Nasim SadatandClaude Opus 5.5
d3800ac9dd
Traefik as the server-wide edge (TLS via Let's Encrypt, dashboard on traefik.petrolyst.com behind oauth2-proxy and Keycloak). The fuel-monitoring stack: Superset on atoma.petrolyst.com with Keycloak login and Petrolyst branding, Trino reading the TimescaleDB fuel-db as catalog "fuel". Customization lives in petrolyst-insights/, deployment in the other folders. Deploys run server-side (deploy/deploy.sh) from a Gitea workflow or manually; releases are immutable, Superset metadata is backed up before migrations, and deploy/rollback.sh restores it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
58 lines
2.4 KiB
YAML
58 lines
2.4 KiB
YAML
# Every push to main deploys everything: Traefik first, then each stack under
|
|
# stacks/. The runner only uploads; the server validates, deploys and
|
|
# smoke-tests (deploy/deploy.sh), so this job needs no Docker of its own.
|
|
name: deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
# Serializes CI runs; deploy.sh's host lock also covers manual rollbacks.
|
|
concurrency:
|
|
group: deploy-petrolyst
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Lint shell scripts
|
|
run: |
|
|
if ! command -v shellcheck >/dev/null; then
|
|
SUDO=$(command -v sudo || true)
|
|
$SUDO apt-get update -qq && $SUDO apt-get install -y -qq shellcheck
|
|
fi
|
|
shellcheck -x host/*.sh deploy/*.sh stacks/*/superset/init.sh stacks/*/fuel-db/init/*.sh
|
|
|
|
- name: Install the deploy key
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }}
|
|
run: |
|
|
install -d -m 0700 "$HOME/.ssh"
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.ssh/deploy_key"
|
|
chmod 0600 "$HOME/.ssh/deploy_key"
|
|
printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
|
|
command -v rsync >/dev/null || { SUDO=$(command -v sudo || true); $SUDO apt-get install -y -qq rsync; }
|
|
|
|
- name: Upload and deploy
|
|
run: |
|
|
ssh_cmd="ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
|
|
# A fresh directory per run; only deploy.sh, under the host lock,
|
|
# turns it into releases/<sha>. --omit-dir-times: the upload's age
|
|
# must be the server's, because retention prunes uploads by mtime.
|
|
incoming="/opt/petrolyst/incoming/${GITHUB_SHA}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT:-1}-$(date -u +%s)"
|
|
rsync -az --omit-dir-times --exclude .git -e "$ssh_cmd" ./ "deploy@${DEPLOY_HOST}:${incoming}/"
|
|
$ssh_cmd "deploy@${DEPLOY_HOST}" "${incoming}/deploy/deploy.sh" "$GITHUB_SHA" "$incoming"
|
|
|
|
- name: Check from outside
|
|
run: |
|
|
test "$(curl -fsS --max-time 20 https://atoma.petrolyst.com/health)" = OK
|
|
curl -fsS --max-time 20 -o /dev/null -w '%{http_code}\n' https://traefik.petrolyst.com/ | grep -qx 302
|