mirror of
https://github.com/NetworkCats/rustyip.git
synced 2026-11-13 16:17:46 +00:00
feat: add deployment infrastructure with Terraform, Ansible, and GitHub Actions
This commit is contained in:
NetworkCats
@@ -0,0 +1,220 @@
|
||||
name: Deploy
|
||||
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "v*"
|
||||
|
||||
env:
|
||||
CARGO_TERM_COLOR: always
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
|
||||
jobs:
|
||||
# ---- CI checks ----
|
||||
check:
|
||||
name: Check
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Rust toolchain
|
||||
uses: dtolnay/rust-toolchain@master
|
||||
with:
|
||||
toolchain: "1.93.1"
|
||||
components: rustfmt, clippy
|
||||
|
||||
- name: Cache Cargo artifacts
|
||||
uses: Swatinem/rust-cache@v2
|
||||
|
||||
- name: Download MMDB database
|
||||
run: |
|
||||
mkdir -p data
|
||||
curl -fsSL -o data/Merged-IP.mmdb \
|
||||
"https://github.com/NetworkCats/Merged-IP-Data/releases/latest/download/Merged-IP.mmdb"
|
||||
|
||||
- name: Check formatting
|
||||
run: cargo fmt --check
|
||||
|
||||
- name: Run Clippy
|
||||
run: cargo clippy -- -D warnings
|
||||
|
||||
- name: Run tests
|
||||
run: cargo test
|
||||
|
||||
# ---- Build and push Docker image ----
|
||||
build:
|
||||
name: Build Image
|
||||
runs-on: ubuntu-latest
|
||||
needs: check
|
||||
outputs:
|
||||
image_tag: ${{ steps.meta.outputs.tags }}
|
||||
image_full: ${{ steps.full_image.outputs.image }}
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Log in to GHCR
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Extract metadata
|
||||
id: meta
|
||||
uses: docker/metadata-action@v5
|
||||
with:
|
||||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
tags: |
|
||||
type=semver,pattern={{version}}
|
||||
type=raw,value=latest
|
||||
|
||||
- name: Build and push image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
push: true
|
||||
tags: ${{ steps.meta.outputs.tags }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
cache-from: type=gha
|
||||
cache-to: type=gha,mode=max
|
||||
|
||||
- name: Set full image reference
|
||||
id: full_image
|
||||
run: |
|
||||
TAG="${GITHUB_REF_NAME#v}"
|
||||
echo "image=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${TAG}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# ---- Deploy to VPS ----
|
||||
deploy:
|
||||
name: Deploy
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
environment: production
|
||||
concurrency:
|
||||
group: deploy-production
|
||||
cancel-in-progress: false
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# ---- Terraform: provision infrastructure ----
|
||||
- name: Setup Terraform
|
||||
uses: hashicorp/setup-terraform@v3
|
||||
with:
|
||||
terraform_wrapper: false
|
||||
|
||||
- name: Terraform init
|
||||
working-directory: deploy/terraform
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_ACCESS_KEY }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_SECRET_KEY }}
|
||||
run: |
|
||||
terraform init \
|
||||
-backend-config="bucket=${{ secrets.TF_STATE_BUCKET }}" \
|
||||
-backend-config="endpoints={s3=\"${{ secrets.TF_STATE_ENDPOINT }}\"}"
|
||||
|
||||
- name: Terraform apply
|
||||
working-directory: deploy/terraform
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_ACCESS_KEY }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_SECRET_KEY }}
|
||||
run: |
|
||||
terraform apply -auto-approve \
|
||||
-var="vultr_api_key=${{ secrets.VULTR_API_KEY }}" \
|
||||
-var="ssh_public_key=${{ secrets.SSH_PUBLIC_KEY }}"
|
||||
|
||||
- name: Extract VPS IP (masked)
|
||||
id: vps
|
||||
working-directory: deploy/terraform
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: ${{ secrets.TF_STATE_ACCESS_KEY }}
|
||||
AWS_SECRET_ACCESS_KEY: ${{ secrets.TF_STATE_SECRET_KEY }}
|
||||
run: |
|
||||
VPS_IP=$(terraform output -raw instance_ip)
|
||||
echo "::add-mask::${VPS_IP}"
|
||||
echo "ip=${VPS_IP}" >> "$GITHUB_OUTPUT"
|
||||
|
||||
# ---- SSH setup ----
|
||||
- name: Setup SSH key
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
|
||||
chmod 600 ~/.ssh/deploy_key
|
||||
ssh-keyscan -H "${{ steps.vps.outputs.ip }}" >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
|
||||
# ---- Detect first deployment ----
|
||||
- name: Detect first deployment
|
||||
id: detect
|
||||
run: |
|
||||
set +e
|
||||
ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new \
|
||||
-i ~/.ssh/deploy_key root@"${{ steps.vps.outputs.ip }}" \
|
||||
"test -f /opt/rustyip/.active_color"
|
||||
if [ $? -ne 0 ]; then
|
||||
echo "first_deploy=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "first_deploy=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
# ---- Ansible: configure VPS and deploy ----
|
||||
- name: Install Ansible
|
||||
run: pip install ansible
|
||||
|
||||
- name: Generate Ansible inventory
|
||||
run: |
|
||||
cat > deploy/ansible/inventory.yml <<EOF
|
||||
all:
|
||||
hosts:
|
||||
vps:
|
||||
ansible_host: "${{ steps.vps.outputs.ip }}"
|
||||
ansible_user: root
|
||||
ansible_ssh_private_key_file: ~/.ssh/deploy_key
|
||||
ansible_ssh_common_args: "-o StrictHostKeyChecking=accept-new"
|
||||
EOF
|
||||
|
||||
- name: Run Ansible playbook
|
||||
working-directory: deploy/ansible
|
||||
env:
|
||||
APP_IMAGE: ${{ needs.build.outputs.image_full }}
|
||||
SITE_DOMAIN: ${{ secrets.SITE_DOMAIN }}
|
||||
DB_UPDATE_URL: ${{ secrets.DB_UPDATE_URL }}
|
||||
ORIGIN_CERT: ${{ secrets.ORIGIN_CERT }}
|
||||
ORIGIN_KEY: ${{ secrets.ORIGIN_KEY }}
|
||||
GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
GHCR_USER: ${{ github.actor }}
|
||||
FIRST_DEPLOY: ${{ steps.detect.outputs.first_deploy }}
|
||||
run: |
|
||||
ansible-playbook -i inventory.yml playbook.yml
|
||||
|
||||
# ---- Verify deployment ----
|
||||
- name: Verify deployment health
|
||||
run: |
|
||||
DEPLOY_COLOR=$(ssh -i ~/.ssh/deploy_key root@"${{ steps.vps.outputs.ip }}" \
|
||||
"cat /opt/rustyip/.active_color")
|
||||
for i in $(seq 1 15); do
|
||||
status=$(ssh -i ~/.ssh/deploy_key root@"${{ steps.vps.outputs.ip }}" \
|
||||
"docker inspect --format='{{ '{{' }}.State.Health.Status{{ '}}' }}' rustyip-app-${DEPLOY_COLOR}" 2>/dev/null)
|
||||
if [ "$status" = "healthy" ]; then
|
||||
echo "Deployment verified: app-${DEPLOY_COLOR} is healthy"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for health check... (attempt $i/15)"
|
||||
sleep 4
|
||||
done
|
||||
echo "Health check failed after 60 seconds"
|
||||
exit 1
|
||||
|
||||
# ---- Cleanup ----
|
||||
- name: Cleanup SSH key
|
||||
if: always()
|
||||
run: rm -f ~/.ssh/deploy_key
|
||||
Reference in New Issue
Block a user