From 0cf03d4de195e8ea3e153c550fd7acc83bb9b117 Mon Sep 17 00:00:00 2001
From: InAnYan <ruslanpopov1512@gmail.com>
Date: Tue, 14 Jul 2026 22:16:08 +0200
Subject: [PATCH] feat(ci-cd): add script for infrastructure

---
 .gitea/workflows/upload-infrastructure.yml | 85 ++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 .gitea/workflows/upload-infrastructure.yml

diff --git a/.gitea/workflows/upload-infrastructure.yml b/.gitea/workflows/upload-infrastructure.yml
new file mode 100644
index 0000000..3f40954
--- /dev/null
+++ b/.gitea/workflows/upload-infrastructure.yml
@@ -0,0 +1,85 @@
+name: Upload Infrastructure
+
+on:
+  workflow_call:
+    inputs:
+      host:
+        description: "IP address or hostname of the remote destination server"
+        required: true
+        type: string
+      user:
+        description: "SSH username for the remote destination server"
+        required: true
+        type: string
+      port:
+        description: "SSH port for the remote destination server"
+        required: false
+        type: string
+        default: "22"
+      jump_host:
+        description: "IP address or hostname of the SSH jump (bastion) server"
+        required: true
+        type: string
+      jump_user:
+        description: "SSH username for the SSH jump (bastion) server"
+        required: true
+        type: string
+      jump_port:
+        description: "SSH port for the SSH jump (bastion) server"
+        required: false
+        type: string
+        default: "22"
+      infrastructure_path:
+        description: "Target directory path to run deployment commands inside"
+        required: false
+        type: string
+        default: "infrastructure"
+    secrets:
+      ssh_key:
+        description: "SSH private key for the remote destination server"
+        required: true
+      jump_ssh_key:
+        description: "SSH private key for the SSH jump (bastion) server"
+        required: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy via SSH Jump Host
+        env:
+          SSH_KEY: ${{ secrets.ssh_key }}
+          JUMP_SSH_KEY: ${{ secrets.jump_ssh_key }}
+        run: |
+          # Create ssh directory and restrict access
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          
+          # Write SSH private keys to files
+          echo "$SSH_KEY" > ~/.ssh/id_rsa
+          echo "$JUMP_SSH_KEY" > ~/.ssh/id_jump
+          chmod 600 ~/.ssh/id_rsa ~/.ssh/id_jump
+          
+          # Create SSH config to handle jump routing, keys, and security bypasses
+          cat << EOF > ~/.ssh/config
+          Host jump
+            HostName ${{ inputs.jump_host }}
+            User ${{ inputs.jump_user }}
+            Port ${{ inputs.jump_port }}
+            IdentityFile ~/.ssh/id_jump
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+          
+          Host target
+            HostName ${{ inputs.host }}
+            User ${{ inputs.user }}
+            Port ${{ inputs.port }}
+            IdentityFile ~/.ssh/id_rsa
+            ProxyJump jump
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+          EOF
+          chmod 600 ~/.ssh/config
+          
+          # Execute deployment commands cleanly
+          ssh target "cd ${{ inputs.infrastructure_path }} && git pull && docker compose down && docker compose up -d"