public/librenotes
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

ci(deploy): switch to libretech/runner-image:v1, consolidate workflow (#43)

Browse Source
This commit is contained in:
libretech
2026-04-29 14:27:05 +02:00
parent f4230c05b7 c580e30097
commit 40d7566d06
6 changed files with 74 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.netcup.example
+5 -3
View File
@@ -1,9 +1,11 @@
# Server-side .env for netcup deploy. Copy to /srv/librenotes/.env on the host.
# Used by: docker compose -f compose.yaml -f compose.netcup.yaml up -d
# Image to pull. Main pushes update :main; tag pushes pin to immutable
# tags such as :v0.1.0. The deploy workflow rewrites this line on tag
# pushes; rollback is `perl -i -pe 's|...|=...:vX.Y.Z|' .env && up -d`.
# Image to pull. The default `:main` rolls forward — main pushes
# rebuild and push the same tag, so `compose pull` picks up the new
# digest without rewriting this file. To pin a release (or roll back),
# edit this line to an immutable tag such as :v0.1.0 and re-run
# `docker compose -f compose.yaml -f compose.netcup.yaml pull && up -d`.
LIBRENOTES_IMAGE=git.librete.ch/public/librenotes:main
# Public origin (caddy reverse-proxies to librenotes:8080)
.gitea/workflows/ci.yml
+3 -3
View File
@@ -9,10 +9,10 @@ on:
jobs:
ci:
runs-on: ubuntu-latest
# Pin image: needs make (not in node:20-bookworm). runner-latest
# bundles make, git, curl + node for setup-go.
# Bespoke runner image (Ubuntu 24.04 + make + git + node + go via
# actions/setup-go). See git.librete.ch/libretech/runner-image.
container:
image: catthehacker/ubuntu:runner-latest
image: git.librete.ch/libretech/runner-image:v1
timeout-minutes: 5
steps:
- name: Checkout
.gitea/workflows/deploy.yml
+47 -80
View File
@@ -6,124 +6,91 @@ on:
tags: ["v*"]
# Required repository secrets:
# REGISTRY registry hostname, e.g. git.librete.ch
# REGISTRY_USER robot account or PAT username
# REGISTRY_PASS robot/PAT token with package:write
# DEPLOY_HOST deployment SSH target, e.g. root@netcup
# DEPLOY_KEY private SSH key (PEM, no passphrase)
# DEPLOY_PATH remote stack directory, e.g. /srv/librenotes
# HEALTH_URL public URL to verify post-deploy, e.g.
# https://ln.cloud.librete.ch/healthz
# REGISTRY registry hostname (git.librete.ch)
# REGISTRY_USER robot account or PAT username (libretech-bot)
# REGISTRY_PASS PAT with write:package
# DEPLOY_HOST SSH target, e.g. user@your-deploy-host
# DEPLOY_KEY passphrase-less private key (PEM)
# DEPLOY_PATH remote stack dir (/srv/librenotes)
# HEALTH_URL https://ln.cloud.librete.ch/healthz
#
# Required repository variable:
# DEPLOY_ENABLED set to "true" to enable the workflow
#
# Image path: ${REGISTRY}/public/librenotes (matches Gitea owner/repo).
# Main pushes publish :main and :<sha7>. Tag pushes publish :<tag> and
# :latest, then pin LIBRENOTES_IMAGE on the host to the immutable tag
# so rollback is just `perl -i -pe 's|^LIBRENOTES_IMAGE=.*|...=...:vX.Y.Z|' .env`
# followed by `docker compose ... up -d`.
# Image: ${REGISTRY}/public/librenotes
# main pushes → :main + :<sha7>
# tag pushes → :<tag> + :latest
#
# The host's /srv/librenotes/.env pins LIBRENOTES_IMAGE once
# (e.g. =git.librete.ch/public/librenotes:main). Main pushes
# update :main rolling so a `compose pull` picks up the new image
# without rewriting any file. Tag pin / rollback is a manual edit
# of LIBRENOTES_IMAGE in .env followed by `compose pull && up -d`.
jobs:
build:
deploy:
runs-on: ubuntu-latest
# Gitea Actions: pin image so docker CLI is present. The runner
# already bind-mounts /var/run/docker.sock into job containers
# automatically (because it has the socket mounted itself); adding
# `volumes:` here again triggers a duplicate-mount-point error.
# Custom Gitea runner image: Ubuntu 24.04 + docker CLI + node + git
# + perl + ssh, runner user pre-joined to docker gid 998 so the
# auto-mounted /var/run/docker.sock is writable without --user root.
container:
image: catthehacker/ubuntu:runner-latest
timeout-minutes: 15
image: git.librete.ch/libretech/runner-image:v1
timeout-minutes: 20
if: ${{ vars.DEPLOY_ENABLED == 'true' }}
outputs:
image_ref: ${{ steps.tags.outputs.image_ref }}
steps:
- uses: actions/checkout@v4
- uses: docker/setup-buildx-action@v3
- name: Log in to registry
uses: docker/login-action@v3
- uses: docker/login-action@v3
with:
registry: ${{ secrets.REGISTRY }}
username: ${{ secrets.REGISTRY_USER }}
password: ${{ secrets.REGISTRY_PASS }}
- name: Compute tags
id: tags
run: |
BASE="${{ secrets.REGISTRY }}/public/librenotes"
if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
TAG="${GITHUB_REF##refs/tags/}"
echo "tags=${BASE}:${TAG},${BASE}:latest" >> "$GITHUB_OUTPUT"
echo "version=${TAG}" >> "$GITHUB_OUTPUT"
echo "image_ref=${BASE}:${TAG}" >> "$GITHUB_OUTPUT"
else
SHA7="${GITHUB_SHA::7}"
echo "tags=${BASE}:main,${BASE}:${SHA7}" >> "$GITHUB_OUTPUT"
echo "version=${SHA7}" >> "$GITHUB_OUTPUT"
echo "image_ref=${BASE}:main" >> "$GITHUB_OUTPUT"
fi
- id: meta
uses: docker/metadata-action@v5
with:
images: ${{ secrets.REGISTRY }}/public/librenotes
tags: |
type=ref,event=branch
type=ref,event=tag
type=sha,format=short
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/') }}
- uses: docker/build-push-action@v6
with:
context: .
push: true
tags: ${{ steps.tags.outputs.tags }}
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
build-args: |
VERSION=${{ steps.tags.outputs.version }}
VERSION=${{ steps.meta.outputs.version }}
BUILDTIME=${{ github.event.head_commit.timestamp }}
deploy:
runs-on: ubuntu-latest
# Same image as build — bundles ssh, perl, curl. No docker needed.
container:
image: catthehacker/ubuntu:runner-latest
needs: build
timeout-minutes: 10
if: ${{ vars.DEPLOY_ENABLED == 'true' }}
steps:
- name: Configure SSH
- name: Deploy to host
env:
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
HEALTH_URL: ${{ secrets.HEALTH_URL }}
run: |
mkdir -p ~/.ssh
mkdir -p ~/.ssh && chmod 700 ~/.ssh
printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_deploy
chmod 600 ~/.ssh/id_deploy
ssh-keyscan -H "${DEPLOY_HOST#*@}" >> ~/.ssh/known_hosts 2>/dev/null || true
- name: Pull and restart on deploy host
env:
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }}
IMAGE_REF: ${{ needs.build.outputs.image_ref }}
run: |
REMOTE_CMD='cd "$DEPLOY_PATH" || exit 1
git pull --ff-only
# Always pin LIBRENOTES_IMAGE so first deploy works without manual
# .env priming and so rollback only ever needs an .env edit.
perl -i -pe "s|^LIBRENOTES_IMAGE=.*|LIBRENOTES_IMAGE=$IMAGE_REF|" .env
grep -q "^LIBRENOTES_IMAGE=" .env || echo "LIBRENOTES_IMAGE=$IMAGE_REF" >> .env
docker compose -f compose.yaml -f compose.netcup.yaml pull
docker compose -f compose.yaml -f compose.netcup.yaml up -d --remove-orphans'
ssh -i ~/.ssh/id_deploy \
-o StrictHostKeyChecking=accept-new \
"$DEPLOY_HOST" \
"DEPLOY_PATH='$DEPLOY_PATH' IMAGE_REF='$IMAGE_REF' bash -s" <<< "$REMOTE_CMD"
"set -e
cd '$DEPLOY_PATH'
git pull --ff-only
docker compose -f compose.yaml -f compose.netcup.yaml pull
docker compose -f compose.yaml -f compose.netcup.yaml up -d --remove-orphans"
- name: Verify health
env:
HEALTH_URL: ${{ secrets.HEALTH_URL }}
run: |
# Give the new container ~60s to come up, then poll for
# 200 from /healthz. Failure aborts the workflow.
# Wait up to 60s for /healthz to return 200.
for i in $(seq 1 12); do
if curl -fsS "$HEALTH_URL" >/dev/null; then
echo "deploy verified"
exit 0
fi
curl -fsS "$HEALTH_URL" >/dev/null && exit 0
sleep 5
done
echo "deploy verification failed"
exit 1
echo "deploy health check failed"; exit 1
CLAUDE.md
+2 -2
View File
@@ -18,7 +18,7 @@ Cloud-native multi-tenant notes application built on Notesium (MIT).
## Wave pipelines
- `gt-issue-*` pipelines use `tea` CLI with `--login librete`
- `gt-issue-*` pipelines use `tea` CLI with `--login libretech`
- `gh-issue-*` pipelines use `gh` CLI
- Personas must be registered in `wave.yaml` under `personas:` key — files alone aren't enough
- `wave.yaml` is gitignored (local config)
@@ -27,6 +27,6 @@ Cloud-native multi-tenant notes application built on Notesium (MIT).
## Gitea
- Instance: https://git.librete.ch
- Auth: `tea` CLI, login name `librete`
- Auth: `tea` CLI, login name `libretech` (matches the Gitea username)
- API: https://git.librete.ch/api/v1
- Issues: https://git.librete.ch/public/librenotes/issues
compose.prod.yaml
-45
View File
@@ -1,45 +0,0 @@
# compose.prod.yaml — production overrides (generic, non-netcup).
#
# Use:
# docker compose -f compose.yaml -f compose.prod.yaml up -d
#
# For the netcup deployment, use `compose.netcup.yaml` instead.
#
# Inputs (env or .env file):
# LIBRENOTES_IMAGE registry image, e.g. git.librete.ch/public/librenotes:v0.1.0
# LIBRENOTES_BASE_URL public origin, e.g. https://librenot.es
# LIBRENOTES_JWT_SECRET secrets manager value, NOT committed
# LIBRENOTES_SMTP_HOST real SMTP host
# LIBRENOTES_SMTP_PORT submission port (587 default)
# LIBRENOTES_SMTP_USER SMTP credential
# LIBRENOTES_SMTP_PASS SMTP credential
# LIBRENOTES_SMTP_FROM envelope sender (e.g. no-reply@librenot.es)
services:
librenotes:
image: ${LIBRENOTES_IMAGE}
build: !reset null
environment:
LIBRENOTES_BASE_URL: ${LIBRENOTES_BASE_URL}
LIBRENOTES_JWT_SECRET: ${LIBRENOTES_JWT_SECRET}
LIBRENOTES_SMTP_HOST: ${LIBRENOTES_SMTP_HOST}
LIBRENOTES_SMTP_PORT: ${LIBRENOTES_SMTP_PORT:-587}
LIBRENOTES_SMTP_USER: ${LIBRENOTES_SMTP_USER}
LIBRENOTES_SMTP_PASS: ${LIBRENOTES_SMTP_PASS}
LIBRENOTES_SMTP_FROM: ${LIBRENOTES_SMTP_FROM}
healthcheck:
test: ["CMD", "/librenotes", "healthcheck"]
interval: 30s
timeout: 5s
retries: 3
start_period: 10s
deploy:
resources:
limits:
memory: 256M
reservations:
memory: 64M
logging:
driver: json-file
options:
max-size: "10m"
max-file: "5"
docs/operations.md
+17 -15
View File
@@ -51,14 +51,16 @@ docker compose -f compose.yaml -f compose.netcup.yaml up -d
### Rollback
Image tags are immutable per commit / version. To roll back, set
`LIBRENOTES_IMAGE` to the previous tag in `.env` and run the same
`up -d` command. The deployment workflow does not auto-rollback
on health-check failure — failed health alerts the operator via
the workflow itself, who can then redeploy the prior tag manually.
Tag pushes publish immutable tags (`:vX.Y.Z`). To pin or roll back,
edit `LIBRENOTES_IMAGE` in `/srv/librenotes/.env` and re-run pull +
up. The deployment workflow itself never rewrites the file — failed
health checks abort the workflow and the operator redeploys
manually.
```sh
# Example: roll back to v0.1.0
ssh netcup
cd /srv/librenotes
perl -i -pe 's|^LIBRENOTES_IMAGE=.*|LIBRENOTES_IMAGE=git.librete.ch/public/librenotes:v0.1.0|' .env
docker compose -f compose.yaml -f compose.netcup.yaml pull
docker compose -f compose.yaml -f compose.netcup.yaml up -d
@@ -67,17 +69,17 @@ docker compose -f compose.yaml -f compose.netcup.yaml up -d
### Gitea Actions runner
Workflows run on the netcup `act_runner` (see `runner/` stack in
the netcup umbrella). Both jobs declare `container: catthehacker/ubuntu:runner-latest`
because:
the netcup umbrella). Both `ci.yml` and `deploy.yml` declare
`container: image: git.librete.ch/libretech/runner-image:v1` —
a bespoke Ubuntu 24.04 image (built and signed by us, hosted on
the same Gitea instance) that bundles `git`, `make`, `node`,
`perl`, `ssh`, and a docker CLI. The image's `runner` user is
pre-joined to `docker` group gid 998 so the auto-mounted
`/var/run/docker.sock` is writable without `--user root`.
- The default runner label image (`node:20-bookworm`) lacks `make`
and `docker`, both required by the workflows.
- The `runner-latest` image bundles `make`, `git`, `curl`, `ssh`,
`node`, plus a docker CLI.
The runner config (`runner/config.yaml`) declares
`/var/run/docker.sock` as a `valid_volume` so the build job can
mount the host socket and push images via `docker/build-push-action`.
The runner config (`runner/config.yaml`) whitelists
`/var/run/docker.sock` under `valid_volumes` to allow the
auto-mount.
## Backups