big update

.gitea/workflows/deploy-caddy.yml

@@ -29,11 +29,15 @@ on:
         type: string
         default: "debian"
 
-    secrets:
+      infisical_api_url:
-      jump_ssh_key:
+        description: "Infisical API URL (for self-hosted instances)"
-        required: true
+        type: string
+        required: false
+        default: "https://secrets.itlab-ffeks.dnu.edu.ua"
 
-      vm_ssh_key:
+    secrets:
+      infisical_cicd_token:
+        description: "Infisical Service Token for CI/CD secrets"
         required: true
 
 
@@ -50,13 +54,26 @@ jobs:
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
 
-          echo "${{ secrets.jump_ssh_key }}" > ~/.ssh/jump_key
+          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
+          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
+          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+          export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+          echo "Fetching SSH keys from Infisical..."
+          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
+          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
+
+          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
+            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
+            exit 1
+          fi
+
+          echo "$JUMP_KEY" > ~/.ssh/jump_key
           chmod 600 ~/.ssh/jump_key
 
-          echo "${{ secrets.vm_ssh_key }}" > ~/.ssh/vm_key
+          echo "$VM_KEY" > ~/.ssh/vm_key
           chmod 600 ~/.ssh/vm_key
 
-
           cat > ~/.ssh/config <<EOF
           Host jump
             HostName ${{ inputs.jump_host }}

.gitea/workflows/deploy-docker-compose.yml

@@ -36,11 +36,30 @@ on:
         type: string
         default: "~"
 
-    secrets:
+      infisical_env:
-      jump_ssh_key:
+        description: "Infisical Environment"
+        type: string
         required: true
 
-      vm_ssh_key:
+      infisical_path:
+        description: "Infisical secret path"
+        type: string
+        required: false
+        default: "/"
+
+      infisical_api_url:
+        description: "Infisical API URL (for self-hosted instances)"
+        type: string
+        required: false
+        default: "https://secrets.itlab-ffeks.dnu.edu.ua"
+
+    secrets:
+      infisical_project_token:
+        description: "Infisical Service Token for project secrets"
+        required: true
+
+      infisical_cicd_token:
+        description: "Infisical Service Token for CI/CD secrets"
         required: true
 
 jobs:
@@ -55,10 +74,24 @@ jobs:
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
 
-          echo "${{ secrets.jump_ssh_key }}" > ~/.ssh/jump_key
+          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
+          export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
+          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+          export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+          echo "Fetching SSH keys from Infisical..."
+          JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
+          VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
+
+          if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
+            echo "Error: SSH keys retrieved from Infisical are empty!" >&2
+            exit 1
+          fi
+
+          echo "$JUMP_KEY" > ~/.ssh/jump_key
           chmod 600 ~/.ssh/jump_key
 
-          echo "${{ secrets.vm_ssh_key }}" > ~/.ssh/vm_key
+          echo "$VM_KEY" > ~/.ssh/vm_key
           chmod 600 ~/.ssh/vm_key
 
           cat > ~/.ssh/config <<EOF
@@ -88,9 +121,19 @@ jobs:
 
       - name: Restart services
         run: |
-          ssh vm <<EOF
+          ssh vm <<'EOF'
             set -e
             cd ${{ inputs.working_directory }}
-            docker compose down
+
-            docker compose up -d
+            export INFISICAL_TOKEN="${{ secrets.infisical_project_token }}"
+            export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
+            export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+            export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+            INFISICAL_ENV="${{ inputs.infisical_env }}"
+            INFISICAL_PATH="${{ inputs.infisical_path }}"
+
+            echo "Running docker compose down and up under Infisical..."
+            infisical run --env="$INFISICAL_ENV" --path="$INFISICAL_PATH" -- docker compose down
+            infisical run --env="$INFISICAL_ENV" --path="$INFISICAL_PATH" -- docker compose up -d
           EOF

.gitea/workflows/deploy-infrastructure.yml

@@ -6,38 +6,60 @@ on:
         description: "The URL endpoint for the Proxmox API"
         type: string
         default: "https://212.3.125.242:8006/"
+      infisical_api_url:
+        description: "Infisical API URL (for self-hosted instances)"
+        type: string
+        required: false
+        default: "https://secrets.itlab-ffeks.dnu.edu.ua"
     secrets:
-      PROXMOX_VE_API_TOKEN:
+      infisical_cicd_token:
-        description: "The API token for Proxmox authentication"
+        description: "Infisical Service Token for CI/CD secrets"
-        required: true
-      INFRASTRUCTURE_TOKEN:
-        description: "Gitea Auth Token"
         required: true
 
 jobs:
   deploy-to-proxmox:
     runs-on: ubuntu-latest
     env:
-      # Proxmox Auth (Endpoint from inputs, Token from explicit secrets)
+      # Proxmox Auth (Endpoint from inputs)
       PROXMOX_VE_ENDPOINT: ${{ inputs.proxmox_endpoint }}
-      PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_VE_API_TOKEN }}
       PROXMOX_VE_INSECURE: "true" 
       
-      # Gitea Remote State Backend (Dynamic per-repository package)
+      # Gitea Remote State Backend (Dynamic per-repository package/workspace)
-      TF_HTTP_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}"
+      TF_HTTP_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}"
-      TF_HTTP_LOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
+      TF_HTTP_LOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}/lock"
-      TF_HTTP_UNLOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
+      TF_HTTP_UNLOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}/lock"
       TF_HTTP_LOCK_METHOD: "POST"
       TF_HTTP_UNLOCK_METHOD: "DELETE"
       TF_HTTP_USERNAME: ${{ gitea.actor }}
-      TF_HTTP_PASSWORD: ${{ secrets.INFRASTRUCTURE_TOKEN }}
+      TF_VAR_environment: ${{ gitea.ref_name }}
 
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
 
+      - name: Fetch secrets from Infisical
+        run: |
+          export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
+          export INFISICAL_API_URL="${{ inputs.infisical_api_url || 'https://app.infisical.com' }}"
+          export INFISICAL_DOMAIN="$INFISICAL_API_URL"
+          export INFISICAL_DISABLE_UPDATE_CHECK=true
+
+          # Fetch secrets (assuming CLI is pre-installed)
+          echo "Fetching secrets from Infisical..."
+          PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --plain)
+          INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --plain)
+
+          # Mask values in logs immediately
+          echo "::add-mask::$PROXMOX_VE_API_TOKEN"
+          echo "::add-mask::$INFRASTRUCTURE_TOKEN"
+
+          # Export to GITHUB_ENV for subsequent steps/env context
+          echo "PROXMOX_VE_API_TOKEN=$PROXMOX_VE_API_TOKEN" >> $GITHUB_ENV
+          echo "INFRASTRUCTURE_TOKEN=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
+          echo "TF_HTTP_PASSWORD=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
+
       - name: Configure Git for private modules
-        run: git config --global url."https://oauth2:${{ secrets.INFRASTRUCTURE_TOKEN }}@git.itlab-ffeks.dnu.edu.ua".insteadOf "https://git.itlab-ffeks.dnu.edu.ua"
+        run: git config --global url."https://oauth2:$INFRASTRUCTURE_TOKEN@git.itlab-ffeks.dnu.edu.ua".insteadOf "https://git.itlab-ffeks.dnu.edu.ua"
         
       - name: Setup OpenTofu
         uses: opentofu/setup-opentofu@v1