84 lines
2.7 KiB
YAML
84 lines
2.7 KiB
YAML
name: Upload Infrastructure
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
infrastructure_path:
|
|
description: "Target directory path to run deployment commands inside"
|
|
required: false
|
|
type: string
|
|
default: "infrastructure"
|
|
secrets:
|
|
ssh_key:
|
|
description: "SSH private key for the remote destination server"
|
|
required: true
|
|
jump_ssh_key:
|
|
description: "SSH private key for the SSH jump (bastion) server"
|
|
required: true
|
|
host:
|
|
description: "IP address or hostname of the remote destination server"
|
|
required: true
|
|
user:
|
|
description: "SSH username for the remote destination server"
|
|
required: true
|
|
port:
|
|
description: "SSH port for the remote destination server"
|
|
required: false
|
|
jump_host:
|
|
description: "IP address or hostname of the SSH jump (bastion) server"
|
|
required: true
|
|
jump_user:
|
|
description: "SSH username for the SSH jump (bastion) server"
|
|
required: true
|
|
jump_port:
|
|
description: "SSH port for the SSH jump (bastion) server"
|
|
required: false
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Deploy via SSH Jump Host
|
|
env:
|
|
SSH_KEY: ${{ secrets.ssh_key }}
|
|
JUMP_SSH_KEY: ${{ secrets.jump_ssh_key }}
|
|
TARGET_HOST: ${{ secrets.host }}
|
|
TARGET_USER: ${{ secrets.user }}
|
|
TARGET_PORT: ${{ secrets.port || '22' }}
|
|
JUMP_HOST: ${{ secrets.jump_host }}
|
|
JUMP_USER: ${{ secrets.jump_user }}
|
|
JUMP_PORT: ${{ secrets.jump_port || '22' }}
|
|
run: |
|
|
# Create ssh directory and restrict access
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# Write SSH private keys to files
|
|
echo "$SSH_KEY" > ~/.ssh/id_rsa
|
|
echo "$JUMP_SSH_KEY" > ~/.ssh/id_jump
|
|
chmod 600 ~/.ssh/id_rsa ~/.ssh/id_jump
|
|
|
|
# Create SSH config to handle jump routing, keys, and security bypasses
|
|
cat << EOF > ~/.ssh/config
|
|
Host jump
|
|
HostName $JUMP_HOST
|
|
User $JUMP_USER
|
|
Port $JUMP_PORT
|
|
IdentityFile ~/.ssh/id_jump
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
|
|
Host target
|
|
HostName $TARGET_HOST
|
|
User $TARGET_USER
|
|
Port $TARGET_PORT
|
|
IdentityFile ~/.ssh/id_rsa
|
|
ProxyJump jump
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
EOF
|
|
chmod 600 ~/.ssh/config
|
|
|
|
# Execute deployment commands cleanly
|
|
ssh target "cd ${{ inputs.infrastructure_path }} && git pull && docker compose down && docker compose up -d"
|