ahmza
eb67d6361e
Temporary diagnostic step before 'Netbird Connect' that checks secret presence (masked), DNS resolution, HTTPS reachability to the management API, and the signal server TCP port from the runner. Helps distinguish DNS/connectivity issues from auth/registration failures behind the recurring 'netbird up' DeadlineExceeded error. Marked continue-on-error so it never blocks the build.
109 lines
3.6 KiB
YAML
109 lines
3.6 KiB
YAML
name: Build Hugo
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
REGISTRY: tea.ahmza.com
|
|
IMAGE_NAME: ${{ gitea.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.GITEATOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64, linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
|
|
steps:
|
|
- name: Debug Netbird connectivity
|
|
env:
|
|
NB_URL: ${{ secrets.NETBIRD_URL }}
|
|
NB_KEY: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
run: |
|
|
echo "=== Secret presence (values are masked) ==="
|
|
echo "NETBIRD_URL length: ${#NB_URL}"
|
|
echo "NETBIRD_SETUP_KEY length: ${#NB_KEY}"
|
|
if [ -z "$NB_URL" ]; then echo "WARNING: NETBIRD_URL is EMPTY"; fi
|
|
if [ -z "$NB_KEY" ]; then echo "WARNING: NETBIRD_SETUP_KEY is EMPTY"; fi
|
|
|
|
# Derive host from the URL without printing the full URL.
|
|
host="$(printf '%s' "$NB_URL" | sed -E 's#^[a-zA-Z]+://##; s#[:/].*$##')"
|
|
echo "Derived management host: ${host:-<none>}"
|
|
|
|
echo "=== DNS resolution ==="
|
|
getent hosts "$host" || nslookup "$host" || echo "DNS resolution FAILED for $host"
|
|
|
|
echo "=== HTTPS reachability (management API, :443) ==="
|
|
curl -sS -o /dev/null -w "HTTP %{http_code} connect=%{time_connect}s total=%{time_total}s\n" \
|
|
--max-time 15 "https://${host}/" || echo "curl to management API FAILED"
|
|
|
|
echo "=== Signal server port (:10000 gRPC) TCP check ==="
|
|
timeout 10 bash -c "cat < /dev/null > /dev/tcp/${host}/10000" \
|
|
&& echo "TCP :10000 reachable" || echo "TCP :10000 NOT reachable (signal server / firewall?)"
|
|
|
|
echo "=== done (this step never fails the build) ==="
|
|
continue-on-error: true
|
|
|
|
- name: Netbird Connect
|
|
uses: Alemiz112/netbird-connect@v1
|
|
with:
|
|
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
hostname: 'gitea-actions-blog'
|
|
management-url: ${{ secrets.NETBIRD_URL }}
|
|
|
|
- name: Deploy to RPIC-Cluster
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.RPIC_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.RPIC_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'kubectl rollout restart deployment blog -n blog-ahmza-com'
|
|
|
|
- name: Deploy to Gimli
|
|
uses: appleboy/ssh-action@v1
|
|
with:
|
|
host: ${{ secrets.GIMLI_HOST }}
|
|
username: ${{ secrets.SSH_USER }}
|
|
key: ${{ secrets.GIMLI_KEY }}
|
|
port: ${{ secrets.SSH_PORT }}
|
|
script: 'docker compose down && docker compose pull && docker compose up -d'
|