|
|
|
@@ -53,11 +53,25 @@ jobs:
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
mkdir -p ~/.ssh
|
|
|
|
|
printf '%s\n' "$PROD_SSH_KEY" > ~/.ssh/id_ed25519
|
|
|
|
|
umask 077
|
|
|
|
|
# Gitea often stores a multiline key as one line. Prefer a base64
|
|
|
|
|
# secret (one line). A raw key that still contains BEGIN is accepted too.
|
|
|
|
|
if printf '%s' "$PROD_SSH_KEY" | grep -q -- '-----BEGIN'; then
|
|
|
|
|
printf '%b\n' "$PROD_SSH_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
|
|
|
|
|
else
|
|
|
|
|
printf '%s' "$PROD_SSH_KEY" | tr -d '[:space:]' | base64 -d > ~/.ssh/id_ed25519
|
|
|
|
|
fi
|
|
|
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
|
if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null; then
|
|
|
|
|
echo "ERROR: PROD_SSH_KEY is not a readable private key."
|
|
|
|
|
echo "On the runner, run: base64 -w0 ~/.ssh/mykopkb_prod"
|
|
|
|
|
echo "Put that single line in the PROD_SSH_KEY secret."
|
|
|
|
|
exit 1
|
|
|
|
|
fi
|
|
|
|
|
ssh-keyscan -H "$PROD_HOST" >> ~/.ssh/known_hosts
|
|
|
|
|
|
|
|
|
|
SSH=(ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes "${PROD_USER}@${PROD_HOST}")
|
|
|
|
|
IMAGE="${FRONTEND_IMAGE}:${IMAGE_TAG}"
|
|
|
|
|
|
|
|
|
|
"${SSH[@]}" "mkdir -p '${PROD_DEPLOY_DIR}'"
|
|
|
|
|
scp -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes \
|
|
|
|
@@ -69,7 +83,6 @@ jobs:
|
|
|
|
|
echo "${REGISTRY_PASSWORD}" | docker login git.koppkb.com \
|
|
|
|
|
-u "${REGISTRY_USERNAME}" --password-stdin
|
|
|
|
|
|
|
|
|
|
IMAGE="${FRONTEND_IMAGE}:${IMAGE_TAG}"
|
|
|
|
|
echo "Checking if image exists: ${IMAGE}"
|
|
|
|
|
docker manifest inspect "${IMAGE}" > /dev/null
|
|
|
|
|
echo "✓ ${IMAGE} found"
|
|
|
|
|