michaelandClaude Fable 5.1
ecfb26d40a
Deploy Waters Boards to AWS / deploy (push) Failing after 2m6s
The workflow now runs on the aws-deploy label: an act_runner container on the Gitea NAS, registered for this repo only. The checklist app's nas runner on Chronicles-NA is no longer involved. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
70 lines
2.9 KiB
YAML
70 lines
2.9 KiB
YAML
# Push to main -> Waters Boards is rebuilt on the AWS Lightsail box.
|
||
#
|
||
# Runs on the "aws-deploy" act_runner: a container on Chronicles-AB (the Gitea NAS) in
|
||
# /volume2/docker/gitea-runner-boards, registered for this repo only. It lives inside the
|
||
# church network because the Gitea server isn't reachable from outside, so AWS can't pull
|
||
# from it; the runner pushes to AWS instead. It syntax-checks the code, rsyncs server/ and
|
||
# deploy/aws/ to /opt/waters-boards on the box over SSH, rebuilds in place and waits for the
|
||
# healthcheck. All of that is deploy/aws/deploy.sh, the same script you run from a laptop.
|
||
# The checklist app's "nas" runner on Chronicles-NA is not involved.
|
||
#
|
||
# ONE-TIME SETUP before the first run (see README.md › Deploy to AWS):
|
||
# 1. Make a deploy-only SSH key (e.g. ssh-keygen -t ed25519 -N '' -f deploy_key) and add the
|
||
# public half to /home/ubuntu/.ssh/authorized_keys on the box.
|
||
# 2. Add repository secrets (Settings ▸ Actions ▸ Secrets):
|
||
# DEPLOY_SSH_KEY the private key from step 1
|
||
# DEPLOY_KNOWN_HOSTS the output of: ssh-keyscan -t ed25519 <static IP>
|
||
# 3. Add repository variables (Settings ▸ Actions ▸ Variables):
|
||
# DEPLOY_HOST the box's static IP
|
||
# DEPLOY_ENABLED true
|
||
# Until DEPLOY_ENABLED is true this job is skipped, so pushes made before the box is
|
||
# ready don't show as failures.
|
||
# 4. The runner: on Chronicles-AB, /volume2/docker/gitea-runner-boards/start-runner.sh
|
||
# (re)creates it. Its runner.env holds a registration token scoped to this repo, minted
|
||
# with: docker exec -u git gitea gitea actions generate-runner-token --scope christian/waters-boards
|
||
# /opt/waters-boards/.env must already exist on the box. The deploy never creates or
|
||
# overwrites it, and never touches data/.
|
||
|
||
name: Deploy Waters Boards to AWS
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'server/**'
|
||
- 'deploy/aws/**'
|
||
- '.gitea/workflows/deploy.yml'
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
deploy:
|
||
if: ${{ vars.DEPLOY_ENABLED == 'true' }}
|
||
runs-on: aws-deploy
|
||
container:
|
||
image: node:22-alpine
|
||
|
||
steps:
|
||
- name: Install tools
|
||
# deploy.sh is a bash script and needs node (already in the image) for its syntax check.
|
||
run: apk add --no-cache bash openssh-client rsync
|
||
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Set up the SSH key
|
||
# Secrets go in through env, not pasted into the script text.
|
||
env:
|
||
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
||
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
||
run: |
|
||
set -eu
|
||
mkdir -p ~/.ssh
|
||
chmod 700 ~/.ssh
|
||
printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
|
||
chmod 600 ~/.ssh/id_ed25519
|
||
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
|
||
chmod 644 ~/.ssh/known_hosts
|
||
|
||
- name: Deploy
|
||
run: BOARDS_HOST="ubuntu@${{ vars.DEPLOY_HOST }}" bash deploy/aws/deploy.sh
|