name: deploy app on: push: branches: - main - canary paths: - fluxer_app/** - .github/workflows/deploy-app.yaml workflow_dispatch: inputs: channel: type: choice options: - stable - canary default: stable description: Channel to deploy ref: type: string required: false default: '' description: Optional git ref to deploy (defaults to main/canary based on channel) concurrency: group: deploy-fluxer-app-${{ github.event_name == 'workflow_dispatch' && inputs.channel || (github.ref_name == 'canary' && 'canary') || 'stable' }} cancel-in-progress: true permissions: contents: write jobs: channel-vars: uses: ./.github/workflows/channel-vars.yaml with: github_event_name: ${{ github.event_name }} github_ref_name: ${{ github.ref_name }} github_ref: ${{ github.ref }} workflow_dispatch_channel: ${{ github.event_name == 'workflow_dispatch' && inputs.channel || '' }} workflow_dispatch_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }} deploy: name: Deploy app needs: channel-vars runs-on: blacksmith-2vcpu-ubuntu-2404 timeout-minutes: 10 env: CHANNEL: ${{ needs.channel-vars.outputs.channel }} IS_CANARY: ${{ needs.channel-vars.outputs.is_canary }} SOURCE_REF: ${{ needs.channel-vars.outputs.source_ref }} STACK_SUFFIX: ${{ needs.channel-vars.outputs.stack_suffix }} SERVICE_NAME: ${{ format('fluxer-app{0}', needs.channel-vars.outputs.stack_suffix) }} DOCKERFILE: fluxer_app/proxy/Dockerfile SENTRY_PROXY_PATH: /error-reporting-proxy CACHE_SCOPE: ${{ format('fluxer-app{0}', needs.channel-vars.outputs.stack_suffix) }} PUBLIC_BOOTSTRAP_API_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://web.canary.fluxer.app/api' || 'https://web.fluxer.app/api' }} PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://api.canary.fluxer.app' || 'https://api.fluxer.app' }} PUBLIC_PROJECT_ENV: ${{ needs.channel-vars.outputs.channel }} PUBLIC_SENTRY_DSN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://59ced0e2666ab83dd1ddb056cdd22d1b@sentry.web.canary.fluxer.app/4510205815291904' || 'https://59ced0e2666ab83dd1ddb056cdd22d1b@sentry.web.fluxer.app/4510205815291904' }} SENTRY_REPORT_HOST: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://sentry.web.canary.fluxer.app' || 'https://sentry.web.fluxer.app' }} API_TARGET: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'fluxer-api-canary_app' || 'fluxer-api_app' }} CADDY_APP_DOMAIN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'web.canary.fluxer.app' || 'web.fluxer.app' }} SENTRY_CADDY_DOMAIN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'sentry.web.canary.fluxer.app' || 'sentry.web.fluxer.app' }} RELEASE_CHANNEL: ${{ needs.channel-vars.outputs.channel }} APP_REPLICAS: ${{ needs.channel-vars.outputs.is_canary == 'true' && 1 || 2 }} steps: - uses: actions/checkout@v6 with: ref: ${{ env.SOURCE_REF }} fetch-depth: 0 - name: Set up pnpm uses: pnpm/action-setup@v4 with: version: 10.26.0 - name: Set up Node.js uses: actions/setup-node@v6 with: node-version: 24 cache: pnpm cache-dependency-path: fluxer_app/pnpm-lock.yaml - name: Set up Go uses: actions/setup-go@v6 with: go-version: '1.25.5' - name: Install dependencies working-directory: fluxer_app run: pnpm install --frozen-lockfile - name: Run Lingui i18n tasks working-directory: fluxer_app run: pnpm lingui:extract && pnpm lingui:compile --strict - name: Record deploy commit run: | set -euo pipefail sha=$(git rev-parse HEAD) echo "Deploying commit ${sha}" printf 'DEPLOY_SHA=%s\n' "$sha" >> "$GITHUB_ENV" - name: Set up Rust uses: dtolnay/rust-toolchain@stable with: targets: wasm32-unknown-unknown - name: Cache Rust dependencies uses: actions/cache@v5 with: path: | ~/.cargo/bin/ ~/.cargo/registry/index/ ~/.cargo/registry/cache/ ~/.cargo/git/db/ fluxer_app/crates/gif_wasm/target/ key: ${{ runner.os }}-cargo-${{ hashFiles('fluxer_app/crates/gif_wasm/Cargo.lock') }} restore-keys: | ${{ runner.os }}-cargo- - name: Install wasm-pack run: | set -euo pipefail if ! command -v wasm-pack >/dev/null 2>&1; then cargo install wasm-pack --version 0.13.1 fi - name: Generate wasm artifacts working-directory: fluxer_app run: pnpm wasm:codegen - name: Build application working-directory: fluxer_app env: NODE_ENV: production PUBLIC_BOOTSTRAP_API_ENDPOINT: ${{ env.PUBLIC_BOOTSTRAP_API_ENDPOINT }} PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${{ env.PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT }} PUBLIC_API_VERSION: 1 PUBLIC_PROJECT_ENV: ${{ env.PUBLIC_PROJECT_ENV }} PUBLIC_SENTRY_PROJECT_ID: 4510205815291904 PUBLIC_SENTRY_PUBLIC_KEY: 59ced0e2666ab83dd1ddb056cdd22d1b PUBLIC_SENTRY_DSN: ${{ env.PUBLIC_SENTRY_DSN }} PUBLIC_SENTRY_PROXY_PATH: ${{ env.SENTRY_PROXY_PATH }} PUBLIC_BUILD_NUMBER: ${{ github.run_number }} run: | set -euo pipefail export PUBLIC_BUILD_SHA=$(git rev-parse --short HEAD) export PUBLIC_BUILD_TIMESTAMP=$(date +%s) pnpm build cat > dist/version.json << EOF { "sha": "$PUBLIC_BUILD_SHA", "buildNumber": $PUBLIC_BUILD_NUMBER, "timestamp": $PUBLIC_BUILD_TIMESTAMP, "env": "$PUBLIC_PROJECT_ENV" } EOF - name: Install rclone run: | set -euo pipefail if ! command -v rclone >/dev/null 2>&1; then curl -fsSL https://rclone.org/install.sh | sudo bash fi - name: Upload assets to S3 static bucket env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} run: | set -euo pipefail mkdir -p ~/.config/rclone cat > ~/.config/rclone/rclone.conf << RCLONEEOF [ovh] type = s3 provider = Other env_auth = true endpoint = https://s3.us-east-va.io.cloud.ovh.us acl = public-read RCLONEEOF rclone copy fluxer_app/dist/assets ovh:fluxer-static/assets \ --transfers 32 \ --checkers 16 \ --size-only \ --fast-list \ --s3-upload-concurrency 8 \ --s3-chunk-size 16M \ -v - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Login to Docker Hub uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - name: Build image uses: docker/build-push-action@v6 with: context: . file: ${{ env.DOCKERFILE }} tags: ${{ env.SERVICE_NAME }}:${{ env.DEPLOY_SHA }} load: true platforms: linux/amd64 cache-from: type=gha,scope=${{ env.CACHE_SCOPE }} cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }} env: DOCKER_BUILD_SUMMARY: false DOCKER_BUILD_RECORD_UPLOAD: false - name: Install docker-pussh run: | set -euo pipefail mkdir -p ~/.docker/cli-plugins curl -fsSL https://raw.githubusercontent.com/psviderski/unregistry/v0.3.1/docker-pussh \ -o ~/.docker/cli-plugins/docker-pussh chmod +x ~/.docker/cli-plugins/docker-pussh - name: Set up SSH agent uses: webfactory/ssh-agent@v0.9.1 with: ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_SERVER }} - name: Add server to known hosts run: | set -euo pipefail mkdir -p ~/.ssh ssh-keyscan -H ${{ secrets.SERVER_IP }} >> ~/.ssh/known_hosts - name: Push image and deploy env: IMAGE_TAG: ${{ env.SERVICE_NAME }}:${{ env.DEPLOY_SHA }} SERVER: ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_IP }} SERVICE_NAME: ${{ env.SERVICE_NAME }} COMPOSE_STACK: ${{ env.SERVICE_NAME }} SENTRY_DSN: https://59ced0e2666ab83dd1ddb056cdd22d1b@o4510149383094272.ingest.us.sentry.io/4510205815291904 SENTRY_PROXY_PATH: ${{ env.SENTRY_PROXY_PATH }} SENTRY_REPORT_HOST: ${{ env.SENTRY_REPORT_HOST }} CADDY_APP_DOMAIN: ${{ env.CADDY_APP_DOMAIN }} SENTRY_CADDY_DOMAIN: ${{ env.SENTRY_CADDY_DOMAIN }} API_TARGET: ${{ env.API_TARGET }} RELEASE_CHANNEL: ${{ env.RELEASE_CHANNEL }} APP_REPLICAS: ${{ env.APP_REPLICAS }} run: | set -euo pipefail docker pussh "${IMAGE_TAG}" "${SERVER}" ssh "${SERVER}" \ "IMAGE_TAG=${IMAGE_TAG} SERVICE_NAME=${SERVICE_NAME} COMPOSE_STACK=${COMPOSE_STACK} SENTRY_DSN=${SENTRY_DSN} SENTRY_PROXY_PATH=${SENTRY_PROXY_PATH} SENTRY_REPORT_HOST=${SENTRY_REPORT_HOST} CADDY_APP_DOMAIN=${CADDY_APP_DOMAIN} SENTRY_CADDY_DOMAIN=${SENTRY_CADDY_DOMAIN} API_TARGET=${API_TARGET} RELEASE_CHANNEL=${RELEASE_CHANNEL} APP_REPLICAS=${APP_REPLICAS} bash" << 'EOF' set -euo pipefail sudo mkdir -p "/opt/${SERVICE_NAME}" sudo chown -R "${USER}:${USER}" "/opt/${SERVICE_NAME}" cd "/opt/${SERVICE_NAME}" cat > compose.yaml << COMPOSEEOF x-deploy-base: &deploy_base restart_policy: condition: on-failure delay: 5s max_attempts: 3 update_config: parallelism: 1 delay: 10s order: start-first rollback_config: parallelism: 1 delay: 10s x-common-caddy-headers: &common_caddy_headers caddy.header.Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload" caddy.header.X-Xss-Protection: "1; mode=block" caddy.header.X-Content-Type-Options: "nosniff" caddy.header.Referrer-Policy: "strict-origin-when-cross-origin" caddy.header.X-Frame-Options: "DENY" caddy.header.Expect-Ct: "max-age=86400, report-uri=\\"${SENTRY_REPORT_HOST}/api/4510205815291904/security/?sentry_key=59ced0e2666ab83dd1ddb056cdd22d1b\\"" caddy.header.Cache-Control: "no-store, no-cache, must-revalidate" caddy.header.Pragma: "no-cache" caddy.header.Expires: "0" x-env-base: &env_base PORT: 8080 RELEASE_CHANNEL: ${RELEASE_CHANNEL} FLUXER_METRICS_HOST: fluxer-metrics_app:8080 SENTRY_DSN: ${SENTRY_DSN} SENTRY_REPORT_HOST: ${SENTRY_REPORT_HOST} x-healthcheck: &healthcheck test: ['CMD', 'curl', '-f', 'http://localhost:8080/_health'] interval: 30s timeout: 10s retries: 3 start_period: 40s services: app: image: ${IMAGE_TAG} deploy: <<: *deploy_base replicas: ${APP_REPLICAS} labels: <<: *common_caddy_headers caddy: ${CADDY_APP_DOMAIN} caddy.handle_path_0: /api* caddy.handle_path_0.reverse_proxy: "http://${API_TARGET}:8080" caddy.reverse_proxy: "{{upstreams 8080}}" environment: <<: *env_base SENTRY_PROXY_PATH: ${SENTRY_PROXY_PATH} networks: [fluxer-shared] healthcheck: *healthcheck sentry: image: ${IMAGE_TAG} deploy: <<: *deploy_base replicas: 1 labels: <<: *common_caddy_headers caddy: ${SENTRY_CADDY_DOMAIN} caddy.reverse_proxy: "{{upstreams 8080}}" environment: <<: *env_base SENTRY_PROXY_PATH: / networks: [fluxer-shared] healthcheck: *healthcheck networks: fluxer-shared: external: true COMPOSEEOF docker stack deploy \ --with-registry-auth \ --detach=false \ --resolve-image never \ -c compose.yaml \ "${COMPOSE_STACK}" EOF