infrastructure/ci-cd
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

big update

Browse Source
This commit is contained in:
InAnYan
2026-08-04 23:35:10 +02:00
parent a22788b8b6
commit 774f71337c
3 changed files with 110 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-caddy.yml
+24 -7
View File
@@ -29,11 +29,15 @@ on:
type: string
default: "debian"
secrets:
jump_ssh_key:
required: true
infisical_api_url:
description: "Infisical API URL (for self-hosted instances)"
type: string
required: false
default: "https://secrets.itlab-ffeks.dnu.edu.ua"
vm_ssh_key:
secrets:
infisical_cicd_token:
description: "Infisical Service Token for CI/CD secrets"
required: true
@@ -50,13 +54,26 @@ jobs:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "${{ secrets.jump_ssh_key }}" > ~/.ssh/jump_key
export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
echo "Fetching SSH keys from Infisical..."
JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
echo "Error: SSH keys retrieved from Infisical are empty!" >&2
exit 1
fi
echo "$JUMP_KEY" > ~/.ssh/jump_key
chmod 600 ~/.ssh/jump_key
echo "${{ secrets.vm_ssh_key }}" > ~/.ssh/vm_key
echo "$VM_KEY" > ~/.ssh/vm_key
chmod 600 ~/.ssh/vm_key
cat > ~/.ssh/config <<EOF
Host jump
HostName ${{ inputs.jump_host }}
.gitea/workflows/deploy-docker-compose.yml
+51 -8
View File
@@ -36,11 +36,30 @@ on:
type: string
default: "~"
secrets:
jump_ssh_key:
infisical_env:
description: "Infisical Environment"
type: string
required: true
vm_ssh_key:
infisical_path:
description: "Infisical secret path"
type: string
required: false
default: "/"
infisical_api_url:
description: "Infisical API URL (for self-hosted instances)"
type: string
required: false
default: "https://secrets.itlab-ffeks.dnu.edu.ua"
secrets:
infisical_project_token:
description: "Infisical Service Token for project secrets"
required: true
infisical_cicd_token:
description: "Infisical Service Token for CI/CD secrets"
required: true
jobs:
@@ -55,10 +74,24 @@ jobs:
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "${{ secrets.jump_ssh_key }}" > ~/.ssh/jump_key
export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
echo "Fetching SSH keys from Infisical..."
JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
echo "Error: SSH keys retrieved from Infisical are empty!" >&2
exit 1
fi
echo "$JUMP_KEY" > ~/.ssh/jump_key
chmod 600 ~/.ssh/jump_key
echo "${{ secrets.vm_ssh_key }}" > ~/.ssh/vm_key
echo "$VM_KEY" > ~/.ssh/vm_key
chmod 600 ~/.ssh/vm_key
cat > ~/.ssh/config <<EOF
@@ -88,9 +121,19 @@ jobs:
- name: Restart services
run: |
ssh vm <<EOF
ssh vm <<'EOF'
set -e
cd ${{ inputs.working_directory }}
docker compose down
docker compose up -d
export INFISICAL_TOKEN="${{ secrets.infisical_project_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
INFISICAL_ENV="${{ inputs.infisical_env }}"
INFISICAL_PATH="${{ inputs.infisical_path }}"
echo "Running docker compose down and up under Infisical..."
infisical run --env="$INFISICAL_ENV" --path="$INFISICAL_PATH" -- docker compose down
infisical run --env="$INFISICAL_ENV" --path="$INFISICAL_PATH" -- docker compose up -d
EOF
.gitea/workflows/deploy-infrastructure.yml
+35 -13
View File
@@ -6,38 +6,60 @@ on:
description: "The URL endpoint for the Proxmox API"
type: string
default: "https://212.3.125.242:8006/"
infisical_api_url:
description: "Infisical API URL (for self-hosted instances)"
type: string
required: false
default: "https://secrets.itlab-ffeks.dnu.edu.ua"
secrets:
PROXMOX_VE_API_TOKEN:
description: "The API token for Proxmox authentication"
required: true
INFRASTRUCTURE_TOKEN:
description: "Gitea Auth Token"
infisical_cicd_token:
description: "Infisical Service Token for CI/CD secrets"
required: true
jobs:
deploy-to-proxmox:
runs-on: ubuntu-latest
env:
# Proxmox Auth (Endpoint from inputs, Token from explicit secrets)
# Proxmox Auth (Endpoint from inputs)
PROXMOX_VE_ENDPOINT: ${{ inputs.proxmox_endpoint }}
PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_VE_API_TOKEN }}
PROXMOX_VE_INSECURE: "true"
# Gitea Remote State Backend (Dynamic per-repository package)
TF_HTTP_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}"
TF_HTTP_LOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
TF_HTTP_UNLOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
# Gitea Remote State Backend (Dynamic per-repository package/workspace)
TF_HTTP_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}"
TF_HTTP_LOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}/lock"
TF_HTTP_UNLOCK_ADDRESS: "https://git.itlab-ffeks.dnu.edu.ua/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}-${{ gitea.ref_name }}/lock"
TF_HTTP_LOCK_METHOD: "POST"
TF_HTTP_UNLOCK_METHOD: "DELETE"
TF_HTTP_USERNAME: ${{ gitea.actor }}
TF_HTTP_PASSWORD: ${{ secrets.INFRASTRUCTURE_TOKEN }}
TF_VAR_environment: ${{ gitea.ref_name }}
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Fetch secrets from Infisical
run: |
export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url || 'https://app.infisical.com' }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
# Fetch secrets (assuming CLI is pre-installed)
echo "Fetching secrets from Infisical..."
PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --plain)
INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --plain)
# Mask values in logs immediately
echo "::add-mask::$PROXMOX_VE_API_TOKEN"
echo "::add-mask::$INFRASTRUCTURE_TOKEN"
# Export to GITHUB_ENV for subsequent steps/env context
echo "PROXMOX_VE_API_TOKEN=$PROXMOX_VE_API_TOKEN" >> $GITHUB_ENV
echo "INFRASTRUCTURE_TOKEN=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
echo "TF_HTTP_PASSWORD=$INFRASTRUCTURE_TOKEN" >> $GITHUB_ENV
- name: Configure Git for private modules
run: git config --global url."https://oauth2:${{ secrets.INFRASTRUCTURE_TOKEN }}@git.itlab-ffeks.dnu.edu.ua".insteadOf "https://git.itlab-ffeks.dnu.edu.ua"
run: git config --global url."https://oauth2:$INFRASTRUCTURE_TOKEN@git.itlab-ffeks.dnu.edu.ua".insteadOf "https://git.itlab-ffeks.dnu.edu.ua"
- name: Setup OpenTofu
uses: opentofu/setup-opentofu@v1