init
This commit is contained in:
Jason Ross
@@ -0,0 +1,41 @@
|
||||
name: 01 - Build and Push Images
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
paths:
|
||||
- "docker/**"
|
||||
|
||||
jobs:
|
||||
build-and-push:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Build and push Coturn image
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: ./docker/coturn
|
||||
push: true
|
||||
tags: ghcr.io/${{ github.repository_owner }}/stoat-coturn:4.9.0-trixie
|
||||
|
||||
- name: Build and push Caddy WAF image
|
||||
uses: docker/build-push-action@v5
|
||||
with:
|
||||
context: ./docker/caddy
|
||||
push: true
|
||||
tags: ghcr.io/${{ github.repository_owner }}/stoat-caddy-waf:latest
|
||||
@@ -0,0 +1,129 @@
|
||||
name: 02 - Deploy Infrastructure and Stack
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
env:
|
||||
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
||||
TF_VAR_gcp_project: ${{ vars.GCP_PROJECT || 'stoat-burrow' }}
|
||||
TF_VAR_gcp_region: ${{ vars.GCP_REGION || 'us-west1' }}
|
||||
TF_VAR_gcp_zone: ${{ vars.GCP_ZONE || 'us-west1-b' }}
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Prepare SSH key for provisioning
|
||||
shell: bash
|
||||
run: |
|
||||
install -m 700 -d "${HOME}/.ssh"
|
||||
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > "${HOME}/.ssh/id_ed25519"
|
||||
chmod 600 "${HOME}/.ssh/id_ed25519"
|
||||
{
|
||||
echo "TF_VAR_admin_ssh_public_key<<EOF"
|
||||
ssh-keygen -y -f "${HOME}/.ssh/id_ed25519"
|
||||
echo "EOF"
|
||||
} >> "${GITHUB_ENV}"
|
||||
|
||||
- name: Prepare Google credentials file
|
||||
shell: bash
|
||||
run: |
|
||||
credentials_file="${RUNNER_TEMP}/gcp-service-account.json"
|
||||
printf '%s' "${{ secrets.GCP_SA_KEY }}" > "${credentials_file}"
|
||||
chmod 600 "${credentials_file}"
|
||||
echo "GOOGLE_APPLICATION_CREDENTIALS=${credentials_file}" >> "${GITHUB_ENV}"
|
||||
|
||||
- name: Setup OpenTofu
|
||||
uses: opentofu/setup-opentofu@v1
|
||||
|
||||
- name: Write OpenTofu backend config
|
||||
working-directory: ./tofu
|
||||
shell: bash
|
||||
run: |
|
||||
cat > backend.hcl <<EOF
|
||||
bucket = "stoat-tofu-state"
|
||||
key = "webrtc-relay/terraform.tfstate"
|
||||
region = "us-east-2"
|
||||
endpoints = {
|
||||
s3 = "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
|
||||
}
|
||||
skip_credentials_validation = true
|
||||
skip_region_validation = true
|
||||
skip_requesting_account_id = true
|
||||
skip_s3_checksum = true
|
||||
EOF
|
||||
|
||||
- name: Tofu init and apply
|
||||
id: tofu
|
||||
working-directory: ./tofu
|
||||
shell: bash
|
||||
run: |
|
||||
tofu init -backend-config=backend.hcl
|
||||
tofu apply -auto-approve -input=false
|
||||
echo "STATIC_IP=$(tofu output -raw relay_ip)" >> "${GITHUB_ENV}"
|
||||
|
||||
- name: Wait for SSH
|
||||
shell: bash
|
||||
run: |
|
||||
for attempt in {1..30}; do
|
||||
if nc -z -w 5 "${STATIC_IP}" 22; then
|
||||
exit 0
|
||||
fi
|
||||
sleep 10
|
||||
done
|
||||
echo "SSH did not become reachable on ${STATIC_IP}" >&2
|
||||
exit 1
|
||||
|
||||
- name: Run Ansible Playbook
|
||||
uses: dawidd6/action-ansible-playbook@v2
|
||||
with:
|
||||
playbook: setup_host.yml
|
||||
directory: ./ansible
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
inventory: |
|
||||
[turn_nodes]
|
||||
${{ env.STATIC_IP }} ansible_user=ubuntu
|
||||
options: --ssh-common-args='-o StrictHostKeyChecking=no'
|
||||
|
||||
- name: SCP compose and config files
|
||||
uses: appleboy/scp-action@v0.1.7
|
||||
with:
|
||||
host: ${{ env.STATIC_IP }}
|
||||
username: ubuntu
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
source: "compose/*"
|
||||
target: "/opt/stoat-turn"
|
||||
strip_components: 1
|
||||
|
||||
- name: Deploy Podman compose stack
|
||||
uses: appleboy/ssh-action@v1.0.3
|
||||
with:
|
||||
host: ${{ env.STATIC_IP }}
|
||||
username: ubuntu
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
script: |
|
||||
set -eu
|
||||
cd /opt/stoat-turn
|
||||
cat > .env <<EOF
|
||||
STATIC_IP=${{ env.STATIC_IP }}
|
||||
GITHUB_REPOSITORY_OWNER=${{ github.repository_owner }}
|
||||
TURN_REALM=${{ vars.TURN_REALM || 'turn.example.com' }}
|
||||
TURN_SHARED_SECRET=${{ secrets.TURN_SHARED_SECRET }}
|
||||
CADDY_DOMAIN=${{ vars.CADDY_DOMAIN || 'relay.example.com' }}
|
||||
CADDY_EMAIL=${{ vars.CADDY_EMAIL || 'ops@example.com' }}
|
||||
STOAT_UPSTREAM=${{ vars.STOAT_UPSTREAM || 'http://host.containers.internal:8080' }}
|
||||
TURN_TLS_CERT_FILE=${{ vars.TURN_TLS_CERT_FILE }}
|
||||
TURN_TLS_KEY_FILE=${{ vars.TURN_TLS_KEY_FILE }}
|
||||
EOF
|
||||
|
||||
printf '%s\n' "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io -u "${{ github.actor }}" --password-stdin
|
||||
podman compose pull
|
||||
podman compose up -d
|
||||
Reference in New Issue
Block a user