Lars Nolden
52 lines
2.2 KiB
YAML
52 lines
2.2 KiB
YAML
name: deploy
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: nixos
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup deploy SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
# Dedicated key file so we never overwrite the runner user's own key.
|
|
# nix/deploy.nix pins this via `-i ~/.ssh/gebos_deploy`.
|
|
install -m 600 /dev/stdin ~/.ssh/gebos_deploy <<< "${{ secrets.DEPLOY_SSH_KEY }}"
|
|
ssh-keyscan -H db.gebos.online app.gebos.online ingest.gebos.online >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
- name: Build all closures
|
|
run: nix flake check --no-build
|
|
|
|
# TEMPORARY: diagnose the SSH auth failure to db-host. Prints only the
|
|
# PUBLIC key fingerprint (no private material) and the ssh negotiation.
|
|
# Remove once deploys succeed.
|
|
- name: Debug SSH to db-host
|
|
run: |
|
|
echo "== runner =="; whoami; echo "HOME=$HOME"
|
|
echo "== installed deploy PUBLIC key (compare to nix/hosts/common.nix:26-27) =="
|
|
ssh-keygen -y -f ~/.ssh/gebos_deploy -P "" < /dev/null \
|
|
|| echo ">>> KEY UNREADABLE: encrypted (has passphrase) or missing"
|
|
echo "deploy should be ...Z+SU"
|
|
echo "me@larsnolden.com should be ...cdd0"
|
|
echo "== ssh auth negotiation =="
|
|
ssh -vvv -F none -i ~/.ssh/gebos_deploy -o IdentitiesOnly=yes \
|
|
-o StrictHostKeyChecking=accept-new -o BatchMode=yes \
|
|
deploy@db.gebos.online 'echo CONNECTED as $(whoami)@$(hostname)' 2>&1 \
|
|
| grep -Ei 'CONNECTED|denied|Server accepts|Offering|Authenticated|not accessible|Host key|incorrect passphrase|No such' \
|
|
|| true
|
|
|
|
# Order matters: db schema migrations are part of db-host's activation,
|
|
# so it must land first. App-host's Supabase compose stack expects the
|
|
# schemas to exist. mqtt-ingest only needs the network paths to db-host.
|
|
- name: Deploy db-host
|
|
run: nix run github:serokell/deploy-rs -- .#db-host --skip-checks
|
|
|
|
- name: Deploy app-host
|
|
run: nix run github:serokell/deploy-rs -- .#app-host --skip-checks
|
|
|
|
- name: Deploy mqtt-ingest
|
|
run: nix run github:serokell/deploy-rs -- .#mqtt-ingest --skip-checks
|