64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
when:
|
|
- event: push
|
|
branch: main
|
|
|
|
steps:
|
|
- name: version
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache git
|
|
- GIT_REV="$(git rev-parse --short HEAD)"
|
|
- BUILD_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
|
|
- APP_V="$(cat version)"
|
|
- printf "GIT_REV=%s\nBUILD_BRANCH=%s\nAPP_V=%s\n" "$GIT_REV" "$BUILD_BRANCH" "$APP_V" | tee .env.version
|
|
|
|
- name: secrets
|
|
image: alpine:latest
|
|
depends_on: [ version ]
|
|
environment:
|
|
VAULT_ADDR: https://vault.sendico.io
|
|
VAULT_ROLE_ID: { from_secret: VAULT_APP_ROLE }
|
|
VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
|
|
commands:
|
|
- apk add --no-cache curl bash coreutils sed python3 openssh-keygen
|
|
- mkdir -p secrets
|
|
# fetch SSH private key for deploy (base64-encoded) and decode
|
|
- ./ci/vlt kv_to_file kv ops/deploy/ssh_key private_b64 secrets/SSH_KEY.b64 600
|
|
- base64 -d secrets/SSH_KEY.b64 > secrets/SSH_KEY
|
|
- chmod 600 secrets/SSH_KEY
|
|
- ssh-keygen -y -f secrets/SSH_KEY >/dev/null
|
|
|
|
- name: deploy
|
|
image: alpine:latest
|
|
depends_on: [ secrets ]
|
|
commands:
|
|
- set -euo pipefail
|
|
- apk add --no-cache bash openssh-client rsync coreutils
|
|
- set -a
|
|
- . ./ci/prod/.env.runtime
|
|
- . ./.env.version
|
|
- set +a
|
|
- mkdir -p /root/.ssh
|
|
- install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
|
|
- SSH_OPTS='-i /root/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -vv'
|
|
- REMOTE_DIR="${REMOTE_BASE%/}/${DB_DIR}"
|
|
- REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
|
|
# sync
|
|
- ssh $SSH_OPTS "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
|
|
- rsync -avz --delete -e "ssh $SSH_OPTS" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
|
|
- rsync -avz -e "ssh $SSH_OPTS" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
|
|
# deploy on remote via heredoc
|
|
- |
|
|
ssh $SSH_OPTS "$REMOTE_TARGET" REMOTE_DIR="$REMOTE_DIR" bash -s <<'EOSSH'
|
|
set -Eeuxo pipefail
|
|
cd "${REMOTE_DIR}/compose"
|
|
set -a
|
|
. ../env/.env.runtime
|
|
set +a
|
|
docker compose -f db.yml pull
|
|
docker compose -f db.yml up -d --remove-orphans
|
|
docker compose ps
|
|
date -Is | tee .last_deploy
|
|
logger -t deploy-db "db deployed at $(date -Is) in ${REMOTE_DIR}"
|
|
EOSSH
|