auto deploy on production server now finalized ready for smoke test.
This commit is contained in:
217
.gitea/workflows/prod-tag-deploy.yml
Normal file
217
.gitea/workflows/prod-tag-deploy.yml
Normal file
@@ -0,0 +1,217 @@
|
||||
# Production: build images for https://nudentic.ir, push :v* to Gitea (not :latest),
|
||||
# SCP compose to Linux, docker login wixur.ir:3000, compose pull + up.
|
||||
#
|
||||
# Triggers: git tag v1.0.1 (and v*.*.*), or Actions → this workflow → Run (input tag).
|
||||
# Staging stays on master: .gitea/workflows/registry-build-deploy.yml
|
||||
#
|
||||
# Do NOT push :latest — staging already uses :latest with the wixur.ir frontend bake.
|
||||
#
|
||||
# Variables:
|
||||
# REGISTRY_HOST Windows Docker push host, e.g. host.docker.internal:3000
|
||||
# REGISTRY_OWNER Gitea user/org for packages
|
||||
# CLONE_HOST git clone, e.g. 127.0.0.1:3000
|
||||
# PROD_PUBLIC_BASE_URL https://nudentic.ir (no trailing slash)
|
||||
# PROD_REGISTRY_HOST Linux pull host, e.g. wixur.ir:3000 (HTTP; insecure-registries on the VPS)
|
||||
# PROD_INFRA_DIR /opt/dyolink/infrastructure
|
||||
#
|
||||
# Secrets (in addition to REGISTRY_USERNAME / REGISTRY_PASSWORD):
|
||||
# PROD_SSH_HOST Linux public IP or hostname
|
||||
# PROD_SSH_USER e.g. dyolink
|
||||
# PROD_SSH_KEY OpenSSH private key (full PEM)
|
||||
# PROD_SSH_PORT optional, default 22
|
||||
#
|
||||
# One-time on Linux: insecure-registries ["wixur.ir:3000"], .env REGISTRY_PREFIX + DOMAIN=nudentic.ir
|
||||
# See infrastructure/DEPLOY.md
|
||||
|
||||
name: Production — tag build, push, deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- 'v*.*.*'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
tag:
|
||||
description: 'Release tag to build and deploy (e.g. v1.0.1)'
|
||||
required: true
|
||||
|
||||
defaults:
|
||||
run:
|
||||
shell: powershell
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
runs-on: windows
|
||||
outputs:
|
||||
image_tag: ${{ steps.meta.outputs.image_tag }}
|
||||
steps:
|
||||
- name: Checkout (this Gitea)
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
||||
$Server = "${{ github.server_url }}".TrimEnd('/')
|
||||
} elseif ($cloneHost -match '^https?://') {
|
||||
$Server = $cloneHost.TrimEnd('/')
|
||||
} else {
|
||||
$Server = 'http://' + $cloneHost
|
||||
}
|
||||
$Repo = "${{ github.repository }}"
|
||||
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
||||
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
||||
$Branch = $dispatchTag
|
||||
} else {
|
||||
$Branch = "${{ github.ref_name }}"
|
||||
}
|
||||
$Token = "${{ github.token }}"
|
||||
$Actor = "${{ github.actor }}"
|
||||
$hp = $Server -replace '^https?://', ''
|
||||
if ($Server.StartsWith('https')) {
|
||||
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
||||
} else {
|
||||
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
||||
}
|
||||
$env:GIT_TERMINAL_PROMPT = '0'
|
||||
git clone --depth 1 --branch $Branch $cloneUrl .
|
||||
|
||||
- name: Resolve image tag (v*.*.* only)
|
||||
id: meta
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
||||
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
||||
$tag = $dispatchTag
|
||||
} else {
|
||||
$tag = "${{ github.ref_name }}"
|
||||
}
|
||||
if ($tag -notmatch '^v\d+\.\d+\.\d+') {
|
||||
Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
|
||||
exit 1
|
||||
}
|
||||
$utf8 = New-Object System.Text.UTF8Encoding $false
|
||||
[System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
|
||||
$prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
|
||||
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
|
||||
Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
|
||||
|
||||
- name: Log in to container registry
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$pass = @'
|
||||
${{ secrets.REGISTRY_PASSWORD }}
|
||||
'@
|
||||
$pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
|
||||
|
||||
- name: Build and push backend (tag only, not :latest)
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$tag = "${{ steps.meta.outputs.image_tag }}"
|
||||
docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
|
||||
docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
|
||||
|
||||
- name: Build and push frontend (nudentic.ir baked in)
|
||||
env:
|
||||
PROD_PUBLIC_BASE_URL: ${{ vars.PROD_PUBLIC_BASE_URL }}
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$tag = "${{ steps.meta.outputs.image_tag }}"
|
||||
$base = $env:PROD_PUBLIC_BASE_URL.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
|
||||
$base = $base.TrimEnd('/')
|
||||
docker build `
|
||||
--build-arg "NEXT_PUBLIC_API_URL=$base/api" `
|
||||
--build-arg "NEXT_PUBLIC_APP_URL=$base" `
|
||||
--build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
|
||||
-t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
|
||||
./frontend
|
||||
docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
|
||||
|
||||
deploy:
|
||||
needs: build-and-push
|
||||
runs-on: windows
|
||||
steps:
|
||||
- name: Checkout (tagged tree for compose file)
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$cloneHost = '${{ vars.CLONE_HOST }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($cloneHost)) {
|
||||
$Server = "${{ github.server_url }}".TrimEnd('/')
|
||||
} elseif ($cloneHost -match '^https?://') {
|
||||
$Server = $cloneHost.TrimEnd('/')
|
||||
} else {
|
||||
$Server = 'http://' + $cloneHost
|
||||
}
|
||||
$Repo = "${{ github.repository }}"
|
||||
$dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
|
||||
if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) {
|
||||
$Branch = $dispatchTag
|
||||
} else {
|
||||
$Branch = "${{ github.ref_name }}"
|
||||
}
|
||||
$Token = "${{ github.token }}"
|
||||
$Actor = "${{ github.actor }}"
|
||||
$hp = $Server -replace '^https?://', ''
|
||||
if ($Server.StartsWith('https')) {
|
||||
$cloneUrl = 'https://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
||||
} else {
|
||||
$cloneUrl = 'http://' + $Actor + ':' + $Token + '@' + $hp + '/' + $Repo + '.git'
|
||||
}
|
||||
$env:GIT_TERMINAL_PROMPT = '0'
|
||||
git clone --depth 1 --branch $Branch $cloneUrl .
|
||||
|
||||
- name: Write SSH key
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$raw = @'
|
||||
${{ secrets.PROD_SSH_KEY }}
|
||||
'@
|
||||
$key = $raw.Trim()
|
||||
if ($key -notmatch 'BEGIN') {
|
||||
Write-Host "Set secret PROD_SSH_KEY to an OpenSSH private key"
|
||||
exit 1
|
||||
}
|
||||
$keyPath = Join-Path $env:RUNNER_TEMP 'prod_ssh'
|
||||
$normalized = $key.Replace("`r`n", "`n").TrimEnd() + "`n"
|
||||
[System.IO.File]::WriteAllText($keyPath, $normalized)
|
||||
icacls $keyPath /inheritance:r | Out-Null
|
||||
icacls $keyPath /grant:r "$($env:USERNAME):(R)" | Out-Null
|
||||
[System.IO.File]::AppendAllText($env:GITHUB_ENV, "PROD_SSH_KEY_PATH=$keyPath`n")
|
||||
|
||||
- name: Copy compose + deploy script to Linux
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
|
||||
$user = '${{ secrets.PROD_SSH_USER }}'.Trim()
|
||||
$port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
|
||||
$infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
|
||||
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
|
||||
ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts"
|
||||
scp.exe @ssh -P $port `
|
||||
infrastructure/docker-compose.prod.yml `
|
||||
"${user}@${hostName}:${infra}/docker-compose.prod.yml"
|
||||
scp.exe @ssh -P $port `
|
||||
infrastructure/scripts/prod-remote-deploy.sh `
|
||||
"${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
|
||||
ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh"
|
||||
|
||||
- name: Login on Linux and deploy tag
|
||||
run: |
|
||||
$ErrorActionPreference = 'Stop'
|
||||
$hostName = '${{ secrets.PROD_SSH_HOST }}'.Trim()
|
||||
$user = '${{ secrets.PROD_SSH_USER }}'.Trim()
|
||||
$port = '${{ secrets.PROD_SSH_PORT }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($port)) { $port = '22' }
|
||||
$infra = '${{ vars.PROD_INFRA_DIR }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
|
||||
$regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
|
||||
if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
|
||||
$tag = "${{ needs.build-and-push.outputs.image_tag }}"
|
||||
$pass = @'
|
||||
${{ secrets.REGISTRY_PASSWORD }}
|
||||
'@
|
||||
$regUser = '${{ secrets.REGISTRY_USERNAME }}'
|
||||
$ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
|
||||
$remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
|
||||
$pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
|
||||
@@ -1,7 +1,7 @@
|
||||
# Staging: build backend/frontend images, push to Gitea Container Registry, deploy on self-hosted runner.
|
||||
#
|
||||
# Triggers: push to master/main, or manual workflow_dispatch.
|
||||
# Production (nudentic.ir / git tags) is a separate later workflow — this file is Windows staging only.
|
||||
# Production (nudentic.ir / git tags): .gitea/workflows/prod-tag-deploy.yml — this file is Windows staging only.
|
||||
#
|
||||
# Repository Variables (Settings → Actions → Variables):
|
||||
# REGISTRY_HOST Docker registry host:port (no http/https). Windows Docker Desktop → host.docker.internal:3000
|
||||
|
||||
Reference in New Issue
Block a user