homelab/.gitea/workflows/deploy.yaml

name: deploy

on:
  push:
    branches:
      - main
  workflow_dispatch:

concurrency:
  group: deploy-main
  cancel-in-progress: false

jobs:
  redeploy:
    runs-on: [self-hosted, linux, arch, homelab, prod]
    steps:
      - name: Redeploy workstation
        shell: bash
        env:
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
        run: |
          set -euo pipefail

          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
          : "${DEPLOY_USER:?missing DEPLOY_USER}"
          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"

          deploy_port="${DEPLOY_PORT:-22}"
          deploy_path="${DEPLOY_PATH:-/srv/homelab}"

          ssh_key="$RUNNER_TEMP/deploy_key"
          mkdir -p "$RUNNER_TEMP"
          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
          chmod 600 "$ssh_key"

          ssh_opts=(
            -i "$ssh_key"
            -p "$deploy_port"
            -o BatchMode=yes
            -o StrictHostKeyChecking=accept-new
          )

          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") bash -se" <<'EOF'
          set -euo pipefail

          repo="${DEPLOY_PATH:-/srv/homelab}"

          if [ ! -d "$repo/.git" ]; then
            echo "Repository not found at $repo"
            exit 1
          fi

          git -C "$repo" fetch origin main
          git -C "$repo" reset --hard origin/main

          echo "Redeploying docker compose stacks"
          while IFS= read -r compose_file; do
            [ -n "$compose_file" ] || continue
            compose_dir=$(dirname "$compose_file")
            echo "  - $compose_dir"
            docker compose -f "$compose_file" up -d --pull always --remove-orphans
          done < <(find "$repo" -type f \( -name 'compose.yaml' -o -name 'compose.yml' \) | sort)

          echo "Applying Kubernetes manifests"
          while IFS= read -r manifest; do
            [ -n "$manifest" ] || continue
            echo "  - $manifest"
            kubectl apply -f "$manifest"
          done < <(
            find "$repo" -type f \
              -path '*/k8s/*' \
              \( -name '*.yaml' -o -name '*.yml' \) \
              ! -name 'kustomization.yaml' \
              ! -name 'kustomization.yml' \
              ! -name '*.example.yaml' \
              ! -name '*.example.yml' \
              ! -name '*values.yaml' \
              ! -name '*values.yml' \
              ! -name 'patch-*.yaml' \
              ! -name 'patch-*.yml' \
            | sort
          )
          EOF