From 7c1b9a5e40b31a3703f03e8c1d655c9381833c2c Mon Sep 17 00:00:00 2001 From: Sebastian Serfling Date: Thu, 7 May 2026 14:56:37 +0200 Subject: [PATCH] feat: Update workflows for Token-based Git clone --- .gitea/workflows/production.yml | 25 ++++++++--------- .gitea/workflows/staging.yml | 48 ++++++++++++++++++++++----------- terraform/main.tf | 27 ++++++++++++------- terraform/variables.tf | 20 ++++++++++---- 4 files changed, 77 insertions(+), 43 deletions(-) diff --git a/.gitea/workflows/production.yml b/.gitea/workflows/production.yml index e1fd076..b324ed5 100644 --- a/.gitea/workflows/production.yml +++ b/.gitea/workflows/production.yml @@ -7,26 +7,23 @@ on: jobs: production: - runs-on: ubuntu-latest + runs-on: production steps: - name: Checkout uses: actions/checkout@v3 with: submodules: true - - name: SSH Key einrichten + - name: Configure Git Token run: | - mkdir -p ~/.ssh - echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key - chmod 600 ~/.ssh/deploy_key - echo "${{ secrets.PROD_HOST_KEY }}" >> ~/.ssh/known_hosts + git config --global url."https://sebastian.serfling:${{ secrets.GIT_TOKEN }}@gitlab.stines.de/".insteadOf "https://gitlab.stines.de/" - - name: Hugo Build - run: hugo --minify --source ./hugo - - - name: Deploy auf Production + - name: Hugo Build & Deploy run: | - rsync -az --delete \ - -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \ - ./hugo/public/ \ - root@${{ secrets.PROD_IP }}:/var/www/html/ + set -e + + # Hugo Build direkt in /var/www/html + hugo --minify --source ./hugo -d /var/www/html + + echo "✅ Production Hugo Build erfolgreich!" + echo "🚀 Live unter https://stines.de" diff --git a/.gitea/workflows/staging.yml b/.gitea/workflows/staging.yml index 71a3dbe..00438f1 100644 --- a/.gitea/workflows/staging.yml +++ b/.gitea/workflows/staging.yml @@ -7,14 +7,14 @@ on: jobs: staging: - runs-on: ubuntu-latest + runs-on: proxmox steps: - name: Checkout uses: actions/checkout@v3 with: submodules: true - - name: Terraform Init & Apply (Staging LXC) + - name: Terraform Init & Apply (Staging LXC erstellen) working-directory: terraform run: | terraform init @@ -23,25 +23,43 @@ jobs: -var="proxmox_token_id=${{ secrets.PROXMOX_TOKEN_ID }}" \ -var="proxmox_token_secret=${{ secrets.PROXMOX_TOKEN_SECRET }}" \ -var="proxmox_node=${{ secrets.PROXMOX_NODE }}" \ + -var="lxc_bridge=vmbr2" \ -var="staging_ip=${{ secrets.STAGING_IP }}" \ -var="staging_gw=${{ secrets.STAGING_GW }}" \ - -var="ssh_public_key=${{ secrets.DEPLOY_SSH_PUBKEY }}" + -var="ssh_public_key=${{ secrets.DEPLOY_SSH_PUBKEY }}" \ + -var="ssh_private_key=${{ secrets.DEPLOY_SSH_KEY }}" env: TF_IN_AUTOMATION: "true" - - name: SSH Key einrichten + - name: Warte auf LXC Boot + run: sleep 30 + + - name: SSH Key Setup run: | mkdir -p ~/.ssh - echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key - chmod 600 ~/.ssh/deploy_key - echo "${{ secrets.STAGING_HOST_KEY }}" >> ~/.ssh/known_hosts + echo "${{ secrets.DEPLOY_SSH_KEY }}" | base64 -d > ~/.ssh/staging_key + chmod 600 ~/.ssh/staging_key + ssh-keyscan -H ${{ secrets.STAGING_IP }} >> ~/.ssh/known_hosts 2>/dev/null || true - - name: Hugo Build - run: hugo --minify --source ./hugo - - - name: Deploy auf Staging + - name: Hugo Clone & Build auf Staging-LXC run: | - rsync -az --delete \ - -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \ - ./hugo/public/ \ - root@${{ secrets.STAGING_IP_PLAIN }}:/var/www/html/ + ssh -i ~/.ssh/staging_key -o StrictHostKeyChecking=no deploy@${{ secrets.STAGING_IP }} bash << 'EOF' + set -e + cd /tmp + + # Repository clonen mit Token (oder updaten falls existiert) + GIT_URL="https://sebastian.serfling:${{ secrets.GIT_TOKEN }}@gitlab.stines.de/sebastian.serfling/Webseite_Stines.git" + + if [ -d "webseite" ]; then + cd webseite + git pull origin main + else + git clone "$GIT_URL" webseite + cd webseite + fi + + # Hugo Build direkt in /var/www/html + hugo --minify --source ./hugo -d /var/www/html + + echo "✅ Staging Hugo Build erfolgreich!" + EOF diff --git a/terraform/main.tf b/terraform/main.tf index dbe2cc1..4521d08 100644 --- a/terraform/main.tf +++ b/terraform/main.tf @@ -17,25 +17,26 @@ provider "proxmox" { resource "proxmox_lxc" "staging" { target_node = var.proxmox_node hostname = "hugo-staging" + vmid = 200 ostemplate = var.lxc_ostemplate unprivileged = true start = true onboot = false - cores = 1 - memory = 512 + cores = 2 + memory = 1024 swap = 512 rootfs { storage = var.lxc_storage - size = "8G" + size = "10G" } network { name = "eth0" - bridge = "vmbr0" - ip = var.staging_ip - gw = var.staging_gw != "" ? var.staging_gw : null + bridge = var.lxc_bridge + ip = "${var.staging_ip}/24" + gw = var.staging_gw } ssh_public_keys = var.ssh_public_key @@ -43,18 +44,26 @@ resource "proxmox_lxc" "staging" { provisioner "remote-exec" { inline = [ "apt-get update -qq", - "apt-get install -y nginx", + "apt-get install -y hugo nginx git rsync curl", "systemctl enable --now nginx", + "useradd -m -s /bin/bash deploy || true", + "mkdir -p /home/deploy/.ssh", + "chmod 700 /home/deploy/.ssh", + "echo '${var.ssh_public_key}' >> /home/deploy/.ssh/authorized_keys", + "chmod 600 /home/deploy/.ssh/authorized_keys", + "chown -R deploy:deploy /home/deploy/.ssh", "mkdir -p /var/www/html", - "chown -R www-data:www-data /var/www/html" + "chown -R deploy:deploy /var/www/html" ] connection { type = "ssh" user = "root" - private_key = file("~/.ssh/deploy_key") + private_key = var.ssh_private_key host = self.network[0].ip } } + + depends_on = [] } output "staging_ip" { diff --git a/terraform/variables.tf b/terraform/variables.tf index b2d718a..688c260 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -17,7 +17,11 @@ variable "proxmox_token_secret" { variable "proxmox_node" { description = "Ziel-Proxmox-Node" type = string - default = "pve" +} + +variable "lxc_bridge" { + description = "Netzwerk-Bridge (z.B. vmbr2)" + type = string } variable "lxc_ostemplate" { @@ -33,18 +37,24 @@ variable "lxc_storage" { } variable "staging_ip" { - description = "Statische IP fuer Staging-LXC (CIDR)" + description = "Statische IP fuer Staging-LXC (ohne CIDR)" type = string - default = "dhcp" + default = "172.17.1.100" } variable "staging_gw" { description = "Gateway fuer Staging-LXC" type = string - default = "" + default = "172.17.1.1" } variable "ssh_public_key" { - description = "SSH Public Key fuer den deploy-User im LXC" + description = "SSH Public Key fuer deploy-User im LXC" type = string } + +variable "ssh_private_key" { + description = "SSH Private Key (für Provisioning)" + type = string + sensitive = true +}