🔒️ make authentication work accross domains (#135) #34
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This is a basic workflow to help you get started with Actions | |
| name: CI/CD For docker deploy | |
| # Controls when the action will run. | |
| on: | |
| # Triggers the workflow on push or pull request events but only for the main branch | |
| push: | |
| branches: | |
| - main | |
| # Allows you to run this workflow manually from the Actions tab | |
| workflow_dispatch: | |
| # A workflow run is made up of one or more jobs that can run sequentially or in parallel | |
| jobs: | |
| build-push-docker: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| steps: | |
| - uses: actions/checkout@v2 | |
| - name: Install SSH key | |
| uses: shimataro/ssh-key-action@v2 | |
| with: | |
| key: ${{ secrets.SSH_SERVER_KEY }} | |
| name: id_rsa # optional | |
| known_hosts: ${{ secrets.KNOWN_HOSTS }} | |
| - name: Deploy to Server | |
| run: | | |
| BUILD_ARGS="--build-arg NEXT_PUBLIC_VERCEL_URL=gh.fredkiss.dev --build-arg GITHUB_REDIRECT_URI=https://gh.fredkiss.dev/api/auth/callback --build-arg SESSION_SECRET=${{ secrets.SESSION_SECRET }} --build-arg DATABASE_URL=${{ secrets.POSTGRES_DB_URL }} --build-arg GITHUB_CLIENT_ID=${{ secrets.GH_CLIENT_ID }} --build-arg GITHUB_SECRET=${{ secrets.GH_SECRET }} --build-arg GITHUB_PERSONAL_ACCESS_TOKEN=${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} --build-arg REDIS_HTTP_USERNAME=${{ secrets.REDIS_HTTP_USERNAME }} --build-arg REDIS_HTTP_PASSWORD=${{ secrets.REDIS_HTTP_PASSWORD }} --build-arg KV_PREFIX=__gh_next__cache_prod_" | |
| ssh -p $DEPLOY_PORT $DEPLOY_USER@$DEPLOY_DOMAIN " | |
| source ~/.zshrc | |
| set -e -o errexit | |
| cd $DEPLOY_DIR | |
| echo 'Login to docker registry...' | |
| echo ${{ secrets.DCR_PASSWD }} | docker login --username=fredkiss3 --password-stdin dcr.fredkiss.dev | |
| echo 'succesfully logged in to registry dcr.fredkiss.dev ✅' | |
| echo use node version 20 | |
| nvm use 20 | |
| echo Pulling latest version... | |
| git fetch origin main | |
| git checkout main | |
| git pull | |
| echo 'Build with docker (and cache)...🔄' | |
| export DOCKER_BUILDKIT=1 | |
| # Use cache from remote repository, tag as latest, keep cache metadata | |
| docker buildx build --push $BUILD_ARGS -f ./docker/Dockerfile.prod -t dcr.fredkiss.dev/gh-next:latest \ | |
| --cache-from type=registry,ref=dcr.fredkiss.dev/gh-next:prod-buildcache,mode=max \ | |
| --cache-to type=registry,ref=dcr.fredkiss.dev/gh-next:prod-buildcache,mode=max . | |
| echo 'build successful ✅' | |
| # Start docker instances | |
| echo 'updating docker services...🔄' | |
| docker stack deploy --with-registry-auth --compose-file ./docker/docker-stack.prod.yaml gh-stack-prod | |
| echo 'services updated succesfully ✅' | |
| # Copying the build cache for faster builds | |
| echo 'copying build cache...🔄' | |
| mkdir -p .next/ | |
| CONTAINER_ID=\$(docker create dcr.fredkiss.dev/gh-next:latest) | |
| echo CID=\$CONTAINER_ID | |
| docker cp \${CONTAINER_ID}:/app/.next/cache .next/ | |
| docker rm \${CONTAINER_ID} | |
| echo 'Build cached copied succesfully ✅' | |
| " | |
| env: | |
| DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }} | |
| DEPLOY_DIR: ${{ secrets.DEPLOY_DIR }} | |
| DEPLOY_DOMAIN: ${{ secrets.DEPLOY_DOMAIN }} | |
| DEPLOY_USER: ${{ secrets.DEPLOY_USER }} |