Josh Bairstow
7ecd1b32ae
Refactor the site container from a TLS-owning, port-binding proxy into an internal plaintext static server that sits behind a dedicated edge reverse proxy, and add an automated build/deploy pipeline. - Caddyfile: single :80 listener (auto_https off), Host-matcher routing for apex/blog/art/code with /_astro+/assets re-root and www->apex redirect - Dockerfile: EXPOSE 80 only (TLS now handled by the edge proxy) - compose.yml: pull registry image, join external 'edge' network, declare routing via caddy-docker-proxy labels; drop build/ports/cert volumes - compose.dev.yml: local container preview on :8080 - .forgejo/workflows/deploy.yml: push-to-main -> desktop runner builds, pushes to the Forgejo registry, SSH-deploys to the VPS - docs + .dockerignore updated for the new topology Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
64 lines
2.3 KiB
YAML
64 lines
2.3 KiB
YAML
# ----------------------------------------------------------------------------
|
|
# Build + deploy jb-website.
|
|
#
|
|
# Runs on the home-desktop host runner (label `desktop`): builds the image,
|
|
# pushes it to the Forgejo container registry, then SSHes to the VPS to pull
|
|
# and restart. The VPS never builds — it only runs the prebuilt image.
|
|
#
|
|
# Required Forgejo settings (Repo > Settings > Actions):
|
|
# Variables:
|
|
# REGISTRY_OWNER lowercase Forgejo user/org that owns the package
|
|
# Secrets:
|
|
# REGISTRY_USER Forgejo username for `docker login`
|
|
# REGISTRY_TOKEN Forgejo PAT with write:package scope
|
|
# DEPLOY_HOST VPS host/IP
|
|
# DEPLOY_USER SSH user on the VPS (deploy account)
|
|
# DEPLOY_SSH_KEY private key whose public half is in the VPS authorized_keys
|
|
# ----------------------------------------------------------------------------
|
|
|
|
name: deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
env:
|
|
REGISTRY: git.joshbairstow.com
|
|
IMAGE_NAME: jb-website
|
|
|
|
jobs:
|
|
build-and-deploy:
|
|
runs-on: desktop
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Resolve image reference
|
|
run: |
|
|
IMAGE="${REGISTRY}/${{ vars.REGISTRY_OWNER }}/${IMAGE_NAME}"
|
|
echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
|
|
echo "Building ${IMAGE}:${{ github.sha }}"
|
|
|
|
- name: Log in to the Forgejo registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" \
|
|
| docker login "${REGISTRY}" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build and push image
|
|
run: |
|
|
docker build -t "${IMAGE}:${{ github.sha }}" -t "${IMAGE}:latest" .
|
|
docker push "${IMAGE}:${{ github.sha }}"
|
|
docker push "${IMAGE}:latest"
|
|
|
|
- name: Deploy to VPS over SSH
|
|
run: |
|
|
install -m 600 /dev/null deploy_key
|
|
printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > deploy_key
|
|
ssh -i deploy_key -o StrictHostKeyChecking=accept-new \
|
|
"${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}" \
|
|
"export REGISTRY_OWNER='${{ vars.REGISTRY_OWNER }}' TAG='${{ github.sha }}'; \
|
|
cd /opt/jb-website && \
|
|
docker compose -f compose.yml pull && \
|
|
docker compose -f compose.yml up -d && \
|
|
docker image prune -f"
|
|
rm -f deploy_key
|