michaelandClaude Fable 5.1
513067509c
Deploy Waters Boards to AWS / deploy (push) Successful in 1m16s
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
74 lines
3.2 KiB
YAML
74 lines
3.2 KiB
YAML
# Push to main -> Waters Boards is rebuilt on the AWS Lightsail box.
|
||
#
|
||
# Runs on the "aws-deploy" act_runner: a container on Chronicles-AB (the Gitea NAS) in
|
||
# /volume2/docker/gitea-runner-boards, registered for this repo only. It lives inside the
|
||
# church network because the Gitea server isn't reachable from outside, so AWS can't pull
|
||
# from it; the runner pushes to AWS instead. It syntax-checks the code, rsyncs server/ and
|
||
# deploy/aws/ to /opt/waters-boards on the box over SSH, rebuilds in place and waits for the
|
||
# healthcheck. All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
|
||
# The checklist app's "nas" runner on Chronicles-NA is not involved.
|
||
#
|
||
# That runner and its job containers use Docker host networking: containers on bridge
|
||
# networks on Chronicles-AB have no outbound NAT (no DNS, no internet), which made the first
|
||
# run fail while fetching actions/checkout.
|
||
#
|
||
# ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
|
||
# 1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
|
||
# public half to /home/ubuntu/.ssh/authorized_keys on the box.
|
||
# 2. Add repository secrets (Settings ▸ Actions ▸ Secrets):
|
||
# DEPLOY_SSH_KEY the private key from step 1
|
||
# DEPLOY_KNOWN_HOSTS the output of: ssh-keyscan -t ed25519 <static IP>
|
||
# 3. Add repository variables (Settings ▸ Actions ▸ Variables):
|
||
# DEPLOY_HOST the box's static IP
|
||
# DEPLOY_ENABLED true
|
||
# Until DEPLOY_ENABLED is true this job is skipped, so pushes made before the box is
|
||
# ready don't show as failures.
|
||
# 4. The runner: on Chronicles-AB, /volume2/docker/gitea-runner-boards/start-runner.sh
|
||
# (re)creates it. Its runner.env holds a registration token scoped to this repo, minted
|
||
# with: docker exec -u git gitea gitea actions generate-runner-token --scope christian/waters-boards
|
||
# /opt/waters-boards/.env must already exist on the box. The deploy never creates or
|
||
# overwrites it, and never touches data/.
|
||
|
||
name: Deploy Waters Boards to AWS
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'server/**'
|
||
- 'deploy/aws/**'
|
||
- '.gitea/workflows/deploy.yml'
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
deploy:
|
||
if: ${{ vars.DEPLOY_ENABLED == 'true' }}
|
||
runs-on: aws-deploy
|
||
container:
|
||
image: node:22-alpine
|
||
|
||
steps:
|
||
- name: Install tools
|
||
# deploy.sh is a bash script and needs node (already in the image) for its syntax check.
|
||
run: apk add --no-cache bash openssh-client rsync curl
|
||
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up the SSH key
|
||
# Secrets go in through env, not pasted into the script text.
|
||
env:
|
||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||
run: |
|
||
set -eu
|
||
mkdir -p ~/.ssh
|
||
chmod 700 ~/.ssh
|
||
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
|
||
chmod 600 ~/.ssh/id_ed25519
|
||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
||
chmod 644 ~/.ssh/known_hosts
|
||
|
||
- name: Deploy
|
||
run: BOARDS_HOST="ubuntu@${{ vars.DEPLOY_HOST }}" bash deploy/aws/deploy.sh
|