mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-05-06 04:14:43 +00:00
fix: deploy using a matrix (#75)
This commit is contained in:
GitHub
parent
10bb940f87
commit
e9fbd41cb4
2 changed files with 51 additions and 135 deletions
148
.github/workflows/deploy-on-merge.yml
vendored
148
.github/workflows/deploy-on-merge.yml
vendored
|
|
@ -13,169 +13,65 @@ on:
|
|||
# AGE_SECRET_KEY — age private key for SOPS decryption
|
||||
|
||||
jobs:
|
||||
deploy:
|
||||
name: Deploy
|
||||
discover:
|
||||
name: Discover hosts
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
outputs:
|
||||
hosts: ${{ steps.discover.outputs.hosts }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 2
|
||||
|
||||
- name: Determine deploy scope from changed files
|
||||
id: scope
|
||||
- name: Read hosts from inventory
|
||||
id: discover
|
||||
run: |
|
||||
# Get files changed in this push
|
||||
CHANGED=$(git diff --name-only HEAD~1 HEAD)
|
||||
echo "Changed files:"
|
||||
echo "$CHANGED"
|
||||
echo ""
|
||||
HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
|
||||
echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"
|
||||
|
||||
HOSTS=""
|
||||
DEPLOY_ALL=false
|
||||
|
||||
while IFS= read -r file; do
|
||||
[ -z "$file" ] && continue
|
||||
case "$file" in
|
||||
|
||||
# --- Roles that target ALL hosts → full fleet deploy ---
|
||||
ansible/roles/common/*|ansible/roles/dotfiles/*|ansible/roles/node_exporter/*)
|
||||
DEPLOY_ALL=true ;;
|
||||
|
||||
# --- Playbook, inventory, or requirements → full fleet ---
|
||||
ansible/deploy.yml|ansible/inventory/hosts.ini|ansible/requirements.yml)
|
||||
DEPLOY_ALL=true ;;
|
||||
|
||||
# --- host_vars → that specific host ---
|
||||
ansible/inventory/host_vars/helsinki-a.yml) HOSTS="$HOSTS helsinki-a" ;;
|
||||
ansible/inventory/host_vars/london-b.yml) HOSTS="$HOSTS london-b" ;;
|
||||
ansible/inventory/host_vars/london-a.yml) HOSTS="$HOSTS london-a" ;;
|
||||
ansible/inventory/host_vars/nuremberg-a.yml) HOSTS="$HOSTS nuremberg-a" ;;
|
||||
ansible/inventory/host_vars/copenhagen-a.yml) HOSTS="$HOSTS copenhagen-a" ;;
|
||||
ansible/inventory/host_vars/copenhagen-c.yml) HOSTS="$HOSTS copenhagen-c" ;;
|
||||
|
||||
# --- Roles → mapped hosts ---
|
||||
ansible/roles/caddy/*|ansible/roles/status_page/*)
|
||||
HOSTS="$HOSTS helsinki-a" ;;
|
||||
ansible/roles/docker/*)
|
||||
HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
|
||||
ansible/roles/docker_services/*)
|
||||
HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
|
||||
ansible/roles/media_stack/*|ansible/roles/backup/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/roles/firewall_alpine/*)
|
||||
HOSTS="$HOSTS nuremberg-a" ;;
|
||||
ansible/roles/systemd_exporter/*)
|
||||
HOSTS="$HOSTS london-b copenhagen-a" ;;
|
||||
ansible/roles/systemd_services/*)
|
||||
HOSTS="$HOSTS helsinki-a copenhagen-a" ;;
|
||||
ansible/roles/zfs/*)
|
||||
HOSTS="$HOSTS london-a london-b" ;;
|
||||
|
||||
# --- Services → mapped hosts ---
|
||||
# helsinki-a services
|
||||
ansible/services/caddy/*|ansible/services/status-page/*)
|
||||
HOSTS="$HOSTS helsinki-a" ;;
|
||||
ansible/services/authelia/*|ansible/services/forgejo/*|ansible/services/bitwarden/*)
|
||||
HOSTS="$HOSTS helsinki-a" ;;
|
||||
ansible/services/thiswebsitedoesnotexist/*)
|
||||
HOSTS="$HOSTS helsinki-a" ;;
|
||||
|
||||
# london-a services (monitoring)
|
||||
ansible/services/prometheus/*|ansible/services/grafana/*)
|
||||
HOSTS="$HOSTS london-a" ;;
|
||||
|
||||
# london-b services (media/storage)
|
||||
ansible/services/nextcloud-aio/*|ansible/services/jellyseerr/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/services/navidrome/*|ansible/services/slskd/*|ansible/services/miniflux/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/services/smartctl-exporter/*|ansible/services/plex-exporter/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/services/transmission/*|ansible/services/radarr/*|ansible/services/prowlarr/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/services/lidarr/*|ansible/services/readarr/*|ansible/services/whisparr/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
ansible/services/samba/*|ansible/services/vsftpd/*)
|
||||
HOSTS="$HOSTS london-b" ;;
|
||||
|
||||
# nuremberg-a services (mail)
|
||||
ansible/services/poste-io/*)
|
||||
HOSTS="$HOSTS nuremberg-a" ;;
|
||||
|
||||
# copenhagen-a services (gaming)
|
||||
ansible/services/minecraft/*|ansible/services/mangos-*)
|
||||
HOSTS="$HOSTS copenhagen-a" ;;
|
||||
|
||||
# --- Unmapped ansible paths → full fleet as safety fallback ---
|
||||
ansible/*)
|
||||
echo "⚠️ Unmapped path: $file — deploying to all"
|
||||
DEPLOY_ALL=true ;;
|
||||
|
||||
# Non-ansible files (docs, Makefile, etc.) → skip
|
||||
*) ;;
|
||||
esac
|
||||
done <<< "$CHANGED"
|
||||
|
||||
if [ "$DEPLOY_ALL" = "true" ] || [ -z "$HOSTS" ]; then
|
||||
echo "Deploy scope: ALL hosts"
|
||||
echo "limit=" >> "$GITHUB_OUTPUT"
|
||||
echo "skip=false" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
UNIQUE=$(echo "$HOSTS" | tr ' ' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
|
||||
echo "Deploy scope: --limit $UNIQUE"
|
||||
echo "limit=$UNIQUE" >> "$GITHUB_OUTPUT"
|
||||
echo "skip=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
deploy:
|
||||
needs: discover
|
||||
name: Deploy → ${{ matrix.host }}
|
||||
runs-on: ubuntu-latest
|
||||
environment: production
|
||||
strategy:
|
||||
matrix:
|
||||
host: ${{ fromJson(needs.discover.outputs.hosts) }}
|
||||
fail-fast: false
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Tailscale
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
uses: tailscale/github-action@v3
|
||||
with:
|
||||
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
||||
|
||||
- name: Set up SSH key
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
run: |
|
||||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
|
||||
ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
|
||||
- name: Install tools
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
run: |
|
||||
pip install ansible
|
||||
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
||||
sudo dpkg -i /tmp/sops.deb
|
||||
|
||||
- name: Install Ansible collections
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
run: ansible-galaxy install -r ansible/requirements.yml
|
||||
|
||||
- name: Decrypt secrets
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
env:
|
||||
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||
run: |
|
||||
# Decrypt all .enc. files to their plaintext counterparts
|
||||
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
||||
out="${f/.enc/}"
|
||||
sops -d "$f" > "$out"
|
||||
echo "Decrypted: $f -> $out"
|
||||
done
|
||||
|
||||
- name: Run playbook
|
||||
if: steps.scope.outputs.skip != 'true'
|
||||
working-directory: ansible/
|
||||
env:
|
||||
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||
run: |
|
||||
LIMIT="${{ steps.scope.outputs.limit }}"
|
||||
if [ -n "$LIMIT" ]; then
|
||||
echo "🎯 Deploying with --limit $LIMIT"
|
||||
ansible-playbook deploy.yml --limit "$LIMIT"
|
||||
else
|
||||
echo "🌐 Deploying to all hosts"
|
||||
ansible-playbook deploy.yml
|
||||
fi
|
||||
run: ansible-playbook deploy.yml --limit "${{ matrix.host }}"
|
||||
|
|
|
|||
38
.github/workflows/deploy.yml
vendored
38
.github/workflows/deploy.yml
vendored
|
|
@ -23,10 +23,35 @@ on:
|
|||
# AGE_SECRET_KEY — age private key for SOPS decryption
|
||||
|
||||
jobs:
|
||||
prepare:
|
||||
name: Prepare matrix
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
hosts: ${{ steps.prepare.outputs.hosts }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Build host matrix
|
||||
id: prepare
|
||||
run: |
|
||||
ALL_HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
|
||||
TARGET="${{ inputs.target }}"
|
||||
if [ "$TARGET" = "all" ]; then
|
||||
echo "hosts=$ALL_HOSTS" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
JSON=$(echo "$TARGET" | tr ',' '\n' | tr -d ' ' | grep -v '^$' | jq -R . | jq -cs .)
|
||||
echo "hosts=$JSON" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
deploy:
|
||||
name: Deploy to ${{ inputs.target }}
|
||||
needs: prepare
|
||||
name: Deploy ${{ inputs.playbook }} → ${{ matrix.host }}
|
||||
runs-on: ubuntu-latest
|
||||
environment: production # requires manual approval in repo settings
|
||||
strategy:
|
||||
matrix:
|
||||
host: ${{ fromJson(needs.prepare.outputs.hosts) }}
|
||||
fail-fast: false
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
|
|
@ -40,7 +65,8 @@ jobs:
|
|||
mkdir -p ~/.ssh
|
||||
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
|
||||
ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
|
||||
|
||||
- name: Install tools
|
||||
run: |
|
||||
|
|
@ -55,11 +81,9 @@ jobs:
|
|||
env:
|
||||
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
||||
run: |
|
||||
# Decrypt all .enc. files to their plaintext counterparts
|
||||
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
||||
out="${f/.enc/}"
|
||||
sops -d "$f" > "$out"
|
||||
echo "Decrypted: $f -> $out"
|
||||
done
|
||||
|
||||
- name: Run playbook
|
||||
|
|
@ -68,17 +92,13 @@ jobs:
|
|||
ANSIBLE_HOST_KEY_CHECKING: "false"
|
||||
run: |
|
||||
PLAYBOOK="${{ inputs.playbook }}"
|
||||
# Normalize: strip prefix/suffix, then re-add as needed
|
||||
PLAYBOOK="${PLAYBOOK#playbooks/}"
|
||||
PLAYBOOK="${PLAYBOOK%.yml}.yml"
|
||||
if [ "$PLAYBOOK" != "deploy.yml" ]; then
|
||||
PLAYBOOK="playbooks/$PLAYBOOK"
|
||||
fi
|
||||
|
||||
ARGS=""
|
||||
if [ "${{ inputs.target }}" != "all" ]; then
|
||||
ARGS="--limit ${{ inputs.target }}"
|
||||
fi
|
||||
ARGS="--limit ${{ matrix.host }}"
|
||||
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
||||
ARGS="$ARGS --check --diff"
|
||||
fi
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue