82 lines
3.5 KiB
YAML
82 lines
3.5 KiB
YAML
name: Deploy storage stack
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: arch-latest
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
pacman -Syu --noconfirm nodejs openssh rsync
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Copy compose + init scripts
|
|
uses: easingthemes/ssh-deploy@v5.1.0
|
|
with:
|
|
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
REMOTE_HOST: ${{ secrets.DEPLOY_IP }}
|
|
REMOTE_USER: ${{ secrets.DEPLOY_USER }}
|
|
ARGS: "-rltgoDzvO --delete"
|
|
SOURCE: "docker-compose.yml garage.toml init"
|
|
TARGET: "/opt/storage/"
|
|
|
|
- name: Write .env from secrets and bring stack up
|
|
uses: appleboy/ssh-action@v1.2.3
|
|
env:
|
|
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
|
|
ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }}
|
|
ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }}
|
|
ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }}
|
|
BINGO_DB_PASSWORD: ${{ secrets.BINGO_DB_PASSWORD }}
|
|
BINGO_S3_ACCESS_KEY: ${{ secrets.BINGO_S3_ACCESS_KEY }}
|
|
BINGO_S3_SECRET_KEY: ${{ secrets.BINGO_S3_SECRET_KEY }}
|
|
PUBLIC_S3_ACCESS_KEY: ${{ secrets.PUBLIC_S3_ACCESS_KEY }}
|
|
PUBLIC_S3_SECRET_KEY: ${{ secrets.PUBLIC_S3_SECRET_KEY }}
|
|
with:
|
|
host: ${{ secrets.DEPLOY_IP }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
envs: POSTGRES_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY,PUBLIC_S3_ACCESS_KEY,PUBLIC_S3_SECRET_KEY
|
|
script_stop: true
|
|
script: |
|
|
umask 077
|
|
mkdir -p /opt/storage
|
|
cat > /opt/storage/.env <<EOF
|
|
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
ASXPIO_DB_PASSWORD=${ASXPIO_DB_PASSWORD}
|
|
ASXPIO_S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY}
|
|
ASXPIO_S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY}
|
|
BINGO_DB_PASSWORD=${BINGO_DB_PASSWORD}
|
|
BINGO_S3_ACCESS_KEY=${BINGO_S3_ACCESS_KEY}
|
|
BINGO_S3_SECRET_KEY=${BINGO_S3_SECRET_KEY}
|
|
PUBLIC_S3_ACCESS_KEY=${PUBLIC_S3_ACCESS_KEY}
|
|
PUBLIC_S3_SECRET_KEY=${PUBLIC_S3_SECRET_KEY}
|
|
EOF
|
|
chmod 600 /opt/storage/.env
|
|
chmod +x /opt/storage/init/postgres-init.sh /opt/storage/init/garage-bootstrap.sh
|
|
|
|
# Garage's RPC secret never leaves the host: made once, kept
|
|
# outside the rsynced paths.
|
|
mkdir -p /opt/storage/secrets
|
|
if [ ! -s /opt/storage/secrets/garage_rpc_secret ]; then
|
|
head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > /opt/storage/secrets/garage_rpc_secret
|
|
fi
|
|
chmod 600 /opt/storage/secrets/garage_rpc_secret
|
|
|
|
cd /opt/storage
|
|
docker compose pull
|
|
docker compose up -d --remove-orphans postgres garage
|
|
# Run the init steps (idempotent).
|
|
docker compose up --exit-code-from postgres-init postgres-init
|
|
ASXPIO_S3_ACCESS_KEY="${ASXPIO_S3_ACCESS_KEY}" ASXPIO_S3_SECRET_KEY="${ASXPIO_S3_SECRET_KEY}" \
|
|
BINGO_S3_ACCESS_KEY="${BINGO_S3_ACCESS_KEY}" BINGO_S3_SECRET_KEY="${BINGO_S3_SECRET_KEY}" \
|
|
PUBLIC_S3_ACCESS_KEY="${PUBLIC_S3_ACCESS_KEY}" PUBLIC_S3_SECRET_KEY="${PUBLIC_S3_SECRET_KEY}" \
|
|
sh init/garage-bootstrap.sh
|
|
|
|
echo "Storage stack deployed."
|