ben
5e76bfdec1
Pushing stage runs CI and deploys to stage.transcribe.z00.nu with its own data, Reverb credentials, and Caddy network.
85 lines
3.0 KiB
Bash
Executable File
85 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Idempotent bootstrap for AndyTranscribe Gitea Actions secrets on z00.
|
|
# Requires an already-running Gitea + act_runner (see airports setup).
|
|
set -euo pipefail
|
|
|
|
GITEA_DIR="${GITEA_DIR:-${HOME}/gitea}"
|
|
REPO_OWNER="${REPO_OWNER:-ben}"
|
|
REPO_NAME="${REPO_NAME:-AndyTranscribe}"
|
|
REGISTRY_HOST="${REGISTRY_HOST:-gitea.z00.nu}"
|
|
DEPLOY_PATH="${DEPLOY_PATH:-${HOME}/andyTranscibe}"
|
|
STAGE_DEPLOY_PATH="${STAGE_DEPLOY_PATH:-${HOME}/andyTranscibe-stage}"
|
|
CREDENTIALS_FILE="${GITEA_DIR}/.credentials"
|
|
|
|
if [[ ! -f "${CREDENTIALS_FILE}" ]]; then
|
|
echo "Missing ${CREDENTIALS_FILE}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# shellcheck disable=SC1090
|
|
source "${CREDENTIALS_FILE}"
|
|
|
|
API="https://${REGISTRY_HOST}/api/v1"
|
|
AUTH=(-u "${ADMIN_USERNAME}:${ADMIN_PASSWORD}")
|
|
|
|
if ! curl -fsS "${AUTH[@]}" "${API}/repos/${REPO_OWNER}/${REPO_NAME}" >/dev/null 2>&1; then
|
|
echo "Repository ${REPO_OWNER}/${REPO_NAME} not found on ${REGISTRY_HOST}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
CI_TOKEN="$(
|
|
docker exec -u git gitea gitea admin user generate-access-token \
|
|
-u "${ADMIN_USERNAME}" \
|
|
-t "ci-${REPO_NAME}-$(date +%Y%m%d%H%M%S)" \
|
|
--scopes "write:package,read:package,write:repository,read:repository" \
|
|
--raw
|
|
)"
|
|
|
|
PULL_TOKEN="$(
|
|
docker exec -u git gitea gitea admin user generate-access-token \
|
|
-u "${ADMIN_USERNAME}" \
|
|
-t "pull-${REPO_NAME}-$(date +%Y%m%d%H%M%S)" \
|
|
--scopes "read:package" \
|
|
--raw
|
|
)"
|
|
|
|
set_secret() {
|
|
local name="$1"
|
|
local value="$2"
|
|
local tmp
|
|
tmp="$(mktemp)"
|
|
python3 -c 'import json,sys; json.dump({"data": sys.argv[1]}, open(sys.argv[2], "w"))' "${value}" "${tmp}"
|
|
curl -fsS "${AUTH[@]}" -X PUT \
|
|
"${API}/repos/${REPO_OWNER}/${REPO_NAME}/actions/secrets/${name}" \
|
|
-H "Content-Type: application/json" \
|
|
--data-binary @"${tmp}" >/dev/null
|
|
rm -f "${tmp}"
|
|
}
|
|
|
|
set_secret "REGISTRY_TOKEN" "${CI_TOKEN}"
|
|
set_secret "DEPLOY_PATHS" "${DEPLOY_PATH}"
|
|
set_secret "STAGE_DEPLOY_PATHS" "${STAGE_DEPLOY_PATH}"
|
|
|
|
printf '%s' "${PULL_TOKEN}" | docker login "${REGISTRY_HOST}" -u "${ADMIN_USERNAME}" --password-stdin
|
|
|
|
REPO_LC="$(echo "${REPO_OWNER}/${REPO_NAME}" | tr '[:upper:]' '[:lower:]')"
|
|
if [[ -f "${DEPLOY_PATH}/.env" ]]; then
|
|
if grep -q '^APP_IMAGE=' "${DEPLOY_PATH}/.env"; then
|
|
sed -i "s|^APP_IMAGE=.*|APP_IMAGE=${REGISTRY_HOST}/${REPO_LC}:latest|" "${DEPLOY_PATH}/.env"
|
|
else
|
|
printf '\nAPP_IMAGE=%s/%s:latest\n' "${REGISTRY_HOST}" "${REPO_LC}" >> "${DEPLOY_PATH}/.env"
|
|
fi
|
|
fi
|
|
|
|
# Ensure the existing host runner is up (shared with airports).
|
|
if systemctl --user is-enabled gitea-act-runner.service >/dev/null 2>&1; then
|
|
systemctl --user restart gitea-act-runner.service || true
|
|
systemctl --user --no-pager --lines=5 status gitea-act-runner.service || true
|
|
fi
|
|
|
|
echo "Gitea CI secrets configured for ${REGISTRY_HOST}/${REPO_OWNER}/${REPO_NAME}"
|
|
echo "Deploy path: ${DEPLOY_PATH}"
|
|
echo "Stage deploy path: ${STAGE_DEPLOY_PATH}"
|
|
echo "Push to main to deploy production; push to stage to deploy https://stage.transcribe.z00.nu"
|
|
echo "First-time stage instance: ./scripts/setup-stage.sh"
|