change to Rust WebRTC TURN server
This commit is contained in:
Jason Ross
@@ -8,8 +8,9 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
env:
|
||||
TF_VAR_gcp_project: ${{ secrets.GCP_PROJECT }}
|
||||
TF_VAR_gcp_project: ${{ vars.GCP_PROJECT }}
|
||||
TF_VAR_gcp_region: ${{ vars.GCP_REGION }}
|
||||
TF_VAR_gcp_zone: ${{ vars.GCP_ZONE }}
|
||||
|
||||
@@ -17,17 +18,56 @@ jobs:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Validate deploy configuration
|
||||
shell: bash
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
|
||||
R2_ENDPOINT_URL: ${{ secrets.R2_ENDPOINT_URL }}
|
||||
R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
||||
R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
||||
TURN_SHARED_SECRET: ${{ secrets.TURN_SHARED_SECRET }}
|
||||
GCP_PROJECT: ${{ vars.GCP_PROJECT }}
|
||||
GCP_REGION: ${{ vars.GCP_REGION }}
|
||||
GCP_ZONE: ${{ vars.GCP_ZONE }}
|
||||
TURN_REALM: ${{ vars.TURN_REALM }}
|
||||
CADDY_EMAIL: ${{ vars.CADDY_EMAIL }}
|
||||
run: |
|
||||
set -eu
|
||||
|
||||
require_value() {
|
||||
local kind="$1"
|
||||
local name="$2"
|
||||
local value="$3"
|
||||
|
||||
if [ -z "${value}" ]; then
|
||||
echo "::error::Missing required GitHub ${kind} ${name}." >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
require_value "secret" "SSH_PRIVATE_KEY" "${SSH_PRIVATE_KEY}"
|
||||
require_value "secret" "GCP_SA_KEY" "${GCP_SA_KEY}"
|
||||
require_value "secret" "R2_ENDPOINT_URL" "${R2_ENDPOINT_URL}"
|
||||
require_value "secret" "R2_ACCESS_KEY_ID" "${R2_ACCESS_KEY_ID}"
|
||||
require_value "secret" "R2_SECRET_ACCESS_KEY" "${R2_SECRET_ACCESS_KEY}"
|
||||
require_value "secret" "TURN_SHARED_SECRET" "${TURN_SHARED_SECRET}"
|
||||
require_value "variable" "GCP_PROJECT" "${GCP_PROJECT}"
|
||||
require_value "variable" "GCP_REGION" "${GCP_REGION}"
|
||||
require_value "variable" "GCP_ZONE" "${GCP_ZONE}"
|
||||
require_value "variable" "TURN_REALM" "${TURN_REALM}"
|
||||
require_value "variable" "CADDY_EMAIL" "${CADDY_EMAIL}"
|
||||
|
||||
- name: Prepare SSH key for provisioning
|
||||
shell: bash
|
||||
env:
|
||||
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
run: |
|
||||
install -m 700 -d "${HOME}/.ssh"
|
||||
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > "${HOME}/.ssh/id_ed25519"
|
||||
printf '%s\n' "${SSH_PRIVATE_KEY}" | tr -d '\r' > "${HOME}/.ssh/id_ed25519"
|
||||
chmod 600 "${HOME}/.ssh/id_ed25519"
|
||||
{
|
||||
echo "TF_VAR_admin_ssh_public_key<<EOF"
|
||||
ssh-keygen -y -f "${HOME}/.ssh/id_ed25519"
|
||||
echo "EOF"
|
||||
} >> "${GITHUB_ENV}"
|
||||
admin_ssh_public_key="$(ssh-keygen -y -f "${HOME}/.ssh/id_ed25519")"
|
||||
printf 'TF_VAR_admin_ssh_public_key=%s\n' "${admin_ssh_public_key}" >> "${GITHUB_ENV}"
|
||||
|
||||
- name: Prepare Google credentials file
|
||||
shell: bash
|
||||
@@ -47,7 +87,7 @@ jobs:
|
||||
cat > backend.hcl <<EOF
|
||||
key = "webrtc-relay/terraform.tfstate"
|
||||
endpoints = {
|
||||
s3 = ${{ secrets.R2_ENDPOINT_URL }}
|
||||
s3 = "${{ secrets.R2_ENDPOINT_URL }}"
|
||||
}
|
||||
access_key = "${{ secrets.R2_ACCESS_KEY_ID }}"
|
||||
secret_key = "${{ secrets.R2_SECRET_ACCESS_KEY }}"
|
||||
@@ -60,18 +100,20 @@ jobs:
|
||||
run: |
|
||||
tofu init -backend-config=backend.hcl
|
||||
tofu apply -auto-approve -input=false
|
||||
echo "${{ secrets.STATIC_IP }}=$(tofu output -raw relay_ip)" >> "${GITHUB_ENV}"
|
||||
relay_ip="$(tofu output -raw relay_ip)"
|
||||
echo "STATIC_IP=${relay_ip}" >> "${GITHUB_ENV}"
|
||||
echo "relay_ip=${relay_ip}" >> "${GITHUB_OUTPUT}"
|
||||
|
||||
- name: Wait for SSH
|
||||
shell: bash
|
||||
run: |
|
||||
for attempt in {1..30}; do
|
||||
if nc -z -w 5 "${${{ secrets.STATIC_IP }}}" 22; then
|
||||
if nc -z -w 5 "${STATIC_IP}" 22; then
|
||||
exit 0
|
||||
fi
|
||||
sleep 10
|
||||
done
|
||||
echo "SSH did not become reachable on ${${{ secrets.STATIC_IP }}}" >&2
|
||||
echo "SSH did not become reachable on ${STATIC_IP}" >&2
|
||||
exit 1
|
||||
|
||||
- name: Run Ansible Playbook
|
||||
@@ -82,13 +124,13 @@ jobs:
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
inventory: |
|
||||
[turn_nodes]
|
||||
${{ secrets.STATIC_IP }} ansible_user=ubuntu
|
||||
${{ steps.tofu.outputs.relay_ip }} ansible_user=ubuntu
|
||||
options: --ssh-common-args='-o StrictHostKeyChecking=no'
|
||||
|
||||
- name: SCP compose and config files
|
||||
uses: appleboy/scp-action@v0.1.7
|
||||
with:
|
||||
host: ${{ secrets.STATIC_IP }}
|
||||
host: ${{ steps.tofu.outputs.relay_ip }}
|
||||
username: ubuntu
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
source: "compose/*"
|
||||
@@ -98,20 +140,21 @@ jobs:
|
||||
- name: Deploy Podman compose stack
|
||||
uses: appleboy/ssh-action@v1.0.3
|
||||
with:
|
||||
host: ${{ secrets.STATIC_IP }}
|
||||
host: ${{ steps.tofu.outputs.relay_ip }}
|
||||
username: ubuntu
|
||||
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
||||
script: |
|
||||
set -eu
|
||||
cd /opt/stoat-turn
|
||||
owner_lc="$(printf '%s' "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')"
|
||||
cat > .env <<EOF
|
||||
STATIC_IP = ${{ secrets.STATIC_IP }}
|
||||
GITHUB_REPOSITORY_OWNER=${{ github.repository_owner }}
|
||||
TURN_REALM=${{ secrets.TURN_REALM }}
|
||||
STATIC_IP=${{ steps.tofu.outputs.relay_ip }}
|
||||
GITHUB_REPOSITORY_OWNER=${owner_lc}
|
||||
TURN_REALM=${{ vars.TURN_REALM }}
|
||||
TURN_SHARED_SECRET=${{ secrets.TURN_SHARED_SECRET }}
|
||||
CADDY_EMAIL=${{ secrets.CADDY_EMAIL }}
|
||||
CADDY_EMAIL=${{ vars.CADDY_EMAIL }}
|
||||
EOF
|
||||
|
||||
printf '%s\n' "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io -u "${{ github.actor }}" --password-stdin
|
||||
podman compose pull
|
||||
podman compose up -d
|
||||
podman compose up -d --remove-orphans
|
||||
|
||||
Reference in New Issue
Block a user