fix: replace tailscale authkey use with oauth (#76)

.github/workflows/deploy-on-merge.yml

@@ -8,174 +8,75 @@ on:
       - 'terraform/**'
 
 # Requires these repository secrets:
-#   TAILSCALE_AUTHKEY  — Tailscale auth key for mesh access
+#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
-#   SSH_PRIVATE_KEY    — SSH key authorized on target hosts
+#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
-#   AGE_SECRET_KEY     — age private key for SOPS decryption
+#   SSH_PRIVATE_KEY      — SSH key authorized on target hosts
+#   AGE_SECRET_KEY       — age private key for SOPS decryption
 
 jobs:
-  deploy:
+  discover:
-    name: Deploy
+    name: Discover hosts
     runs-on: ubuntu-latest
-    environment: production
+    outputs:
+      hosts: ${{ steps.discover.outputs.hosts }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
 
-      - name: Determine deploy scope from changed files
+      - name: Read hosts from inventory
-        id: scope
+        id: discover
         run: |
-          # Get files changed in this push
+          HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
-          CHANGED=$(git diff --name-only HEAD~1 HEAD)
+          echo "hosts=$HOSTS" >> "$GITHUB_OUTPUT"
-          echo "Changed files:"
-          echo "$CHANGED"
-          echo ""
 
-          HOSTS=""
+  deploy:
-          DEPLOY_ALL=false
+    needs: discover
-
+    name: Deploy → ${{ matrix.host }}
-          while IFS= read -r file; do
+    runs-on: ubuntu-latest
-            [ -z "$file" ] && continue
+    environment: production
-            case "$file" in
+    permissions:
-
+      id-token: write
-              # --- Roles that target ALL hosts → full fleet deploy ---
+    strategy:
-              ansible/roles/common/*|ansible/roles/dotfiles/*|ansible/roles/node_exporter/*)
+      matrix:
-                DEPLOY_ALL=true ;;
+        host: ${{ fromJson(needs.discover.outputs.hosts) }}
-
+      fail-fast: false
-              # --- Playbook, inventory, or requirements → full fleet ---
+    steps:
-              ansible/deploy.yml|ansible/inventory/hosts.ini|ansible/requirements.yml)
+      - uses: actions/checkout@v4
-                DEPLOY_ALL=true ;;
-
-              # --- host_vars → that specific host ---
-              ansible/inventory/host_vars/helsinki-a.yml)   HOSTS="$HOSTS helsinki-a" ;;
-              ansible/inventory/host_vars/london-b.yml)     HOSTS="$HOSTS london-b" ;;
-              ansible/inventory/host_vars/london-a.yml)     HOSTS="$HOSTS london-a" ;;
-              ansible/inventory/host_vars/nuremberg-a.yml)  HOSTS="$HOSTS nuremberg-a" ;;
-              ansible/inventory/host_vars/copenhagen-a.yml) HOSTS="$HOSTS copenhagen-a" ;;
-              ansible/inventory/host_vars/copenhagen-c.yml) HOSTS="$HOSTS copenhagen-c" ;;
-
-              # --- Roles → mapped hosts ---
-              ansible/roles/caddy/*|ansible/roles/status_page/*)
-                HOSTS="$HOSTS helsinki-a" ;;
-              ansible/roles/docker/*)
-                HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
-              ansible/roles/docker_services/*)
-                HOSTS="$HOSTS helsinki-a london-b nuremberg-a copenhagen-a" ;;
-              ansible/roles/media_stack/*|ansible/roles/backup/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/roles/firewall_alpine/*)
-                HOSTS="$HOSTS nuremberg-a" ;;
-              ansible/roles/systemd_exporter/*)
-                HOSTS="$HOSTS london-b copenhagen-a" ;;
-              ansible/roles/systemd_services/*)
-                HOSTS="$HOSTS helsinki-a copenhagen-a" ;;
-              ansible/roles/zfs/*)
-                HOSTS="$HOSTS london-a london-b" ;;
-
-              # --- Services → mapped hosts ---
-              # helsinki-a services
-              ansible/services/caddy/*|ansible/services/status-page/*)
-                HOSTS="$HOSTS helsinki-a" ;;
-              ansible/services/authelia/*|ansible/services/forgejo/*|ansible/services/bitwarden/*)
-                HOSTS="$HOSTS helsinki-a" ;;
-              ansible/services/thiswebsitedoesnotexist/*)
-                HOSTS="$HOSTS helsinki-a" ;;
-
-              # london-a services (monitoring)
-              ansible/services/prometheus/*|ansible/services/grafana/*)
-                HOSTS="$HOSTS london-a" ;;
-
-              # london-b services (media/storage)
-              ansible/services/nextcloud-aio/*|ansible/services/jellyseerr/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/services/navidrome/*|ansible/services/slskd/*|ansible/services/miniflux/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/services/smartctl-exporter/*|ansible/services/plex-exporter/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/services/transmission/*|ansible/services/radarr/*|ansible/services/prowlarr/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/services/lidarr/*|ansible/services/readarr/*|ansible/services/whisparr/*)
-                HOSTS="$HOSTS london-b" ;;
-              ansible/services/samba/*|ansible/services/vsftpd/*)
-                HOSTS="$HOSTS london-b" ;;
-
-              # nuremberg-a services (mail)
-              ansible/services/poste-io/*)
-                HOSTS="$HOSTS nuremberg-a" ;;
-
-              # copenhagen-a services (gaming)
-              ansible/services/minecraft/*|ansible/services/mangos-*)
-                HOSTS="$HOSTS copenhagen-a" ;;
-
-              # --- Unmapped ansible paths → full fleet as safety fallback ---
-              ansible/*)
-                echo "⚠️  Unmapped path: $file — deploying to all"
-                DEPLOY_ALL=true ;;
-
-              # Non-ansible files (docs, Makefile, etc.) → skip
-              *) ;;
-            esac
-          done <<< "$CHANGED"
-
-          if [ "$DEPLOY_ALL" = "true" ] || [ -z "$HOSTS" ]; then
-            echo "Deploy scope: ALL hosts"
-            echo "limit=" >> "$GITHUB_OUTPUT"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          else
-            UNIQUE=$(echo "$HOSTS" | tr ' ' '\n' | grep -v '^$' | sort -u | tr '\n' ',' | sed 's/,$//')
-            echo "Deploy scope: --limit $UNIQUE"
-            echo "limit=$UNIQUE" >> "$GITHUB_OUTPUT"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
 
       - name: Set up Tailscale
-        if: steps.scope.outputs.skip != 'true'
+        uses: tailscale/github-action@v4
-        uses: tailscale/github-action@v3
         with:
-          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
+          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
+          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
+          tags: tag:ci
 
       - name: Set up SSH key
-        if: steps.scope.outputs.skip != 'true'
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
+          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
+          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Install tools
-        if: steps.scope.outputs.skip != 'true'
         run: |
           pip install ansible
           wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
           sudo dpkg -i /tmp/sops.deb
 
       - name: Install Ansible collections
-        if: steps.scope.outputs.skip != 'true'
         run: ansible-galaxy install -r ansible/requirements.yml
 
       - name: Decrypt secrets
-        if: steps.scope.outputs.skip != 'true'
         env:
           SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: |
-          # Decrypt all .enc. files to their plaintext counterparts
           find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
             out="${f/.enc/}"
             sops -d "$f" > "$out"
-            echo "Decrypted: $f -> $out"
           done
 
       - name: Run playbook
-        if: steps.scope.outputs.skip != 'true'
         working-directory: ansible/
         env:
           ANSIBLE_HOST_KEY_CHECKING: "false"
-        run: |
+        run: ansible-playbook deploy.yml --limit "${{ matrix.host }}"
-          LIMIT="${{ steps.scope.outputs.limit }}"
-          if [ -n "$LIMIT" ]; then
-            echo "🎯 Deploying with --limit $LIMIT"
-            ansible-playbook deploy.yml --limit "$LIMIT"
-          else
-            echo "🌐 Deploying to all hosts"
-            ansible-playbook deploy.yml
-          fi

.github/workflows/deploy.yml

@@ -18,29 +18,60 @@ on:
         default: true
 
 # Requires these repository secrets:
-#   TAILSCALE_AUTHKEY  — Tailscale auth key for mesh access
+#   TAILSCALE_CLIENT_ID  — Tailscale OAuth client ID (federated identity)
-#   SSH_PRIVATE_KEY    — SSH key authorized on target hosts
+#   TAILSCALE_AUDIENCE   — Tailscale federated identity audience
-#   AGE_SECRET_KEY     — age private key for SOPS decryption
+#   SSH_PRIVATE_KEY      — SSH key authorized on target hosts
+#   AGE_SECRET_KEY       — age private key for SOPS decryption
 
 jobs:
+  prepare:
+    name: Prepare matrix
+    runs-on: ubuntu-latest
+    outputs:
+      hosts: ${{ steps.prepare.outputs.hosts }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build host matrix
+        id: prepare
+        run: |
+          ALL_HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
+          TARGET="${{ inputs.target }}"
+          if [ "$TARGET" = "all" ]; then
+            echo "hosts=$ALL_HOSTS" >> "$GITHUB_OUTPUT"
+          else
+            JSON=$(echo "$TARGET" | tr ',' '\n' | tr -d ' ' | grep -v '^$' | jq -R . | jq -cs .)
+            echo "hosts=$JSON" >> "$GITHUB_OUTPUT"
+          fi
+
   deploy:
-    name: Deploy to ${{ inputs.target }}
+    needs: prepare
+    name: Deploy ${{ inputs.playbook }} → ${{ matrix.host }}
     runs-on: ubuntu-latest
     environment: production  # requires manual approval in repo settings
+    permissions:
+      id-token: write
+    strategy:
+      matrix:
+        host: ${{ fromJson(needs.prepare.outputs.hosts) }}
+      fail-fast: false
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Tailscale
-        uses: tailscale/github-action@v3
+        uses: tailscale/github-action@v4
         with:
-          authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
+          oauth-client-id: ${{ secrets.TAILSCALE_CLIENT_ID }}
+          audience: ${{ secrets.TAILSCALE_AUDIENCE }}
+          tags: tag:ci
 
       - name: Set up SSH key
         run: |
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H 100.67.6.27 100.84.65.101 100.122.219.41 100.117.235.28 100.89.206.60 100.115.45.53 >> ~/.ssh/known_hosts 2>/dev/null || true
+          IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
+          ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
 
       - name: Install tools
         run: |
@@ -55,11 +86,9 @@ jobs:
         env:
           SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
         run: |
-          # Decrypt all .enc. files to their plaintext counterparts
           find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
             out="${f/.enc/}"
             sops -d "$f" > "$out"
-            echo "Decrypted: $f -> $out"
           done
 
       - name: Run playbook
@@ -68,17 +97,13 @@ jobs:
           ANSIBLE_HOST_KEY_CHECKING: "false"
         run: |
           PLAYBOOK="${{ inputs.playbook }}"
-          # Normalize: strip prefix/suffix, then re-add as needed
           PLAYBOOK="${PLAYBOOK#playbooks/}"
           PLAYBOOK="${PLAYBOOK%.yml}.yml"
           if [ "$PLAYBOOK" != "deploy.yml" ]; then
             PLAYBOOK="playbooks/$PLAYBOOK"
           fi
 
-          ARGS=""
+          ARGS="--limit ${{ matrix.host }}"
-          if [ "${{ inputs.target }}" != "all" ]; then
-            ARGS="--limit ${{ inputs.target }}"
-          fi
           if [ "${{ inputs.dry_run }}" = "true" ]; then
             ARGS="$ARGS --check --diff"
           fi