Sergei Poljanski
dc04ff3cce
All checks were successful
Deploy storage stack / deploy (push) Successful in 25s
MinIO is abandoned upstream and its images are gone from the registries, so the object store cannot be rebuilt or updated. Garage takes its place. This is the first step: Garage runs as one node next to MinIO, with the same three buckets and one key per app, and is not routed yet. MinIO keeps serving s3.asxp.io and is no longer bootstrapped, so its users stay as they are until the data is copied and the apps are switched. Garage only accepts keys in its own format. The bootstrap hashes the existing secrets into that format, as the apps' deploys will, so no secret has to change for the move; a secret already in Garage's format is used as it is. Garage has no anonymous S3 access. The public bucket is marked as a website instead, to be served through Garage's web endpoint. Assisted-by: Claude:fable-5-2
88 lines
3.9 KiB
YAML
88 lines
3.9 KiB
YAML
name: Deploy storage stack
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: arch-latest
|
|
steps:
|
|
- name: Install dependencies
|
|
run: |
|
|
pacman -Syu --noconfirm nodejs openssh rsync
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Copy compose + init scripts
|
|
uses: easingthemes/ssh-deploy@v5.1.0
|
|
with:
|
|
SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
REMOTE_HOST: ${{ secrets.DEPLOY_IP }}
|
|
REMOTE_USER: ${{ secrets.DEPLOY_USER }}
|
|
ARGS: "-rltgoDzvO --delete"
|
|
SOURCE: "docker-compose.yml garage.toml init"
|
|
TARGET: "/opt/storage/"
|
|
|
|
- name: Write .env from secrets and bring stack up
|
|
uses: appleboy/ssh-action@v1.2.3
|
|
env:
|
|
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
|
|
MINIO_ROOT_USER: ${{ secrets.MINIO_ROOT_USER }}
|
|
MINIO_ROOT_PASSWORD: ${{ secrets.MINIO_ROOT_PASSWORD }}
|
|
ASXPIO_DB_PASSWORD: ${{ secrets.ASXPIO_DB_PASSWORD }}
|
|
ASXPIO_S3_ACCESS_KEY: ${{ secrets.ASXPIO_S3_ACCESS_KEY }}
|
|
ASXPIO_S3_SECRET_KEY: ${{ secrets.ASXPIO_S3_SECRET_KEY }}
|
|
BINGO_DB_PASSWORD: ${{ secrets.BINGO_DB_PASSWORD }}
|
|
BINGO_S3_ACCESS_KEY: ${{ secrets.BINGO_S3_ACCESS_KEY }}
|
|
BINGO_S3_SECRET_KEY: ${{ secrets.BINGO_S3_SECRET_KEY }}
|
|
PUBLIC_S3_ACCESS_KEY: ${{ secrets.PUBLIC_S3_ACCESS_KEY }}
|
|
PUBLIC_S3_SECRET_KEY: ${{ secrets.PUBLIC_S3_SECRET_KEY }}
|
|
with:
|
|
host: ${{ secrets.DEPLOY_IP }}
|
|
username: ${{ secrets.DEPLOY_USER }}
|
|
key: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
envs: POSTGRES_PASSWORD,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY,PUBLIC_S3_ACCESS_KEY,PUBLIC_S3_SECRET_KEY
|
|
script_stop: true
|
|
script: |
|
|
umask 077
|
|
mkdir -p /opt/storage
|
|
cat > /opt/storage/.env <<EOF
|
|
POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
|
|
MINIO_ROOT_USER=${MINIO_ROOT_USER}
|
|
MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD}
|
|
ASXPIO_DB_PASSWORD=${ASXPIO_DB_PASSWORD}
|
|
ASXPIO_S3_ACCESS_KEY=${ASXPIO_S3_ACCESS_KEY}
|
|
ASXPIO_S3_SECRET_KEY=${ASXPIO_S3_SECRET_KEY}
|
|
BINGO_DB_PASSWORD=${BINGO_DB_PASSWORD}
|
|
BINGO_S3_ACCESS_KEY=${BINGO_S3_ACCESS_KEY}
|
|
BINGO_S3_SECRET_KEY=${BINGO_S3_SECRET_KEY}
|
|
PUBLIC_S3_ACCESS_KEY=${PUBLIC_S3_ACCESS_KEY}
|
|
PUBLIC_S3_SECRET_KEY=${PUBLIC_S3_SECRET_KEY}
|
|
EOF
|
|
chmod 600 /opt/storage/.env
|
|
chmod +x /opt/storage/init/postgres-init.sh /opt/storage/init/garage-bootstrap.sh
|
|
|
|
# Garage's RPC secret never leaves the host: made once, kept
|
|
# outside the rsynced paths.
|
|
mkdir -p /opt/storage/secrets
|
|
if [ ! -s /opt/storage/secrets/garage_rpc_secret ]; then
|
|
head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n' > /opt/storage/secrets/garage_rpc_secret
|
|
fi
|
|
chmod 600 /opt/storage/secrets/garage_rpc_secret
|
|
|
|
cd /opt/storage
|
|
# minio/minio and minio/mc are gone from Docker Hub (upstream
|
|
# abandoned); the host's cached copies are all there is.
|
|
docker compose pull --ignore-pull-failures
|
|
docker compose up -d postgres minio garage
|
|
# Run the init steps (idempotent).
|
|
docker compose up --exit-code-from postgres-init postgres-init
|
|
ASXPIO_S3_ACCESS_KEY="${ASXPIO_S3_ACCESS_KEY}" ASXPIO_S3_SECRET_KEY="${ASXPIO_S3_SECRET_KEY}" \
|
|
BINGO_S3_ACCESS_KEY="${BINGO_S3_ACCESS_KEY}" BINGO_S3_SECRET_KEY="${BINGO_S3_SECRET_KEY}" \
|
|
PUBLIC_S3_ACCESS_KEY="${PUBLIC_S3_ACCESS_KEY}" PUBLIC_S3_SECRET_KEY="${PUBLIC_S3_SECRET_KEY}" \
|
|
sh init/garage-bootstrap.sh
|
|
|
|
echo "Storage stack deployed."
|