3f63e84cd6
All checks were successful
Deploy Indiekit Server / deploy (push) Successful in 1m11s
Runner is on the internal network — connecting to the public domain fails due to hairpin NAT, same as the syndication webhook. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
name: Deploy Indiekit Server
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: freebsd
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Deploy to node jail
|
|
run: |
|
|
set -eu
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
|
|
chmod 600 ~/.ssh/id_rsa
|
|
ssh-keyscan -p ${{ secrets.SSH_PORT }} 10.100.0.1 >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
ssh -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_USER }}@10.100.0.1 << SSHEOF
|
|
set -eu
|
|
restart_log=/tmp/indiekit-restart.log
|
|
|
|
# Update code as indiekit user; point remote at internal Gitea (no auth needed — public read).
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && git remote set-url origin http://10.100.0.90:3000/giersig.eu/indiekit-server.git && git fetch origin && git reset --hard origin/main"'
|
|
|
|
# Install dependencies (postinstall runs all patches automatically).
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && npm ci --legacy-peer-deps"'
|
|
|
|
# Ensure env file and required secrets are present.
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && test -f .env"'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && grep -Eq \"^SECRET=.+\" .env || { echo \"Missing SECRET in .env\"; exit 1; }"'
|
|
|
|
# Preflight checks before touching the running service.
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-production-security.mjs"'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-mongo-connection.mjs"'
|
|
|
|
# Restart asynchronously to avoid the SSH session hanging on open stdout.
|
|
sudo bastille cmd node sh -lc "nohup service indiekit restart >\${restart_log} 2>&1 </dev/null &"
|
|
|
|
# Wait for service to come up.
|
|
attempts=0
|
|
while [ \$attempts -lt 30 ]; do
|
|
if sudo bastille cmd node sh -lc 'service indiekit onestatus >/dev/null 2>&1'; then
|
|
echo "IndieKit is running."
|
|
exit 0
|
|
fi
|
|
attempts=\$((attempts + 1))
|
|
sleep 2
|
|
done
|
|
|
|
echo "IndieKit failed to start."
|
|
sudo bastille cmd node sh -lc "tail -n 120 \${restart_log} || true"
|
|
sudo bastille cmd node sh -lc 'service indiekit onestatus || true'
|
|
exit 1
|
|
SSHEOF
|