chore: add ssh deploy workflow

2026-06-21 22:14:05 +02:00
parent a2df8504f5
commit 03b8ebe763
2 changed files with 174 additions and 0 deletions
@@ -0,0 +1,87 @@
+name: deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-main
+  cancel-in-progress: false
+
+jobs:
+  redeploy:
+    runs-on: [self-hosted, linux, arch, homelab, prod]
+    steps:
+      - name: Redeploy workstation
+        shell: bash
+        env:
+          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
+          DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }}
+          DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
+          DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          set -euo pipefail
+
+          : "${DEPLOY_HOST:?missing DEPLOY_HOST}"
+          : "${DEPLOY_USER:?missing DEPLOY_USER}"
+          : "${DEPLOY_KEY:?missing DEPLOY_SSH_KEY}"
+
+          deploy_port="${DEPLOY_PORT:-22}"
+          deploy_path="${DEPLOY_PATH:-/srv/homelab}"
+
+          ssh_key="$RUNNER_TEMP/deploy_key"
+          mkdir -p "$RUNNER_TEMP"
+          printf '%s\n' "$DEPLOY_KEY" > "$ssh_key"
+          chmod 600 "$ssh_key"
+
+          ssh_opts=(
+            -i "$ssh_key"
+            -p "$deploy_port"
+            -o BatchMode=yes
+            -o StrictHostKeyChecking=accept-new
+          )
+
+          ssh "${ssh_opts[@]}" "${DEPLOY_USER}@${DEPLOY_HOST}" "DEPLOY_PATH=$(printf '%q' \"$deploy_path\") bash -se" <<'EOF'
+          set -euo pipefail
+
+          repo="${DEPLOY_PATH:-/srv/homelab}"
+
+          if [ ! -d "$repo/.git" ]; then
+            echo "Repository not found at $repo"
+            exit 1
+          fi
+
+          git -C "$repo" fetch origin main
+          git -C "$repo" reset --hard origin/main
+
+          echo "Redeploying docker compose stacks"
+          while IFS= read -r compose_file; do
+            [ -n "$compose_file" ] || continue
+            compose_dir=$(dirname "$compose_file")
+            echo "  - $compose_dir"
+            docker compose -f "$compose_file" up -d --pull always --remove-orphans
+          done < <(find "$repo" -type f \( -name 'compose.yaml' -o -name 'compose.yml' \) | sort)
+
+          echo "Applying Kubernetes manifests"
+          while IFS= read -r manifest; do
+            [ -n "$manifest" ] || continue
+            echo "  - $manifest"
+            kubectl apply -f "$manifest"
+          done < <(
+            find "$repo" -type f \
+              -path '*/k8s/*' \
+              \( -name '*.yaml' -o -name '*.yml' \) \
+              ! -name 'kustomization.yaml' \
+              ! -name 'kustomization.yml' \
+              ! -name '*.example.yaml' \
+              ! -name '*.example.yml' \
+              ! -name '*values.yaml' \
+              ! -name '*values.yml' \
+              ! -name 'patch-*.yaml' \
+              ! -name 'patch-*.yml' \
+            | sort
+          )
+          EOF