bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: split runtime env into individual secrets

Browse Source
This commit is contained in:
a.tolmachev
2026-04-11 12:18:30 +03:00
parent 0c17058d21
commit 9b6ce337e6
3 changed files with 90 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/deploy.yml
+53 -21
View File
@@ -118,33 +118,65 @@ jobs:
"${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH }}/docker-compose.yml"
- name: Write environment file
env:
POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
CRANK_DATABASE_URL: ${{ secrets.CRANK_DATABASE_URL }}
CRANK_STORAGE_ROOT: ${{ secrets.CRANK_STORAGE_ROOT }}
CRANK_PUBLISH_HOST: ${{ secrets.CRANK_PUBLISH_HOST }}
CRANK_ADMIN_BIND: ${{ secrets.CRANK_ADMIN_BIND }}
CRANK_MCP_BIND: ${{ secrets.CRANK_MCP_BIND }}
CRANK_MCP_REFRESH_MS: ${{ secrets.CRANK_MCP_REFRESH_MS }}
CRANK_LOG_LEVEL: ${{ secrets.CRANK_LOG_LEVEL }}
CRANK_SECRET_PROVIDER: ${{ secrets.CRANK_SECRET_PROVIDER }}
CRANK_MASTER_KEY: ${{ secrets.CRANK_MASTER_KEY }}
CRANK_PUBLIC_BASE_URL: ${{ secrets.CRANK_PUBLIC_BASE_URL }}
CRANK_MCP_PUBLIC_URL: ${{ secrets.CRANK_MCP_PUBLIC_URL }}
CRANK_SESSION_SECRET: ${{ secrets.CRANK_SESSION_SECRET }}
CRANK_PASSWORD_PEPPER: ${{ secrets.CRANK_PASSWORD_PEPPER }}
CRANK_SESSION_TTL_HOURS: ${{ secrets.CRANK_SESSION_TTL_HOURS }}
CRANK_BOOTSTRAP_ADMIN_EMAIL: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_EMAIL }}
CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_PASSWORD }}
CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME }}
CRANK_DEMO_SEED: ${{ secrets.CRANK_DEMO_SEED }}
run: |
tmp_env="$(mktemp)"
append_if_set() {
if [ -n "$2" ]; then
printf '%s=%s\n' "$1" "$2" >> "$tmp_env"
fi
}
: > "$tmp_env"
append_if_set POSTGRES_DB "$POSTGRES_DB"
append_if_set POSTGRES_USER "$POSTGRES_USER"
append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
append_if_set CRANK_DATABASE_URL "$CRANK_DATABASE_URL"
append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
append_if_set CRANK_PUBLISH_HOST "$CRANK_PUBLISH_HOST"
append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL"
append_if_set CRANK_SECRET_PROVIDER "$CRANK_SECRET_PROVIDER"
append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY"
append_if_set CRANK_PUBLIC_BASE_URL "$CRANK_PUBLIC_BASE_URL"
append_if_set CRANK_MCP_PUBLIC_URL "$CRANK_MCP_PUBLIC_URL"
append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET"
append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER"
append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS"
append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL"
append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD"
append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME"
append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED"
{
printf '%s\n' "${{ secrets.DEPLOY_ENV_FILE }}"
printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' "${{ env.ADMIN_API_IMAGE }}" "${{ env.IMAGE_TAG }}"
printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' "${{ env.MCP_SERVER_IMAGE }}" "${{ env.IMAGE_TAG }}"
printf 'CRANK_UI_IMAGE=%s:%s\n' "${{ env.UI_IMAGE }}" "${{ env.IMAGE_TAG }}"
} | ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
} >> "$tmp_env"
cat "$tmp_env" | ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
"mkdir -p '${{ secrets.DEPLOY_PATH }}' && cat > '${{ secrets.DEPLOY_PATH }}/.env'"
- name: Apply deploy overrides
run: |
if [ -n "${{ secrets.DEPLOY_MASTER_KEY }}" ]; then
ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
set -e
cd '${{ secrets.DEPLOY_PATH }}'
sed -i '/^CRANK_MASTER_KEY=/d' .env
printf 'CRANK_MASTER_KEY=%s\n' '${{ secrets.DEPLOY_MASTER_KEY }}' >> .env
"
fi
if [ -n "${{ secrets.DEPLOY_DEMO_SEED }}" ]; then
ssh "${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" "
set -e
cd '${{ secrets.DEPLOY_PATH }}'
sed -i '/^CRANK_DEMO_SEED=/d' .env
printf 'CRANK_DEMO_SEED=%s\n' '${{ secrets.DEPLOY_DEMO_SEED }}' >> .env
"
fi
rm -f "$tmp_env"
- name: Validate required environment variables
run: |