chore(ci): remove root .woodpecker.yml, superseded by .woodpecker/deploy.yml
Woodpecker ignores this file entirely once .woodpecker/ folder exists (config resolution: .woodpecker/ > .woodpecker.yaml > .woodpecker.yml). Content preserved verbatim in .woodpecker/deploy.yml.
This commit is contained in:
-295
@@ -1,295 +0,0 @@
|
|||||||
when:
|
|
||||||
- event: push
|
|
||||||
branch: main
|
|
||||||
|
|
||||||
steps:
|
|
||||||
validate:
|
|
||||||
image: alpine:latest
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache docker-cli docker-cli-compose
|
|
||||||
- |
|
|
||||||
# Collect changed stacks — both flat files and folder-based
|
|
||||||
CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
|
|
||||||
|
|
||||||
# Flat: any root-level *.yaml
|
|
||||||
FLAT=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.ya?ml$' || true)
|
|
||||||
|
|
||||||
# Folder: any file under a subfolder (e.g. immich/immich.yml)
|
|
||||||
FOLDERS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
|
|
||||||
|
|
||||||
[ -z "$FLAT" ] && [ -z "$FOLDERS" ] && echo "No stacks changed" && exit 0
|
|
||||||
|
|
||||||
for f in $FLAT; do
|
|
||||||
[ -f "$f" ] || continue
|
|
||||||
docker compose -f "$f" --no-interpolate config -q \
|
|
||||||
&& echo " OK $f" || { echo " FAIL $f"; exit 1; }
|
|
||||||
done
|
|
||||||
|
|
||||||
for d in $FOLDERS; do
|
|
||||||
[ -d "$d" ] || continue
|
|
||||||
# Build -f flags for all compose files in folder, main first
|
|
||||||
MAIN=""
|
|
||||||
EXTRAS=""
|
|
||||||
for ext in yml yaml; do
|
|
||||||
[ -f "$d/$d.$ext" ] && MAIN="$d/$d.$ext" && break
|
|
||||||
done
|
|
||||||
[ -z "$MAIN" ] && echo " SKIP $d (no main compose file)" && continue
|
|
||||||
for cf in $(find "$d" -maxdepth 1 \( -name '*.yml' -o -name '*.yaml' \) | sort); do
|
|
||||||
[ "$cf" = "$MAIN" ] && continue
|
|
||||||
EXTRAS="$EXTRAS -f $cf"
|
|
||||||
done
|
|
||||||
docker compose -f "$MAIN" $EXTRAS --no-interpolate config -q \
|
|
||||||
&& echo " OK $d/" || { echo " FAIL $d/"; exit 1; }
|
|
||||||
done
|
|
||||||
|
|
||||||
provision-secrets:
|
|
||||||
image: alpine:latest
|
|
||||||
environment:
|
|
||||||
SSH_KEY:
|
|
||||||
from_secret: ssh_key
|
|
||||||
SWARM_MANAGER_IP:
|
|
||||||
from_secret: swarm_manager_ip
|
|
||||||
3DPRINT_DB_PASSWORD:
|
|
||||||
from_secret: 3dprint_db_password
|
|
||||||
GAMMA_AUTH_TOKEN:
|
|
||||||
from_secret: gamma_auth_token
|
|
||||||
GIT_DB_PASSWORD:
|
|
||||||
from_secret: git_db_password
|
|
||||||
GIT_RUNNER_TOKEN:
|
|
||||||
from_secret: git_runner_token
|
|
||||||
GIT_MCP_ACCESS_TOKEN:
|
|
||||||
from_secret: git_mcp_access_token
|
|
||||||
HOMEASSISTANT_FRIGATE_RTSP_PASSWORD:
|
|
||||||
from_secret: homeassistant_frigate_rtsp_password
|
|
||||||
HOMEASSISTANT_IMMICH_API_KEY:
|
|
||||||
from_secret: homeassistant_immich_api_key
|
|
||||||
IMMICH_DB_PASSWORD:
|
|
||||||
from_secret: immich_db_password
|
|
||||||
IMMICH_KIOSK_BASICAUTH:
|
|
||||||
from_secret: immich_kiosk_basicauth
|
|
||||||
MEALIE_DB_PASSWORD:
|
|
||||||
from_secret: mealie_db_password
|
|
||||||
MEALIE_LDAP_QUERY_PASSWORD:
|
|
||||||
from_secret: mealie_ldap_query_password
|
|
||||||
MESHCENTRAL_BACKUP_PASSWORD:
|
|
||||||
from_secret: meshcentral_backup_password
|
|
||||||
N8N_DB_PASSWORD:
|
|
||||||
from_secret: n8n_db_password
|
|
||||||
N8N_ENCRYPTION_KEY:
|
|
||||||
from_secret: n8n_encryption_key
|
|
||||||
POSTGRESQL_PASSWORD:
|
|
||||||
from_secret: postgresql_password
|
|
||||||
POSTGRESQL_PGADMIN_PASSWORD:
|
|
||||||
from_secret: postgresql_pgadmin_password
|
|
||||||
PRODUCTIVITY_PAPERLESS_SECRET_KEY:
|
|
||||||
from_secret: productivity_paperless_secret_key
|
|
||||||
PRODUCTIVITY_DB_PASSWORD:
|
|
||||||
from_secret: productivity_db_password
|
|
||||||
PRODUCTIVITY_OIDC_PROVIDERS:
|
|
||||||
from_secret: productivity_oidc_providers
|
|
||||||
VAULTWARDEN_ADMIN_TOKEN:
|
|
||||||
from_secret: vaultwarden_admin_token
|
|
||||||
VAULTWARDEN_DATABASE_URL:
|
|
||||||
from_secret: vaultwarden_database_url
|
|
||||||
ENTERTAINMENT_DISCORD_TOKEN:
|
|
||||||
from_secret: entertainment_discord_token
|
|
||||||
ENTERTAINMENT_DISCORD_CLIENT_SECRET:
|
|
||||||
from_secret: entertainment_discord_client_secret
|
|
||||||
ENTERTAINMENT_SECRET_KEY_BASE:
|
|
||||||
from_secret: entertainment_secret_key_base
|
|
||||||
ENTERTAINMENT_BASIC_AUTH_PASSWORD:
|
|
||||||
from_secret: entertainment_basic_auth_password
|
|
||||||
ENTERTAINMENT_SPARKY_DB_PASSWORD:
|
|
||||||
from_secret: entertainment_sparky_db_password
|
|
||||||
ENTERTAINMENT_SPARKY_APP_DB_PASSWORD:
|
|
||||||
from_secret: entertainment_sparky_app_db_password
|
|
||||||
ENTERTAINMENT_SPARKY_ENCRYPTION_KEY:
|
|
||||||
from_secret: entertainment_sparky_encryption_key
|
|
||||||
ENTERTAINMENT_BETTER_AUTH_SECRET:
|
|
||||||
from_secret: entertainment_better_auth_secret
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache openssh-client
|
|
||||||
- mkdir -p ~/.ssh
|
|
||||||
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
||||||
- chmod 600 ~/.ssh/id_rsa
|
|
||||||
- ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
||||||
- |
|
|
||||||
CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
|
|
||||||
FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
|
|
||||||
FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
|
|
||||||
ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
|
|
||||||
[ -z "$ALL_STACKS" ] && echo "No stacks changed, skipping" && exit 0
|
|
||||||
- scp -o StrictHostKeyChecking=no deploy/create-secrets.sh root@${SWARM_MANAGER_IP}:/tmp/cs.sh
|
|
||||||
- |
|
|
||||||
CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
|
|
||||||
FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
|
|
||||||
FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
|
|
||||||
ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
|
|
||||||
|
|
||||||
for STACK in $ALL_STACKS; do
|
|
||||||
echo "Provisioning: $STACK"
|
|
||||||
case "$STACK" in
|
|
||||||
maintenance|media|unifi|guacamole|security|auth|traefik|meshcentral|ddm)
|
|
||||||
echo " No Docker secrets for $STACK — secrets in host .env";;
|
|
||||||
immich)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'immich_db_password' '${IMMICH_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'immich_kiosk_basicauth' '${IMMICH_KIOSK_BASICAUTH}'";;
|
|
||||||
woodpecker)
|
|
||||||
echo " Manual only — skipping";;
|
|
||||||
3dprint)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
|
|
||||||
gamma)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
|
|
||||||
git)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}'
|
|
||||||
create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
|
|
||||||
homeassistant)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
|
|
||||||
create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";;
|
|
||||||
mealie)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
|
|
||||||
n8n)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
|
|
||||||
postgresql)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}'
|
|
||||||
create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
|
|
||||||
productivity)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
|
|
||||||
create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
|
|
||||||
vaultwarden)
|
|
||||||
printf '%s' "${VAULTWARDEN_ADMIN_TOKEN}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_admin_token 2>/dev/null; docker secret create vaultwarden_admin_token -"
|
|
||||||
printf '%s' "${VAULTWARDEN_DATABASE_URL}" | ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "docker secret rm vaultwarden_database_url 2>/dev/null; docker secret create vaultwarden_database_url -";;
|
|
||||||
ai)
|
|
||||||
echo " No Docker secrets for ai -- secrets in host .env";;
|
|
||||||
entertainment)
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} "source /tmp/cs.sh
|
|
||||||
create_or_update_secret 'entertainment_discord_token' '${ENTERTAINMENT_DISCORD_TOKEN}'
|
|
||||||
create_or_update_secret 'entertainment_discord_client_secret' '${ENTERTAINMENT_DISCORD_CLIENT_SECRET}'
|
|
||||||
create_or_update_secret 'entertainment_secret_key_base' '${ENTERTAINMENT_SECRET_KEY_BASE}'
|
|
||||||
create_or_update_secret 'entertainment_basic_auth_password' '${ENTERTAINMENT_BASIC_AUTH_PASSWORD}'
|
|
||||||
create_or_update_secret 'entertainment_sparky_db_password' '${ENTERTAINMENT_SPARKY_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'entertainment_sparky_app_db_password' '${ENTERTAINMENT_SPARKY_APP_DB_PASSWORD}'
|
|
||||||
create_or_update_secret 'entertainment_sparky_encryption_key' '${ENTERTAINMENT_SPARKY_ENCRYPTION_KEY}'
|
|
||||||
create_or_update_secret 'entertainment_better_auth_secret' '${ENTERTAINMENT_BETTER_AUTH_SECRET}'";;
|
|
||||||
*)
|
|
||||||
echo " No secrets case for $STACK";;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
deploy:
|
|
||||||
image: alpine:latest
|
|
||||||
environment:
|
|
||||||
SSH_KEY:
|
|
||||||
from_secret: ssh_key
|
|
||||||
SWARM_MANAGER_IP:
|
|
||||||
from_secret: swarm_manager_ip
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache openssh-client rsync
|
|
||||||
- mkdir -p ~/.ssh
|
|
||||||
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
||||||
- chmod 600 ~/.ssh/id_rsa
|
|
||||||
- ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
||||||
- |
|
|
||||||
CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
|
|
||||||
FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
|
|
||||||
FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
|
|
||||||
ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
|
|
||||||
[ -z "$ALL_STACKS" ] && echo "No stacks changed" && exit 0
|
|
||||||
|
|
||||||
# Always sync deploy/ scripts first
|
|
||||||
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
|
|
||||||
deploy/ root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/deploy/
|
|
||||||
|
|
||||||
for STACK in $ALL_STACKS; do
|
|
||||||
echo "--- Deploying: $STACK ---"
|
|
||||||
# Sync files to host first (always, even for bootstrap stacks)
|
|
||||||
if [ -d "$STACK" ]; then
|
|
||||||
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
|
|
||||||
"$STACK/" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/$STACK/
|
|
||||||
elif [ -f "${STACK}.yaml" ]; then
|
|
||||||
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
|
|
||||||
"${STACK}.yaml" root@${SWARM_MANAGER_IP}:/volume1/docker/compose-files/
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Bootstrap-tier guard: file synced to host, deploy is MANUAL
|
|
||||||
case "$STACK" in
|
|
||||||
traefik|woodpecker|postgresql)
|
|
||||||
echo " [BOOTSTRAP] $STACK: file synced. Deploy is MANUAL."
|
|
||||||
echo " Run: bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK"
|
|
||||||
continue ;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
# Tier 2: auto-deploy
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
|
|
||||||
"bash /volume1/docker/compose-files/deploy/stack-deploy.sh $STACK" \
|
|
||||||
&& echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; }
|
|
||||||
done
|
|
||||||
|
|
||||||
verify:
|
|
||||||
image: alpine:latest
|
|
||||||
environment:
|
|
||||||
SSH_KEY:
|
|
||||||
from_secret: ssh_key
|
|
||||||
SWARM_MANAGER_IP:
|
|
||||||
from_secret: swarm_manager_ip
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache openssh-client
|
|
||||||
- mkdir -p ~/.ssh
|
|
||||||
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
||||||
- chmod 600 ~/.ssh/id_rsa
|
|
||||||
- ssh-keyscan -H ${SWARM_MANAGER_IP} >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
||||||
- |
|
|
||||||
CHANGED_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n')
|
|
||||||
FLAT_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+\.yaml$' | sed 's/\.yaml$//' || true)
|
|
||||||
FOLDER_STACKS=$(echo "$CHANGED_FILES" | grep -E '^[^/]+/' | cut -d/ -f1 | sort -u || true)
|
|
||||||
ALL_STACKS=$(printf '%s\n%s' "$FLAT_STACKS" "$FOLDER_STACKS" | grep -v '^$' | sort -u)
|
|
||||||
[ -z "$ALL_STACKS" ] && exit 0
|
|
||||||
sleep 5
|
|
||||||
for STACK in $ALL_STACKS; do
|
|
||||||
echo "--- $STACK ---"
|
|
||||||
ssh -o StrictHostKeyChecking=no root@${SWARM_MANAGER_IP} \
|
|
||||||
"docker stack ps $STACK --filter desired-state=running \
|
|
||||||
--format ' {{.Name}} {{.CurrentState}}'"
|
|
||||||
done
|
|
||||||
|
|
||||||
notify-success:
|
|
||||||
image: alpine:latest
|
|
||||||
environment:
|
|
||||||
TEAMS_WEBHOOK:
|
|
||||||
from_secret: teams_webhook
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache curl
|
|
||||||
- |
|
|
||||||
CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
|
|
||||||
PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
|
|
||||||
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
|
||||||
when:
|
|
||||||
- status: success
|
|
||||||
|
|
||||||
notify-failure:
|
|
||||||
image: alpine:latest
|
|
||||||
environment:
|
|
||||||
TEAMS_WEBHOOK:
|
|
||||||
from_secret: teams_webhook
|
|
||||||
WOODPECKER_HOST:
|
|
||||||
from_secret: woodpecker_host
|
|
||||||
commands:
|
|
||||||
- apk add --no-cache curl
|
|
||||||
- |
|
|
||||||
PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://%s","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE" "$WOODPECKER_HOST")
|
|
||||||
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
|
||||||
when:
|
|
||||||
- status: failure
|
|
||||||
Reference in New Issue
Block a user