67 lines
2.8 KiB
YAML
67 lines
2.8 KiB
YAML
name: Reusable OpenTofu Deploy Template
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
proxmox_endpoint:
|
|
description: "The URL endpoint for the Proxmox API"
|
|
type: string
|
|
default: "https://212.3.125.242:8006/"
|
|
secrets:
|
|
PROXMOX_VE_API_TOKEN:
|
|
description: "The API token for Proxmox authentication"
|
|
required: true
|
|
GITEA_TOKEN:
|
|
description: "Gitea Auth Token"
|
|
required: true
|
|
|
|
jobs:
|
|
deploy-to-proxmox:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
# Proxmox Auth (Endpoint from inputs, Token from explicit secrets)
|
|
PROXMOX_VE_ENDPOINT: ${{ inputs.proxmox_endpoint }}
|
|
PROXMOX_VE_API_TOKEN: ${{ secrets.PROXMOX_VE_API_TOKEN }}
|
|
PROXMOX_VE_INSECURE: "true"
|
|
|
|
# Gitea Remote State Backend (Dynamic per-repository package)
|
|
TF_HTTP_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}"
|
|
TF_HTTP_LOCK_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
|
|
TF_HTTP_UNLOCK_ADDRESS: "${{ gitea.server_url }}/api/packages/${{ gitea.repository_owner }}/terraform/state/${{ gitea.event.repository.name }}/lock"
|
|
TF_HTTP_LOCK_METHOD: "POST"
|
|
TF_HTTP_UNLOCK_METHOD: "DELETE"
|
|
TF_HTTP_USERNAME: ${{ gitea.actor }}
|
|
TF_HTTP_PASSWORD: ${{ secrets.GITEA_TOKEN }}
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup OpenTofu
|
|
uses: opentofu/setup-opentofu@v1
|
|
|
|
- name: Configure and Debug Authentication
|
|
run: |
|
|
echo "=== Debug: Variable Check ==="
|
|
echo "Raw Server URL: ${{ gitea.server_url }}"
|
|
|
|
# Extract just the hostname (e.g., git.itlab-ffeks.dnu.edu.ua)
|
|
GITEA_HOST=$(echo "${{ gitea.server_url }}" | awk -F/ '{print $3}')
|
|
echo "Extracted Hostname: $GITEA_HOST"
|
|
|
|
# Write it to .netrc (Git and cURL use this automatically for auth)
|
|
echo "machine $GITEA_HOST login ${{ gitea.actor }} password ${{ secrets.GITEA_TOKEN }}" > ~/.netrc
|
|
chmod 600 ~/.netrc
|
|
|
|
echo "=== Debug: .netrc Check ==="
|
|
ls -la ~/.netrc
|
|
# Print the file contents but mask the password to avoid leaking it in logs
|
|
cat ~/.netrc | sed 's/password .*/password ****/'
|
|
|
|
echo "=== Debug: Testing Git Connection directly ==="
|
|
# Try to reach the module repo directly using Git to see if auth works
|
|
git ls-remote "https://$GITEA_HOST/infrastructure/proxmox-vm.git" HEAD || echo "Git test failed, but continuing to see Tofu output..."
|
|
|
|
- name: OpenTofu Init & Apply
|
|
run: |
|
|
tofu init
|
|
tofu apply -auto-approve |