81 lines
3.1 KiB
YAML
81 lines
3.1 KiB
YAML
---
|
|
# yamllint disable rule:line-length
|
|
name: deploy neuro
|
|
|
|
on: # yamllint disable-line rule:truthy
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: deploy-neuro
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
deploy:
|
|
name: deploy neuro from performance node
|
|
if: ${{ gitea.ref == 'refs/heads/master' }}
|
|
runs-on: gross-nix-x86-perf
|
|
timeout-minutes: 60
|
|
env:
|
|
NIX_CONFIG: |
|
|
fallback = true
|
|
extra-substituters = https://cache.nixos.org https://cache.hectic-lab.com/hectic
|
|
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hectic:KMQsKow4SoA9K2vOJlOljmx7/Zpf91Yy+5qEtxDDCzA=
|
|
steps:
|
|
- name: Checkout dispatched revision
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
ref: ${{ gitea.sha }}
|
|
persist-credentials: false
|
|
|
|
- name: Show runner and cache configuration
|
|
run: |
|
|
set -eu
|
|
uname -a
|
|
nix --version
|
|
nix config show fallback
|
|
nix config show substituters
|
|
nix config show trusted-public-keys
|
|
|
|
- name: Deploy neuro
|
|
env:
|
|
ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
|
|
WITH_ATTIC_BUILD_TIMEOUT: "2700"
|
|
WITH_ATTIC_UPLOAD_TIMEOUT: "600"
|
|
WITH_ATTIC_BATCH_SIZE: "8"
|
|
NEURO_SSH_PRIVATE_KEY: ${{ secrets.NEURO_SSH_PRIVATE_KEY }}
|
|
NEURO_SSH_KNOWN_HOSTS: ${{ secrets.NEURO_SSH_KNOWN_HOSTS }}
|
|
run: |
|
|
set -eu
|
|
test -n "$NEURO_SSH_PRIVATE_KEY"
|
|
test -n "$NEURO_SSH_KNOWN_HOSTS"
|
|
ssh_home=$(mktemp -d)
|
|
trap 'rm -rf "$ssh_home"' EXIT
|
|
install -d -m 700 "$ssh_home/.ssh"
|
|
printf '%s\n' "$NEURO_SSH_PRIVATE_KEY" > "$ssh_home/.ssh/id_ed25519"
|
|
printf '%s\n' "$NEURO_SSH_KNOWN_HOSTS" > "$ssh_home/.ssh/known_hosts"
|
|
chmod 600 "$ssh_home/.ssh/id_ed25519" "$ssh_home/.ssh/known_hosts"
|
|
printf '%s\n' \
|
|
'Host neuro' \
|
|
' HostName 95.31.254.84' \
|
|
' User root' \
|
|
' Port 34457' \
|
|
" IdentityFile $ssh_home/.ssh/id_ed25519" \
|
|
' IdentitiesOnly yes' \
|
|
' StrictHostKeyChecking yes' \
|
|
" UserKnownHostsFile $ssh_home/.ssh/known_hosts" \
|
|
> "$ssh_home/.ssh/config"
|
|
chmod 600 "$ssh_home/.ssh/config"
|
|
export HOME="$ssh_home"
|
|
export HECTIC_DEPLOY_SSH_CONFIG="$HOME/.ssh/config"
|
|
export NIX_SSHOPTS="-F $HOME/.ssh/config -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -o IdentitiesOnly=yes -i $HOME/.ssh/id_ed25519"
|
|
ssh -F "$HOME/.ssh/config" -o BatchMode=yes -o ConnectTimeout=10 \
|
|
-o StrictHostKeyChecking=yes \
|
|
-o UserKnownHostsFile="$HOME/.ssh/known_hosts" \
|
|
-o IdentitiesOnly=yes \
|
|
-i "$HOME/.ssh/id_ed25519" \
|
|
neuro true
|
|
# Run deploy tool from checked-out Gitea revision; repository is not mirrored on GitHub.
|
|
nix run --refresh '.#with-attic-cache' -- -- \
|
|
nix run --refresh '.#deploy' -- \
|
|
push -- --flake '.#neuro|x86_64-linux' --target-host neuro --use-remote-sudo
|