130 lines
4.3 KiB
YAML
130 lines
4.3 KiB
YAML
name: 02 - Deploy Infrastructure and Stack
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
|
|
TF_VAR_gcp_project: ${{ vars.GCP_PROJECT || 'stoat-burrow' }}
|
|
TF_VAR_gcp_region: ${{ vars.GCP_REGION || 'us-west1' }}
|
|
TF_VAR_gcp_zone: ${{ vars.GCP_ZONE || 'us-west1-b' }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Prepare SSH key for provisioning
|
|
shell: bash
|
|
run: |
|
|
install -m 700 -d "${HOME}/.ssh"
|
|
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > "${HOME}/.ssh/id_ed25519"
|
|
chmod 600 "${HOME}/.ssh/id_ed25519"
|
|
{
|
|
echo "TF_VAR_admin_ssh_public_key<<EOF"
|
|
ssh-keygen -y -f "${HOME}/.ssh/id_ed25519"
|
|
echo "EOF"
|
|
} >> "${GITHUB_ENV}"
|
|
|
|
- name: Prepare Google credentials file
|
|
shell: bash
|
|
run: |
|
|
credentials_file="${RUNNER_TEMP}/gcp-service-account.json"
|
|
printf '%s' "${{ secrets.GCP_SA_KEY }}" > "${credentials_file}"
|
|
chmod 600 "${credentials_file}"
|
|
echo "GOOGLE_APPLICATION_CREDENTIALS=${credentials_file}" >> "${GITHUB_ENV}"
|
|
|
|
- name: Setup OpenTofu
|
|
uses: opentofu/setup-opentofu@v1
|
|
|
|
- name: Write OpenTofu backend config
|
|
working-directory: ./tofu
|
|
shell: bash
|
|
run: |
|
|
cat > backend.hcl <<EOF
|
|
bucket = "stoat-tofu-state"
|
|
key = "webrtc-relay/terraform.tfstate"
|
|
region = "us-east-2"
|
|
endpoints = {
|
|
s3 = "https://${{ secrets.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com"
|
|
}
|
|
skip_credentials_validation = true
|
|
skip_region_validation = true
|
|
skip_requesting_account_id = true
|
|
skip_s3_checksum = true
|
|
EOF
|
|
|
|
- name: Tofu init and apply
|
|
id: tofu
|
|
working-directory: ./tofu
|
|
shell: bash
|
|
run: |
|
|
tofu init -backend-config=backend.hcl
|
|
tofu apply -auto-approve -input=false
|
|
echo "STATIC_IP=$(tofu output -raw relay_ip)" >> "${GITHUB_ENV}"
|
|
|
|
- name: Wait for SSH
|
|
shell: bash
|
|
run: |
|
|
for attempt in {1..30}; do
|
|
if nc -z -w 5 "${STATIC_IP}" 22; then
|
|
exit 0
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "SSH did not become reachable on ${STATIC_IP}" >&2
|
|
exit 1
|
|
|
|
- name: Run Ansible Playbook
|
|
uses: dawidd6/action-ansible-playbook@v2
|
|
with:
|
|
playbook: setup_host.yml
|
|
directory: ./ansible
|
|
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
inventory: |
|
|
[turn_nodes]
|
|
${{ env.STATIC_IP }} ansible_user=ubuntu
|
|
options: --ssh-common-args='-o StrictHostKeyChecking=no'
|
|
|
|
- name: SCP compose and config files
|
|
uses: appleboy/scp-action@v0.1.7
|
|
with:
|
|
host: ${{ env.STATIC_IP }}
|
|
username: ubuntu
|
|
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
source: "compose/*"
|
|
target: "/opt/stoat-turn"
|
|
strip_components: 1
|
|
|
|
- name: Deploy Podman compose stack
|
|
uses: appleboy/ssh-action@v1.0.3
|
|
with:
|
|
host: ${{ env.STATIC_IP }}
|
|
username: ubuntu
|
|
key: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
script: |
|
|
set -eu
|
|
cd /opt/stoat-turn
|
|
cat > .env <<EOF
|
|
STATIC_IP=${{ env.STATIC_IP }}
|
|
GITHUB_REPOSITORY_OWNER=${{ github.repository_owner }}
|
|
TURN_REALM=${{ vars.TURN_REALM || 'turn.example.com' }}
|
|
TURN_SHARED_SECRET=${{ secrets.TURN_SHARED_SECRET }}
|
|
CADDY_DOMAIN=${{ vars.CADDY_DOMAIN || 'relay.example.com' }}
|
|
CADDY_EMAIL=${{ vars.CADDY_EMAIL || 'ops@example.com' }}
|
|
STOAT_UPSTREAM=${{ vars.STOAT_UPSTREAM || 'http://host.containers.internal:8080' }}
|
|
TURN_TLS_CERT_FILE=${{ vars.TURN_TLS_CERT_FILE }}
|
|
TURN_TLS_KEY_FILE=${{ vars.TURN_TLS_KEY_FILE }}
|
|
EOF
|
|
|
|
printf '%s\n' "${{ secrets.GITHUB_TOKEN }}" | podman login ghcr.io -u "${{ github.actor }}" --password-stdin
|
|
podman compose pull
|
|
podman compose up -d
|