ci(deploy): deploy images over ssh from gitea actions

2026-07-07 15:02:02 +08:00
parent 9cb9534459
commit e699ff13b3
8 changed files with 290 additions and 62 deletions
@@ -131,6 +131,105 @@ jobs:
          docker push "$IMAGE_VERSION_TAG"
          docker push "$IMAGE_LATEST_TAG"

+      - name: Deploy image over SSH
+        env:
+          TEST_SSH_HOST: ${{ secrets.TEST_SSH_HOST }}
+          TEST_SSH_USER: ${{ secrets.TEST_SSH_USER }}
+          TEST_SSH_PORT: ${{ secrets.TEST_SSH_PORT }}
+          TEST_SSH_PRIVATE_KEY: ${{ secrets.TEST_SSH_PRIVATE_KEY }}
+          TEST_SSH_KNOWN_HOSTS: ${{ secrets.TEST_SSH_KNOWN_HOSTS }}
+          TEST_DEPLOY_DIR: ${{ secrets.TEST_DEPLOY_DIR }}
+          PROD_SSH_HOST: ${{ secrets.PROD_SSH_HOST }}
+          PROD_SSH_USER: ${{ secrets.PROD_SSH_USER }}
+          PROD_SSH_PORT: ${{ secrets.PROD_SSH_PORT }}
+          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          PROD_SSH_KNOWN_HOSTS: ${{ secrets.PROD_SSH_KNOWN_HOSTS }}
+          PROD_DEPLOY_DIR: ${{ secrets.PROD_DEPLOY_DIR }}
+          REGISTRY_HOST: ${{ secrets.REGISTRY_HOST }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+          set -eu
+
+          case "$DEPLOY_ENV" in
+            test)
+              DEPLOY_HOST="$TEST_SSH_HOST"
+              DEPLOY_USER="$TEST_SSH_USER"
+              DEPLOY_PORT="${TEST_SSH_PORT:-22}"
+              DEPLOY_KEY="$TEST_SSH_PRIVATE_KEY"
+              DEPLOY_KNOWN_HOSTS="$TEST_SSH_KNOWN_HOSTS"
+              DEPLOY_DIR="${TEST_DEPLOY_DIR:-/opt/cozsweet-web-test}"
+              HOST_PORT="9135"
+              CONTAINER_NAME="cozsweet-web-test"
+              PROJECT_NAME="cozsweet-web-test"
+              ;;
+            prod)
+              DEPLOY_HOST="$PROD_SSH_HOST"
+              DEPLOY_USER="$PROD_SSH_USER"
+              DEPLOY_PORT="${PROD_SSH_PORT:-22}"
+              DEPLOY_KEY="$PROD_SSH_PRIVATE_KEY"
+              DEPLOY_KNOWN_HOSTS="$PROD_SSH_KNOWN_HOSTS"
+              DEPLOY_DIR="${PROD_DEPLOY_DIR:-/opt/cozsweet-web-prod}"
+              HOST_PORT="9185"
+              CONTAINER_NAME="cozsweet-web-prod"
+              PROJECT_NAME="cozsweet-web-prod"
+              ;;
+            *)
+              echo "Unsupported deploy env: $DEPLOY_ENV" >&2
+              exit 1
+              ;;
+          esac
+
+          if [ -z "$DEPLOY_HOST" ] || [ -z "$DEPLOY_USER" ] || [ -z "$DEPLOY_KEY" ]; then
+            echo "Missing SSH deployment secrets for $DEPLOY_ENV" >&2
+            exit 1
+          fi
+
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          KEY_FILE="$HOME/.ssh/cozsweet_deploy_key"
+          printf '%s\n' "$DEPLOY_KEY" > "$KEY_FILE"
+          chmod 600 "$KEY_FILE"
+
+          if [ -n "$DEPLOY_KNOWN_HOSTS" ]; then
+            printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts
+          else
+            ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
+          fi
+
+          SSH_TARGET="$DEPLOY_USER@$DEPLOY_HOST"
+          SSH_OPTS="-i $KEY_FILE -p $DEPLOY_PORT -o IdentitiesOnly=yes"
+          SCP_OPTS="-i $KEY_FILE -P $DEPLOY_PORT -o IdentitiesOnly=yes"
+
+          ssh $SSH_OPTS "$SSH_TARGET" "mkdir -p '$DEPLOY_DIR'"
+          scp $SCP_OPTS docker-compose.yml "$SSH_TARGET:$DEPLOY_DIR/docker-compose.yml"
+          scp $SCP_OPTS scripts/server/deploy-docker-image.sh "$SSH_TARGET:$DEPLOY_DIR/deploy-docker-image.sh"
+          scp $SCP_OPTS "$NEXT_ENV_FILE" "$SSH_TARGET:$DEPLOY_DIR/$NEXT_ENV_FILE"
+
+          printf '%s' "$REGISTRY_PASSWORD" \
+            | ssh $SSH_OPTS "$SSH_TARGET" \
+                "docker login '$REGISTRY_HOST' -u '$REGISTRY_USERNAME' --password-stdin"
+
+          ssh $SSH_OPTS "$SSH_TARGET" \
+            "cd '$DEPLOY_DIR' && chmod +x ./deploy-docker-image.sh && ./deploy-docker-image.sh '$IMAGE_VERSION_TAG' '$NEXT_ENV_FILE' '$HOST_PORT' '$CONTAINER_NAME' '$PROJECT_NAME'"
+
+      - name: Purge Cloudflare cache
+        env:
+          CF_ZONE_ID: ${{ secrets.CF_ZONE_ID }}
+          CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
+        run: |
+          set -eu
+
+          if [ -z "$CF_ZONE_ID" ] || [ -z "$CF_API_TOKEN" ]; then
+            echo "Cloudflare secrets are not configured, skip purge."
+            exit 0
+          fi
+
+          curl -fsS -X POST "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/purge_cache" \
+            -H "Authorization: Bearer $CF_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d '{"purge_everything":true}'
+
      - name: Cleanup build env file
        if: always()
        run: |