226 lines
10 KiB
YAML
226 lines
10 KiB
YAML
when:
|
|
- event: push
|
|
branch: main
|
|
|
|
steps:
|
|
validate:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache docker-cli docker-cli-compose
|
|
- |
|
|
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
|
[ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
|
|
for f in $YAML_FILES; do
|
|
[ -f "$f" ] || continue
|
|
docker compose -f "$f" --no-interpolate config -q \
|
|
&& echo " OK $f" || { echo " FAIL $f"; exit 1; }
|
|
done
|
|
|
|
provision-secrets:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache openssh-client
|
|
- mkdir -p ~/.ssh
|
|
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
- chmod 600 ~/.ssh/id_rsa
|
|
- ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
|
|
- |
|
|
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
|
[ -z "$YAML_FILES" ] && echo "No stack yaml files changed, skipping" && exit 0
|
|
- scp -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null deploy/create-secrets.sh root@192.168.4.32:/tmp/cs.sh
|
|
- |
|
|
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
|
for f in $YAML_FILES; do
|
|
STACK=$(basename "$f" .yaml)
|
|
echo "Provisioning: $STACK"
|
|
case "$STACK" in
|
|
maintenance|media|unifi)
|
|
echo " No secrets for $STACK";;
|
|
woodpecker)
|
|
echo " Manual only - skipping";;
|
|
3dprint)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret '3dprint_db_password' '${3DPRINT_DB_PASSWORD}'";;
|
|
auth)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'auth_pg_password' '${AUTH_PG_PASSWORD}'
|
|
create_or_update_secret 'auth_secret_key' '${AUTH_SECRET_KEY}'
|
|
create_or_update_secret 'auth_pg_password2' '${AUTH_PG_PASSWORD2}'";;
|
|
gamma)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'gamma_auth_token' '${GAMMA_AUTH_TOKEN}'";;
|
|
git)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'git_db_password' '${GIT_DB_PASSWORD}'
|
|
create_or_update_secret 'git_runner_token' '${GIT_RUNNER_TOKEN}'
|
|
create_or_update_secret 'git_mcp_access_token' '${GIT_MCP_ACCESS_TOKEN}'";;
|
|
homeassistant)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'homeassistant_frigate_rtsp_password' '${HOMEASSISTANT_FRIGATE_RTSP_PASSWORD}'
|
|
create_or_update_secret 'homeassistant_immich_api_key' '${HOMEASSISTANT_IMMICH_API_KEY}'";;
|
|
guacamole)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'guacamole_ldap_bind_password' '${GUACAMOLE_LDAP_BIND_PASSWORD}'
|
|
create_or_update_secret 'guacamole_oidc_client_secret' '${GUACAMOLE_OIDC_CLIENT_SECRET}'
|
|
create_or_update_secret 'guacamole_db_password' '${GUACAMOLE_DB_PASSWORD}'";;
|
|
mealie)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'mealie_db_password' '${MEALIE_DB_PASSWORD}'
|
|
create_or_update_secret 'mealie_ldap_query_password' '${MEALIE_LDAP_QUERY_PASSWORD}'";;
|
|
meshcentral)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'meshcentral_backup_password' '${MESHCENTRAL_BACKUP_PASSWORD}'";;
|
|
n8n)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'n8n_db_password' '${N8N_DB_PASSWORD}'
|
|
create_or_update_secret 'n8n_encryption_key' '${N8N_ENCRYPTION_KEY}'";;
|
|
postgresql)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'postgresql_password' '${POSTGRESQL_PASSWORD}'
|
|
create_or_update_secret 'postgresql_pgadmin_password' '${POSTGRESQL_PGADMIN_PASSWORD}'";;
|
|
traefik)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'traefik_keepalived_password' '${TRAEFIK_KEEPALIVED_PASSWORD}'";;
|
|
productivity)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'productivity_paperless_secret_key' '${PRODUCTIVITY_PAPERLESS_SECRET_KEY}'
|
|
create_or_update_secret 'productivity_db_password' '${PRODUCTIVITY_DB_PASSWORD}'
|
|
create_or_update_secret 'productivity_oidc_providers' '${PRODUCTIVITY_OIDC_PROVIDERS}'";;
|
|
vaultwarden)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'vaultwarden_admin_token' '${VAULTWARDEN_ADMIN_TOKEN}'
|
|
create_or_update_secret 'vaultwarden_database_url' '${VAULTWARDEN_DATABASE_URL}'";;
|
|
security)
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 "source /tmp/cs.sh
|
|
create_or_update_secret 'security_pg_pass' '${SECURITY_PG_PASS}'
|
|
create_or_update_secret 'security_authentik_secret_key' '${SECURITY_AUTHENTIK_SECRET_KEY}'
|
|
create_or_update_secret 'security_authentik_pg_password' '${SECURITY_AUTHENTIK_PG_PASSWORD}'
|
|
create_or_update_secret 'security_crowdsec_pgdsn' '${SECURITY_CROWDSEC_PGDSN}'
|
|
create_or_update_secret 'security_bouncer_key_traefik' '${SECURITY_BOUNCER_KEY_TRAEFIK}'
|
|
create_or_update_secret 'security_crowdsec_api_key' '${SECURITY_CROWDSEC_API_KEY}'
|
|
create_or_update_secret 'security_crowdsec_password' '${SECURITY_CROWDSEC_PASSWORD}'";;
|
|
*)
|
|
echo " No secrets case for $STACK";;
|
|
esac
|
|
done
|
|
secrets:
|
|
- ssh_key
|
|
- 3dprint_db_password
|
|
- ai_aws_access_key_id
|
|
- ai_aws_secret_access_key
|
|
- ai_litellm_master_key
|
|
- ai_litellm_salt_key
|
|
- ai_litellm_db_password
|
|
- ai_oauth_client_id
|
|
- ai_oauth_client_secret
|
|
- ai_webui_secret_key
|
|
- ai_open_webui_db_url
|
|
- ai_mcpo_api_key
|
|
- auth_pg_password
|
|
- auth_secret_key
|
|
- auth_pg_password2
|
|
- entertainment_discord_token
|
|
- entertainment_discord_client_secret
|
|
- entertainment_secret_key_base
|
|
- entertainment_basic_auth_password
|
|
- entertainment_sparky_db_password
|
|
- entertainment_sparky_app_db_password
|
|
- entertainment_sparky_encryption_key
|
|
- entertainment_better_auth_secret
|
|
- gamma_auth_token
|
|
- git_db_password
|
|
- git_runner_token
|
|
- git_mcp_access_token
|
|
- guacamole_ldap_bind_password
|
|
- guacamole_oidc_client_secret
|
|
- guacamole_db_password
|
|
- homeassistant_frigate_rtsp_password
|
|
- homeassistant_immich_api_key
|
|
- mealie_db_password
|
|
- mealie_ldap_query_password
|
|
- meshcentral_backup_password
|
|
- n8n_db_password
|
|
- n8n_encryption_key
|
|
- postgresql_password
|
|
- postgresql_pgadmin_password
|
|
- productivity_paperless_secret_key
|
|
- productivity_db_password
|
|
- productivity_oidc_providers
|
|
- security_pg_pass
|
|
- security_authentik_secret_key
|
|
- security_authentik_pg_password
|
|
- security_crowdsec_pgdsn
|
|
- security_bouncer_key_traefik
|
|
- security_crowdsec_api_key
|
|
- security_crowdsec_password
|
|
- traefik_keepalived_password
|
|
- vaultwarden_admin_token
|
|
- vaultwarden_database_url
|
|
|
|
deploy:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache openssh-client rsync
|
|
- mkdir -p ~/.ssh
|
|
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
- chmod 600 ~/.ssh/id_rsa
|
|
- ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
|
|
- scp -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null deploy/safe-deploy.sh root@192.168.4.32:/tmp/sd.sh
|
|
- |
|
|
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
|
[ -z "$YAML_FILES" ] && echo "No yaml files changed" && exit 0
|
|
for f in $YAML_FILES; do
|
|
[ -f "$f" ] || continue
|
|
STACK=$(basename "$f" .yaml)
|
|
rsync -av -e "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_rsa" \
|
|
"$f" root@192.168.4.32:/volume1/docker/compose-files/
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
|
|
"python3 /tmp/sd.sh ${STACK}" \
|
|
&& echo " OK $STACK" || { echo " FAIL $STACK"; exit 1; }
|
|
done
|
|
secrets: [ ssh_key ]
|
|
|
|
verify:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache openssh-client
|
|
- mkdir -p ~/.ssh
|
|
- echo "$SSH_KEY" | base64 -d > ~/.ssh/id_rsa
|
|
- chmod 600 ~/.ssh/id_rsa
|
|
- ssh-keyscan -H 192.168.4.32 >> ~/.ssh/known_hosts 2>/dev/null
|
|
- |
|
|
YAML_FILES=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' '\n' | grep '\.yaml$' || true)
|
|
[ -z "$YAML_FILES" ] && exit 0
|
|
sleep 5
|
|
for f in $YAML_FILES; do
|
|
STACK=$(basename "$f" .yaml)
|
|
echo "--- $STACK ---"
|
|
ssh -o StrictHostKeyChecking=no root@192.168.4.32 \
|
|
"docker stack ps $STACK --filter desired-state=running \
|
|
--format ' {{.Name}} {{.CurrentState}}'"
|
|
done
|
|
secrets: [ ssh_key ]
|
|
|
|
notify-success:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache curl
|
|
- |
|
|
CHANGED=$(echo "${CI_COMMIT_CHANGED_FILES}" | tr ',' ' ')
|
|
PAYLOAD=$(printf '{"title":"Swarm Deploy OK","text":"Stacks: %s Commit: %s","themeColor":"00aa00"}' "$CHANGED" "$CI_COMMIT_MESSAGE")
|
|
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
|
secrets: [ teams_webhook ]
|
|
when:
|
|
- status: success
|
|
|
|
notify-failure:
|
|
image: alpine:latest
|
|
commands:
|
|
- apk add --no-cache curl
|
|
- |
|
|
PAYLOAD=$(printf '{"title":"Swarm Deploy FAILED","text":"Commit: %s See: https://woodpecker.bryanmail.net","themeColor":"ff0000"}' "$CI_COMMIT_MESSAGE")
|
|
curl -sf -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$TEAMS_WEBHOOK" || true
|
|
secrets: [ teams_webhook ]
|
|
when:
|
|
- status: failure
|