albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

update deployment workflow

Browse source
This commit is contained in:
albert 2025-02-04 19:09:55 -08:00
parent a010e77bf1
commit f47bf88e2d
Signed by: albert
GPG key ID: 3895DD267CA11BA9
3 changed files with 80 additions and 116 deletions

89
.forgejo/workflows/deploy-rs.yml
View file

@ -1,89 +0,0 @@
# yamllint disable rule:line-length rule:truthy
---
name: deploy-rs
run-name: ${{ github.actor }} - deploy-rs
on:
schedule:
- cron: '0 2 * * 0'
# “At 02:00 Sunday."
workflow_dispatch:
jobs:
deploy-rs:
runs-on: forgejo
container:
image: git.sysctl.io/albert/actions-container-images/headscale-runner:latest
options: --mount type=bind,src=/dev/net/tun,dst=/dev/net/tun --privileged
steps:
- name: "Install SSH Keys"
run: |
echo "${{ secrets.SSH_PUBLIC_KEY }}" > /root/.ssh/id_ed25519.pub
echo "${{ secrets.SSH_PRIVATE_KEY }}" > /root/.ssh/id_ed25519
chmod 700 /root/.ssh
chmod 600 /root/.ssh/id_ed25519
chmod 644 /root/.ssh/id_ed25519.pub
cat /etc/hosts.template > /etc/hosts
- name: "Connect to Headscale"
run: |
set -x
sudo tailscaled --cleanup
sudo tailscaled --no-logs-no-support --state=mem: 2> ~/tailscaled.log &
sudo tailscale up \
--login-server=https://headscale.sysctl.io \
--accept-routes \
--accept-dns \
--authkey ${{ secrets.TAILSCALE_KEY }} \
--hostname forgejo-runner \
--advertise-tags "tag:forgejo,tag:container,tag:ephemeral"
- name: "nixos-version (Pre)"
run: |
ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01.servers.hs.net \
"
nixos-version
"
- name: "SSH and Deploy"
run: |
ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01.servers.hs.net \
"
set -x
eval (ssh-agent -c)
ssh-add
env | grep SSH
cd /etc/nixos/git
git pull
ssh -qA osaka-linode-01.servers.hs.net 'sudo systemctl restart podman-derp'
ssh -qA frankfurt-linode-01.servers.hs.net 'sudo systemctl restart podman-derp'
ssh -qA milan-linode-01.servers.hs.net 'sudo systemctl restart podman-derp'
ssh -qA warsaw-ovh-01.servers.hs.net 'sudo systemctl restart container@rdesktop'
sleep 30
deploy -sd
deploy -sd
"
- name: "nixos-version (Post)"
run: |
ssh -q -A -o StrictHostKeyChecking=no albert@warsaw-ovh-01.servers.hs.net \
"
nixos-version
"
tailscale down
- if: success()
uses: https://git.sysctl.io/actions/gotify-action@master
with:
gotify_api_base: '${{ secrets.GOTIFY_URL }}'
gotify_app_token: '${{ secrets.GOTIFY_TOKEN }}'
notification_title: '[ ${{ github.repository }}: ${{ github.workflow }} ] NixOS Deployed'
notification_message: 'Deployment completed successfully.'
name: "Send Notification - Success"
- if: failure()
uses: https://git.sysctl.io/actions/gotify-action@master
with:
gotify_api_base: '${{ secrets.GOTIFY_URL }}'
gotify_app_token: '${{ secrets.GOTIFY_TOKEN }}'
notification_title: '[ ${{ github.repository }}: ${{ github.workflow }} ] Deployment Failed'
notification_message: 'Your deployment has failed. Check Forgejo.'
name: "Send Notification - Failure"

105
.forgejo/workflows/deploy.yml
View file

@ -1,34 +1,87 @@
name: Deploy Systems
on: [workflow_dispatch]
# yamllint disable rule:line-length rule:truthy
---
name: deploy-rs
run-name: ${{ github.actor }} - deploy-rs
on:
schedule:
- cron: '0 2 * * 0'
# “At 02:00 Sunday."
workflow_dispatch:
env:
SSH_OPTS: "-q -A -o StrictHostKeyChecking=no"
TS_OPTS: "--login-server=https://headscale.sysctl.io --accept-routes --accept-dns --hostname forgejo-runner"
jobs:
deploy:
runs-on: nix
deploy-rs:
runs-on: forgejo
container:
image: git.sysctl.io/albert/actions-images/nixos:latest
options: --mount type=bind,src=/dev/net/tun,dst=/dev/net/tun --privileged
steps:
- uses: https://git.madhouse-project.org/actions/nix/setup@v2
with:
nix_path: nixpkgs=flake:nixpkgs
- uses: https://git.madhouse-project.org/actions/nix/build@v2
with:
flake: .
targets: |
nixosConfigurations
- uses: https://git.madhouse-project.org/actions/nix/deploy-rs@v2
with:
ssh_user: ${{ secrets.SSH_USER }}
ssh_key: ${{ secrets.SSH_PRIVATE_KEY }}
confirm: true
- uses: https://git.sysctl.io/actions/gotify-action@master
- name: Add Gotify to Hosts
run: echo "100.64.0.5 gotify.sysctl.io" >> /etc/hosts
- name: Install SSH Keys
run: |
echo "${{ secrets.SSH_PRIVATE_KEY }}" > /root/.ssh/id_ed25519
chmod 700 /root/.ssh
chmod 600 /root/.ssh/id_ed25519
- name: Start Tailscale Daemon
run: |
tailscaled --no-logs-no-support --state=mem: &
- name: Connect to Headscale Network
run: |
tailscale up ${{ env.TS_OPTS }} --authkey ${{ secrets.TAILSCALE_KEY }}
- name: Restart Linode DERP Relay - Osaka
run: ssh ${{ env.SSH_OPTS }} albert@osaka-linode-01.servers.hs.net "sudo systemctl restart podman-derp"
- name: Restart Linode DERP Relay - Frankfurt
run: ssh ${{ env.SSH_OPTS }} albert@frankfurt-linode-01.servers.hs.net "sudo systemctl restart podman-derp"
- name: Restart Linode DERP Relay - Milan
run: ssh ${{ env.SSH_OPTS }} albert@milan-linode-01.servers.hs.net "sudo systemctl restart podman-derp"
- name: nixos-version (Pre)
run: ssh ${{ env.SSH_OPTS }} albert@warsaw-ovh-01.servers.hs.net "nixos-version"
- name: deploy-rs
run: deploy ${{}}
- name: nixos-version (Post)
run: ssh ${{ env.SSH_OPTS }} lbert@warsaw-ovh-01.servers.hs.net "nixos-version"
- name: Send Notification
uses: actions/gotify-action@master
if: always()
with:
gotify_api_base: ${{ secrets.GOTIFY_URL }}
gotify_app_token: ${{ secrets.GOTIFY_TOKEN }}
notification_title: |
[${{ github.repository }}] Deployment ${{ job.status }}
${{ github.workflow }}: ${{ job.status }}
notification_message: |
Status: ${{ job.status }}
Commit: ${{ github.sha }}
Repo: ${{ github.repository }}
Status: ${{ job.status }}
Commit: ${{ github.sha }}
steamdeck:
runs-on: forgejo
container:
image: git.sysctl.io/albert/actions-images/node:latest
steps:
- name: Add Gotify to Hosts
run: echo "100.64.0.5 gotify.sysctl.io" >> /etc/hosts
- name: Set up SSH Keys
run: echo "${{ secrets.SSH_PRIVATE_KEY }}" > /root/.ssh/id_ed25519
- name: Setup Node
uses: actions/setup-node@v4
- name: Update Repository
run: ssh -q -A albert@steamdeck.albert.hs.net "git -C /etc/nixos/git pull"
- run: ssh -qA -o StrictHostKeyChecking=no albert@steamdeck.albert.hs.net "nixos-version"
- name: Update NixOS
run: ssh -qA -o StrictHostKeyChecking=no albert@steamdeck.albert.hs.net "sudo nixos-rebuild switch --flake /etc/nixos/git"
- name: Update Home Manager
run: ssh -qA -o StrictHostKeyChecking=no albert@steamdeck.albert.hs.net "home-manager switch -b backup --flake /etc/nixos/git"
- run: ssh -qA -o StrictHostKeyChecking=no albert@steamdeck.albert.hs.net "nixos-version"
- name: Send Notification
uses: actions/gotify-action@master
if: always()
with:
gotify_api_base: ${{ secrets.GOTIFY_URL }}
gotify_app_token: ${{ secrets.GOTIFY_TOKEN }}
notification_title: |
${{ github.workflow }}: ${{ job.status }}
notification_message: |
Repo: ${{ github.repository }}
Status: ${{ job.status }}
Commit: ${{ github.sha }}

2
.forgejo/workflows/update-steamdeck.yml
View file

@ -7,7 +7,7 @@ on:
schedule:
- cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
jobs:
update:
steamdeck:
runs-on: forgejo
container:
image: git.sysctl.io/albert/actions-images/node:latest