"
|
|
echo "Put that single line in the PROD_SSH_KEY secret."
|
|
exit 1
|
|
fi
|
|
ssh-keyscan -H "$PROD_HOST" >> ~/.ssh/known_hosts
|
|
|
|
SSH=(ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes "${PROD_USER}@${PROD_HOST}")
|
|
IMAGE="${FRONTEND_IMAGE}:${IMAGE_TAG}"
|
|
|
|
"${SSH[@]}" "mkdir -p '${PROD_DEPLOY_DIR}'"
|
|
scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
|
|
docker/docker-compose.production.yml \
|
|
"${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/docker-compose.frontend.yml"
|
|
|
|
"${SSH[@]}" "bash -s" << EOF
|
|
set -euo pipefail
|
|
echo "${REGISTRY_PASSWORD}" | docker login git.koppkb.com \
|
|
-u "${REGISTRY_USERNAME}" --password-stdin
|
|
|
|
echo "Checking if image exists: ${IMAGE}"
|
|
docker manifest inspect "${IMAGE}" > /dev/null
|
|
echo "✓ ${IMAGE} found"
|
|
|
|
echo "Deploying frontend IMAGE=${IMAGE}"
|
|
|
|
docker network inspect mykopkb-production-network >/dev/null 2>&1 \
|
|
|| docker network create mykopkb-production-network
|
|
|
|
cd "${PROD_DEPLOY_DIR}"
|
|
export IMAGE_TAG="${IMAGE_TAG}"
|
|
|
|
docker rm -f mykopkb-fe-production || true
|
|
docker compose -f docker-compose.frontend.yml -p mykopkb-fe pull
|
|
docker compose -f docker-compose.frontend.yml -p mykopkb-fe up -d
|
|
|
|
sleep 10
|
|
STATUS=\$(docker compose -f docker-compose.frontend.yml -p mykopkb-fe ps --status running --format '{{.Name}}' frontend || true)
|
|
if [ -z "\$STATUS" ]; then
|
|
docker compose -f docker-compose.frontend.yml -p mykopkb-fe logs --tail=50 frontend || true
|
|
exit 1
|
|
fi
|
|
|
|
FE_PORT=\$(grep -E '^FE_PORT=' .env 2>/dev/null | cut -d= -f2- | tr -d '"' || true)
|
|
FE_PORT=\${FE_PORT:-8081}
|
|
curl -sf "http://127.0.0.1:\${FE_PORT}/health"
|
|
echo "✓ Deployed frontend IMAGE_TAG=${IMAGE_TAG}"
|
|
EOF
|