Sergei Poljanski
63bd67a86d
Service changes were made by hand on the servers, which is how the repository drifted. Apply site.yaml from a workflow instead: every push dry-runs it against production, and a push to main applies it. Jobs run in containers on asxpio-services. asxpio-ops is reached over the private network; the services host is reached through asxpio-ops, because a container connecting to its own host arrives from a Docker bridge address that sshd and the firewall refuse. Host keys are pinned in known_hosts. Ansible comes from a pinned nixpkgs revision so every run uses the same version. Assisted-by: Claude:fable-5-2
61 lines
2 KiB
YAML
61 lines
2 KiB
YAML
name: deploy
|
|
|
|
# main: dry run, then apply ansible/site.yaml to both servers
|
|
# other branches: dry run only
|
|
#
|
|
# Secrets: SSH_DEPLOY_KEY (user deploy on both servers) and
|
|
# ANSIBLE_VAULT_PASSWORD (decrypts inventory/group_vars/all/vault.yaml).
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'ansible/**'
|
|
- '.forgejo/workflows/deploy.yaml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
ansible:
|
|
runs-on: nix-latest
|
|
env:
|
|
NIX_CONFIG: |
|
|
experimental-features = nix-command flakes
|
|
build-users-group =
|
|
sandbox = false
|
|
# Pinned so CI runs the same Ansible on every run
|
|
NIXPKGS: github:NixOS/nixpkgs/0bb2eedc20e4739f29e8045034f2828ad7054f8f
|
|
ANSIBLE_HOST_KEY_CHECKING: "True"
|
|
ANSIBLE_FORCE_COLOR: "1"
|
|
steps:
|
|
- name: Prepare container for actions
|
|
run: nix-env -iA nixpkgs.nodejs_22
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up credentials
|
|
env:
|
|
SSH_DEPLOY_KEY: ${{ secrets.SSH_DEPLOY_KEY }}
|
|
ANSIBLE_VAULT_PASSWORD: ${{ secrets.ANSIBLE_VAULT_PASSWORD }}
|
|
run: |
|
|
if [ -z "$SSH_DEPLOY_KEY" ] || [ -z "$ANSIBLE_VAULT_PASSWORD" ]; then
|
|
echo "SSH_DEPLOY_KEY and ANSIBLE_VAULT_PASSWORD must be set as repository secrets" >&2
|
|
exit 1
|
|
fi
|
|
umask 077
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$SSH_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
cp ansible/known_hosts ~/.ssh/known_hosts
|
|
printf '%s\n' "$ANSIBLE_VAULT_PASSWORD" > ansible/.vault_pass
|
|
|
|
- name: Dry run
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml --check
|
|
|
|
- name: Apply
|
|
if: github.ref == 'refs/heads/main'
|
|
working-directory: ansible
|
|
run: nix shell "$NIXPKGS#ansible" "$NIXPKGS#openssh" -c ansible-playbook -i inventory/ci.yaml site.yaml
|
|
|
|
- name: Remove credentials
|
|
if: always()
|
|
run: rm -f ~/.ssh/id_ed25519 ansible/.vault_pass
|