288 lines
13 KiB
YAML
288 lines
13 KiB
YAML
name: "platform-deploy"
|
|
description: "Build & deploy a dev project (static / docker / docker-db) onto the platform"
|
|
inputs:
|
|
repo:
|
|
description: "owner/repo"
|
|
required: true
|
|
ref:
|
|
description: "branch name"
|
|
required: true
|
|
sha:
|
|
description: "commit sha"
|
|
required: false
|
|
default: ""
|
|
token:
|
|
description: "forge token for checkout"
|
|
required: true
|
|
secrets_json:
|
|
description: "toJSON(secrets)"
|
|
required: false
|
|
default: "{}"
|
|
vars_json:
|
|
description: "toJSON(vars)"
|
|
required: false
|
|
default: "{}"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- shell: sh
|
|
env:
|
|
IN_REPO: ${{ inputs.repo }}
|
|
IN_REF: ${{ inputs.ref }}
|
|
IN_SHA: ${{ inputs.sha }}
|
|
IN_TOKEN: ${{ inputs.token }}
|
|
SJSON: ${{ inputs.secrets_json }}
|
|
VJSON: ${{ inputs.vars_json }}
|
|
run: |
|
|
set -eu
|
|
FORGE_HOST="git.extract.team"
|
|
OUR_IP="51.161.128.94"
|
|
|
|
echo "::group::setup"
|
|
# platform-ci-base bakes in git/jq/dig/rsync/bun — skip apk on the fast path,
|
|
# fall back to installing only if a tool is missing (e.g. stock docker:24 image).
|
|
command -v git >/dev/null 2>&1 && command -v jq >/dev/null 2>&1 && command -v dig >/dev/null 2>&1 \
|
|
|| apk add --no-cache git jq bind-tools rsync >/dev/null 2>&1 || true
|
|
REPO="$IN_REPO"; REF="$IN_REF"; SHA="${IN_SHA:-manual}"
|
|
SLUG=$(printf '%s' "$REPO" | tr 'A-Z/' 'a-z-')
|
|
FRAG="/srv/platform/caddy/sites/${SLUG}.caddy"
|
|
echo "repo=$REPO ref=$REF slug=$SLUG"
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::checkout"
|
|
rm -rf /tmp/repo
|
|
git clone --depth 1 -b "$REF" \
|
|
"https://x-access-token:${IN_TOKEN}@${FORGE_HOST}/${REPO}.git" /tmp/repo
|
|
cd /tmp/repo
|
|
[ -f package.json ] || { echo "::error::no package.json in repo root"; exit 1; }
|
|
[ -f .env ] || { echo "::error::no .env in repo root (need DOMAIN=...)"; exit 1; }
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::parse .env"
|
|
: > /tmp/envp
|
|
while IFS='=' read -r k v; do
|
|
case "$k" in ''|\#*) continue ;; esac
|
|
v=$(printf '%s' "$v" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//' \
|
|
-e 's/^"\(.*\)"$/\1/' -e "s/^'\(.*\)'$/\1/")
|
|
printf '%s=%s\n' "$k" "$v" >> /tmp/envp
|
|
done < .env
|
|
set -a; . /tmp/envp; set +a
|
|
echo "::endgroup::"
|
|
|
|
# ---- kill-switch: repo variable ENABLED overrides .env ----
|
|
ADMIN_ENABLED=$(printf '%s' "$VJSON" | jq -r '.ENABLED // empty')
|
|
EN="${ENABLED:-true}"; [ -n "$ADMIN_ENABLED" ] && EN="$ADMIN_ENABLED"
|
|
DOMAIN="${DOMAIN:-}"
|
|
|
|
reload_caddy() {
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile
|
|
}
|
|
write_fragment() { # $1 = new content
|
|
NEW="$1"
|
|
if [ -f "$FRAG" ] && [ "$(cat "$FRAG")" = "$NEW" ]; then
|
|
echo " caddy fragment unchanged; no reload"; return 0
|
|
fi
|
|
PREV=""; [ -f "$FRAG" ] && PREV=$(cat "$FRAG")
|
|
printf '%s' "$NEW" > "$FRAG"
|
|
if reload_caddy; then
|
|
echo " caddy reloaded ($FRAG)"
|
|
else
|
|
echo "::error::caddy reload failed — reverting fragment"
|
|
if [ -n "$PREV" ]; then printf '%s' "$PREV" > "$FRAG"; else rm -f "$FRAG"; fi
|
|
reload_caddy || true
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# ---- disabled path ----
|
|
if [ "$EN" = "false" ]; then
|
|
echo "🛑 ENABLED=false → tearing down $SLUG"
|
|
docker rm -f "$SLUG" >/dev/null 2>&1 && echo " container removed" || echo " no container"
|
|
[ -n "$DOMAIN" ] && rm -rf "/srv/sites/${DOMAIN}"
|
|
rm -f "/srv/platform/caddy/sites/${SLUG}-get.caddy" 2>/dev/null || true # install subdomain, if any
|
|
[ -f "$FRAG" ] && rm -f "$FRAG"
|
|
reload_caddy || true; echo " fragment(s) removed + caddy reloaded"
|
|
echo "✅ $SLUG disabled (404)"
|
|
exit 0
|
|
fi
|
|
|
|
[ -n "$DOMAIN" ] || { echo "::error::DOMAIN not set in .env"; exit 1; }
|
|
|
|
# ---- deploy type ----
|
|
DT="${DEPLOY:-}"
|
|
if [ -z "$DT" ]; then
|
|
if [ -f Dockerfile ]; then DT=docker; else DT=static; fi
|
|
fi
|
|
BUILD_DIR="${BUILD_DIR:-dist}"
|
|
APP_PORT="${APP_PORT:-80}"
|
|
echo "deploy_type=$DT domain=$DOMAIN build_dir=$BUILD_DIR"
|
|
|
|
# ---- DNS sanity (warn only) ----
|
|
if ! dig +short A "$DOMAIN" 2>/dev/null | grep -q "$OUR_IP"; then
|
|
echo "::warning::$DOMAIN does not resolve to $OUR_IP yet — TLS issuance will retry once DNS is set"
|
|
fi
|
|
|
|
# ---- auto-www ----
|
|
SITE_ADDR="$DOMAIN"; ALT=""
|
|
WWW_MODE="${WWW:-auto}"
|
|
if [ "$WWW_MODE" != "false" ]; then
|
|
case "$DOMAIN" in
|
|
www.*) CAND="${DOMAIN#www.}" ;;
|
|
*.*.*) CAND="" ;;
|
|
*.*) CAND="www.${DOMAIN}" ;;
|
|
*) CAND="" ;;
|
|
esac
|
|
if [ -n "$CAND" ] && dig +short A "$CAND" 2>/dev/null | grep -q "$OUR_IP"; then
|
|
ALT="$CAND"; SITE_ADDR="$DOMAIN, $CAND"; echo " auto-www: + $CAND"
|
|
elif [ -n "$CAND" ]; then
|
|
echo " auto-www: $CAND has no A→$OUR_IP, serving $DOMAIN only"
|
|
fi
|
|
fi
|
|
|
|
# ---- extra domains (EXTRA_DOMAINS=alias1.com,alias2.com in .env) ----
|
|
# Serve the SAME site on additional domains, each with its own auto-TLS cert.
|
|
# Point each domain's A-record at the platform IP. www is NOT auto-added for
|
|
# extras — list "www.alias.com" explicitly if you want it.
|
|
if [ -n "${EXTRA_DOMAINS:-}" ]; then
|
|
OLDIFS=$IFS; IFS=', '
|
|
for ed in ${EXTRA_DOMAINS}; do
|
|
[ -z "$ed" ] && continue
|
|
SITE_ADDR="$SITE_ADDR, $ed"
|
|
echo " extra domain: + $ed"
|
|
dig +short A "$ed" 2>/dev/null | grep -q "$OUR_IP" \
|
|
|| echo "::warning::$ed has no A→$OUR_IP yet — add the DNS record; TLS issues once it resolves"
|
|
done
|
|
IFS=$OLDIFS
|
|
fi
|
|
|
|
# ---- domain collision pre-check: clear error instead of a raw caddy
|
|
# "ambiguous site definition" when another deploy already serves this domain ----
|
|
for dom in $(printf '%s' "$SITE_ADDR" | tr ',' ' '); do
|
|
for frag in /srv/platform/caddy/sites/*.caddy; do
|
|
[ -f "$frag" ] || continue
|
|
base=$(basename "$frag")
|
|
{ [ "$base" = "${SLUG}.caddy" ] || [ "$base" = "_platform.caddy" ]; } && continue
|
|
for a in $(sed -n '1,/{/p' "$frag" | tr -d '{' | tr ',' ' '); do
|
|
if [ "$a" = "$dom" ]; then
|
|
echo "::error::domain '$dom' is already served by another deploy ($base). Change DOMAIN in your .env, or ask the admin to free it (remove $base)."
|
|
exit 1
|
|
fi
|
|
done
|
|
done
|
|
done
|
|
|
|
case "$DT" in
|
|
static)
|
|
# build IN-PLACE — the job runs on platform-ci-base which has bun, so no
|
|
# throwaway helper + docker-cp round-trip. (Trade-off: the dev's build runs
|
|
# in the privileged job container; consistent with the Phase-6 socket-accepted
|
|
# model. Revert to the sandboxed helper if that matters more than ~3s.)
|
|
echo "::group::build (bun, in-place)"
|
|
cd /tmp/repo
|
|
if [ -f bun.lock ] || [ -f bun.lockb ]; then bun install --frozen-lockfile; else bun install; fi
|
|
bun run build
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::publish static → /srv/sites/$DOMAIN"
|
|
[ -d "/tmp/repo/${BUILD_DIR}" ] || { echo "::error::build output '${BUILD_DIR}' not found"; exit 1; }
|
|
TMP="/srv/sites/.tmp-${SLUG}-${SHA}"
|
|
rm -rf "$TMP"; mkdir -p "$TMP"
|
|
cp -a "/tmp/repo/${BUILD_DIR}/." "$TMP/"
|
|
rm -rf "/srv/sites/${DOMAIN}"; mv "$TMP" "/srv/sites/${DOMAIN}"
|
|
echo " $(find "/srv/sites/${DOMAIN}" -type f | wc -l) files published"
|
|
echo "::endgroup::"
|
|
|
|
write_fragment "$(printf '%s {\n\timport accesslog\n\troot * /srv/sites/%s\n\tfile_server\n\ttry_files {path} /index.html\n}\n' "$SITE_ADDR" "$DOMAIN")"
|
|
|
|
# Remove any prior container LAST — zero-downtime: a pre-existing
|
|
# container kept serving the domain (via its old fragment) all through
|
|
# the build above, until the file_server fragment took over just now.
|
|
docker rm -f "$SLUG" >/dev/null 2>&1 && echo " removed old container (switched to static)" || true
|
|
;;
|
|
|
|
docker|docker-db)
|
|
rm -rf "/srv/sites/${DOMAIN}" # in case it was previously a static deploy
|
|
[ -f Dockerfile ] || { echo "::error::DEPLOY=$DT needs a Dockerfile in repo root"; exit 1; }
|
|
echo "::group::docker build"
|
|
IMG="platform/${SLUG}:${SHA}"
|
|
# BuildKit ON: enables --mount=type=cache in the repo's Dockerfile and
|
|
# layer reuse from the previous :latest (inline cache) → fast rebuilds when
|
|
# deps/layers are unchanged. First build of a repo just misses the cache.
|
|
DOCKER_BUILDKIT=1 docker build \
|
|
--cache-from "platform/${SLUG}:latest" \
|
|
--build-arg BUILDKIT_INLINE_CACHE=1 \
|
|
-t "$IMG" -t "platform/${SLUG}:latest" /tmp/repo
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::run container"
|
|
# Everything in .env (except platform-control keys) is passed straight into
|
|
# the container as env vars — the dev keeps config in .env and just pushes,
|
|
# nothing to set up by hand. Forgejo Actions secrets via RUNTIME_KEYS still
|
|
# work and are layered on top (and override .env on name clash).
|
|
RTENV="/tmp/runtime.env"; : > "$RTENV"
|
|
CTRL=" DOMAIN DEPLOY BUILD_DIR APP_PORT WWW EXTRA_DOMAINS TWITTER TWITTER_URL X INSTALL_SH RUNTIME_KEYS ENABLED "
|
|
while IFS='=' read -r k v; do
|
|
[ -z "$k" ] && continue
|
|
case "$CTRL" in *" $k "*) continue ;; esac
|
|
printf '%s=%s\n' "$k" "$v" >> "$RTENV"
|
|
done < /tmp/envp
|
|
RK="${RUNTIME_KEYS:-}"
|
|
OLDIFS=$IFS; IFS=', '
|
|
for key in $RK; do
|
|
[ -z "$key" ] && continue
|
|
val=$(printf '%s' "$SJSON" | jq -r --arg k "$key" '.[$k] // empty')
|
|
if [ -n "$val" ]; then printf '%s=%s\n' "$key" "$val" >> "$RTENV"; echo " + secret from Forgejo: $key"; fi
|
|
done
|
|
IFS=$OLDIFS
|
|
echo " + $(grep -c . "$RTENV" || echo 0) env vars into container (from .env)"
|
|
set -- --name "$SLUG" --network sites --restart unless-stopped --env-file "$RTENV" \
|
|
--label "platform.project=${REPO}" --label "platform.slug=${SLUG}" --label "platform.domain=${DOMAIN}"
|
|
if [ "$DT" = "docker-db" ]; then
|
|
printf '%s\n' "DATABASE_URL=file:/data/app.db" >> "$RTENV"
|
|
set -- "$@" -v "${SLUG}-data:/data"
|
|
echo " + sqlite volume ${SLUG}-data, DATABASE_URL=file:/data/app.db"
|
|
fi
|
|
docker rm -f "$SLUG" >/dev/null 2>&1 || true
|
|
docker run -d "$@" "$IMG" >/dev/null
|
|
rm -f "$RTENV"
|
|
echo " container $SLUG up → port $APP_PORT"
|
|
echo "::endgroup::"
|
|
|
|
write_fragment "$(printf '%s {\n\timport accesslog\n\treverse_proxy %s:%s\n}\n' "$SITE_ADDR" "$SLUG" "$APP_PORT")"
|
|
;;
|
|
*)
|
|
echo "::error::unknown DEPLOY=$DT (use static | docker | docker-db)"; exit 1 ;;
|
|
esac
|
|
|
|
# ---- install subdomain (curl get.<domain> | sh) — static OR docker ----
|
|
# Opt in via .env INSTALL_SH=<file> (looked up in the repo at root or public/).
|
|
# The file is copied to a tiny dir and served as text/plain at get.<domain>,
|
|
# regardless of deploy type. Unset INSTALL_SH → the subdomain is removed.
|
|
# Dev adds the DNS A-record get.<domain> → our IP themselves.
|
|
GFRAG="/srv/platform/caddy/sites/${SLUG}-get.caddy"
|
|
GDIR="/srv/sites/.get-${SLUG}"
|
|
if [ -n "${INSTALL_SH:-}" ]; then
|
|
GDOM="get.${DOMAIN}"; GFILE=$(basename "$INSTALL_SH")
|
|
SRC=""
|
|
for cand in "/tmp/repo/${INSTALL_SH}" "/tmp/repo/public/${INSTALL_SH}"; do
|
|
[ -f "$cand" ] && { SRC="$cand"; break; }
|
|
done
|
|
rm -rf "$GDIR"; mkdir -p "$GDIR"
|
|
if [ -n "$SRC" ]; then cp "$SRC" "$GDIR/$GFILE"
|
|
else echo "::warning::${INSTALL_SH} not found in repo (root or public/) — ${GDOM} will 404"; fi
|
|
dig +short A "$GDOM" 2>/dev/null | grep -q "$OUR_IP" \
|
|
|| echo "::warning::no A record ${GDOM} → ${OUR_IP} yet — add it; TLS issues once it resolves"
|
|
GNEW=$(printf '%s {\n\troot * %s\n\trewrite * /%s\n\theader Content-Type text/plain\n\tfile_server\n}\n' "$GDOM" "$GDIR" "$GFILE")
|
|
if [ ! -f "$GFRAG" ] || [ "$(cat "$GFRAG")" != "$GNEW" ]; then
|
|
printf '%s' "$GNEW" > "$GFRAG"
|
|
reload_caddy && echo " install subdomain → https://${GDOM}" \
|
|
|| { echo "::error::caddy reload failed for $GFRAG"; rm -f "$GFRAG"; reload_caddy || true; }
|
|
else
|
|
echo " install subdomain fragment unchanged"
|
|
fi
|
|
elif [ -f "$GFRAG" ]; then
|
|
rm -f "$GFRAG"; rm -rf "$GDIR"; reload_caddy || true; echo " install subdomain removed (INSTALL_SH unset)"
|
|
fi
|
|
|
|
echo "✅ deployed https://${DOMAIN}${ALT:+ + https://$ALT}"
|