276 lines
9.4 KiB
YAML
276 lines
9.4 KiB
YAML
name: 'Deploy Static Pages'
|
|
description: 'Packages static web assets into a hardened Nginx container, pushes to Gitea registry, and deploys to TrueNAS with Traefik ingress.'
|
|
inputs:
|
|
path:
|
|
description: 'Path to static files directory (e.g. ./dist, ./build/web, ./public)'
|
|
required: false
|
|
default: './dist'
|
|
domain:
|
|
description: 'Target URL or domain for Traefik router (e.g. "my-app.rodydavis.dev" or "https://my-app.rodydavis.dev")'
|
|
required: false
|
|
default: ''
|
|
app_name:
|
|
description: 'Application / container name (defaults to repository name)'
|
|
required: false
|
|
default: ''
|
|
registry:
|
|
description: 'Container registry host'
|
|
required: false
|
|
default: 'git.rodydavis.dev'
|
|
image_name:
|
|
description: 'Container image tag (defaults to registry/repository:latest)'
|
|
required: false
|
|
default: ''
|
|
git_token:
|
|
description: 'Token with package write permissions for container registry'
|
|
required: false
|
|
default: ''
|
|
ssh_key:
|
|
description: 'Private SSH key for authenticating to TrueNAS SCALE'
|
|
required: false
|
|
default: ''
|
|
host:
|
|
description: 'TrueNAS SSH host IP or domain'
|
|
required: false
|
|
default: '10.0.0.218'
|
|
user:
|
|
description: 'TrueNAS SSH user'
|
|
required: false
|
|
default: 'root'
|
|
network:
|
|
description: 'Docker external network name for Traefik'
|
|
required: false
|
|
default: 'apps-net'
|
|
spa:
|
|
description: 'Enable SPA router fallback in Nginx (try_files $uri $uri/ /index.html)'
|
|
required: false
|
|
default: 'true'
|
|
traefik_entrypoints:
|
|
description: 'Traefik entrypoint (e.g. web, websecure)'
|
|
required: false
|
|
default: 'web'
|
|
push_image:
|
|
description: 'Whether to push the built Docker image to registry'
|
|
required: false
|
|
default: 'true'
|
|
deploy:
|
|
description: 'Whether to deploy to TrueNAS'
|
|
required: false
|
|
default: 'true'
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- name: Package and Deploy Static Pages
|
|
shell: bash
|
|
env:
|
|
INPUT_PATH: ${{ inputs.path }}
|
|
INPUT_DOMAIN: ${{ inputs.domain }}
|
|
INPUT_APP_NAME: ${{ inputs.app_name }}
|
|
INPUT_REGISTRY: ${{ inputs.registry }}
|
|
INPUT_IMAGE_NAME: ${{ inputs.image_name }}
|
|
INPUT_GIT_TOKEN: ${{ inputs.git_token }}
|
|
INPUT_SSH_KEY: ${{ inputs.ssh_key }}
|
|
INPUT_HOST: ${{ inputs.host }}
|
|
INPUT_USER: ${{ inputs.user }}
|
|
INPUT_NETWORK: ${{ inputs.network }}
|
|
INPUT_SPA: ${{ inputs.spa }}
|
|
INPUT_ENTRYPOINTS: ${{ inputs.traefik_entrypoints }}
|
|
INPUT_PUSH_IMAGE: ${{ inputs.push_image }}
|
|
INPUT_DEPLOY: ${{ inputs.deploy }}
|
|
REPO_NAME: ${{ github.event.repository.name }}
|
|
GITHUB_REPOSITORY: ${{ github.repository }}
|
|
GITHUB_ACTOR: ${{ github.actor }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "🚀 Starting Static Pages Deployment..."
|
|
|
|
# 1. Resolve repository name fallback
|
|
if [ -z "${REPO_NAME:-}" ]; then
|
|
REPO_NAME=$(basename "${GITHUB_REPOSITORY:-app}")
|
|
fi
|
|
|
|
# 2. Locate static build assets
|
|
ASSET_DIR="$INPUT_PATH"
|
|
if [ ! -d "$ASSET_DIR" ]; then
|
|
echo "Specified path '$ASSET_DIR' not found. Searching common output directories..."
|
|
if [ -d "./dist" ]; then
|
|
ASSET_DIR="./dist"
|
|
elif [ -d "./build/web" ]; then
|
|
ASSET_DIR="./build/web"
|
|
elif [ -d "./web/dist" ]; then
|
|
ASSET_DIR="./web/dist"
|
|
elif [ -d "./public" ]; then
|
|
ASSET_DIR="./public"
|
|
elif [ -d "./build" ]; then
|
|
ASSET_DIR="./build"
|
|
elif [ -d "./out" ]; then
|
|
ASSET_DIR="./out"
|
|
else
|
|
echo "::error::Could not find static asset directory! Checked: '$INPUT_PATH', ./dist, ./build/web, ./public, ./build, ./out"
|
|
exit 1
|
|
fi
|
|
fi
|
|
echo "📁 Using static assets from: $ASSET_DIR"
|
|
|
|
# 3. Resolve target domain & router name
|
|
DOMAIN="$INPUT_DOMAIN"
|
|
if [ -n "$DOMAIN" ]; then
|
|
DOMAIN=$(echo "$DOMAIN" | sed -E 's#^https?://##' | sed 's#/.*$##')
|
|
else
|
|
CLEAN_REPO=$(echo "$REPO_NAME" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
|
|
DOMAIN="${CLEAN_REPO}.rodydavis.dev"
|
|
fi
|
|
|
|
APP_NAME="${INPUT_APP_NAME:-$REPO_NAME}"
|
|
APP_NAME=$(echo "$APP_NAME" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
|
|
ROUTER_NAME=$(echo "$APP_NAME" | tr -cd '[:alnum:]')
|
|
|
|
# 4. Resolve container image tag
|
|
REGISTRY="${INPUT_REGISTRY:-git.rodydavis.dev}"
|
|
if [ -n "$INPUT_IMAGE_NAME" ]; then
|
|
IMAGE_NAME="$INPUT_IMAGE_NAME"
|
|
else
|
|
REPO_LOWER=$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')
|
|
IMAGE_NAME="${REGISTRY}/${REPO_LOWER}:latest"
|
|
fi
|
|
|
|
echo "🌐 Routing Target: https://${DOMAIN}"
|
|
echo "📦 Container Name: ${APP_NAME}-web"
|
|
echo "🏷️ Image Tag: ${IMAGE_NAME}"
|
|
|
|
# 5. Prepare build bundle in temporary staging directory
|
|
BUILD_STAGING=$(mktemp -d)
|
|
trap 'rm -rf "$BUILD_STAGING"' EXIT
|
|
|
|
mkdir -p "${BUILD_STAGING}/html"
|
|
cp -R "${ASSET_DIR}/." "${BUILD_STAGING}/html/"
|
|
|
|
# Configure SPA fallback rule
|
|
if [ "$INPUT_SPA" = "true" ]; then
|
|
SPA_DIRECTIVE='try_files $uri $uri/ /index.html;'
|
|
else
|
|
SPA_DIRECTIVE='try_files $uri $uri/ =404;'
|
|
fi
|
|
|
|
cat <<EOF > "${BUILD_STAGING}/nginx.conf"
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name localhost;
|
|
|
|
root /usr/share/nginx/html;
|
|
index index.html index.htm;
|
|
|
|
gzip on;
|
|
gzip_vary on;
|
|
gzip_min_length 1024;
|
|
gzip_proxied expired no-cache no-store private auth;
|
|
gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript application/json application/manifest+json image/svg+xml;
|
|
|
|
location = /sw.js {
|
|
add_header Cache-Control "no-cache, no-store, must-revalidate";
|
|
expires 0;
|
|
}
|
|
|
|
location = /manifest.json {
|
|
add_header Cache-Control "no-cache, must-revalidate";
|
|
expires 0;
|
|
}
|
|
|
|
location / {
|
|
${SPA_DIRECTIVE}
|
|
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
}
|
|
|
|
location ~* \.(?:css|js|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc|woff|woff2)$ {
|
|
expires 1y;
|
|
add_header Cache-Control "public, immutable";
|
|
}
|
|
|
|
error_page 500 502 503 504 /50x.html;
|
|
location = /50x.html {
|
|
root /usr/share/nginx/html;
|
|
}
|
|
}
|
|
EOF
|
|
|
|
cat <<EOF > "${BUILD_STAGING}/Dockerfile"
|
|
FROM nginx:alpine
|
|
WORKDIR /usr/share/nginx/html
|
|
RUN rm -rf ./*
|
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
|
COPY html/ ./
|
|
EXPOSE 80
|
|
CMD ["nginx", "-g", "daemon off;"]
|
|
EOF
|
|
|
|
cat <<EOF > "${BUILD_STAGING}/docker-compose.yml"
|
|
version: '3.8'
|
|
|
|
services:
|
|
${APP_NAME}-web:
|
|
image: ${IMAGE_NAME}
|
|
container_name: ${APP_NAME}-web
|
|
restart: unless-stopped
|
|
networks:
|
|
- ${INPUT_NETWORK}
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.${ROUTER_NAME}.rule=Host(\`${DOMAIN}\`)"
|
|
- "traefik.http.routers.${ROUTER_NAME}.entrypoints=${INPUT_ENTRYPOINTS}"
|
|
- "traefik.http.services.${ROUTER_NAME}.loadbalancer.server.port=80"
|
|
|
|
networks:
|
|
${INPUT_NETWORK}:
|
|
external: true
|
|
EOF
|
|
|
|
# 6. Docker Build
|
|
echo "🔨 Building Docker image..."
|
|
docker build -t "$IMAGE_NAME" -f "${BUILD_STAGING}/Dockerfile" "$BUILD_STAGING"
|
|
|
|
# 7. Push image to registry
|
|
if [ "$INPUT_PUSH_IMAGE" = "true" ]; then
|
|
if [ -n "$INPUT_GIT_TOKEN" ]; then
|
|
echo "🔐 Logging into ${REGISTRY}..."
|
|
echo "$INPUT_GIT_TOKEN" | docker login "$REGISTRY" -u "${GITHUB_ACTOR}" --password-stdin
|
|
fi
|
|
echo "📤 Pushing image to ${IMAGE_NAME}..."
|
|
docker push "$IMAGE_NAME"
|
|
else
|
|
echo "⏭️ Skipping image push (push_image=false)"
|
|
fi
|
|
|
|
# 8. Deploy to TrueNAS
|
|
if [ "$INPUT_DEPLOY" = "true" ]; then
|
|
if [ -z "$INPUT_SSH_KEY" ]; then
|
|
echo "⚠️ No ssh_key provided for TrueNAS. Skipping remote deployment step."
|
|
else
|
|
echo "🚢 Deploying to TrueNAS SCALE (${INPUT_HOST})..."
|
|
mkdir -p ~/.ssh
|
|
echo "$INPUT_SSH_KEY" > ~/.ssh/truenas_deploy_key
|
|
chmod 600 ~/.ssh/truenas_deploy_key
|
|
ssh-keyscan -H "$INPUT_HOST" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
REMOTE_DIR="/mnt/jupiter/apps/${APP_NAME}"
|
|
echo "Ensuring remote directory ${REMOTE_DIR} on ${INPUT_HOST}..."
|
|
ssh -i ~/.ssh/truenas_deploy_key -o StrictHostKeyChecking=no "${INPUT_USER}@${INPUT_HOST}" "mkdir -p ${REMOTE_DIR}"
|
|
|
|
echo "Syncing docker-compose.yml to ${REMOTE_DIR}..."
|
|
scp -i ~/.ssh/truenas_deploy_key -o StrictHostKeyChecking=no "${BUILD_STAGING}/docker-compose.yml" "${INPUT_USER}@${INPUT_HOST}:${REMOTE_DIR}/docker-compose.yml"
|
|
|
|
echo "Pulling latest image and restarting stack..."
|
|
ssh -i ~/.ssh/truenas_deploy_key -o StrictHostKeyChecking=no "${INPUT_USER}@${INPUT_HOST}" "cd ${REMOTE_DIR} && docker compose pull && docker compose up -d --remove-orphans"
|
|
|
|
rm -f ~/.ssh/truenas_deploy_key
|
|
echo "✅ Deployment complete! Accessible at: https://${DOMAIN}"
|
|
fi
|
|
else
|
|
echo "⏭️ Skipping deployment step (deploy=false)"
|
|
fi
|