vjrj
1a49376d84
aaron routes to groucho via ada (ens18 down); the groucho->aaron data path drops packets so the SSH banner never returns (TCP+ICMP ok). Left workflow_dispatch-only until the network is fixed; deploy meanwhile via ansible tane-landing.yml.
75 lines
2.9 KiB
YAML
75 lines
2.9 KiB
YAML
# Auto-deploy the landing site (tane.comunes.org) on push to main.
|
|
#
|
|
# Replicates `ansible-playbook tane-landing.yml`: rsync site/ to groucho and
|
|
# rebuild the Hugo->nginx container there. The runner (aaron) and groucho are on
|
|
# the same internal subnet (10.20.20.x), so it deploys over direct SSH.
|
|
#
|
|
# Derived content (legal pages, screenshots) is still regenerated by hand and
|
|
# committed — same as before; see site/DEPLOY.md. This workflow only ships what
|
|
# is already in the repo.
|
|
#
|
|
# One-time setup (see site/DEPLOY.md):
|
|
# - Generate a deploy keypair; add the PUBLIC key to groucho:/root/.ssh/authorized_keys.
|
|
# - Store the PRIVATE key as the Forgejo repo secret GROUCHO_DEPLOY_KEY.
|
|
|
|
name: site
|
|
|
|
# BLOCKED (2026-07-16): the runner (aaron) cannot open an SSH data connection to
|
|
# groucho. aaron's direct iface to groucho's subnet (ens18, 10.20.20.x) is down,
|
|
# so aaron routes to groucho via ada (10.0.0.2) and the groucho->aaron data path
|
|
# drops packets (TCP connects + ICMP ok, but the SSH banner never returns; proven:
|
|
# aaron->ada:22 gets a banner, aaron->groucho:22 does not). Not MTU/fail2ban/DNS.
|
|
# Until aaron<->groucho networking is fixed, deploy the site from a machine that
|
|
# reaches groucho via ada: `ansible-playbook -i comunes_inventory.ini tane-landing.yml`
|
|
# (see site/DEPLOY.md). Trigger left manual-only so it stops failing on every push.
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: site-deploy
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
GROUCHO_HOST: "10.20.20.116"
|
|
SITE_DEST: "/data/tane-landing/src/"
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: docker
|
|
container:
|
|
image: debian:bookworm-slim
|
|
steps:
|
|
- name: Install tools
|
|
run: apt-get update -qq && apt-get install -y -qq git rsync openssh-client curl
|
|
|
|
- name: Checkout (manual git, Node-free)
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Configure SSH deploy key
|
|
env:
|
|
GROUCHO_DEPLOY_KEY: ${{ secrets.GROUCHO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "$GROUCHO_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H "$GROUCHO_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: Sync site source to groucho
|
|
run: |
|
|
rsync -az --delete \
|
|
--exclude=public --exclude=resources --exclude=.hugo_build.lock \
|
|
site/ "root@${GROUCHO_HOST}:${SITE_DEST}"
|
|
|
|
- name: Rebuild the Hugo -> nginx container on groucho
|
|
run: |
|
|
ssh "root@${GROUCHO_HOST}" 'cd /data/tane-landing && docker compose up -d --build'
|
|
|
|
- name: Verify
|
|
run: curl -sI https://tane.comunes.org/ | head -1
|