d3fb055df4
Addresses Node.js 20 deprecation warning in GitHub Actions runners. actions/checkout and actions/setup-node v4 use Node.js 24-compatible runtimes, ahead of the June 2026 forced migration. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
87 lines
4.0 KiB
YAML
87 lines
4.0 KiB
YAML
name: Deploy Indiekit Blog
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '18'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --legacy-peer-deps
|
|
|
|
- name: Build (if needed)
|
|
run: |
|
|
# Add build steps if your project requires them
|
|
echo "No build step required"
|
|
|
|
- name: Deploy to FreeBSD host and jail
|
|
uses: appleboy/ssh-action@v0.1.10
|
|
with:
|
|
host: ${{ secrets.FREEBSD_HOST }}
|
|
username: ${{ secrets.FREEBSD_DEPLOY_USER }}
|
|
key: ${{ secrets.FREEBSD_DEPLOY_SSH_KEY }}
|
|
port: 222
|
|
script: |
|
|
set -eu
|
|
restart_log=/tmp/indiekit-restart.log
|
|
|
|
# Update code and dependencies as indiekit user inside the jail.
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && git fetch origin && git reset --hard origin/main && npm ci --legacy-peer-deps && install -m 755 start.example.sh start.sh"'
|
|
|
|
# sharp/libvips are managed manually on the server.
|
|
|
|
# Verify and re-apply patches in case postinstall was skipped (e.g. npm ci --ignore-scripts).
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && for patch in scripts/patch-*.mjs; do node \"\$patch\"; done"'
|
|
|
|
# Ensure env file exists and contains auth secrets required by start.sh.
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && test -f .env"'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && if ! grep -Eq \"^SECRET=.*\" .env; then echo \"Missing SECRET in /usr/local/indiekit/.env\"; exit 1; fi; if ! (grep -Eq \"^PASSWORD_SECRET=.*\" .env || grep -Eq \"^INDIEKIT_ALLOW_PASSWORD_SETUP=1\" .env); then echo \"Missing PASSWORD_SECRET (or set INDIEKIT_ALLOW_PASSWORD_SETUP=1 for one-time recovery) in /usr/local/indiekit/.env\"; exit 1; fi"'
|
|
|
|
# Validate startup prerequisites before touching the running service.
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-production-security.mjs"'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-mongo-connection.mjs"'
|
|
|
|
# Restart asynchronously to avoid hanging SSH sessions when rc scripts keep stdout open.
|
|
sudo bastille cmd node sh -lc "nohup service indiekit restart >${restart_log} 2>&1 </dev/null &"
|
|
|
|
# Give the process time to boot and pass preflight checks.
|
|
attempts=0
|
|
max_attempts=30
|
|
while [ "$attempts" -lt "$max_attempts" ]; do
|
|
if sudo bastille cmd node sh -lc 'service indiekit onestatus >/dev/null 2>&1'; then
|
|
echo "Indiekit restart triggered and service is running."
|
|
exit 0
|
|
fi
|
|
|
|
attempts=$((attempts + 1))
|
|
sleep 2
|
|
done
|
|
|
|
echo "Indiekit process not found after restart."
|
|
sudo bastille cmd node sh -lc "tail -n 120 ${restart_log} || true"
|
|
sudo bastille cmd node sh -lc 'service indiekit onestatus || true'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-production-security.mjs" || true'
|
|
sudo bastille cmd node sh -lc 'su -l indiekit -c "cd /usr/local/indiekit && NODE_ENV=production node scripts/preflight-mongo-connection.mjs" || true'
|
|
exit 1
|
|
# Optionally reload nginx on web jail
|
|
# - name: Reload nginx
|
|
# uses: appleboy/ssh-action@v0.1.10
|
|
# with:
|
|
# host: ${{ secrets.FREEBSD_WEB_HOST }}
|
|
# username: ${{ secrets.FREEBSD_WEB_USER }}
|
|
# key: ${{ secrets.FREEBSD_WEB_SSH_KEY }}
|
|
# port: ${{ secrets.FREEBSD_WEB_PORT }}
|
|
# script: sudo service nginx reload
|
|
|