renamed the stuff and stuff to do stff on stuff blablabla
This commit is contained in:
@@ -0,0 +1,172 @@
|
||||
name: Build Hugo
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ "main" ]
|
||||
|
||||
env:
|
||||
REGISTRY: tea.ahmza.com
|
||||
IMAGE_NAME: ${{ gitea.repository }}
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
attestations: write
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Checkout Repo
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Login to Gitea Container Registry
|
||||
uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ gitea.repository_owner }}
|
||||
password: ${{ secrets.GITEATOKEN }}
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v3
|
||||
|
||||
- name: Set up Docker Buildx
|
||||
uses: docker/setup-buildx-action@v3
|
||||
|
||||
- name: Build and push
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
platforms: linux/arm64, linux/amd64
|
||||
push: true
|
||||
build-args: |
|
||||
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
||||
tags: |
|
||||
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
||||
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
||||
# Registry-backed build cache. The GitHub-hosted 'gha' cache is not
|
||||
# reachable from self-hosted Gitea runners, so store the cache as a
|
||||
# dedicated tag in the same registry instead.
|
||||
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
|
||||
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
|
||||
steps:
|
||||
- name: Pre-flight - verify VPN prerequisites
|
||||
# NetBird brings up a WireGuard interface, which needs a TUN device and
|
||||
# NET_ADMIN inside the job container. Without them, `netbird up` hangs
|
||||
# ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
|
||||
# failure is obvious and points at the fix (runner config.yaml).
|
||||
run: |
|
||||
echo "::group::NetBird prerequisites"
|
||||
if [ -e /dev/net/tun ]; then
|
||||
echo "OK: /dev/net/tun present"
|
||||
else
|
||||
echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
|
||||
exit 1
|
||||
fi
|
||||
if command -v capsh >/dev/null 2>&1; then
|
||||
capsh --print | grep -q 'cap_net_admin' \
|
||||
&& echo "OK: NET_ADMIN present" \
|
||||
|| echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
|
||||
else
|
||||
echo "note: capsh unavailable, skipping NET_ADMIN check"
|
||||
fi
|
||||
echo "::endgroup::"
|
||||
|
||||
- name: Netbird Connect
|
||||
id: netbird
|
||||
timeout-minutes: 3
|
||||
uses: Alemiz112/netbird-connect@v1
|
||||
with:
|
||||
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
||||
hostname: 'gitea-actions-blog'
|
||||
management-url: ${{ secrets.NETBIRD_URL }}
|
||||
|
||||
- name: NetBird status
|
||||
# Surface the actual peer/route state in the log and hard-assert that
|
||||
# the management connection is up before attempting any deploys.
|
||||
run: |
|
||||
echo "::group::netbird status"
|
||||
sudo netbird status --detail || true
|
||||
echo "::endgroup::"
|
||||
sudo netbird status | grep -q 'Management: Connected' \
|
||||
&& echo "NetBird management connected." \
|
||||
|| { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
|
||||
|
||||
- name: Install kubectl
|
||||
uses: azure/setup-kubectl@v4
|
||||
with:
|
||||
version: 'v1.36.2'
|
||||
|
||||
- name: Configure Kubernetes access
|
||||
env:
|
||||
KUBE_CONFIG: ${{ secrets.TALOS_PROD_KUBE_CONFIG }}
|
||||
run: |
|
||||
mkdir -p "$HOME/.kube"
|
||||
|
||||
printf '%s' "$KUBE_CONFIG" \
|
||||
| base64 -d \
|
||||
> "$HOME/.kube/config"
|
||||
|
||||
chmod 600 "$HOME/.kube/config"
|
||||
|
||||
- name: Verify Kubernetes access
|
||||
run: |
|
||||
kubectl version --client
|
||||
|
||||
echo "Deployment patch:"
|
||||
kubectl auth can-i patch deployments \
|
||||
-n blog-ahmza-com
|
||||
|
||||
echo "Secret read:"
|
||||
kubectl auth can-i get secrets \
|
||||
-n blog-ahmza-com
|
||||
|
||||
kubectl -n blog-ahmza-com get deployment blog
|
||||
|
||||
- name: Deploy to Kubernetes
|
||||
env:
|
||||
IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
||||
run: |
|
||||
set -eu
|
||||
|
||||
echo "Deploying:"
|
||||
echo "$IMAGE"
|
||||
|
||||
kubectl -n blog-ahmza-com \
|
||||
set image deployment/blog \
|
||||
blog="$IMAGE"
|
||||
|
||||
if ! kubectl -n blog-ahmza-com \
|
||||
rollout status deployment/blog \
|
||||
--timeout=5m
|
||||
then
|
||||
echo "::error::Deployment failed; rolling back"
|
||||
|
||||
kubectl -n blog-ahmza-com \
|
||||
rollout undo deployment/blog
|
||||
|
||||
kubectl -n blog-ahmza-com \
|
||||
rollout status deployment/blog \
|
||||
--timeout=5m
|
||||
|
||||
exit 1
|
||||
fi
|
||||
|
||||
kubectl -n blog-ahmza-com get pods -o wide
|
||||
|
||||
|
||||
- name: NetBird diagnostics & disconnect
|
||||
# Runs even on failure: captures final state for debugging and tears the
|
||||
# peer down so stale 'gitea-actions-blog' peers don't pile up.
|
||||
if: always()
|
||||
run: |
|
||||
echo "::group::final netbird status"
|
||||
sudo netbird status --detail || echo "netbird unavailable"
|
||||
echo "::endgroup::"
|
||||
sudo netbird down || true
|
||||
Reference in New Issue
Block a user