Lars Nolden
5e2454f622
The gitea-runner is a systemd DynamicUser whose passwd home is /, so ssh expands ~ to /.ssh/... (not $HOME). deploy-rs passes ssh opts to ssh with no shell, so a tilde in deploy.nix sshOpts resolved to a missing key and nix copy failed with 'failed to start SSH connection'. Keep deploy.nix sshOpts path-free; build absolute -i/known_hosts paths in deploy.yml from $HOME (bash-expanded) and append them via --ssh-opts, which deploy-rs merges into NIX_SSHOPTS for the copy and the activation ssh. Also removes the temporary SSH debug step. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
name: deploy
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: nixos
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup deploy SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
# Dedicated key file so we never overwrite the runner user's own key.
|
|
install -m 600 /dev/stdin ~/.ssh/gebos_deploy <<< "${{ secrets.DEPLOY_SSH_KEY }}"
|
|
ssh-keyscan -H db.gebos.online app.gebos.online ingest.gebos.online >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
# The gitea-runner is a systemd DynamicUser whose passwd home is `/`,
|
|
# so ssh expands `~` to `/.ssh/...` rather than $HOME. deploy-rs passes
|
|
# ssh opts with no shell, so it can't expand $HOME itself. Build the
|
|
# absolute paths here (bash expands $HOME) and hand them to deploy-rs
|
|
# via --ssh-opts; they append to nix/deploy.nix's path-free sshOpts.
|
|
echo "DEPLOY_SSH_OPTS=-i $HOME/.ssh/gebos_deploy -o UserKnownHostsFile=$HOME/.ssh/known_hosts" >> "$GITHUB_ENV"
|
|
|
|
- name: Build all closures
|
|
run: nix flake check --no-build
|
|
|
|
# Order matters: db schema migrations are part of db-host's activation,
|
|
# so it must land first. App-host's Supabase compose stack expects the
|
|
# schemas to exist. mqtt-ingest only needs the network paths to db-host.
|
|
- name: Deploy db-host
|
|
run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#db-host --skip-checks
|
|
|
|
- name: Deploy app-host
|
|
run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#app-host --skip-checks
|
|
|
|
- name: Deploy mqtt-ingest
|
|
run: nix run github:serokell/deploy-rs -- --ssh-opts "$DEPLOY_SSH_OPTS" .#mqtt-ingest --skip-checks
|