crank/.gitea/workflows/deploy.yml

name: Deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

env:
  REGISTRY: git.itexp.me
  IMAGE_TAG: ${{ gitea.sha }}
  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
  OPENBAO_ENV_FILE: .openbao-env

jobs:
  build-images:
    runs-on: [self-hosted, linux, x64]
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: admin-api
            dockerfile: apps/admin-api/Dockerfile
            image: git.itexp.me/bsodfather/crank-community-admin-api
          - name: mcp-server
            dockerfile: apps/mcp-server/Dockerfile
            image: git.itexp.me/bsodfather/crank-community-mcp-server
          - name: ui
            dockerfile: apps/ui/Dockerfile
            image: git.itexp.me/bsodfather/crank-community-ui

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Verify runner toolchain
        run: docker --version

      - name: Load deployment secrets from OpenBao
        env:
          BAO_ADDR: ${{ secrets.BAO_ADDR }}
          BAO_TOKEN: ${{ secrets.BAO_TOKEN }}
          BAO_SECRET_PATH: ${{ secrets.BAO_SECRET_PATH }}
        run: scripts/load-openbao-env.sh

      - name: Login to registry
        run: |
          . "$OPENBAO_ENV_FILE"
          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin

      - name: Build and push ${{ matrix.name }}
        run: |
          docker build -f '${{ matrix.dockerfile }}' \
            -t '${{ matrix.image }}:${{ env.IMAGE_TAG }}' \
            -t '${{ matrix.image }}:main' \
            .
          docker push '${{ matrix.image }}:${{ env.IMAGE_TAG }}'
          docker push '${{ matrix.image }}:main'

  deploy:
    needs: build-images
    runs-on: [self-hosted, linux, x64]

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Load deployment secrets from OpenBao
        env:
          BAO_ADDR: ${{ secrets.BAO_ADDR }}
          BAO_TOKEN: ${{ secrets.BAO_TOKEN }}
          BAO_SECRET_PATH: ${{ secrets.BAO_SECRET_PATH }}
        run: scripts/load-openbao-env.sh

      - name: Configure SSH key
        run: |
          . "$OPENBAO_ENV_FILE"
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
          chmod 600 ~/.ssh/id_ed25519

      - name: Configure known hosts
        run: |
          . "$OPENBAO_ENV_FILE"
          if [ -n "${DEPLOY_KNOWN_HOSTS:-}" ]; then
            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
          else
            ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > ~/.ssh/known_hosts
          fi
          chmod 644 ~/.ssh/known_hosts

      - name: Sync deployment files to server
        run: |
          . "$OPENBAO_ENV_FILE"
          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
            "mkdir -p '$DEPLOY_PATH'"
          rsync -az -e "ssh -p $DEPLOY_PORT" deploy/community/docker-compose.yml \
            "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml"

      - name: Write environment file
        run: |
          . "$OPENBAO_ENV_FILE"
          tmp_env="$(mktemp)"
          append_if_set() {
            if [ -n "$2" ]; then
              printf '%s=%s\n' "$1" "$2" >> "$tmp_env"
            fi
          }
          : > "$tmp_env"
          append_if_set POSTGRES_DB "$POSTGRES_DB"
          append_if_set POSTGRES_USER "$POSTGRES_USER"
          append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
          append_if_set POSTGRES_HOST "$POSTGRES_HOST"
          append_if_set POSTGRES_PORT "$POSTGRES_PORT"
          append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
          append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND"
          append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
          append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
          append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
          append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL"
          append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY"
          append_if_set CRANK_BASE_URL "$CRANK_BASE_URL"
          append_if_set CRANK_CACHE_BACKEND "$CRANK_CACHE_BACKEND"
          append_if_set CRANK_CACHE_URL "$CRANK_CACHE_URL"
          append_if_set CRANK_CACHE_DEFAULT_TTL_MS "$CRANK_CACHE_DEFAULT_TTL_MS"
          append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET"
          append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER"
          append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS"
          append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL"
          append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD"
          append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME"
          append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED"
          {
            printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' '${{ env.ADMIN_API_IMAGE }}' '${{ env.IMAGE_TAG }}'
            printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' '${{ env.MCP_SERVER_IMAGE }}' '${{ env.IMAGE_TAG }}'
            printf 'CRANK_UI_IMAGE=%s:%s\n' '${{ env.UI_IMAGE }}' '${{ env.IMAGE_TAG }}'
          } >> "$tmp_env"
          cat "$tmp_env" | ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \
            "mkdir -p '$DEPLOY_PATH' && cat > '$DEPLOY_PATH/.env'"
          rm -f "$tmp_env"

      - name: Validate required environment variables
        run: |
          . "$OPENBAO_ENV_FILE"
          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
            set -e
            cd '$DEPLOY_PATH'
            required_vars='
              POSTGRES_HOST
              POSTGRES_PORT
              POSTGRES_DB
              POSTGRES_USER
              POSTGRES_PASSWORD
              CRANK_MASTER_KEY
              CRANK_SESSION_SECRET
              CRANK_PASSWORD_PEPPER
              CRANK_BOOTSTRAP_ADMIN_EMAIL
              CRANK_BOOTSTRAP_ADMIN_PASSWORD
              CRANK_BASE_URL
            '
            for var in \$required_vars; do
              value=\$(grep -E \"^\${var}=\" .env | tail -n1 | cut -d= -f2- || true)
              if [ -z \"\$value\" ]; then
                echo \"missing required env: \$var\" >&2
                exit 1
              fi
            done
          "

      - name: Deploy with Docker Compose
        run: |
          . "$OPENBAO_ENV_FILE"
          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
            set -e
            cd '$DEPLOY_PATH'
            compose_profiles=''
            cache_backend=\$(grep -E '^CRANK_CACHE_BACKEND=' .env | tail -n1 | cut -d= -f2- || true)
            if [ \"\$cache_backend\" = 'valkey' ] || [ \"\$cache_backend\" = 'redis' ]; then
              compose_profiles='--profile cache'
            fi
            echo '$DEPLOY_REGISTRY_TOKEN' | docker login '${{ env.REGISTRY }}' -u '$DEPLOY_REGISTRY_USER' --password-stdin
            docker compose \$compose_profiles config -q
            docker compose \$compose_profiles pull
            docker compose \$compose_profiles up -d --remove-orphans
          "

      - name: Verify health endpoints
        run: |
          . "$OPENBAO_ENV_FILE"
          ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" "
            set -e
            cd '$DEPLOY_PATH'
            for attempt in \$(seq 1 30); do
              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
                exit 0
              fi
              sleep 2
            done
            echo 'deployment health verification failed' >&2
            docker compose ps >&2
            exit 1
          "