nix/.forgejo/workflows/cron/auto-deploy-rs.yml

# yamllint disable rule:line-length rule:truthy
---
name: Cron - deploy-rs
run-name: ${{ github.actor }} - deploy-rs
on:
  schedule:
    - cron: '0 2 * * 0'
    # “At 02:00 Sunday."

jobs:
  deploy-rs:
    runs-on: ubuntu
    container:
      image: ubuntu:24.04
      options: --mount type=bind,src=/dev/net/tun,dst=/dev/net/tun --privileged
    steps:
      - name: "Setup: Runner"
        run: |
          set -x
          apt update -y
          apt install git nodejs nix-bin sudo curl -y
          git config --global user.email ${{github.actor}}
          git config --global user.name "Forgejo Runner"
          echo "100.64.0.13 gotify.sysctl.io" >> /etc/hosts

      - name: "Setup:  Tailscale Repo"
        run: |
          set -x
          mkdir -p --mode=0755 /usr/share/keyrings
          curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/lunar.noarmor.gpg | sudo tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
          curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/lunar.tailscale-keyring.list | sudo tee /etc/apt/sources.list.d/tailscale.list
          apt update -y
          apt install tailscale -y

      - name: "Setup: SSH"
        run: |
          rm -rf /root/.ssh
          mkdir /root/.ssh
          echo "${{ secrets.SSH_PUBLIC_KEY }}"  > /root/.ssh/id_ed25519.pub
          echo "${{ secrets.SSH_PRIVATE_KEY }}" > /root/.ssh/id_ed25519
          chmod 700 /root/.ssh
          chmod 600 /root/.ssh/id_ed25519
          chmod 644 /root/.ssh/id_ed25519.pub

      - name: "Setup:  Headscale Network"
        run: |
          set -x
          sudo tailscaled --cleanup
          sudo tailscaled --state=mem: 2> ~/tailscaled.log &
          sudo tailscale up \
              --login-server=https://headscale.sysctl.io \
              --accept-routes \
              --accept-dns \
              --authkey ${{ secrets.TAILSCALE_KEY }}  \
              --hostname forgejo-runner \
              --advertise-tags "tag:forgejo,tag:container,tag:ephemeral"
          sudo tailscale status
          sudo tailscale netcheck

      - name: "nixos-version (Pre)"
        run: |
          ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01 \
              "
              nixos-version
              "

      - name: "SSH and Deploy"
        run: |
          ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01 \
              "
              set -x
              eval (ssh-agent -c)
              ssh-add
              env | grep SSH
              cd /etc/nixos/git
              git pull
              ssh -qA osaka-linode-01     'sudo systemctl restart podman-derp'
              ssh -qA frankfurt-linode-01 'sudo systemctl restart podman-derp'
              ssh -qA milan-linode-01     'sudo systemctl restart podman-derp'
              ssh -qA warsaw-ovh-01       'sudo systemctl restart container@rdesktop'
              sleep 30
              deploy -sd
              deploy -sd
              "

      - name: "nixos-version (Post)"
        run: |
          ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01 \
              "
              nixos-version
              "
          tailscale down

      - if: success()
        uses: https://git.sysctl.io/actions/gotify-action@master
        with:
          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
          gotify_app_token: '${{ secrets.GOTIFY_TOKEN }}'
          notification_title: '[ ${{ github.repository }}: ${{ github.workflow }} ] NixOS Deployed'
          notification_message: 'Deployment completed successfully.'
        name: "Send Notification - Success"
      - if: failure()
        uses: https://git.sysctl.io/actions/gotify-action@master
        with:
          gotify_api_base: '${{ secrets.GOTIFY_URL }}'
          gotify_app_token: '${{ secrets.GOTIFY_TOKEN }}'
          notification_title: '[ ${{ github.repository }}: ${{ github.workflow }} ] Deployment Failed'
          notification_message: 'Your deployment has failed.  Check Forgejo.'
        name: "Send Notification - Failure"