jack
44ccdf4882
- Remove tools server entirely (roles/tools, playbooks/tools.yml, CI deploy step) - Remove Vaultwarden (already absent from compose, clean up vars) - Remove node-exporter, cadvisor, promtail from main stack - Remove grafana/uptime-kuma Traefik routes (pointed to tools) - Remove monitoring network from docker-compose - Remove tools vault vars (grafana_admin_password, alertmanager telegram) - Rename domain_plane: plane.walava.io → hub.walava.io - Update CI workflow to only deploy main server - Update STATUS.md and BACKLOG.md to reflect current state
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
name: CI/CD
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
workflow_dispatch: # allows triggering via Forgejo API (/deploy bot command)
|
|
|
|
jobs:
|
|
# ── Syntax check (every PR + push) ─────────────────────────────────────────
|
|
syntax-check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install ansible
|
|
run: pip3 install ansible --quiet --break-system-packages
|
|
|
|
- name: Install collections
|
|
run: |
|
|
ansible-galaxy collection install \
|
|
community.general community.docker ansible.posix --force
|
|
|
|
- name: Write vault password
|
|
run: |
|
|
echo "${{ secrets.VAULT_PASSWORD }}" > ~/.vault-password-file
|
|
chmod 600 ~/.vault-password-file
|
|
|
|
- name: Syntax check — main
|
|
run: ansible-playbook playbooks/deploy.yml --syntax-check
|
|
|
|
|
|
# ── Deploy (push to master only, after syntax-check passes) ────────────────
|
|
deploy:
|
|
needs: syntax-check
|
|
if: github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
pip3 install ansible --quiet --break-system-packages
|
|
ansible-galaxy collection install \
|
|
ansible.posix community.general community.docker --force
|
|
|
|
- name: Configure SSH
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
# Scan host keys directly (no need for SSH_KNOWN_HOSTS secret)
|
|
ssh-keyscan -p 22 87.249.49.32 >> ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/known_hosts
|
|
|
|
- name: Write vault password
|
|
run: |
|
|
echo "${{ secrets.VAULT_PASSWORD }}" > ~/.vault-password-file
|
|
chmod 600 ~/.vault-password-file
|
|
|
|
- name: Deploy main server
|
|
run: ansible-playbook playbooks/deploy.yml -l main
|
|
|