85 lines
3.2 KiB
YAML
85 lines
3.2 KiB
YAML
name: Deploy Production Data Services
|
|
|
|
# Manual deploy for Postgres and Redis. A backend release does not run this.
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: mykopkb-production
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Deploy data services over SSH
|
|
env:
|
|
PROD_HOST: ${{ secrets.PROD_HOST }}
|
|
PROD_USER: ${{ secrets.PROD_USER }}
|
|
PROD_SSH_KEY: ${{ secrets.PROD_SSH_KEY }}
|
|
PROD_DEPLOY_DIR: ${{ secrets.PROD_DEPLOY_DIR }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ ! -f .env.production ]; then
|
|
echo "ERROR: .env.production is missing from the repository checkout"
|
|
exit 1
|
|
fi
|
|
|
|
if ! command -v ssh >/dev/null 2>&1; then
|
|
apt-get update && apt-get install -y openssh-client
|
|
fi
|
|
|
|
mkdir -p ~/.ssh
|
|
umask 077
|
|
if printf '%s' "$PROD_SSH_KEY" | grep -q -- '-----BEGIN'; then
|
|
printf '%b\n' "$PROD_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
|
|
else
|
|
printf '%s' "$PROD_SSH_KEY" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_ed25519
|
|
fi
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null; then
|
|
echo "ERROR: PROD_SSH_KEY is not a readable private key."
|
|
exit 1
|
|
fi
|
|
ssh-keyscan -H "$PROD_HOST" >> ~/.ssh/known_hosts
|
|
|
|
SSH=(ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes "${PROD_USER}@${PROD_HOST}")
|
|
|
|
"${SSH[@]}" "bash -s" << EOF
|
|
set -euo pipefail
|
|
for name in mykopkb-postgres-production mykopkb-redis-production; do
|
|
if docker inspect "\$name" >/dev/null 2>&1; then
|
|
project=\$(docker inspect -f '{{index .Config.Labels "com.docker.compose.project"}}' "\$name" 2>/dev/null || true)
|
|
if [ "\$project" != "mykopkb-data" ]; then
|
|
echo "ERROR: \$name is already running under compose project '\${project:-unknown}'."
|
|
echo "This workflow does not replace the existing database or Redis containers."
|
|
exit 1
|
|
fi
|
|
fi
|
|
done
|
|
EOF
|
|
|
|
"${SSH[@]}" "mkdir -p '${PROD_DEPLOY_DIR}/redis-config' '${PROD_DEPLOY_DIR}/docker/postgres/conf.d'"
|
|
scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
|
|
docker/production/docker-compose.data.yml \
|
|
"${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/docker-compose.data.yml"
|
|
scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
|
|
.env.production \
|
|
"${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/.env"
|
|
scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
|
|
docker/production/redis/redis.conf \
|
|
"${PROD_USER}@${PROD_HOST}:${PROD_DEPLOY_DIR}/redis-config/redis.conf"
|
|
|
|
"${SSH[@]}" "bash -s" << EOF
|
|
set -euo pipefail
|
|
chmod 600 "${PROD_DEPLOY_DIR}/.env"
|
|
|
|
docker network inspect mykopkb-production-network >/dev/null 2>&1 \
|
|
|| docker network create mykopkb-production-network
|
|
|
|
cd "${PROD_DEPLOY_DIR}"
|
|
docker compose -p mykopkb-data -f docker-compose.data.yml up -d
|
|
docker compose -p mykopkb-data -f docker-compose.data.yml ps
|
|
EOF
|