blog-ahmza-com/.github/workflows/build-docker-images.yml

name: Build Hugo

on:
  push:
    branches: [ "main" ]

env:
  REGISTRY: tea.ahmza.com
  IMAGE_NAME: ${{ gitea.repository }}

jobs:
  build:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Login to Gitea Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ gitea.repository_owner }}
          password: ${{ secrets.GITEATOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/arm64, linux/amd64
          push: true
          build-args: |
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
          tags: |
            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
            ${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
          # Registry-backed build cache. The GitHub-hosted 'gha' cache is not
          # reachable from self-hosted Gitea runners, so store the cache as a
          # dedicated tag in the same registry instead.
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
  deploy:
    runs-on: ubuntu-latest
    needs: build

    steps:
      - name: Debug Netbird connectivity
        env:
          NB_URL: ${{ secrets.NETBIRD_URL }}
          NB_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
        run: |
          echo "=== Secret presence (values are masked) ==="
          echo "NETBIRD_URL length: ${#NB_URL}"
          echo "NETBIRD_SETUP_KEY length: ${#NB_KEY}"
          if [ -z "$NB_URL" ]; then echo "WARNING: NETBIRD_URL is EMPTY"; fi
          if [ -z "$NB_KEY" ]; then echo "WARNING: NETBIRD_SETUP_KEY is EMPTY"; fi

          # Derive host from the URL without printing the full URL.
          host="$(printf '%s' "$NB_URL" | sed -E 's#^[a-zA-Z]+://##; s#[:/].*$##')"
          echo "Derived management host: ${host:-<none>}"

          echo "=== DNS resolution ==="
          getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"

          echo "=== Control plane: HTTPS :443 reachable? ==="
          curl -sS -o /dev/null -w "HTTP %{http_code}  connect=%{time_connect}s\n" \
            --max-time 15 "https://${host}/" || echo "curl to :443 FAILED"

          # Other Netbird peers connect fine, so the server + 51820/udp are OK.
          # 'netbird up' still hangs on THIS runner, which points to the runner
          # container being unable to create the WireGuard tunnel interface.
          # WireGuard needs a TUN device + NET_ADMIN capability inside the
          # container; runner containers often lack these.

          echo "=== Runner: TUN device present? (/dev/net/tun) ==="
          if [ -c /dev/net/tun ]; then
            echo "/dev/net/tun EXISTS (char device)"
          else
            echo "/dev/net/tun MISSING -- WireGuard cannot create a tunnel (LIKELY CAUSE)"
          fi

          echo "=== Runner: effective capabilities (need NET_ADMIN) ==="
          if command -v capsh >/dev/null 2>&1; then
            capsh --print 2>/dev/null | grep -i 'Current:' || true
          else
            grep -i CapEff /proc/self/status || true
            echo "(decode with: capsh --decode=<hex>; NET_ADMIN is bit 12 / 0x1000)"
          fi

          echo "=== Runner: WireGuard tooling / kernel module ==="
          command -v wg >/dev/null 2>&1 && echo "wg present" || echo "wg NOT present"
          command -v wireguard-go >/dev/null 2>&1 && echo "wireguard-go (userspace) present" || echo "wireguard-go NOT present"
          (lsmod 2>/dev/null | grep -q wireguard && echo "kernel wireguard module loaded") || echo "kernel wireguard module NOT loaded (userspace fallback needed)"

          echo "=== Runner: can we create a dummy TUN? (definitive test) ==="
          if command -v ip >/dev/null 2>&1; then
            if ip tuntap add dev nbtest0 mode tun 2>/tmp/tunerr; then
              echo "SUCCESS: created TUN interface -> NET_ADMIN + TUN available"
              ip tuntap del dev nbtest0 mode tun 2>/dev/null || true
            else
              echo "FAILED to create TUN interface -> $(cat /tmp/tunerr)"
              echo "This is almost certainly why 'netbird up' hangs."
            fi
          else
            echo "iproute2 'ip' not available"
          fi

          echo "=== done (this step never fails the build) ==="
        continue-on-error: true

      - name: Netbird Connect
        uses: Alemiz112/netbird-connect@v1
        with:
          setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
          hostname: 'gitea-actions-blog'
          management-url: ${{ secrets.NETBIRD_URL }}

      - name: Deploy to RPIC-Cluster
        # RPIC cluster is temporarily out of service. Don't let its failure
        # block the Gimli deploy or fail the whole job. Remove this line once
        # the cluster is back.
        continue-on-error: true
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.RPIC_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.RPIC_KEY }}
          port: ${{ secrets.SSH_PORT }}
          script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'

      - name: Deploy to Gimli
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.GIMLI_HOST }}
          username: ${{ secrets.SSH_USER }}
          key: ${{ secrets.GIMLI_KEY }}
          port: ${{ secrets.SSH_PORT }}
          script: 'docker compose down && docker compose pull && docker compose up -d'