name: Deploy on: push: branches: - main workflow_dispatch: env: REGISTRY: git.itexp.me IMAGE_TAG: ${{ gitea.sha }} ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui OPENBAO_ENV_FILE: .openbao-env jobs: build-images: runs-on: [self-hosted, linux, x64] strategy: fail-fast: false matrix: include: - name: admin-api dockerfile: apps/admin-api/Dockerfile image: git.itexp.me/bsodfather/crank-community-admin-api - name: mcp-server dockerfile: apps/mcp-server/Dockerfile image: git.itexp.me/bsodfather/crank-community-mcp-server - name: ui dockerfile: apps/ui/Dockerfile image: git.itexp.me/bsodfather/crank-community-ui steps: - name: Checkout uses: actions/checkout@v5 - name: Verify runner toolchain run: docker --version - name: Load deployment secrets from OpenBao env: BAO_ADDR: ${{ secrets.BAO_ADDR }} BAO_TOKEN: ${{ secrets.BAO_TOKEN }} BAO_SECRET_PATH: ${{ secrets.BAO_SECRET_PATH }} run: scripts/load-openbao-env.sh - name: Login to registry run: | . "$OPENBAO_ENV_FILE" printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \ docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin - name: Build and push ${{ matrix.name }} run: | docker build -f '${{ matrix.dockerfile }}' \ -t '${{ matrix.image }}:${{ env.IMAGE_TAG }}' \ -t '${{ matrix.image }}:main' \ . docker push '${{ matrix.image }}:${{ env.IMAGE_TAG }}' docker push '${{ matrix.image }}:main' deploy: needs: build-images runs-on: [self-hosted, linux, x64] steps: - name: Checkout uses: actions/checkout@v5 - name: Load deployment secrets from OpenBao env: BAO_ADDR: ${{ secrets.BAO_ADDR }} BAO_TOKEN: ${{ secrets.BAO_TOKEN }} BAO_SECRET_PATH: ${{ secrets.BAO_SECRET_PATH }} run: scripts/load-openbao-env.sh - name: Configure SSH key run: | . "$OPENBAO_ENV_FILE" mkdir -p ~/.ssh chmod 700 ~/.ssh printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 - name: Configure known hosts run: | . "$OPENBAO_ENV_FILE" if [ -n "${DEPLOY_KNOWN_HOSTS:-}" ]; then printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts else ssh-keyscan -p "${DEPLOY_PORT:-22}" "$DEPLOY_HOST" > ~/.ssh/known_hosts fi chmod 644 ~/.ssh/known_hosts - name: Sync deployment files to server run: | . "$OPENBAO_ENV_FILE" ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \ "mkdir -p '$DEPLOY_PATH'" rsync -az -e "ssh -p $DEPLOY_PORT" deploy/community/docker-compose.yml \ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/docker-compose.yml" - name: Write environment file run: | . "$OPENBAO_ENV_FILE" tmp_env="$(mktemp)" append_if_set() { if [ -n "$2" ]; then printf '%s=%s\n' "$1" "$2" >> "$tmp_env" fi } : > "$tmp_env" append_if_set POSTGRES_DB "$POSTGRES_DB" append_if_set POSTGRES_USER "$POSTGRES_USER" append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD" append_if_set POSTGRES_HOST "$POSTGRES_HOST" append_if_set POSTGRES_PORT "$POSTGRES_PORT" append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT" append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND" append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND" append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND" append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS" append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL" append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY" append_if_set CRANK_BASE_URL "$CRANK_BASE_URL" append_if_set CRANK_CACHE_BACKEND "$CRANK_CACHE_BACKEND" append_if_set CRANK_CACHE_URL "$CRANK_CACHE_URL" append_if_set CRANK_CACHE_DEFAULT_TTL_MS "$CRANK_CACHE_DEFAULT_TTL_MS" append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET" append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER" append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS" append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL" append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD" append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME" append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED" { printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' '${{ env.ADMIN_API_IMAGE }}' '${{ env.IMAGE_TAG }}' printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' '${{ env.MCP_SERVER_IMAGE }}' '${{ env.IMAGE_TAG }}' printf 'CRANK_UI_IMAGE=%s:%s\n' '${{ env.UI_IMAGE }}' '${{ env.IMAGE_TAG }}' } >> "$tmp_env" cat "$tmp_env" | ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" \ "mkdir -p '$DEPLOY_PATH' && cat > '$DEPLOY_PATH/.env'" rm -f "$tmp_env" - name: Validate required environment variables run: | . "$OPENBAO_ENV_FILE" ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" " set -e cd '$DEPLOY_PATH' required_vars=' POSTGRES_HOST POSTGRES_PORT POSTGRES_DB POSTGRES_USER POSTGRES_PASSWORD CRANK_MASTER_KEY CRANK_SESSION_SECRET CRANK_PASSWORD_PEPPER CRANK_BOOTSTRAP_ADMIN_EMAIL CRANK_BOOTSTRAP_ADMIN_PASSWORD CRANK_BASE_URL ' for var in \$required_vars; do value=\$(grep -E \"^\${var}=\" .env | tail -n1 | cut -d= -f2- || true) if [ -z \"\$value\" ]; then echo \"missing required env: \$var\" >&2 exit 1 fi done " - name: Deploy with Docker Compose run: | . "$OPENBAO_ENV_FILE" ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" " set -e cd '$DEPLOY_PATH' compose_profiles='' cache_backend=\$(grep -E '^CRANK_CACHE_BACKEND=' .env | tail -n1 | cut -d= -f2- || true) if [ \"\$cache_backend\" = 'valkey' ] || [ \"\$cache_backend\" = 'redis' ]; then compose_profiles='--profile cache' fi echo '$DEPLOY_REGISTRY_TOKEN' | docker login '${{ env.REGISTRY }}' -u '$DEPLOY_REGISTRY_USER' --password-stdin docker compose \$compose_profiles config -q docker compose \$compose_profiles pull docker compose \$compose_profiles up -d --remove-orphans " - name: Verify health endpoints run: | . "$OPENBAO_ENV_FILE" ssh -p "$DEPLOY_PORT" "$DEPLOY_USER@$DEPLOY_HOST" " set -e cd '$DEPLOY_PATH' for attempt in \$(seq 1 30); do if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \ && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \ && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then exit 0 fi sleep 2 done echo 'deployment health verification failed' >&2 docker compose ps >&2 exit 1 "