84 lines
3.1 KiB
YAML
84 lines
3.1 KiB
YAML
# Build the site image and push it to this Gitea instance's container
|
|
# registry. Registry host and owner come from the instance itself, so the
|
|
# same file works on the home Gitea and the VPS Gitea without edits.
|
|
#
|
|
# Needs one repo secret: REGISTRY_TOKEN, a personal access token for the
|
|
# repo owner with package read/write scope.
|
|
|
|
name: Build image
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: debian
|
|
env:
|
|
SERVER_URL: ${{ gitea.server_url }}
|
|
OWNER: ${{ gitea.repository_owner }}
|
|
REPO: ${{ gitea.repository }}
|
|
SHA: ${{ gitea.sha }}
|
|
steps:
|
|
# Trust the home CA when one is configured: instance variable HOME_CA
|
|
# holds the root cert as PEM. Leave it unset on hosts with a public
|
|
# cert (the VPS) and this step is skipped.
|
|
- name: Trust home CA
|
|
if: ${{ vars.HOME_CA != '' }}
|
|
env:
|
|
HOME_CA: ${{ vars.HOME_CA }}
|
|
run: |
|
|
printf '%s\n' "$HOME_CA" > /usr/local/share/ca-certificates/home-ca.crt
|
|
update-ca-certificates
|
|
|
|
- uses: actions/checkout@v4
|
|
env:
|
|
NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
|
|
|
|
# node:24-trixie (Debian 13) has git and node but no Docker CLI. Install
|
|
# the CLI and buildx from Docker's apt repo; the daemon is the runner's.
|
|
- name: Install Docker CLI
|
|
run: |
|
|
install -m 0755 -d /etc/apt/keyrings
|
|
curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
|
|
chmod a+r /etc/apt/keyrings/docker.asc
|
|
cat > /etc/apt/sources.list.d/docker.sources <<SRC
|
|
Types: deb
|
|
URIs: https://download.docker.com/linux/debian
|
|
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
|
|
Components: stable
|
|
Signed-By: /etc/apt/keyrings/docker.asc
|
|
SRC
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends docker-ce-cli docker-buildx-plugin
|
|
|
|
- name: Log in to registry
|
|
run: |
|
|
REGISTRY="${SERVER_URL#https://}"
|
|
echo "REGISTRY=$REGISTRY" >> "$GITHUB_ENV"
|
|
echo "IMAGE=$REGISTRY/${REPO,,}" >> "$GITHUB_ENV"
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login "$REGISTRY" -u "$OWNER" --password-stdin
|
|
|
|
- name: Build
|
|
run: docker build -t "$IMAGE:latest" -t "$IMAGE:${SHA::12}" .
|
|
|
|
- name: Push
|
|
run: docker push --all-tags "$IMAGE"
|
|
|
|
# Redeploy on the Docker host. The key's forced command on the host
|
|
# only accepts allowlisted site names, so this can't run anything else.
|
|
# Skipped when DEPLOY_HOST isn't set.
|
|
- name: Deploy
|
|
if: ${{ vars.DEPLOY_HOST != '' }}
|
|
env:
|
|
DEPLOY_HOST: ${{ vars.DEPLOY_HOST }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ vars.DEPLOY_KNOWN_HOSTS }}
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
install -m 700 -d ~/.ssh
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=yes "root@$DEPLOY_HOST" theoldfitz
|