infrastructure/ci-cd
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

big update

Browse Source
This commit is contained in:
InAnYan
2026-08-05 18:45:55 +02:00
parent 2cd5ebbb40
commit 9a906669d0
4 changed files with 146 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-caddy.yml
+17 -45
View File
@@ -35,6 +35,11 @@ on:
required: false
default: "https://secrets.itlab-ffeks.dnu.edu.ua"
infisical_env:
description: "Infisical Environment"
type: string
required: false
secrets:
infisical_cicd_token:
description: "Infisical Service Token for CI/CD secrets"
@@ -46,52 +51,19 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Install Infisical CLI
run: |
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
sudo apt-get update && sudo apt-get install -y infisical
- name: Configure SSH
run: |
mkdir -p ~/.ssh
chmod 700 ~/.ssh
export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
echo "Fetching SSH keys from Infisical..."
JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
echo "Error: SSH keys retrieved from Infisical are empty!" >&2
exit 1
fi
echo "$JUMP_KEY" > ~/.ssh/jump_key
chmod 600 ~/.ssh/jump_key
echo "$VM_KEY" > ~/.ssh/vm_key
chmod 600 ~/.ssh/vm_key
cat > ~/.ssh/config <<EOF
Host jump
HostName ${{ inputs.jump_host }}
User ${{ inputs.jump_user }}
Port ${{ inputs.jump_port }}
IdentityFile ~/.ssh/jump_key
StrictHostKeyChecking no
Host caddy
HostName ${{ inputs.vm_ip }}
User ${{ inputs.vm_user }}
Port ${{ inputs.vm_port }}
IdentityFile ~/.ssh/vm_key
ProxyJump jump
StrictHostKeyChecking no
EOF
uses: ./.gitea/actions/configure-homelab-ssh
with:
infisical_cicd_token: ${{ secrets.infisical_cicd_token }}
infisical_api_url: ${{ inputs.infisical_api_url }}
infisical_env: ${{ inputs.infisical_env }}
jump_host: ${{ inputs.jump_host }}
jump_port: ${{ inputs.jump_port }}
jump_user: ${{ inputs.jump_user }}
vm_ip: ${{ inputs.vm_ip }}
vm_port: ${{ inputs.vm_port }}
vm_user: ${{ inputs.vm_user }}
ssh_host_alias: caddy
- name: Upload Caddyfile
.gitea/workflows/deploy-docker-compose.yml
+16 -46
View File
@@ -39,7 +39,7 @@ on:
infisical_env:
description: "Infisical Environment"
type: string
required: true
required: false
infisical_path:
description: "Infisical secret path"
@@ -69,52 +69,19 @@ jobs:
steps:
- uses: actions/checkout@v4
- name: Install Infisical CLI
run: |
curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash
sudo apt-get update && sudo apt-get install -y infisical
- name: Configure SSH
run: |
mkdir -p ~/.ssh
chmod 700 ~/.ssh
export INFISICAL_TOKEN="${{ secrets.infisical_cicd_token }}"
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
echo "Fetching SSH keys from Infisical..."
JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --plain)
VM_KEY=$(infisical secrets get VM_SSH_KEY --plain)
if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
echo "Error: SSH keys retrieved from Infisical are empty!" >&2
exit 1
fi
echo "$JUMP_KEY" > ~/.ssh/jump_key
chmod 600 ~/.ssh/jump_key
echo "$VM_KEY" > ~/.ssh/vm_key
chmod 600 ~/.ssh/vm_key
cat > ~/.ssh/config <<EOF
Host jump
HostName ${{ inputs.jump_host }}
User ${{ inputs.jump_user }}
Port ${{ inputs.jump_port }}
IdentityFile ~/.ssh/jump_key
StrictHostKeyChecking no
Host vm
HostName ${{ inputs.vm_ip }}
User ${{ inputs.vm_user }}
Port ${{ inputs.vm_port }}
IdentityFile ~/.ssh/vm_key
ProxyJump jump
StrictHostKeyChecking no
EOF
uses: ./.gitea/actions/configure-homelab-ssh
with:
infisical_cicd_token: ${{ secrets.infisical_cicd_token }}
infisical_api_url: ${{ inputs.infisical_api_url }}
infisical_env: ${{ inputs.infisical_env }}
jump_host: ${{ inputs.jump_host }}
jump_port: ${{ inputs.jump_port }}
jump_user: ${{ inputs.jump_user }}
vm_ip: ${{ inputs.vm_ip }}
vm_port: ${{ inputs.vm_port }}
vm_user: ${{ inputs.vm_user }}
ssh_host_alias: vm
- name: Test SSH connection to VM
run: |
@@ -136,6 +103,9 @@ jobs:
export INFISICAL_DISABLE_UPDATE_CHECK=true
INFISICAL_ENV="${{ inputs.infisical_env }}"
if [ -z "$INFISICAL_ENV" ]; then
INFISICAL_ENV="${{ gitea.ref_name }}"
fi
INFISICAL_PATH="${{ inputs.infisical_path }}"
echo "Running docker compose down and up under Infisical..."
.gitea/workflows/deploy-infrastructure.yml
+11 -2
View File
@@ -11,6 +11,10 @@ on:
type: string
required: false
default: "https://secrets.itlab-ffeks.dnu.edu.ua"
infisical_env:
description: "Infisical Environment"
type: string
required: false
secrets:
infisical_cicd_token:
description: "Infisical Service Token for CI/CD secrets"
@@ -49,10 +53,15 @@ jobs:
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
export INFISICAL_DISABLE_UPDATE_CHECK=true
INFISICAL_ENV="${{ inputs.infisical_env }}"
if [ -z "$INFISICAL_ENV" ]; then
INFISICAL_ENV="${{ gitea.ref_name }}"
fi
# Fetch secrets (assuming CLI is pre-installed)
echo "Fetching secrets from Infisical..."
PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --plain)
INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --plain)
PROXMOX_VE_API_TOKEN=$(infisical secrets get PROXMOX_VE_API_TOKEN --env="$INFISICAL_ENV" --plain)
INFRASTRUCTURE_TOKEN=$(infisical secrets get INFRASTRUCTURE_TOKEN --env="$INFISICAL_ENV" --plain)
# Mask values in logs immediately
echo "::add-mask::$PROXMOX_VE_API_TOKEN"