matrix

.gitea/workflows/deploy.yaml

@@ -67,7 +67,50 @@ jobs:
              cat > \"docker-compose-$REF_NAME.yml\"" \
             < docker-compose.yml
 
-      - name: 🔐 Create secrets and envs
+      - name: 🧩 Prepare configs
+        env:
+          MATRIX_SERVER_NAME: ${{ vars.MATRIX_SERVER_NAME }}
+          MATRIX_PUBLIC_BASEURL: ${{ vars.MATRIX_PUBLIC_BASEURL }}
+          ELEMENT_WEB_URL: ${{ vars.ELEMENT_WEB_URL }}
+          SYNAPSE_POSTGRES_PASSWORD: ${{ secrets.SYNAPSE_POSTGRES_PASSWORD }}
+          SYNAPSE_REGISTRATION_SHARED_SECRET: ${{ secrets.SYNAPSE_REGISTRATION_SHARED_SECRET }}
+        run: |
+          rm -rf .deploy
+
+          python3 - << 'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          replacements = {
+              "MATRIX_SERVER_NAME": os.environ["MATRIX_SERVER_NAME"],
+              "MATRIX_PUBLIC_BASEURL": os.environ["MATRIX_PUBLIC_BASEURL"].rstrip("/") + "/",
+              "ELEMENT_WEB_LOCATION": os.environ["ELEMENT_WEB_URL"].rstrip("/") + "/",
+              "SYNAPSE_POSTGRES_PASSWORD": os.environ["SYNAPSE_POSTGRES_PASSWORD"],
+              "SYNAPSE_REGISTRATION_SHARED_SECRET": os.environ["SYNAPSE_REGISTRATION_SHARED_SECRET"],
+          }
+
+          def render(template_path, output_path):
+              config = template_path.read_text(encoding="utf-8")
+              for key, value in replacements.items():
+                  config = config.replace(f"__{key}__", json.dumps(value))
+              output_path.parent.mkdir(parents=True, exist_ok=True)
+              output_path.write_text(config, encoding="utf-8")
+
+          render(
+              Path("config/synapse/homeserver.yaml.template"),
+              Path(".deploy/secrets/synapse_homeserver_config.yaml"),
+          )
+          render(
+              Path("config/element/config.json.template"),
+              Path(".deploy/secrets/element_config.json"),
+          )
+          PY
+
+          find .deploy -type d -exec chmod 700 {} \;
+          find .deploy -type f -exec chmod 644 {} \;
+
+      - name: 🔐 Create env, secrets and config
         env:
           SSHPASS: ${{ secrets.SSH_PASSWORD }}
           SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
@@ -81,7 +124,14 @@ jobs:
           VAULTWARDEN_ADMIN_TOKEN: ${{ secrets.VAULTWARDEN_ADMIN_TOKEN }}
           NEXTCLOUD_DOMAIN: ${{ vars.NEXTCLOUD_DOMAIN }}
           RUSTDESK_DOMAIN: ${{ vars.RUSTDESK_DOMAIN }}
+          POSTGRES_ADMIN_PASSWORD: ${{ secrets.POSTGRES_ADMIN_PASSWORD }}
+          SYNAPSE_POSTGRES_PASSWORD: ${{ secrets.SYNAPSE_POSTGRES_PASSWORD }}
         run: |
+          tar -C .deploy -czf - secrets | sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" \
+            "mkdir -p \"$DEPLOY_DIRECTORY\" && \
+             cd \"$DEPLOY_DIRECTORY\" && \
+             tar -xzf -"
+
           sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
             set -e
             cd "$DEPLOY_DIRECTORY"
@@ -111,10 +161,67 @@ jobs:
           $VAULTWARDEN_ADMIN_TOKEN
           EOF_SECRET
 
+            cat << 'EOF_SECRET' > secrets/postgres_admin_password.txt
+          $POSTGRES_ADMIN_PASSWORD
+          EOF_SECRET
+
+            cat << 'EOF_SECRET' > secrets/synapse_postgres_password.txt
+          $SYNAPSE_POSTGRES_PASSWORD
+          EOF_SECRET
             chmod 700 secrets
             chmod 600 secrets/*.txt
+            chmod 644 secrets/synapse_homeserver_config.yaml secrets/element_config.json
           EOT
 
+      - name: 🗄️ Initialize databases
+        env:
+          SSHPASS: ${{ secrets.SSH_PASSWORD }}
+          SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
+          SSH_HOST: ${{ secrets.SSH_HOST }}
+          DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
+          REF_NAME: ${{ env.CLEAN_REF_NAME }}
+          DRY_RUN_ENABLED: ${{ vars.DEPLOY_DRY_RUN_ENABLED }}
+        run: |
+          if [ "${DRY_RUN_ENABLED}" = "true" ]; then
+            echo "Dry run enabled, database initialization skipped."
+            exit 0
+          fi
+
+          sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
+            set -e
+            cd "$DEPLOY_DIRECTORY"
+
+            docker compose -f "docker-compose-${REF_NAME}.yml" pull db
+            docker compose -f "docker-compose-${REF_NAME}.yml" up -d db
+
+            for attempt in \$(seq 1 30); do
+              if docker compose -f "docker-compose-${REF_NAME}.yml" exec -T db pg_isready -U postgres; then
+                break
+              fi
+
+              if [ "\${attempt}" -eq 30 ]; then
+                echo "PostgreSQL is not ready after 30 attempts."
+                exit 1
+              fi
+
+              sleep 2
+            done
+          EOT
+
+          sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" \
+            "cd \"$DEPLOY_DIRECTORY\" && \
+            docker run --rm -i \
+              --entrypoint /bin/sh \
+              --network vbevdev \
+              -e PGHOST=db \
+              -e PGPORT=5432 \
+              -e PGUSER=postgres \
+              -e PGPASSWORD_FILE=/run/secrets/postgres_admin_password.txt \
+              -e SYNAPSE_POSTGRES_PASSWORD_FILE=/run/secrets/synapse_postgres_password.txt \
+              -v \"$DEPLOY_DIRECTORY/secrets:/run/secrets:ro\" \
+              postgres:16-alpine \
+              -s" < ops/postgres/init-services.sh
+
       - name: 🚀 Run new containers
         env:
           SSHPASS: ${{ secrets.SSH_PASSWORD }}