271 lines
8.6 KiB
YAML
271 lines
8.6 KiB
YAML
name: Build Hugo
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
|
|
env:
|
|
REGISTRY: tea.ahmza.com
|
|
IMAGE_NAME: ${{ gitea.repository }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Login to Gitea Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.GITEATOKEN }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/arm64, linux/amd64
|
|
push: true
|
|
build-args: |
|
|
BUILDKIT_CONTEXT_KEEP_GIT_DIR=true
|
|
tags: |
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:latest
|
|
${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
# Registry-backed build cache. The GitHub-hosted 'gha' cache is not
|
|
# reachable from self-hosted Gitea runners, so store the cache as a
|
|
# dedicated tag in the same registry instead.
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository_owner }}/blog-ahmza-com:buildcache,mode=max
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
needs: build
|
|
|
|
steps:
|
|
- name: Pre-flight - verify VPN prerequisites
|
|
# NetBird brings up a WireGuard interface, which needs a TUN device and
|
|
# NET_ADMIN inside the job container. Without them, `netbird up` hangs
|
|
# ~50s and dies with a cryptic "DeadlineExceeded". Check up front so the
|
|
# failure is obvious and points at the fix (runner config.yaml).
|
|
run: |
|
|
echo "::group::NetBird prerequisites"
|
|
if [ -e /dev/net/tun ]; then
|
|
echo "OK: /dev/net/tun present"
|
|
else
|
|
echo "::error title=Missing TUN device::/dev/net/tun not found. Add --device=/dev/net/tun to the runner's config.yaml container.options."
|
|
exit 1
|
|
fi
|
|
if command -v capsh >/dev/null 2>&1; then
|
|
capsh --print | grep -q 'cap_net_admin' \
|
|
&& echo "OK: NET_ADMIN present" \
|
|
|| echo "::warning title=NET_ADMIN missing::netbird up will likely time out (DeadlineExceeded) configuring wt0. Add --cap-add=NET_ADMIN to the runner's config.yaml container.options."
|
|
else
|
|
echo "note: capsh unavailable, skipping NET_ADMIN check"
|
|
fi
|
|
echo "::endgroup::"
|
|
|
|
- name: Netbird Connect
|
|
id: netbird
|
|
timeout-minutes: 3
|
|
uses: Alemiz112/netbird-connect@v1
|
|
with:
|
|
setup-key: ${{ secrets.NETBIRD_SETUP_KEY }}
|
|
hostname: 'gitea-actions-blog'
|
|
management-url: ${{ secrets.NETBIRD_URL }}
|
|
|
|
- name: NetBird status
|
|
# Surface the actual peer/route state in the log and hard-assert that
|
|
# the management connection is up before attempting any deploys.
|
|
run: |
|
|
echo "::group::netbird status"
|
|
sudo netbird status --detail || true
|
|
echo "::endgroup::"
|
|
sudo netbird status | grep -q 'Management: Connected' \
|
|
&& echo "NetBird management connected." \
|
|
|| { echo "::error title=NetBird not connected::Management not connected after netbird up."; exit 1; }
|
|
|
|
- name: Install kubectl
|
|
uses: azure/setup-kubectl@v4
|
|
with:
|
|
version: 'v1.36.2'
|
|
|
|
- name: Configure Kubernetes access
|
|
env:
|
|
KUBE_TOKEN: ${{ secrets.KUBE_TOKEN }}
|
|
KUBE_CA_B64: ${{ secrets.KUBE_CA_B64 }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if [ -z "${KUBE_TOKEN:-}" ]; then
|
|
echo "::error::KUBE_TOKEN is empty"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -z "${KUBE_CA_B64:-}" ]; then
|
|
echo "::error::KUBE_CA_B64 is empty"
|
|
exit 1
|
|
fi
|
|
|
|
KUBECONFIG_PATH="${RUNNER_TEMP}/blog-kubeconfig"
|
|
CA_PATH="${RUNNER_TEMP}/kubernetes-ca.crt"
|
|
|
|
printf '%s' "$KUBE_CA_B64" \
|
|
| base64 -d \
|
|
> "$CA_PATH"
|
|
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
set-cluster talos-prod \
|
|
--server=https://10.10.10.210:6443 \
|
|
--tls-server-name=k8s-api.ahmza.com \
|
|
--certificate-authority="$CA_PATH" \
|
|
--embed-certs=true
|
|
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
set-credentials gitea-blog-deployer \
|
|
--token="$KUBE_TOKEN"
|
|
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
set-context blog-deployer@talos-prod \
|
|
--cluster=talos-prod \
|
|
--user=gitea-blog-deployer \
|
|
--namespace=blog-ahmza-com
|
|
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
use-context blog-deployer@talos-prod
|
|
|
|
chmod 600 "$KUBECONFIG_PATH"
|
|
|
|
echo "KUBECONFIG=$KUBECONFIG_PATH" >> "$GITHUB_ENV"
|
|
|
|
echo
|
|
echo "Kubernetes configuration:"
|
|
echo -n " API server: "
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
view --minify \
|
|
-o jsonpath='{.clusters[0].cluster.server}'
|
|
echo
|
|
|
|
echo -n " Context: "
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
current-context
|
|
|
|
echo
|
|
|
|
# Check that a bearer token really made it into the generated config
|
|
# without printing the token itself.
|
|
TOKEN_LENGTH="$(
|
|
kubectl config \
|
|
--kubeconfig="$KUBECONFIG_PATH" \
|
|
view --raw --minify \
|
|
-o jsonpath='{.users[0].user.token}' \
|
|
| wc -c
|
|
)"
|
|
|
|
echo " Token length: $TOKEN_LENGTH"
|
|
|
|
if [ "$TOKEN_LENGTH" -lt 100 ]; then
|
|
echo "::error::Generated kubeconfig does not contain a valid-looking token"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify Kubernetes access
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "Testing authenticated API access..."
|
|
kubectl -n blog-ahmza-com get deployment blog
|
|
|
|
echo
|
|
echo "Testing intended permissions..."
|
|
|
|
if kubectl auth can-i patch deployments \
|
|
-n blog-ahmza-com
|
|
then
|
|
echo "OK: deployment patch permitted"
|
|
else
|
|
echo "::error::Deployment patch unexpectedly denied"
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo "Testing privilege boundary..."
|
|
|
|
if kubectl auth can-i get secrets \
|
|
-n blog-ahmza-com
|
|
then
|
|
echo "::error::CI account unexpectedly has Secret read access"
|
|
exit 1
|
|
else
|
|
echo "OK: Secret read correctly denied"
|
|
fi
|
|
|
|
- name: Deploy to Kubernetes
|
|
env:
|
|
IMAGE: tea.ahmza.com/ahmza/blog-ahmza-com:${{ gitea.event.head_commit.id }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "Deploying image:"
|
|
echo " $IMAGE"
|
|
|
|
kubectl -n blog-ahmza-com \
|
|
set image deployment/blog \
|
|
blog="$IMAGE"
|
|
|
|
if ! kubectl -n blog-ahmza-com \
|
|
rollout status deployment/blog \
|
|
--timeout=5m
|
|
then
|
|
echo "::error::New deployment failed. Rolling back."
|
|
|
|
kubectl -n blog-ahmza-com \
|
|
rollout undo deployment/blog
|
|
|
|
kubectl -n blog-ahmza-com \
|
|
rollout status deployment/blog \
|
|
--timeout=5m
|
|
|
|
exit 1
|
|
fi
|
|
|
|
echo
|
|
echo "Deployment complete:"
|
|
kubectl -n blog-ahmza-com get pods -o wide
|
|
|
|
echo
|
|
echo "Running image:"
|
|
kubectl -n blog-ahmza-com \
|
|
get deployment blog \
|
|
-o jsonpath='{.spec.template.spec.containers[?(@.name=="blog")].image}'
|
|
echo
|
|
|
|
- name: NetBird diagnostics & disconnect
|
|
# Runs even on failure: captures final state for debugging and tears the
|
|
# peer down so stale 'gitea-actions-blog' peers don't pile up.
|
|
if: always()
|
|
run: |
|
|
echo "::group::final netbird status"
|
|
sudo netbird status --detail || echo "netbird unavailable"
|
|
echo "::endgroup::"
|
|
sudo netbird down || true
|