ahmza
b05814980f
The Netbird server multiplexes management + signal + dashboard behind Traefik on :443 (no separate :10000 signal port). The tunnel data plane is WireGuard on 51820/udp and STUN on 3478/udp. Update the debug step to probe those UDP ports plus a general outbound-UDP check (public STUN) to determine whether the runner network blocks UDP egress -- the likely cause of 'netbird up' timing out after the control plane connects fine.
137 lines
5.0 KiB
YAML
137 lines
5.0 KiB
YAML
name: Build Hugo
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
REGISTRY: tea.ahmza.com
|
|
IMAGE_NAME: ${{ gitea.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.GITEATOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64, linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
|
|
steps:
|
|
- name: Debug Netbird connectivity
|
|
env:
|
|
NB_URL: ${{ secrets.NETBIRD_URL }}
|
|
NB_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
run: |
|
|
echo "=== Secret presence (values are masked) ==="
|
|
echo "NETBIRD_URL length: ${#NB_URL}"
|
|
echo "NETBIRD_SETUP_KEY length: ${#NB_KEY}"
|
|
if [ -z "$NB_URL" ]; then echo "WARNING: NETBIRD_URL is EMPTY"; fi
|
|
if [ -z "$NB_KEY" ]; then echo "WARNING: NETBIRD_SETUP_KEY is EMPTY"; fi
|
|
|
|
# Derive host from the URL without printing the full URL.
|
|
host="$(printf '%s' "$NB_URL" | sed -E 's#^[a-zA-Z]+://##; s#[:/].*$##')"
|
|
echo "Derived management host: ${host:-<none>}"
|
|
|
|
echo "=== DNS resolution ==="
|
|
getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
|
|
|
|
# This deployment multiplexes management + signal + dashboard
|
|
# behind Traefik on :443 (gRPC-over-HTTP/2). There is no separate
|
|
# :10000 signal port. The data plane is WireGuard on 51820/udp and
|
|
# STUN on 3478/udp -- those are the ports that actually matter for
|
|
# 'netbird up' to complete the tunnel handshake.
|
|
|
|
echo "=== Control plane: HTTPS :443 (mgmt + signal via Traefik) ==="
|
|
curl -sS -o /dev/null -w "HTTP %{http_code} connect=%{time_connect}s total=%{time_total}s\n" \
|
|
--max-time 15 "https://${host}/" || echo "curl to :443 FAILED"
|
|
|
|
ip="$(getent hosts "$host" | awk '{print $1; exit}')"
|
|
echo "Resolved IP: ${ip:-<none>}"
|
|
|
|
echo "=== Data plane: WireGuard 51820/udp (nc UDP probe) ==="
|
|
if command -v nc >/dev/null 2>&1; then
|
|
nc -zu -w 5 "$host" 51820 \
|
|
&& echo "UDP 51820 appears OPEN/reachable" \
|
|
|| echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
|
|
else
|
|
echo "nc not available; installing..."
|
|
(apt-get update -qq && apt-get install -y -qq netcat-openbsd) >/dev/null 2>&1 || true
|
|
nc -zu -w 5 "$host" 51820 \
|
|
&& echo "UDP 51820 appears OPEN/reachable" \
|
|
|| echo "UDP 51820 probe returned non-zero (may be filtered/blocked -- prime suspect)"
|
|
fi
|
|
|
|
echo "=== STUN 3478/udp (nc UDP probe) ==="
|
|
nc -zu -w 5 "$host" 3478 \
|
|
&& echo "UDP 3478 appears OPEN/reachable" \
|
|
|| echo "UDP 3478 probe returned non-zero (may be filtered/blocked)"
|
|
|
|
echo "=== Outbound UDP allowed at all? (probe public STUN) ==="
|
|
nc -zu -w 5 stun.l.google.com 19302 \
|
|
&& echo "General outbound UDP works (reached Google STUN)" \
|
|
|| echo "General outbound UDP may be BLOCKED on this runner network"
|
|
|
|
echo "=== done (this step never fails the build) ==="
|
|
continue-on-error: true
|
|
|
|
- name: Netbird Connect
|
|
uses: Alemiz112/netbird-connect@v1
|
|
with:
|
|
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
hostname: 'gitea-actions-blog'
|
|
management-url: ${{ secrets.NETBIRD_URL }}
|
|
|
|
- name: Deploy to RPIC-Cluster
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.RPIC_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.RPIC_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
|
|
|
|
- name: Deploy to Gimli
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.GIMLI_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.GIMLI_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'docker compose down && docker compose pull && docker compose up -d'
|