mirror of
https://github.com/mauricioabh/arbpulse.git
synced 2026-07-27 15:47:43 +00:00
Mauricio Barragan
f6108d8f8f
Build the Docker image in GitHub Actions, publish to ghcr.io/mauricioabh/arbpulse (latest + sha tags), then SSH into the Hetzner VPS to docker compose pull + up -d with a health-check gate. The VPS no longer builds images, keeping CPU/RAM free for the running apps and making rollbacks a matter of pulling a previous sha tag. - .github/workflows/vps-deploy.yml: build-push (GHCR) + deploy (SSH) jobs - deploy/docker-compose.yml: app image now ghcr.io/mauricioabh/arbpulse - deploy/deploy.sh: pulls from GHCR by default (BUILD=1 for local build), default APP_DIR aligned to /root/projects/arbpulse - docs: deploy/README.md CI/CD section + paths, README deploy section Co-authored-by: Cursor <cursoragent@cursor.com>
93 lines
2.5 KiB
YAML
93 lines
2.5 KiB
YAML
# Production deploy: build the image in CI, publish to GHCR, then SSH into the
|
|
# Hetzner VPS to pull + restart. The VPS never builds — it only pulls the image
|
|
# that passed CI. Rollback = re-run this workflow from an older commit, or
|
|
# `docker compose pull` a previous sha-tag on the VPS.
|
|
#
|
|
# Secrets: VPS_SSH_KEY (dedicated deploy key), VPS_HOST, VPS_USER.
|
|
|
|
name: VPS Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: vps-deploy
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
IMAGE: ghcr.io/${{ github.repository }}
|
|
|
|
jobs:
|
|
build-push:
|
|
name: Build & push to GHCR
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- uses: docker/metadata-action@v5
|
|
id: meta
|
|
with:
|
|
images: ${{ env.IMAGE }}
|
|
tags: |
|
|
type=raw,value=latest
|
|
type=sha,format=long
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
cache-from: type=gha
|
|
cache-to: type=gha,mode=max
|
|
|
|
deploy:
|
|
name: Deploy to VPS
|
|
needs: build-push
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Setup SSH
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s' "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
ssh-keyscan -H "${{ secrets.VPS_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null
|
|
|
|
- name: Pull image and restart app
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key "${{ secrets.VPS_USER }}@${{ secrets.VPS_HOST }}" bash -s <<'EOF'
|
|
set -euo pipefail
|
|
cd /root/projects/arbpulse
|
|
git fetch origin main
|
|
git checkout main
|
|
git reset --hard origin/main
|
|
cd deploy
|
|
docker compose pull app
|
|
docker compose up -d app
|
|
echo "waiting for health..."
|
|
for i in $(seq 1 12); do
|
|
if curl -fsS http://127.0.0.1:8080/api/health >/dev/null 2>&1; then
|
|
echo "app healthy"
|
|
docker image prune -f >/dev/null
|
|
exit 0
|
|
fi
|
|
sleep 5
|
|
done
|
|
echo "app did not become healthy in time" >&2
|
|
docker compose logs --tail 50 app >&2
|
|
exit 1
|
|
EOF
|