jbourdon/social-media
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(cd): hardening of env settings
All checks were successful
deploy-socialize / image (push) Successful in 28s
Details
deploy-socialize / deploy (push) Successful in 15s
Details

Browse Source
This commit is contained in:
Jonathan Bourdon
2026-05-06 21:25:11 -04:00
parent 4eb0fbc22b
commit ef323c291f
2 changed files with 18 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
.gitea/workflows/deploy-socialize.yml
View File

@@ -47,21 +47,9 @@ jobs:
DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
DEPLOY_SSH_PRIVATE_KEY_B64: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY_B64 }}
POSTGRES_HOST: ${{ secrets.POSTGRES_HOST }}
POSTGRES_PORT: ${{ secrets.POSTGRES_PORT }}
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
RESEND_FROM_EMAIL: ${{ secrets.RESEND_FROM_EMAIL }}
JWT_SIGNING_KEY: ${{ secrets.JWT_SIGNING_KEY }}
SOCIALIZE_IMAGE_TAG: ${{ gitea.sha }}
run: |
: "${POSTGRES_PASSWORD:?POSTGRES_PASSWORD secret is required}"
: "${RESEND_API_KEY:?RESEND_API_KEY secret is required}"
: "${RESEND_FROM_EMAIL:?RESEND_FROM_EMAIL secret is required}"
: "${JWT_SIGNING_KEY:?JWT_SIGNING_KEY secret is required}"
: "${SOCIALIZE_IMAGE_TAG:?SOCIALIZE_IMAGE_TAG is required}"
POSTGRES_HOST="${POSTGRES_HOST:-db}"
POSTGRES_PORT="${POSTGRES_PORT:-5432}"
mkdir -p ~/.ssh
printf '%s' "$DEPLOY_SSH_PRIVATE_KEY_B64" | base64 -d > ~/.ssh/deploy_key
@@ -76,36 +64,12 @@ jobs:
deploy_env="$(mktemp)"
{
write_env_value POSTGRES_USER sa
write_env_value POSTGRES_HOST "$POSTGRES_HOST"
write_env_value POSTGRES_PORT "$POSTGRES_PORT"
write_env_value POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
write_env_value POSTGRES_DB socialize
write_env_value ConnectionStrings__PostgresConnection "Host=$POSTGRES_HOST;Port=$POSTGRES_PORT;Database=socialize;Username=sa;Password=$POSTGRES_PASSWORD"
write_env_value ASPNETCORE_ENVIRONMENT Production
write_env_value ASPNETCORE_URLS http://0.0.0.0:8080
write_env_value WEBSITE_FRONTEND_BASE_URL https://socialize.mapachotes.com
write_env_value Website__FrontendBaseUrl https://socialize.mapachotes.com
write_env_value RESEND_API_KEY "$RESEND_API_KEY"
write_env_value Emailer__ApiKey "$RESEND_API_KEY"
write_env_value RESEND_FROM_EMAIL "$RESEND_FROM_EMAIL"
write_env_value Emailer__FromEmail "$RESEND_FROM_EMAIL"
write_env_value JWT_ISSUER https://socialize.mapachotes.com
write_env_value Authentication__Jwt__Issuer https://socialize.mapachotes.com
write_env_value JWT_AUDIENCE socialize-preprod
write_env_value Authentication__Jwt__Audience socialize-preprod
write_env_value JWT_SIGNING_KEY "$JWT_SIGNING_KEY"
write_env_value Authentication__Jwt__Key "$JWT_SIGNING_KEY"
write_env_value JWT_LIFETIME 00:05:00
write_env_value Authentication__Jwt__Lifetime 00:05:00
write_env_value JWT_REFRESH_TOKEN_LIFETIME 0.00:30:00
write_env_value Authentication__Jwt__RefreshTokenLifetime 0.00:30:00
write_env_value SOCIALIZE_IMAGE_TAG "$SOCIALIZE_IMAGE_TAG"
} > "$deploy_env"
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$deploy_env" "$DEPLOY_USER@$DEPLOY_HOST:/srv/prod/socialize/.env"
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$deploy_env" "$DEPLOY_USER@$DEPLOY_HOST:/srv/prod/socialize/.deploy.env"
rm -f "$deploy_env"
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new deploy/compose.yml "$DEPLOY_USER@$DEPLOY_HOST:/srv/prod/socialize/compose.yml"
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=accept-new "$DEPLOY_USER@$DEPLOY_HOST" \
'cd /srv/prod/socialize && set -a && . ./.env && set +a && ./deploy.sh'
'test -r /etc/socialize/socialize.env && cd /srv/prod/socialize && ./deploy.sh'