360 lines
13 KiB
YAML
360 lines
13 KiB
YAML
name: deploy api
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- canary
|
|
paths:
|
|
- fluxer_api/**
|
|
- .github/workflows/deploy-api.yaml
|
|
workflow_dispatch:
|
|
inputs:
|
|
channel:
|
|
type: choice
|
|
options:
|
|
- stable
|
|
- canary
|
|
default: stable
|
|
description: Channel to deploy
|
|
ref:
|
|
type: string
|
|
required: false
|
|
default: ''
|
|
description: Optional git ref to deploy (defaults to main/canary based on channel)
|
|
|
|
concurrency:
|
|
group: deploy-fluxer-api-${{ github.event_name == 'workflow_dispatch' && inputs.channel || (github.ref_name == 'canary' && 'canary') || 'stable' }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
channel-vars:
|
|
uses: ./.github/workflows/channel-vars.yaml
|
|
with:
|
|
github_event_name: ${{ github.event_name }}
|
|
github_ref_name: ${{ github.ref_name }}
|
|
github_ref: ${{ github.ref }}
|
|
workflow_dispatch_channel: ${{ github.event_name == 'workflow_dispatch' && inputs.channel || '' }}
|
|
workflow_dispatch_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
|
|
|
|
deploy:
|
|
name: Deploy api
|
|
needs: channel-vars
|
|
runs-on: blacksmith-2vcpu-ubuntu-2404
|
|
timeout-minutes: 10
|
|
env:
|
|
CHANNEL: ${{ needs.channel-vars.outputs.channel }}
|
|
IS_CANARY: ${{ needs.channel-vars.outputs.is_canary }}
|
|
SOURCE_REF: ${{ needs.channel-vars.outputs.source_ref }}
|
|
STACK_SUFFIX: ${{ needs.channel-vars.outputs.stack_suffix }}
|
|
|
|
STACK: ${{ format('fluxer-api{0}', needs.channel-vars.outputs.stack_suffix) }}
|
|
WORKER_STACK: ${{ format('fluxer-api-worker{0}', needs.channel-vars.outputs.stack_suffix) }}
|
|
CACHE_SCOPE: ${{ format('deploy-fluxer-api{0}', needs.channel-vars.outputs.stack_suffix) }}
|
|
|
|
API_PUBLIC_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://api.canary.fluxer.app' || 'https://api.fluxer.app' }}
|
|
API_CLIENT_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://web.canary.fluxer.app/api' || 'https://web.fluxer.app/api' }}
|
|
APP_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://web.canary.fluxer.app' || 'https://web.fluxer.app' }}
|
|
|
|
MARKETING_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://canary.fluxer.app' || 'https://fluxer.app' }}
|
|
|
|
ADMIN_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://admin.canary.fluxer.app' || 'https://admin.fluxer.app' }}
|
|
ADMIN_REDIRECT_URI: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://admin.canary.fluxer.app/oauth2_callback' || 'https://admin.fluxer.app/oauth2_callback' }}
|
|
|
|
CADDY_DOMAIN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'api.canary.fluxer.app' || 'api.fluxer.app' }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
ref: ${{ env.SOURCE_REF }}
|
|
fetch-depth: 0
|
|
|
|
- name: Record deploy commit
|
|
run: |
|
|
set -euo pipefail
|
|
sha=$(git rev-parse HEAD)
|
|
echo "Deploying commit ${sha}"
|
|
printf 'DEPLOY_SHA=%s\n' "$sha" >> "$GITHUB_ENV"
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
|
|
|
- name: Build image(s)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: fluxer_api
|
|
file: fluxer_api/Dockerfile
|
|
tags: |
|
|
${{ env.STACK }}:${{ env.DEPLOY_SHA }}
|
|
${{ env.WORKER_STACK }}:${{ env.DEPLOY_SHA }}
|
|
load: true
|
|
platforms: linux/amd64
|
|
cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
|
|
cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
|
|
env:
|
|
DOCKER_BUILD_SUMMARY: false
|
|
DOCKER_BUILD_RECORD_UPLOAD: false
|
|
|
|
- name: Install docker-pussh
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p ~/.docker/cli-plugins
|
|
curl -fsSL https://raw.githubusercontent.com/psviderski/unregistry/v0.3.1/docker-pussh \
|
|
-o ~/.docker/cli-plugins/docker-pussh
|
|
chmod +x ~/.docker/cli-plugins/docker-pussh
|
|
|
|
- name: Set up SSH agent
|
|
uses: webfactory/ssh-agent@v0.9.1
|
|
with:
|
|
ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_SERVER }}
|
|
|
|
- name: Add server to known hosts
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p ~/.ssh
|
|
ssh-keyscan -H ${{ secrets.SERVER_IP }} >> ~/.ssh/known_hosts
|
|
|
|
- name: Push image(s) and deploy
|
|
env:
|
|
SERVER: ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_IP }}
|
|
IMAGE_TAG_APP: ${{ env.STACK }}:${{ env.DEPLOY_SHA }}
|
|
IMAGE_TAG_WORKER: ${{ env.WORKER_STACK }}:${{ env.DEPLOY_SHA }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
docker pussh "${IMAGE_TAG_APP}" "${SERVER}"
|
|
|
|
if [[ "${IS_CANARY}" == "true" ]]; then
|
|
docker pussh "${IMAGE_TAG_WORKER}" "${SERVER}"
|
|
fi
|
|
|
|
ssh "${SERVER}" \
|
|
"IMAGE_TAG_APP=${IMAGE_TAG_APP} IMAGE_TAG_WORKER=${IMAGE_TAG_WORKER} STACK=${STACK} WORKER_STACK=${WORKER_STACK} IS_CANARY=${IS_CANARY} APP_ENDPOINT=${APP_ENDPOINT} API_PUBLIC_ENDPOINT=${API_PUBLIC_ENDPOINT} API_CLIENT_ENDPOINT=${API_CLIENT_ENDPOINT} MARKETING_ENDPOINT=${MARKETING_ENDPOINT} ADMIN_ENDPOINT=${ADMIN_ENDPOINT} ADMIN_REDIRECT_URI=${ADMIN_REDIRECT_URI} CADDY_DOMAIN=${CADDY_DOMAIN} bash" << 'EOF'
|
|
set -euo pipefail
|
|
|
|
write_runtime_env() {
|
|
local dir="$1"
|
|
cat > "${dir}/runtime.env" << ENVEOF
|
|
NODE_ENV=production
|
|
FLUXER_API_PORT=8080
|
|
SENTRY_DSN=https://bb16e8b823b82d788db49a666b3b4b90@o4510149383094272.ingest.us.sentry.io/4510205804019712
|
|
|
|
CASSANDRA_HOSTS=cassandra
|
|
CASSANDRA_KEYSPACE=fluxer
|
|
CASSANDRA_LOCAL_DC=dc1
|
|
|
|
FLUXER_GATEWAY_RPC_HOST=fluxer-gateway_app
|
|
FLUXER_GATEWAY_RPC_PORT=8081
|
|
|
|
FLUXER_MEDIA_PROXY_HOST=fluxer-media-proxy_app
|
|
FLUXER_MEDIA_PROXY_PORT=8080
|
|
|
|
FLUXER_METRICS_HOST=fluxer-metrics_app:8080
|
|
|
|
FLUXER_API_CLIENT_ENDPOINT=${API_CLIENT_ENDPOINT}
|
|
FLUXER_APP_ENDPOINT=${APP_ENDPOINT}
|
|
FLUXER_CDN_ENDPOINT=https://fluxerstatic.com
|
|
FLUXER_MEDIA_ENDPOINT=https://fluxerusercontent.com
|
|
FLUXER_INVITE_ENDPOINT=https://fluxer.gg
|
|
FLUXER_GIFT_ENDPOINT=https://fluxer.gift
|
|
|
|
AWS_S3_ENDPOINT=https://s3.us-east-va.io.cloud.ovh.us
|
|
AWS_S3_BUCKET_CDN=fluxer
|
|
AWS_S3_BUCKET_UPLOADS=fluxer-uploads
|
|
AWS_S3_BUCKET_REPORTS=fluxer-reports
|
|
AWS_S3_BUCKET_HARVESTS=fluxer-harvests
|
|
AWS_S3_BUCKET_DOWNLOADS=fluxer-downloads
|
|
|
|
SENDGRID_FROM_EMAIL=noreply@fluxer.app
|
|
SENDGRID_FROM_NAME=Fluxer
|
|
SENDGRID_WEBHOOK_PUBLIC_KEY=MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEoeqQS37o9s8ZcLBJUtT4hghAmI5RqsvcQ0OvsUn3XPfl7GkjxljufyxuL8+m1mCHP2IA1jdYT3kJQoQYXP6ZpQ==
|
|
|
|
FLUXER_API_PUBLIC_ENDPOINT=${API_PUBLIC_ENDPOINT}
|
|
FLUXER_GATEWAY_ENDPOINT=wss://gateway.fluxer.app
|
|
|
|
FLUXER_MARKETING_ENDPOINT=${MARKETING_ENDPOINT}
|
|
FLUXER_PATH_MARKETING=/
|
|
|
|
FLUXER_ADMIN_ENDPOINT=${ADMIN_ENDPOINT}
|
|
FLUXER_PATH_ADMIN=/
|
|
|
|
ADMIN_OAUTH2_CLIENT_ID=1440355698178071552
|
|
ADMIN_OAUTH2_REDIRECT_URI=${ADMIN_REDIRECT_URI}
|
|
ADMIN_OAUTH2_AUTO_CREATE=false
|
|
|
|
PASSKEYS_ENABLED=true
|
|
PASSKEY_RP_NAME=Fluxer
|
|
PASSKEY_RP_ID=fluxer.app
|
|
PASSKEY_ALLOWED_ORIGINS=https://web.fluxer.app,https://web.canary.fluxer.app
|
|
|
|
CAPTCHA_ENABLED=true
|
|
CAPTCHA_PRIMARY_PROVIDER=turnstile
|
|
HCAPTCHA_SITE_KEY=9cbad400-df84-4e0c-bda6-e65000be78aa
|
|
TURNSTILE_SITE_KEY=0x4AAAAAAB_lAoDdTWznNHMq
|
|
|
|
EMAIL_ENABLED=true
|
|
SMS_ENABLED=true
|
|
VOICE_ENABLED=true
|
|
|
|
SEARCH_ENABLED=true
|
|
MEILISEARCH_URL=http://meilisearch:7700
|
|
|
|
STRIPE_ENABLED=true
|
|
STRIPE_PRICE_ID_MONTHLY_USD=price_1SJHZzFPC94Os7FdzBgvz0go
|
|
STRIPE_PRICE_ID_YEARLY_USD=price_1SJHabFPC94Os7FdhSOWVfcr
|
|
STRIPE_PRICE_ID_VISIONARY_USD=price_1SJHGTFPC94Os7FdWTyqvJZ8
|
|
STRIPE_PRICE_ID_MONTHLY_EUR=price_1SJHaFFPC94Os7FdmcrGicXa
|
|
STRIPE_PRICE_ID_YEARLY_EUR=price_1SJHarFPC94Os7Fddbyzr5I8
|
|
STRIPE_PRICE_ID_VISIONARY_EUR=price_1SJHGnFPC94Os7FdZn23KkYB
|
|
STRIPE_PRICE_ID_GIFT_VISIONARY_USD=price_1SKhWqFPC94Os7FdxRmQrg3k
|
|
STRIPE_PRICE_ID_GIFT_VISIONARY_EUR=price_1SKhXrFPC94Os7FdcepLrJqr
|
|
STRIPE_PRICE_ID_GIFT_1_MONTH_USD=price_1SJHHKFPC94Os7FdGwUs1EQg
|
|
STRIPE_PRICE_ID_GIFT_1_YEAR_USD=price_1SJHHrFPC94Os7FdWrQN5tKl
|
|
STRIPE_PRICE_ID_GIFT_1_MONTH_EUR=price_1SJHHaFPC94Os7FdwwpwhliW
|
|
STRIPE_PRICE_ID_GIFT_1_YEAR_EUR=price_1SJHI5FPC94Os7Fd3DpLxb0D
|
|
|
|
FLUXER_VISIONARIES_GUILD_ID=1428504839258075143
|
|
FLUXER_OPERATORS_GUILD_ID=1434192442151473226
|
|
|
|
CLOUDFLARE_PURGE_ENABLED=true
|
|
|
|
CLAMAV_ENABLED=true
|
|
CLAMAV_HOST=clamav
|
|
CLAMAV_PORT=3310
|
|
|
|
GEOIP_HOST=fluxer-geoip_app:8080
|
|
GEOIP_PROVIDER=maxmind
|
|
MAXMIND_DB_PATH=/data/GeoLite2-City.mmdb
|
|
|
|
VAPID_PUBLIC_KEY=BEIwQxIwfj6m90tLYAR0AU_GJWU4kw8J_zJcHQG55NCUWSyRy-dzMOgvxk8yEDwdVyJZa6xUL4fmwngijq8T2pY
|
|
ENVEOF
|
|
}
|
|
|
|
deploy_api_stack() {
|
|
sudo mkdir -p "/opt/${STACK}"
|
|
sudo chown -R "${USER}:${USER}" "/opt/${STACK}"
|
|
cd "/opt/${STACK}"
|
|
|
|
write_runtime_env "$(pwd)"
|
|
|
|
cat > compose.yaml << COMPOSEEOF
|
|
x-deploy-base: &deploy_base
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
rollback_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
|
|
x-healthcheck: &healthcheck
|
|
test: ['CMD', 'curl', '-f', 'http://localhost:8080/_health']
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|
|
|
|
services:
|
|
app:
|
|
image: ${IMAGE_TAG_APP}
|
|
command: ['npm', 'run', 'start']
|
|
env_file:
|
|
- /etc/fluxer/fluxer.env
|
|
- ./runtime.env
|
|
volumes:
|
|
- /opt/geoip/GeoLite2-City.mmdb:/data/GeoLite2-City.mmdb:ro
|
|
deploy:
|
|
<<: *deploy_base
|
|
replicas: 2
|
|
labels:
|
|
- "caddy=${CADDY_DOMAIN}"
|
|
- 'caddy.reverse_proxy={{upstreams 8080}}'
|
|
- 'caddy.header.Strict-Transport-Security="max-age=31536000; includeSubDomains; preload"'
|
|
- 'caddy.header.X-Xss-Protection="1; mode=block"'
|
|
- 'caddy.header.X-Content-Type-Options=nosniff'
|
|
- 'caddy.header.Referrer-Policy=strict-origin-when-cross-origin'
|
|
- 'caddy.header.X-Frame-Options=DENY'
|
|
- 'caddy.header.Expect-Ct="max-age=86400, report-uri=\\"https://o4510149383094272.ingest.us.sentry.io/api/4510205804019712/security/?sentry_key=bb16e8b823b82d788db49a666b3b4b90\\""'
|
|
networks: [fluxer-shared]
|
|
healthcheck: *healthcheck
|
|
|
|
networks:
|
|
fluxer-shared:
|
|
external: true
|
|
COMPOSEEOF
|
|
|
|
docker stack deploy \
|
|
--with-registry-auth \
|
|
--detach=false \
|
|
--resolve-image never \
|
|
-c compose.yaml \
|
|
"${STACK}"
|
|
}
|
|
|
|
deploy_worker_stack_canary_only() {
|
|
if [[ "${IS_CANARY}" != "true" ]]; then
|
|
return 0
|
|
fi
|
|
|
|
sudo mkdir -p "/opt/${WORKER_STACK}"
|
|
sudo chown -R "${USER}:${USER}" "/opt/${WORKER_STACK}"
|
|
cd "/opt/${WORKER_STACK}"
|
|
|
|
write_runtime_env "$(pwd)"
|
|
|
|
cat > compose.yaml << COMPOSEEOF
|
|
x-deploy-base: &deploy_base
|
|
restart_policy:
|
|
condition: on-failure
|
|
delay: 5s
|
|
max_attempts: 3
|
|
update_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
order: start-first
|
|
rollback_config:
|
|
parallelism: 1
|
|
delay: 10s
|
|
|
|
services:
|
|
worker:
|
|
image: ${IMAGE_TAG_WORKER}
|
|
command: ['npm', 'run', 'start:worker']
|
|
env_file:
|
|
- /etc/fluxer/fluxer.env
|
|
- ./runtime.env
|
|
deploy:
|
|
<<: *deploy_base
|
|
replicas: 1
|
|
networks: [fluxer-shared]
|
|
|
|
networks:
|
|
fluxer-shared:
|
|
external: true
|
|
COMPOSEEOF
|
|
|
|
docker stack deploy \
|
|
--with-registry-auth \
|
|
--detach=false \
|
|
--resolve-image never \
|
|
-c compose.yaml \
|
|
"${WORKER_STACK}"
|
|
}
|
|
|
|
deploy_api_stack
|
|
deploy_worker_stack_canary_only
|
|
EOF
|