72 lines
2.3 KiB
YAML
72 lines
2.3 KiB
YAML
# Auto-deploy the landing site (tane.comunes.org) on push to main.
|
|
#
|
|
# Replicates `ansible-playbook tane-landing.yml`: rsync site/ to groucho and
|
|
# rebuild the Hugo->nginx container there. The runner (aaron) and groucho are on
|
|
# the same internal subnet (10.20.20.x), so it deploys over direct SSH.
|
|
#
|
|
# Derived content (legal pages, screenshots) is still regenerated by hand and
|
|
# committed — same as before; see site/DEPLOY.md. This workflow only ships what
|
|
# is already in the repo.
|
|
#
|
|
# One-time setup (see site/DEPLOY.md):
|
|
# - Generate a deploy keypair; add the PUBLIC key to groucho:/root/.ssh/authorized_keys.
|
|
# - Store the PRIVATE key as the Forgejo repo secret GROUCHO_DEPLOY_KEY.
|
|
|
|
name: site
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'site/**'
|
|
- 'docs/**'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: site-deploy
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
GROUCHO_HOST: "10.0.0.116"
|
|
SITE_DEST: "/data/ane-landing/src/"
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: docker
|
|
container:
|
|
image: debian:bookworm-slim
|
|
steps:
|
|
- name: Install tools
|
|
run: apt-get update -qq && apt-get install -y -qq git rsync openssh-client curl
|
|
|
|
- name: Checkout (manual git, Node-free)
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
git config --global --add safe.directory '*'
|
|
git init -q .
|
|
git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
|
|
git fetch -q --depth 1 origin "${GITHUB_SHA}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Configure SSH deploy key
|
|
env:
|
|
GROUCHO_DEPLOY_KEY: ${{ secrets.GROUCHO_DEPLOY_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "$GROUCHO_DEPLOY_KEY" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
ssh-keyscan -H "$GROUCHO_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: Sync site source to groucho
|
|
run: |
|
|
rsync -az --delete \
|
|
--exclude=public --exclude=resources --exclude=.hugo_build.lock \
|
|
site/ "root@${GROUCHO_HOST}:${SITE_DEST}"
|
|
|
|
- name: Rebuild the Hugo -> nginx container on groucho
|
|
run: |
|
|
ssh "root@${GROUCHO_HOST}" 'cd /data/tane-landing && docker compose up -d --build'
|
|
|
|
- name: Verify
|
|
run: curl -sI https://tane.comunes.org/ | head -1
|