mirror of
https://github.com/RWejlgaard/pez-infra.git
synced 2026-05-06 04:14:43 +00:00
105 lines
3.3 KiB
YAML
105 lines
3.3 KiB
YAML
name: Deploy (manual)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
target:
|
|
description: 'Target host (e.g. helsinki-a, london-b, all)'
|
|
required: true
|
|
type: string
|
|
playbook:
|
|
description: 'Ansible playbook to run (e.g. site.yml, update.yml)'
|
|
required: true
|
|
type: string
|
|
dry_run:
|
|
description: 'Dry run (--check mode)'
|
|
required: false
|
|
type: boolean
|
|
default: true
|
|
|
|
# Requires these repository secrets:
|
|
# TAILSCALE_AUTHKEY — Tailscale auth key for mesh access
|
|
# SSH_PRIVATE_KEY — SSH key authorized on target hosts
|
|
# AGE_SECRET_KEY — age private key for SOPS decryption
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Prepare matrix
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
hosts: ${{ steps.prepare.outputs.hosts }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build host matrix
|
|
id: prepare
|
|
run: |
|
|
ALL_HOSTS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk '{print $1}' | jq -R . | jq -cs .)
|
|
TARGET="${{ inputs.target }}"
|
|
if [ "$TARGET" = "all" ]; then
|
|
echo "hosts=$ALL_HOSTS" >> "$GITHUB_OUTPUT"
|
|
else
|
|
JSON=$(echo "$TARGET" | tr ',' '\n' | tr -d ' ' | grep -v '^$' | jq -R . | jq -cs .)
|
|
echo "hosts=$JSON" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
deploy:
|
|
needs: prepare
|
|
name: Deploy ${{ inputs.playbook }} → ${{ matrix.host }}
|
|
runs-on: ubuntu-latest
|
|
environment: production # requires manual approval in repo settings
|
|
strategy:
|
|
matrix:
|
|
host: ${{ fromJson(needs.prepare.outputs.hosts) }}
|
|
fail-fast: false
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Tailscale
|
|
uses: tailscale/github-action@v3
|
|
with:
|
|
authkey: ${{ secrets.TAILSCALE_AUTHKEY }}
|
|
|
|
- name: Set up SSH key
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
IPS=$(grep 'ansible_host=' ansible/inventory/hosts.ini | awk -F'ansible_host=' '{print $2}' | awk '{print $1}' | tr '\n' ' ')
|
|
ssh-keyscan -H $IPS >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
- name: Install tools
|
|
run: |
|
|
pip install ansible
|
|
wget -qO /tmp/sops.deb https://github.com/getsops/sops/releases/download/v3.9.4/sops_3.9.4_amd64.deb
|
|
sudo dpkg -i /tmp/sops.deb
|
|
|
|
- name: Install Ansible collections
|
|
run: ansible-galaxy install -r ansible/requirements.yml
|
|
|
|
- name: Decrypt secrets
|
|
env:
|
|
SOPS_AGE_KEY: ${{ secrets.AGE_SECRET_KEY }}
|
|
run: |
|
|
find . -name '*.enc.yml' -o -name '*.enc.yaml' -o -name '*.enc.env' | while read f; do
|
|
out="${f/.enc/}"
|
|
sops -d "$f" > "$out"
|
|
done
|
|
|
|
- name: Run playbook
|
|
working-directory: ansible/
|
|
env:
|
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
|
run: |
|
|
PLAYBOOK="${{ inputs.playbook }}"
|
|
PLAYBOOK="${PLAYBOOK#playbooks/}"
|
|
PLAYBOOK="${PLAYBOOK%.yml}.yml"
|
|
if [ "$PLAYBOOK" != "deploy.yml" ]; then
|
|
PLAYBOOK="playbooks/$PLAYBOOK"
|
|
fi
|
|
|
|
ARGS="--limit ${{ matrix.host }}"
|
|
if [ "${{ inputs.dry_run }}" = "true" ]; then
|
|
ARGS="$ARGS --check --diff"
|
|
fi
|
|
ansible-playbook "$PLAYBOOK" $ARGS
|