Sergei Poljanski
e9388c0b0d
All checks were successful
Deploy storage stack / deploy (push) Successful in 20s
Garage serves all three buckets and both apps, and a last comparison found nothing in MinIO that Garage lacks. Drop the MinIO service, its bootstrap and its root credentials from the deploy, and let compose remove the leftover containers. The storage_minio_data volume is left on the host. All images can be pulled again, so the deploy goes back to failing on a pull error. Document Garage in the README and SECRETS, including the key format and how the existing secrets map to it, and swap the MinIO client in the flake for awscli and rclone. Assisted-by: Claude:fable-5-2
82 lines
3.5 KiB
YAML
82 lines
3.5 KiB
YAML
name: Deploy storage stack
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: arch-latest
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
pacman -Syu --noconfirm nodejs openssh rsync
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Copy compose + init scripts
|
|
uses: easingthemes/ssh-deploy@v5.1.0
|
|
with:
|
|
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
REMOTE_HOST: ${{ secrets.DEPLOY_IP }}
|
|
REMOTE_USER: ${{ secrets.DEPLOY_USER }}
|
|
ARGS: "-rltgoDzvO --delete"
|
|
SOURCE: "docker-compose.yml garage.toml init"
|
|
TARGET: "/opt/storage/"
|
|
|
|
- name: Write .env from secrets and bring stack up
|
|
uses: appleboy/ssh-action@v1.2.3
|
|
env:
|
|
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
|
|
ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }}
|
|
ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }}
|
|
ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }}
|
|
BINGO_DB_PASSWORD: ${{ secrets.BINGO_DB_PASSWORD }}
|
|
BINGO_S3_ACCESS_KEY: ${{ secrets.BINGO_S3_ACCESS_KEY }}
|
|
BINGO_S3_SECRET_KEY: ${{ secrets.BINGO_S3_SECRET_KEY }}
|
|
PUBLIC_S3_ACCESS_KEY: ${{ secrets.PUBLIC_S3_ACCESS_KEY }}
|
|
PUBLIC_S3_SECRET_KEY: ${{ secrets.PUBLIC_S3_SECRET_KEY }}
|
|
with:
|
|
host: ${{ secrets.DEPLOY_IP }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
envs: POSTGRES_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY,PUBLIC_S3_ACCESS_KEY,PUBLIC_S3_SECRET_KEY
|
|
script_stop: true
|
|
script: |
|
|
umask 077
|
|
mkdir -p /opt/storage
|
|
cat > /opt/storage/.env <<EOF
|
|
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
ASXPIO_DB_PASSWORD=${ASXPIO_DB_PASSWORD}
|
|
ASXPIO_S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY}
|
|
ASXPIO_S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY}
|
|
BINGO_DB_PASSWORD=${BINGO_DB_PASSWORD}
|
|
BINGO_S3_ACCESS_KEY=${BINGO_S3_ACCESS_KEY}
|
|
BINGO_S3_SECRET_KEY=${BINGO_S3_SECRET_KEY}
|
|
PUBLIC_S3_ACCESS_KEY=${PUBLIC_S3_ACCESS_KEY}
|
|
PUBLIC_S3_SECRET_KEY=${PUBLIC_S3_SECRET_KEY}
|
|
EOF
|
|
chmod 600 /opt/storage/.env
|
|
chmod +x /opt/storage/init/postgres-init.sh /opt/storage/init/garage-bootstrap.sh
|
|
|
|
# Garage's RPC secret never leaves the host: made once, kept
|
|
# outside the rsynced paths.
|
|
mkdir -p /opt/storage/secrets
|
|
if [ ! -s /opt/storage/secrets/garage_rpc_secret ]; then
|
|
head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > /opt/storage/secrets/garage_rpc_secret
|
|
fi
|
|
chmod 600 /opt/storage/secrets/garage_rpc_secret
|
|
|
|
cd /opt/storage
|
|
docker compose pull
|
|
docker compose up -d --remove-orphans postgres garage
|
|
# Run the init steps (idempotent).
|
|
docker compose up --exit-code-from postgres-init postgres-init
|
|
ASXPIO_S3_ACCESS_KEY="${ASXPIO_S3_ACCESS_KEY}" ASXPIO_S3_SECRET_KEY="${ASXPIO_S3_SECRET_KEY}" \
|
|
BINGO_S3_ACCESS_KEY="${BINGO_S3_ACCESS_KEY}" BINGO_S3_SECRET_KEY="${BINGO_S3_SECRET_KEY}" \
|
|
PUBLIC_S3_ACCESS_KEY="${PUBLIC_S3_ACCESS_KEY}" PUBLIC_S3_SECRET_KEY="${PUBLIC_S3_SECRET_KEY}" \
|
|
sh init/garage-bootstrap.sh
|
|
|
|
echo "Storage stack deployed."
|