diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml index f40ef09..bf79a17 100644 --- a/.gitea/workflows/ci-cd.yml +++ b/.gitea/workflows/ci-cd.yml @@ -1,9 +1,13 @@ # Gitea Actions. While .gitea/workflows exists Gitea ignores .github/workflows (GitHub Pages only). # # Every push and pull request: install, test and build. -# Push to main: then deploy to the server over SSH and start it with docker compose. +# Push to main: build the Docker image, push it to the Gitea registry, then have the server pull it. +# The server holds no source code, only deploy/docker-compose.yml and a .env naming the image. # # Repository settings → Actions → Secrets: +# REGISTRY_USERNAME Gitea user that publishes images +# REGISTRY_TOKEN its personal access token with package Read and Write +# (the built-in GITEA_TOKEN cannot publish packages) # DEPLOY_HOST server address (deploy is skipped while this is empty) # DEPLOY_SSH_KEY private key whose public key is in the server user's ~/.ssh/authorized_keys # DEPLOY_USER SSH user, default root; it must be able to run docker @@ -12,8 +16,7 @@ # Repository settings → Actions → Variables (optional): # NPM_REGISTRY npm mirror used by the runner and the server's Docker build when # registry.npmjs.org is unreachable, e.g. from servers in Iran -# DEPLOY_PATH directory on the server, default vending-machine-game (in the user's home) -# SITE_ADDRESS domains served with HTTPS, default "robotmarkets.ir, www.robotmarkets.ir" +# DEPLOY_PATH directory on the server, default /opt/vending-machine-game # HEALTH_URL URL checked after deploy, e.g. https://robotmarkets.ir/ name: CI/CD @@ -49,11 +52,56 @@ jobs: - name: Build run: npm run build - deploy: + publish: needs: test if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' runs-on: ubuntu-latest timeout-minutes: 30 + outputs: + image: ${{ steps.push.outputs.image }} + steps: + - uses: actions/checkout@v4 + - name: Build, push and link the image + id: push + shell: bash + env: + REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }} + REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }} + SOURCE_REPOSITORY: ${{ gitea.repository }} + COMMIT_SHA: ${{ gitea.sha }} + RUN_ID: ${{ gitea.run_id }} + run: | + set -euo pipefail + REGISTRY='git.my-rm.com' + OWNER="${SOURCE_REPOSITORY%%/*}" + REPO="${SOURCE_REPOSITORY#*/}" + IMAGE="$REGISTRY/${OWNER,,}/${REPO,,}:build-$(date -u +%Y%m%d-%H%M%S)-${RUN_ID}-${COMMIT_SHA:0:7}" + + # Keep this job's registry credentials away from the host's own logins. + DOCKER_CONFIG="$(mktemp -d)" + export DOCKER_CONFIG + trap 'rm -rf "$DOCKER_CONFIG"' EXIT + + printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin + docker build \ + --build-arg "NPM_REGISTRY=$NPM_CONFIG_REGISTRY" \ + --label "org.opencontainers.image.source=https://$REGISTRY/$SOURCE_REPOSITORY" \ + --label "org.opencontainers.image.revision=$COMMIT_SHA" \ + --tag "$IMAGE" . + docker push "$IMAGE" + + # Show the package under this repository's Packages tab. + curl --fail-with-body --silent --show-error --request POST \ + --header "Authorization: token $REGISTRY_TOKEN" \ + "https://$REGISTRY/api/v1/packages/$OWNER/container/${REPO,,}/-/link/$REPO" + + echo "image=$IMAGE" >> "$GITEA_OUTPUT" + echo "Published and linked: $IMAGE" + + deploy: + needs: publish + runs-on: ubuntu-latest + timeout-minutes: 15 container: image: node:22-bookworm env: @@ -63,8 +111,8 @@ jobs: DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }} DEPLOY_PATH: ${{ vars.DEPLOY_PATH }} - SITE_ADDRESS: ${{ vars.SITE_ADDRESS }} HEALTH_URL: ${{ vars.HEALTH_URL }} + IMAGE: ${{ needs.publish.outputs.image }} steps: - uses: actions/checkout@v4 - name: Deploy to the server @@ -75,8 +123,7 @@ jobs: fi port="${DEPLOY_PORT:-22}" target="${DEPLOY_USER:-root}@${DEPLOY_HOST}" - dir="${DEPLOY_PATH:-vending-machine-game}" - site="${SITE_ADDRESS:-robotmarkets.ir, www.robotmarkets.ir}" + dir="${DEPLOY_PATH:-/opt/vending-machine-game}" mkdir -p ~/.ssh && chmod 700 ~/.ssh printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/deploy_key && chmod 600 ~/.ssh/deploy_key if [ -n "$DEPLOY_KNOWN_HOSTS" ]; then @@ -84,10 +131,12 @@ jobs: else ssh-keyscan -p "$port" "$DEPLOY_HOST" > ~/.ssh/known_hosts 2>/dev/null fi - # Ship the checked-out sources (no git history) and rebuild/restart the container there. - tar czf - --exclude=./.git --exclude=./node_modules --exclude=./dist . \ - | ssh -i ~/.ssh/deploy_key -p "$port" "$target" \ - "mkdir -p '$dir' && tar xzf - -C '$dir' && cd '$dir' && SITE_ADDRESS='$site' NPM_REGISTRY='$NPM_CONFIG_REGISTRY' docker compose up -d --build --remove-orphans && docker image prune -f" + # Only the compose file goes to the server; the app itself comes from the registry image. + # The server user must already be logged in to git.my-rm.com (docker login, package Read token). + ssh_opts="-i $HOME/.ssh/deploy_key -p $port" + ssh $ssh_opts "$target" "mkdir -p '$dir'" + scp -i ~/.ssh/deploy_key -P "$port" deploy/docker-compose.yml "$target:$dir/docker-compose.yml" + ssh $ssh_opts "$target" "cd '$dir' && cp -f .env .env.previous 2>/dev/null; printf 'IMAGE=%s\n' '$IMAGE' > .env && docker compose pull && docker compose up -d --remove-orphans && docker image prune -f" - name: Check the site if: env.HEALTH_URL != '' && env.DEPLOY_HOST != '' diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml new file mode 100644 index 0000000..9142be9 --- /dev/null +++ b/deploy/docker-compose.yml @@ -0,0 +1,17 @@ +# Server deployment: runs the prebuilt image from the Gitea registry behind Nginx Proxy Manager. +# NPM terminates HTTPS and forwards to http://vending-machine-game:80 on the frontend_proxy network. +# IMAGE is set in .env next to this file (CI writes it on every deploy). +services: + game: + image: ${IMAGE:?set IMAGE in .env} + container_name: vending-machine-game + restart: unless-stopped + environment: + # Plain HTTP inside the network; no host ports are published. + SITE_ADDRESS: ":80" + networks: + - frontend_proxy + +networks: + frontend_proxy: + external: true