michaelandClaude Fable 5.1
3aa7fb7b83
Deploy Waters Boards to AWS / deploy (push) Canceled after 0s
Replace the planned Synology deploy with one Lightsail box: Caddy in front of the app for automatic HTTPS (deploy/aws/docker-compose.yml, Caddyfile), a deploy script that rsyncs server/ and rebuilds in place without touching data/ or .env, and a Gitea workflow that runs the same script from the nas runner over SSH. README documents the box, DNS, .env, deploys and restore. Allow both church Google Workspace domains to sign in. Drop the NAS-only compose file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
67 lines
2.6 KiB
YAML
67 lines
2.6 KiB
YAML
# Push to main -> Waters Boards is rebuilt on the AWS Lightsail box.
|
||
#
|
||
# Runs on the "nas" act_runner, which lives inside the church network and can reach the
|
||
# internet. (The Gitea server isn't reachable from outside, so AWS can't pull from it; the
|
||
# runner pushes to AWS instead.) It syntax-checks the code, rsyncs server/ and deploy/aws/ to
|
||
# /opt/waters-boards on the box over SSH, rebuilds in place and waits for the healthcheck.
|
||
# All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
|
||
#
|
||
# ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
|
||
# 1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
|
||
# public half to /home/ubuntu/.ssh/authorized_keys on the box.
|
||
# 2. Add repository secrets (Settings ▸ Actions ▸ Secrets):
|
||
# DEPLOY_SSH_KEY the private key from step 1
|
||
# DEPLOY_KNOWN_HOSTS the output of: ssh-keyscan -t ed25519 <static IP>
|
||
# 3. Add repository variables (Settings ▸ Actions ▸ Variables):
|
||
# DEPLOY_HOST the box's static IP
|
||
# DEPLOY_ENABLED true
|
||
# Until DEPLOY_ENABLED is true this job is skipped, so pushes made before the box is
|
||
# ready don't show as failures.
|
||
# 4. The "nas" runner must be registered where it can see this repo (user- or instance-level,
|
||
# not only on the checklist repo).
|
||
# /opt/waters-boards/.env must already exist on the box. The deploy never creates or
|
||
# overwrites it, and never touches data/.
|
||
|
||
name: Deploy Waters Boards to AWS
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'server/**'
|
||
- 'deploy/aws/**'
|
||
- '.gitea/workflows/deploy.yml'
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
deploy:
|
||
if: ${{ vars.DEPLOY_ENABLED == 'true' }}
|
||
runs-on: nas
|
||
container:
|
||
image: node:22-alpine
|
||
|
||
steps:
|
||
- name: Install tools
|
||
# deploy.sh is a bash script and needs node (already in the image) for its syntax check.
|
||
run: apk add --no-cache bash openssh-client rsync
|
||
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up the SSH key
|
||
# Secrets go in through env, not pasted into the script text.
|
||
env:
|
||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||
run: |
|
||
set -eu
|
||
mkdir -p ~/.ssh
|
||
chmod 700 ~/.ssh
|
||
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
|
||
chmod 600 ~/.ssh/id_ed25519
|
||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
||
chmod 644 ~/.ssh/known_hosts
|
||
|
||
- name: Deploy
|
||
run: BOARDS_HOST="ubuntu@${{ vars.DEPLOY_HOST }}" bash deploy/aws/deploy.sh
|