280 lines
11 KiB
YAML
280 lines
11 KiB
YAML
name: 🚀 Deploy
|
|
run-name: '🚀 Deploy: ${{ gitea.ref_name }} by @${{ gitea.actor }}'
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: 📂 Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: 🧼 Clean ref name
|
|
run: |
|
|
ORIGINAL_REF_NAME="${{ gitea.ref_name }}"
|
|
CLEAN_REF_NAME=${ORIGINAL_REF_NAME//\//-}
|
|
echo "Clean ref name: $CLEAN_REF_NAME"
|
|
echo "CLEAN_REF_NAME=$CLEAN_REF_NAME" >> $GITEA_ENV
|
|
|
|
- name: ⚙️ Configure ssh client
|
|
uses: ./.gitea/actions/configure-ssh-client
|
|
with:
|
|
ssh_host: ${{ secrets.SSH_HOST }}
|
|
|
|
- name: 📦 Create backup of data/ folder
|
|
if: ${{ vars.DEPLOY_BACKUP_ENABLED == 'true' }}
|
|
env:
|
|
SSHPASS: ${{ secrets.SSH_PASSWORD }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
REF_NAME: ${{ env.CLEAN_REF_NAME }}
|
|
run: |
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
|
|
set -e
|
|
cd "$DEPLOY_DIRECTORY"
|
|
|
|
mkdir -p backups
|
|
|
|
BACKUP_DATE=\$(date +%Y-%m-%d_%H-%M-%S)
|
|
BACKUP_FILE="backups/backup-${REF_NAME}-\${BACKUP_DATE}.tar.gz"
|
|
|
|
echo "Creating backup of data/ into \${BACKUP_FILE}..."
|
|
|
|
if [ -d "data" ]; then
|
|
echo "$SSHPASS" | sudo -S tar -czf "\${BACKUP_FILE}" data
|
|
echo "✅ Backup created successfully!"
|
|
else
|
|
echo "⚡️ No data/ folder, backup creation skipped."
|
|
fi
|
|
|
|
echo "$SSHPASS" | sudo -S find backups/ -type f -name "backup-*.tar.gz" -mtime +7 -delete
|
|
EOT
|
|
|
|
- name: 🏗️ Create docker-compose file
|
|
env:
|
|
SSHPASS: ${{ secrets.SSH_PASSWORD }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
REF_NAME: ${{ env.CLEAN_REF_NAME }}
|
|
run: |
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" \
|
|
"mkdir -p \"$DEPLOY_DIRECTORY\" && \
|
|
cd \"$DEPLOY_DIRECTORY\" && \
|
|
rm -f docker-compose-*.yml && \
|
|
cat > \"docker-compose-$REF_NAME.yml\"" \
|
|
< docker-compose.yml
|
|
|
|
- name: 🧩 Prepare configs
|
|
env:
|
|
MATRIX_SERVER_NAME: ${{ vars.MATRIX_SERVER_NAME }}
|
|
MATRIX_PUBLIC_BASEURL: ${{ vars.MATRIX_PUBLIC_BASEURL }}
|
|
ELEMENT_WEB_URL: ${{ vars.ELEMENT_WEB_URL }}
|
|
SYNAPSE_POSTGRES_PASSWORD: ${{ secrets.SYNAPSE_POSTGRES_PASSWORD }}
|
|
SYNAPSE_REGISTRATION_SHARED_SECRET: ${{ secrets.SYNAPSE_REGISTRATION_SHARED_SECRET }}
|
|
run: |
|
|
rm -rf .deploy
|
|
|
|
python3 - << 'PY'
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
replacements = {
|
|
"MATRIX_SERVER_NAME": os.environ["MATRIX_SERVER_NAME"],
|
|
"MATRIX_PUBLIC_BASEURL": os.environ["MATRIX_PUBLIC_BASEURL"].rstrip("/") + "/",
|
|
"ELEMENT_WEB_LOCATION": os.environ["ELEMENT_WEB_URL"].rstrip("/") + "/",
|
|
"SYNAPSE_POSTGRES_PASSWORD": os.environ["SYNAPSE_POSTGRES_PASSWORD"],
|
|
"SYNAPSE_REGISTRATION_SHARED_SECRET": os.environ["SYNAPSE_REGISTRATION_SHARED_SECRET"],
|
|
}
|
|
|
|
def render(template_path, output_path):
|
|
config = template_path.read_text(encoding="utf-8")
|
|
for key, value in replacements.items():
|
|
config = config.replace(f"__{key}__", json.dumps(value))
|
|
output_path.parent.mkdir(parents=True, exist_ok=True)
|
|
output_path.write_text(config, encoding="utf-8")
|
|
|
|
render(
|
|
Path("config/synapse/homeserver.yaml.template"),
|
|
Path(".deploy/secrets/synapse_homeserver_config.yaml"),
|
|
)
|
|
render(
|
|
Path("config/element/config.json.template"),
|
|
Path(".deploy/secrets/element_config.json"),
|
|
)
|
|
PY
|
|
|
|
find .deploy -type d -exec chmod 700 {} \;
|
|
find .deploy -type f -exec chmod 644 {} \;
|
|
|
|
- name: 🔐 Create env, secrets and config
|
|
env:
|
|
SSHPASS: ${{ secrets.SSH_PASSWORD }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
BESZEL_AGENT_KEY: ${{ secrets.BESZEL_AGENT_KEY }}
|
|
BESZEL_AGENT_TOKEN: ${{ secrets.BESZEL_AGENT_TOKEN }}
|
|
BESZEL_HUB_URL: ${{ vars.BESZEL_HUB_URL }}
|
|
GITEA_RUNNER_REGISTRATION_TOKEN: ${{ secrets.RUNNER_REGISTRATION_TOKEN }}
|
|
GITEA_URL: ${{ vars.GIT_URL }}
|
|
VAULTWARDEN_ADMIN_TOKEN: ${{ secrets.VAULTWARDEN_ADMIN_TOKEN }}
|
|
NEXTCLOUD_DOMAIN: ${{ vars.NEXTCLOUD_DOMAIN }}
|
|
RUSTDESK_DOMAIN: ${{ vars.RUSTDESK_DOMAIN }}
|
|
POSTGRES_ADMIN_PASSWORD: ${{ secrets.POSTGRES_ADMIN_PASSWORD }}
|
|
SYNAPSE_POSTGRES_PASSWORD: ${{ secrets.SYNAPSE_POSTGRES_PASSWORD }}
|
|
run: |
|
|
tar -C .deploy -czf - secrets | sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" \
|
|
"mkdir -p \"$DEPLOY_DIRECTORY\" && \
|
|
cd \"$DEPLOY_DIRECTORY\" && \
|
|
tar -xzf -"
|
|
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
|
|
set -e
|
|
cd "$DEPLOY_DIRECTORY"
|
|
|
|
cat << 'EOF_ENV' > .env
|
|
BESZEL_HUB_URL=$BESZEL_HUB_URL
|
|
NEXTCLOUD_DOMAIN=$NEXTCLOUD_DOMAIN
|
|
GITEA_URL=$GITEA_URL
|
|
RUSTDESK_DOMAIN=$RUSTDESK_DOMAIN
|
|
EOF_ENV
|
|
|
|
mkdir -p secrets
|
|
|
|
cat << 'EOF_SECRET' > secrets/beszel_agent_key.txt
|
|
$BESZEL_AGENT_KEY
|
|
EOF_SECRET
|
|
|
|
cat << 'EOF_SECRET' > secrets/beszel_agent_token.txt
|
|
$BESZEL_AGENT_TOKEN
|
|
EOF_SECRET
|
|
|
|
cat << 'EOF_SECRET' > secrets/gitea_runner_registration_token.txt
|
|
$GITEA_RUNNER_REGISTRATION_TOKEN
|
|
EOF_SECRET
|
|
|
|
cat << 'EOF_SECRET' > secrets/vaultwarden_admin_token.txt
|
|
$VAULTWARDEN_ADMIN_TOKEN
|
|
EOF_SECRET
|
|
|
|
cat << 'EOF_SECRET' > secrets/postgres_admin_password.txt
|
|
$POSTGRES_ADMIN_PASSWORD
|
|
EOF_SECRET
|
|
|
|
cat << 'EOF_SECRET' > secrets/synapse_postgres_password.txt
|
|
$SYNAPSE_POSTGRES_PASSWORD
|
|
EOF_SECRET
|
|
chmod 700 secrets
|
|
chmod 600 secrets/*.txt
|
|
chmod 644 secrets/synapse_homeserver_config.yaml secrets/element_config.json
|
|
EOT
|
|
|
|
- name: 🗄️ Initialize databases
|
|
env:
|
|
SSHPASS: ${{ secrets.SSH_PASSWORD }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
REF_NAME: ${{ env.CLEAN_REF_NAME }}
|
|
DRY_RUN_ENABLED: ${{ vars.DEPLOY_DRY_RUN_ENABLED }}
|
|
run: |
|
|
if [ "${DRY_RUN_ENABLED}" = "true" ]; then
|
|
echo "Dry run enabled, database initialization skipped."
|
|
exit 0
|
|
fi
|
|
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
|
|
set -e
|
|
cd "$DEPLOY_DIRECTORY"
|
|
|
|
docker compose -f "docker-compose-${REF_NAME}.yml" pull db
|
|
docker compose -f "docker-compose-${REF_NAME}.yml" up -d db
|
|
|
|
for attempt in \$(seq 1 30); do
|
|
if docker compose -f "docker-compose-${REF_NAME}.yml" exec -T db pg_isready -U postgres; then
|
|
break
|
|
fi
|
|
|
|
if [ "\${attempt}" -eq 30 ]; then
|
|
echo "PostgreSQL is not ready after 30 attempts."
|
|
exit 1
|
|
fi
|
|
|
|
sleep 2
|
|
done
|
|
EOT
|
|
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" \
|
|
"cd \"$DEPLOY_DIRECTORY\" && \
|
|
docker run --rm -i \
|
|
--entrypoint /bin/sh \
|
|
--network vbevdev \
|
|
-e PGHOST=db \
|
|
-e PGPORT=5432 \
|
|
-e PGUSER=postgres \
|
|
-e PGPASSWORD_FILE=/run/secrets/postgres_admin_password.txt \
|
|
-e SYNAPSE_POSTGRES_PASSWORD_FILE=/run/secrets/synapse_postgres_password.txt \
|
|
-v \"$DEPLOY_DIRECTORY/secrets:/run/secrets:ro\" \
|
|
postgres:16-alpine \
|
|
-s" < ops/postgres/init-services.sh
|
|
|
|
- name: 🚀 Run new containers
|
|
env:
|
|
SSHPASS: ${{ secrets.SSH_PASSWORD }}
|
|
SSH_USERNAME: ${{ secrets.SSH_USERNAME }}
|
|
SSH_HOST: ${{ secrets.SSH_HOST }}
|
|
DEPLOY_DIRECTORY: ${{ vars.DEPLOY_DIRECTORY }}
|
|
DEPLOY_LOG_FILE: /tmp/deploy-${{ env.CLEAN_REF_NAME }}.log
|
|
DRY_RUN_ENABLED: ${{ vars.DEPLOY_DRY_RUN_ENABLED }}
|
|
REF_NAME: ${{ env.CLEAN_REF_NAME }}
|
|
TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_DEPLOY_BOT_TOKEN }}
|
|
TELEGRAM_CHAT: ${{ secrets.TELEGRAM_DEPLOY_CHAT_ID }}
|
|
PROXY_URL: ${{ secrets.PROXY_URL }}
|
|
SUCCESS_MESSAGE: |-
|
|
✅ <b>Успешный деплой!</b>
|
|
Релиз: <code>${{ gitea.ref_name }}</code>
|
|
FAILURE_MESSAGE: |-
|
|
❌ <b>Ошибка деплоя!</b>
|
|
Релиз: <code>${{ gitea.ref_name }}</code>
|
|
run: |
|
|
sshpass -e ssh -p 22 "$SSH_USERNAME@$SSH_HOST" bash -s << EOT
|
|
set -e
|
|
cd "$DEPLOY_DIRECTORY"
|
|
|
|
nohup bash -c '
|
|
sleep 5
|
|
|
|
if [ "${DRY_RUN_ENABLED}" = "true" ]; then
|
|
DRY_RUN_FLAG="--dry-run"
|
|
else
|
|
DRY_RUN_FLAG=""
|
|
fi
|
|
|
|
if docker compose \${DRY_RUN_FLAG} -f "docker-compose-${REF_NAME}.yml" pull > ${DEPLOY_LOG_FILE} 2>&1 && \
|
|
docker compose \${DRY_RUN_FLAG} -f "docker-compose-${REF_NAME}.yml" up -d --remove-orphans >> ${DEPLOY_LOG_FILE} 2>&1; then
|
|
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
|
|
--proxy "${PROXY_URL}" \
|
|
-d "chat_id=${TELEGRAM_CHAT}" \
|
|
-d "parse_mode=HTML" \
|
|
--data-urlencode "text=${SUCCESS_MESSAGE}" > /dev/null
|
|
else
|
|
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
|
|
--proxy "${PROXY_URL}" \
|
|
-d "chat_id=${TELEGRAM_CHAT}" \
|
|
-d "parse_mode=HTML" \
|
|
--data-urlencode "text=${FAILURE_MESSAGE}" > /dev/null
|
|
fi
|
|
|
|
curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendDocument" \
|
|
--proxy "${PROXY_URL}" \
|
|
-F "chat_id=${TELEGRAM_CHAT}" \
|
|
-F "document=@${DEPLOY_LOG_FILE}" > /dev/null && rm -f ${DEPLOY_LOG_FILE}
|
|
' > /dev/null 2>&1 &
|
|
EOT
|
|
|
|
echo "New containers will be started after 5 seconds"
|