Bendik Aagaard Lynghaug
70a7586471
Deploy / deploy (push) Failing after 27s
sudo needs setuid escalation, which the runner's own unit disables entirely via NoNewPrivileges=yes (unconditionally, independent of any sudoers config - the earlier sudoers.d/deploy-runner grant was never going to work). Caddy reload already works via the runner's existing docker group membership; the service restart now goes through plain systemctl (talks to PID1 over D-Bus, no escalation needed), authorized by a new polkit rule scoped to deploy-runner + app@*.service.
97 lines
4.3 KiB
YAML
97 lines
4.3 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: bare
|
|
env:
|
|
# The bare runner's own systemd service intentionally has a minimal
|
|
# PATH/HOME (no rustup default toolchain in reach) - point it at the
|
|
# shared toolchain install directly rather than assuming an ambient
|
|
# dev shell environment.
|
|
CARGO_HOME: /var/local/cargo
|
|
RUSTUP_HOME: /var/local/rustup
|
|
PATH: /var/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/bin
|
|
# Shared with interactive dev builds (see ~/.config/fish/config.fish)
|
|
# so a crate compiled once, by either a manual build or CI, is
|
|
# cached for the other - real cache hits, not just a warm toolchain.
|
|
# SCCACHE_SERVER_PORT deliberately differs from the interactive
|
|
# dev shell's (4227): sccache's server is discovered by a fixed
|
|
# TCP port shared by every local user, so if both contexts used
|
|
# the same port, whichever one's server happened to be running
|
|
# would silently "win" and serve build requests it doesn't have
|
|
# filesystem permission for. Separate ports keep each context's
|
|
# own server answering its own requests; the cache directory
|
|
# (not the server process) is what's actually shared.
|
|
SCCACHE_DIR: /var/local/sccache
|
|
SCCACHE_SERVER_PORT: "4228"
|
|
CARGO_TARGET_DIR: /var/local/cargo-target
|
|
# cargo-leptos's own downloaded tools (wasm-bindgen, wasm-opt) cache
|
|
# under $XDG_CACHE_HOME - left at its default that resolves inside
|
|
# this unit's systemd StateDirectory, files it creates there end up
|
|
# owned by the kernel's overflow "nobody" uid instead of the
|
|
# runner's own dynamic uid (a StateDirectory quirk, not something
|
|
# in our control), so a later run can't execute what an earlier run
|
|
# downloaded. Redirecting it to our own known-good shared dir avoids
|
|
# that entirely.
|
|
XDG_CACHE_HOME: /var/local/leptos-cache
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build
|
|
run: cargo leptos build --release
|
|
|
|
- name: Ship release
|
|
run: |
|
|
set -euo pipefail
|
|
rel="/srv/app/uhhm-portal/releases/${{ github.sha }}"
|
|
mkdir -p "$rel"
|
|
cp "$CARGO_TARGET_DIR/release/portal" "$rel/uhhm-portal"
|
|
# site-root ("target/site" in Cargo.toml) is project-relative,
|
|
# not affected by CARGO_TARGET_DIR - only the plain `cargo build`
|
|
# outputs (release/, front/) move with that override.
|
|
cp -r target/site "$rel/site"
|
|
ln -sfn "$rel" /srv/app/uhhm-portal/current
|
|
|
|
# Sourced from this repo's own Settings -> Actions Variables/Secrets,
|
|
# not typed onto the host by hand - see the infrastructure repo's
|
|
# deploy-runner plan for the exact names/values to configure once.
|
|
- name: Write service env
|
|
run: |
|
|
cat > /etc/app/uhhm-portal.env <<EOF
|
|
NATS_URL=${{ secrets.PORTAL_NATS_URL }}
|
|
KANIDM_URL=${{ vars.PORTAL_KANIDM_URL }}
|
|
OAUTH2_CLIENT_ID=${{ vars.PORTAL_OAUTH2_CLIENT_ID }}
|
|
OAUTH2_CLIENT_SECRET=${{ secrets.PORTAL_OAUTH2_CLIENT_SECRET }}
|
|
PUBLIC_URL=${{ vars.PORTAL_PUBLIC_URL }}
|
|
COOKIE_SECURE=true
|
|
CONTENT_REPO=https://project.uhhm.no/uhhm/questions
|
|
CONTENT_BRANCH=main
|
|
SITE_NAME=${{ vars.PORTAL_SITE_NAME }}
|
|
LEPTOS_SITE_ADDR=0.0.0.0:3010
|
|
EOF
|
|
|
|
# No sudo: the runner's own unit sets NoNewPrivileges=yes, which
|
|
# blocks setuid escalation outright (sudo can't work at all under
|
|
# it, regardless of sudoers config) - systemctl talks to PID1 over
|
|
# D-Bus instead, authorized by a polkit rule scoped to deploy-runner
|
|
# + this unit pattern (see /etc/polkit-1/rules.d/10-deploy-runner.rules
|
|
# on the host).
|
|
- name: Restart service
|
|
run: systemctl restart app@uhhm-portal.service
|
|
|
|
# No sudo here either - the runner is already in the `docker` group,
|
|
# so it can talk to the Docker socket directly.
|
|
- name: Update Caddy routing
|
|
run: |
|
|
cat > /etc/caddy/services.d/uhhm-portal.caddy <<'EOF'
|
|
www.{$DOMAIN}, {$DOMAIN} {
|
|
reverse_proxy host.docker.internal:3010
|
|
log { output file /var/log/caddy/www.log }
|
|
}
|
|
EOF
|
|
docker exec caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
|