218 lines
9.2 KiB
YAML
218 lines
9.2 KiB
YAML
# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest),
|
|
# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up.
|
|
#
|
|
# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag).
|
|
# Staging stays on master: .gitea/workflows/registry-build-deploy.yml
|
|
#
|
|
# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake.
|
|
#
|
|
# Variables:
|
|
# REGISTRY_HOST Windows Docker push host, e.g. host.docker.internal:3000
|
|
# REGISTRY_OWNER Gitea user/org for packages
|
|
# CLONE_HOST git clone, e.g. 127.0.0.1:3000
|
|
# PROD_PUBLIC_BASE_URL https://nudentic.ir (no trailing slash)
|
|
# PROD_REGISTRY_HOST Linux pull host, e.g. wixur.ir:3000 (HTTP; insecure-registries on the VPS)
|
|
# PROD_INFRA_DIR /opt/dyolink/infrastructure
|
|
#
|
|
# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD):
|
|
# PROD_SSH_HOST Linux public IP or hostname
|
|
# PROD_SSH_USER e.g. dyolink
|
|
# PROD_SSH_KEY OpenSSH private key (full PEM)
|
|
# PROD_SSH_PORT optional, default 22
|
|
#
|
|
# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir
|
|
# See infrastructure/DEPLOY.md
|
|
|
|
name: Production — tag build, push, deploy
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*.*.*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'Release tag to build and deploy (e.g. v1.0.1)'
|
|
required: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: powershell
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: windows
|
|
outputs:
|
|
image_tag: ${{ steps.meta.outputs.image_tag }}
|
|
steps:
|
|
- name: Checkout (this Gitea)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
|
$Server = "${{ github.server_url }}".TrimEnd('/')
|
|
} elseif ($cloneHost -match '^https?://') {
|
|
$Server = $cloneHost.TrimEnd('/')
|
|
} else {
|
|
$Server = 'http://' + $cloneHost
|
|
}
|
|
$Repo = "${{ github.repository }}"
|
|
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
|
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
|
$Branch = $dispatchTag
|
|
} else {
|
|
$Branch = "${{ github.ref_name }}"
|
|
}
|
|
$Token = "${{ github.token }}"
|
|
$Actor = "${{ github.actor }}"
|
|
$hp = $Server -replace '^https?://', ''
|
|
if ($Server.StartsWith('https')) {
|
|
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
} else {
|
|
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
}
|
|
$env:GIT_TERMINAL_PROMPT = '0'
|
|
git clone --depth 1 --branch $Branch $cloneUrl .
|
|
|
|
- name: Resolve image tag (v*.*.* only)
|
|
id: meta
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
|
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
|
$tag = $dispatchTag
|
|
} else {
|
|
$tag = "${{ github.ref_name }}"
|
|
}
|
|
if ($tag -notmatch '^v\d+\.\d+\.\d+') {
|
|
Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
|
|
exit 1
|
|
}
|
|
$utf8 = New-Object System.Text.UTF8Encoding $false
|
|
[System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
|
|
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
|
|
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
|
|
Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
|
|
|
|
- name: Log in to container registry
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$pass = @'
|
|
${{ secrets.REGISTRY_PASSWORD }}
|
|
'@
|
|
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
|
|
|
- name: Build and push backend (tag only, not :latest)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$tag = "${{ steps.meta.outputs.image_tag }}"
|
|
docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
|
|
|
|
- name: Build and push frontend (nudentic.ir baked in)
|
|
env:
|
|
PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$tag = "${{ steps.meta.outputs.image_tag }}"
|
|
$base = $env:PROD_PUBLIC_BASE_URL.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
|
|
$base = $base.TrimEnd('/')
|
|
docker build `
|
|
--build-arg "NEXT_PUBLIC_API_URL=$base/api" `
|
|
--build-arg "NEXT_PUBLIC_APP_URL=$base" `
|
|
--build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
|
|
-t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
|
|
./frontend
|
|
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
|
|
|
|
deploy:
|
|
needs: build-and-push
|
|
runs-on: windows
|
|
steps:
|
|
- name: Checkout (tagged tree for compose file)
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
|
$Server = "${{ github.server_url }}".TrimEnd('/')
|
|
} elseif ($cloneHost -match '^https?://') {
|
|
$Server = $cloneHost.TrimEnd('/')
|
|
} else {
|
|
$Server = 'http://' + $cloneHost
|
|
}
|
|
$Repo = "${{ github.repository }}"
|
|
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
|
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
|
$Branch = $dispatchTag
|
|
} else {
|
|
$Branch = "${{ github.ref_name }}"
|
|
}
|
|
$Token = "${{ github.token }}"
|
|
$Actor = "${{ github.actor }}"
|
|
$hp = $Server -replace '^https?://', ''
|
|
if ($Server.StartsWith('https')) {
|
|
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
} else {
|
|
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
|
}
|
|
$env:GIT_TERMINAL_PROMPT = '0'
|
|
git clone --depth 1 --branch $Branch $cloneUrl .
|
|
|
|
- name: Write SSH key
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$raw = @'
|
|
${{ secrets.PROD_SSH_KEY }}
|
|
'@
|
|
$key = $raw.Trim()
|
|
if ($key -notmatch 'BEGIN') {
|
|
Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key"
|
|
exit 1
|
|
}
|
|
$keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh'
|
|
$normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n"
|
|
[System.IO.File]::WriteAllText($keyPath, $normalized)
|
|
icacls $keyPath /inheritance:r | Out-Null
|
|
icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null
|
|
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n")
|
|
|
|
- name: Copy compose + deploy script to Linux
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
|
|
$user = '${{ secrets.PROD_SSH_USER }}'.Trim()
|
|
$port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
|
|
$infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
|
|
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
|
|
ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts"
|
|
scp.exe @ssh -P $port `
|
|
infrastructure/docker-compose.prod.yml `
|
|
"${user}@${hostName}:${infra}/docker-compose.prod.yml"
|
|
scp.exe @ssh -P $port `
|
|
infrastructure/scripts/prod-remote-deploy.sh `
|
|
"${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
|
|
ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh"
|
|
|
|
- name: Login on Linux and deploy tag
|
|
run: |
|
|
$ErrorActionPreference = 'Stop'
|
|
$hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
|
|
$user = '${{ secrets.PROD_SSH_USER }}'.Trim()
|
|
$port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
|
|
$infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
|
|
$regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
|
|
if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
|
|
$tag = "${{ needs.build-and-push.outputs.image_tag }}"
|
|
$pass = @'
|
|
${{ secrets.REGISTRY_PASSWORD }}
|
|
'@
|
|
$regUser = '${{ secrets.REGISTRY_USERNAME }}'
|
|
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
|
|
$remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
|
|
$pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
|