54 lines
1.6 KiB
YAML
54 lines
1.6 KiB
YAML
when:
|
|
- event: push
|
|
branch: main
|
|
|
|
steps:
|
|
- name: version
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache git
|
|
- GIT_REV="$(git rev-parse --short HEAD)"
|
|
- BUILD_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
|
|
- APP_V="$(cat version)"
|
|
- printf "GIT_REV=%s\nBUILD_BRANCH=%s\nAPP_V=%s\n" "$GIT_REV" "$BUILD_BRANCH" "$APP_V" | tee .env.version
|
|
|
|
- name: secrets
|
|
image: alpine:latest
|
|
depends_on: [ version ]
|
|
environment:
|
|
VAULT_ADDR: https://vault.sendico.io
|
|
VAULT_ROLE_ID: { from_secret: VAULT_APP_ROLE }
|
|
VAULT_SECRET_ID: { from_secret: VAULT_SECRET_ID }
|
|
commands:
|
|
- apk add --no-cache curl bash coreutils sed
|
|
- mkdir -p secrets
|
|
# fetch registry creds
|
|
- ./ci/vlt kv_to_file kv registry user secrets/REGISTRY_USER 600
|
|
- ./ci/vlt kv_to_file kv registry password secrets/REGISTRY_PASS 600
|
|
# fetch SSH private key for deploy
|
|
- ./ci/vlt kv_to_file kv ops/deploy/ssh_key private secrets/SSH_KEY 600
|
|
|
|
- name: lock-db
|
|
image: quay.io/skopeo/stable:latest
|
|
depends_on: [ secrets ]
|
|
environment:
|
|
REGISTRY_URL: registry.sendico.io
|
|
MONGO_VERSION: latest
|
|
commands:
|
|
- bash ci/prod/scripts/lock-db.sh
|
|
|
|
- name: deploy
|
|
image: alpine:latest
|
|
depends_on: [ lock-db ]
|
|
commands:
|
|
- |
|
|
set -euo
|
|
apk add --no-cache bash openssh-client rsync
|
|
set -a
|
|
. ./ci/prod/.env.runtime
|
|
. ./.env.version
|
|
set +a
|
|
mkdir -p /root/.ssh
|
|
install -m 600 secrets/SSH_KEY /root/.ssh/id_rsa
|
|
bash ci/prod/scripts/deploy-db.sh
|