www/.github/workflows/deploy.yaml at master · ibp-network/www · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
name: Deploy IBP site

# Manual only. Every push to master used to auto-deploy ibp-rotko-net;
# moved off that because deploys are a deliberate action, not a side-effect
# of pushing a typo fix. Use `gh workflow run deploy.yaml -f targets=...`
# or the "Run workflow" button on the Actions tab.
on:
  workflow_dispatch:
    inputs:
      targets:
        type: choice
        description: 'Which hosts to deploy to'
        required: true
        default: 'ibp-rotko-net'
        options:
          - ibp-rotko-net
          - ibp-network
          - dotters-network
          - all

env:
  # One image, built once and shipped to every target. The running
  # container NAME and host PORT differ per environment (set in each
  # deploy job's env block) so dev (ibp.rotko.net) and prod
  # (ibp.network) can run side by side on the same host behind the
  # reverse proxy.
  IMAGE_NAME: ibp-www
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install
        run: npm ci

      - name: Type-check
        run: npm run typecheck

      - name: Build
        run: npm run build

      - name: Build container
        run: |
          podman build -t ${{ env.IMAGE_NAME }}:latest .
          podman save -o /tmp/${{ env.IMAGE_NAME }}.tar localhost/${{ env.IMAGE_NAME }}:latest
          ls -lh /tmp/${{ env.IMAGE_NAME }}.tar

      - uses: actions/upload-artifact@v7
        with:
          name: image
          path: /tmp/${{ env.IMAGE_NAME }}.tar
          retention-days: 1

  deploy-rotko:
    needs: build
    if: github.event.inputs.targets == 'ibp-rotko-net' || github.event.inputs.targets == 'all'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/download-artifact@v8
        with: { name: image, path: /tmp }
      - name: Ship + restart
        env:
          # ibp.rotko.net — development / staging
          CONTAINER_NAME: ibp-rotko-net
          HOST_PORT: 44446
          HOST: ${{ secrets.IBP_ROTKO_NET_HOST }}
          USER: ${{ secrets.IBP_ROTKO_NET_USER }}
          KEY: ${{ secrets.IBP_ROTKO_NET_KEY }}
        run: |
          set -euo pipefail
          [ -n "$HOST" ] && [ -n "$USER" ] && [ -n "$KEY" ] || { echo "Missing secrets for ibp-rotko-net"; exit 1; }
          mkdir -p ~/.ssh && echo "$KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          SSH="ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy $USER@$HOST"
          scp -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy /tmp/${{ env.IMAGE_NAME }}.tar "$USER@$HOST:/tmp/"
          # Host can use podman or docker — they accept identical syntax
          # for load / run / stop / rm. The same image tarball loads cleanly
          # into either.
          $SSH "set -e
                if command -v podman >/dev/null; then RT=podman
                elif command -v docker >/dev/null; then RT=docker
                else echo 'no container runtime found on host' >&2; exit 1
                fi
                \$RT load -i /tmp/${{ env.IMAGE_NAME }}.tar
                \$RT stop ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT rm   ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT run -d --restart=always -p 127.0.0.1:${{ env.HOST_PORT }}:80 --name ${{ env.CONTAINER_NAME }} localhost/${{ env.IMAGE_NAME }}:latest
                rm /tmp/${{ env.IMAGE_NAME }}.tar
                sleep 2
                curl -fsS http://127.0.0.1:${{ env.HOST_PORT }}/ > /dev/null"
          rm -f ~/.ssh/id_deploy

  deploy-ibp-network:
    needs: build
    if: github.event.inputs.targets == 'ibp-network' || github.event.inputs.targets == 'all'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/download-artifact@v8
        with: { name: image, path: /tmp }
      - name: Ship + restart
        env:
          # ibp.network — production
          CONTAINER_NAME: ibp-network
          HOST_PORT: 44447
          HOST: ${{ secrets.IBP_NETWORK_HOST }}
          USER: ${{ secrets.IBP_NETWORK_USER }}
          KEY: ${{ secrets.IBP_NETWORK_KEY }}
        run: |
          set -euo pipefail
          [ -n "$HOST" ] && [ -n "$USER" ] && [ -n "$KEY" ] || { echo "Missing secrets for ibp-network"; exit 1; }
          mkdir -p ~/.ssh && echo "$KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          SSH="ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy $USER@$HOST"
          scp -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy /tmp/${{ env.IMAGE_NAME }}.tar "$USER@$HOST:/tmp/"
          # Host can use podman or docker — they accept identical syntax
          # for load / run / stop / rm. The same image tarball loads cleanly
          # into either.
          $SSH "set -e
                if command -v podman >/dev/null; then RT=podman
                elif command -v docker >/dev/null; then RT=docker
                else echo 'no container runtime found on host' >&2; exit 1
                fi
                \$RT load -i /tmp/${{ env.IMAGE_NAME }}.tar
                \$RT stop ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT rm   ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT run -d --restart=always -p 127.0.0.1:${{ env.HOST_PORT }}:80 --name ${{ env.CONTAINER_NAME }} localhost/${{ env.IMAGE_NAME }}:latest
                rm /tmp/${{ env.IMAGE_NAME }}.tar
                sleep 2
                curl -fsS http://127.0.0.1:${{ env.HOST_PORT }}/ > /dev/null"
          rm -f ~/.ssh/id_deploy

  deploy-dotters:
    needs: build
    if: github.event.inputs.targets == 'dotters-network' || github.event.inputs.targets == 'all'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/download-artifact@v8
        with: { name: image, path: /tmp }
      - name: Ship + restart
        env:
          # dotters.network — production mirror pool
          CONTAINER_NAME: ibp-dotters
          HOST_PORT: 44448
          HOST: ${{ secrets.DOTTERS_NETWORK_HOST }}
          USER: ${{ secrets.DOTTERS_NETWORK_USER }}
          KEY: ${{ secrets.DOTTERS_NETWORK_KEY }}
        run: |
          set -euo pipefail
          [ -n "$HOST" ] && [ -n "$USER" ] && [ -n "$KEY" ] || { echo "Missing secrets for dotters-network"; exit 1; }
          mkdir -p ~/.ssh && echo "$KEY" > ~/.ssh/id_deploy && chmod 600 ~/.ssh/id_deploy
          SSH="ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy $USER@$HOST"
          scp -o StrictHostKeyChecking=no -i ~/.ssh/id_deploy /tmp/${{ env.IMAGE_NAME }}.tar "$USER@$HOST:/tmp/"
          # Host can use podman or docker — they accept identical syntax
          # for load / run / stop / rm. The same image tarball loads cleanly
          # into either.
          $SSH "set -e
                if command -v podman >/dev/null; then RT=podman
                elif command -v docker >/dev/null; then RT=docker
                else echo 'no container runtime found on host' >&2; exit 1
                fi
                \$RT load -i /tmp/${{ env.IMAGE_NAME }}.tar
                \$RT stop ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT rm   ${{ env.CONTAINER_NAME }} 2>/dev/null || true
                \$RT run -d --restart=always -p 127.0.0.1:${{ env.HOST_PORT }}:80 --name ${{ env.CONTAINER_NAME }} localhost/${{ env.IMAGE_NAME }}:latest
                rm /tmp/${{ env.IMAGE_NAME }}.tar
                sleep 2
                curl -fsS http://127.0.0.1:${{ env.HOST_PORT }}/ > /dev/null"
          rm -f ~/.ssh/id_deploy