[skip ci] chore: cleanup workflows

2026-01-02 12:13:01 +00:00
parent 2f557eda8c
commit 197b23757f
21 changed files with 1016 additions and 2204 deletions
--- a/.github/workflows/deploy-admin.yaml
+++ b/.github/workflows/deploy-admin.yaml
@@ -4,25 +4,71 @@ on:
  push:
    branches:
      - main
+      - canary
    paths:
-      - fluxer_admin/**/*
+      - fluxer_admin/**
      - .github/workflows/deploy-admin.yaml
  workflow_dispatch:
+    inputs:
+      channel:
+        type: choice
+        options:
+          - stable
+          - canary
+        default: stable
+        description: Channel to deploy
+      ref:
+        type: string
+        required: false
+        default: ''
+        description: Optional git ref to deploy (defaults to main/canary based on channel)

 concurrency:
-  group: deploy-fluxer-admin
+  group: deploy-fluxer-admin-${{ github.event_name == 'workflow_dispatch' && inputs.channel || (github.ref_name == 'canary' && 'canary') || 'stable' }}
  cancel-in-progress: true

 permissions:
  contents: read
-
 jobs:
+  channel-vars:
+    uses: ./.github/workflows/channel-vars.yaml
+    with:
+      github_event_name: ${{ github.event_name }}
+      github_ref_name: ${{ github.ref_name }}
+      github_ref: ${{ github.ref }}
+      workflow_dispatch_channel: ${{ github.event_name == 'workflow_dispatch' && inputs.channel || '' }}
+      workflow_dispatch_ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
  deploy:
-    name: Deploy app
+    name: Deploy admin
+    needs: channel-vars
    runs-on: blacksmith-2vcpu-ubuntu-2404
    timeout-minutes: 10
+    env:
+      CHANNEL: ${{ needs.channel-vars.outputs.channel }}
+      IS_CANARY: ${{ needs.channel-vars.outputs.is_canary }}
+      SOURCE_REF: ${{ needs.channel-vars.outputs.source_ref }}
+      STACK_SUFFIX: ${{ needs.channel-vars.outputs.stack_suffix }}
+      STACK: ${{ format('fluxer-admin{0}', needs.channel-vars.outputs.stack_suffix) }}
+      CACHE_SCOPE: ${{ format('deploy-fluxer-admin{0}', needs.channel-vars.outputs.stack_suffix) }}
+      CADDY_DOMAIN: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'admin.canary.fluxer.app' || 'admin.fluxer.app' }}
+      APP_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://web.canary.fluxer.app' || 'https://web.fluxer.app' }}
+      API_PUBLIC_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://api.canary.fluxer.app' || 'https://api.fluxer.app' }}
+      ADMIN_ENDPOINT: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://admin.canary.fluxer.app' || 'https://admin.fluxer.app' }}
+      ADMIN_REDIRECT_URI: ${{ needs.channel-vars.outputs.is_canary == 'true' && 'https://admin.canary.fluxer.app/oauth2_callback' || 'https://admin.fluxer.app/oauth2_callback' }}
+      REPLICAS: ${{ needs.channel-vars.outputs.is_canary == 'true' && 1 || 2 }}
    steps:
      - uses: actions/checkout@v6
+        with:
+          ref: ${{ env.SOURCE_REF }}
+          fetch-depth: 0
+
+      - name: Record deploy commit
+        run: |
+          set -euo pipefail
+          sha=$(git rev-parse HEAD)
+          echo "Deploying commit ${sha}"
+          printf 'DEPLOY_SHA=%s\n' "$sha" >> "$GITHUB_ENV"

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
@@ -38,13 +84,11 @@ jobs:
        with:
          context: fluxer_admin
          file: fluxer_admin/Dockerfile
-          tags: fluxer-admin:${{ github.sha }}
+          tags: ${{ env.STACK }}:${{ env.DEPLOY_SHA }}
          load: true
          platforms: linux/amd64
-          cache-from: type=gha,scope=deploy-fluxer-admin
-          cache-to: type=gha,mode=max,scope=deploy-fluxer-admin
-          build-args: |
-            BUILD_TIMESTAMP=${{ github.run_id }}
+          cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
+          cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
        env:
          DOCKER_BUILD_SUMMARY: false
          DOCKER_BUILD_RECORD_UPLOAD: false
@@ -70,51 +114,70 @@ jobs:

      - name: Push image and deploy
        env:
-          IMAGE_TAG: fluxer-admin:${{ github.sha }}
+          IMAGE_TAG: ${{ env.STACK }}:${{ env.DEPLOY_SHA }}
          SERVER: ${{ secrets.SERVER_USER }}@${{ secrets.SERVER_IP }}
+          STACK: ${{ env.STACK }}
+          APP_ENDPOINT: ${{ env.APP_ENDPOINT }}
+          API_PUBLIC_ENDPOINT: ${{ env.API_PUBLIC_ENDPOINT }}
+          ADMIN_ENDPOINT: ${{ env.ADMIN_ENDPOINT }}
+          ADMIN_REDIRECT_URI: ${{ env.ADMIN_REDIRECT_URI }}
+          CADDY_DOMAIN: ${{ env.CADDY_DOMAIN }}
+          REPLICAS: ${{ env.REPLICAS }}
        run: |
          set -euo pipefail
-          docker pussh ${IMAGE_TAG} ${SERVER}
+          docker pussh "${IMAGE_TAG}" "${SERVER}"

-          ssh ${SERVER} "IMAGE_TAG=${IMAGE_TAG}" bash << 'EOF'
-            set -e
-            sudo mkdir -p /opt/fluxer-admin
-            sudo chown -R ${USER}:${USER} /opt/fluxer-admin
-            cd /opt/fluxer-admin
+          ssh "${SERVER}" \
+            "IMAGE_TAG=${IMAGE_TAG} STACK=${STACK} APP_ENDPOINT=${APP_ENDPOINT} API_PUBLIC_ENDPOINT=${API_PUBLIC_ENDPOINT} ADMIN_ENDPOINT=${ADMIN_ENDPOINT} ADMIN_REDIRECT_URI=${ADMIN_REDIRECT_URI} CADDY_DOMAIN=${CADDY_DOMAIN} REPLICAS=${REPLICAS} bash" << 'EOF'
+          set -euo pipefail
+          sudo mkdir -p "/opt/${STACK}"
+          sudo chown -R "${USER}:${USER}" "/opt/${STACK}"
+          cd "/opt/${STACK}"
+
+          cat > compose.yaml << COMPOSEEOF
+          x-deploy-base: &deploy_base
+            restart_policy:
+              condition: on-failure
+              delay: 5s
+              max_attempts: 3
+            update_config:
+              parallelism: 1
+              delay: 10s
+              order: start-first
+            rollback_config:
+              parallelism: 1
+              delay: 10s
+
+          x-healthcheck: &healthcheck
+            test: ['CMD', 'curl', '-f', 'http://localhost:8080/']
+            interval: 30s
+            timeout: 10s
+            retries: 3
+            start_period: 40s

-            cat > compose.yaml << COMPOSEEOF
          services:
            app:
              image: ${IMAGE_TAG}
              env_file:
                - /etc/fluxer/fluxer.env
              environment:
-                - FLUXER_API_PUBLIC_ENDPOINT=https://api.fluxer.app
-                - FLUXER_APP_ENDPOINT=https://web.fluxer.app
-                - FLUXER_MEDIA_ENDPOINT=https://fluxerusercontent.com
-                - FLUXER_CDN_ENDPOINT=https://fluxerstatic.com
-                - FLUXER_ADMIN_ENDPOINT=https://admin.fluxer.app
-                - FLUXER_PATH_ADMIN=/
-                - APP_MODE=admin
-                - FLUXER_ADMIN_PORT=8080
-                - ADMIN_OAUTH2_REDIRECT_URI=https://admin.fluxer.app/oauth2_callback
-                - ADMIN_OAUTH2_CLIENT_ID=1440355698178071552
-                - FLUXER_METRICS_HOST=fluxer-metrics_app:8080
+                FLUXER_API_PUBLIC_ENDPOINT: ${API_PUBLIC_ENDPOINT}
+                FLUXER_APP_ENDPOINT: ${APP_ENDPOINT}
+                FLUXER_MEDIA_ENDPOINT: https://fluxerusercontent.com
+                FLUXER_CDN_ENDPOINT: https://fluxerstatic.com
+                FLUXER_ADMIN_ENDPOINT: ${ADMIN_ENDPOINT}
+                FLUXER_PATH_ADMIN: /
+                APP_MODE: admin
+                FLUXER_ADMIN_PORT: 8080
+                ADMIN_OAUTH2_REDIRECT_URI: ${ADMIN_REDIRECT_URI}
+                ADMIN_OAUTH2_CLIENT_ID: 1440355698178071552
+                ADMIN_OAUTH2_AUTO_CREATE: "false"
+                FLUXER_METRICS_HOST: fluxer-metrics_app:8080
              deploy:
-                replicas: 2
-                restart_policy:
-                  condition: on-failure
-                  delay: 5s
-                  max_attempts: 3
-                update_config:
-                  parallelism: 1
-                  delay: 10s
-                  order: start-first
-                rollback_config:
-                  parallelism: 1
-                  delay: 10s
+                <<: *deploy_base
+                replicas: ${REPLICAS}
                labels:
-                  - 'caddy=admin.fluxer.app'
+                  - "caddy=${CADDY_DOMAIN}"
                  - 'caddy.reverse_proxy={{upstreams 8080}}'
                  - 'caddy.header.X-Robots-Tag="noindex, nofollow, nosnippet, noimageindex"'
                  - 'caddy.header.Strict-Transport-Security="max-age=31536000; includeSubDomains; preload"'
@@ -122,20 +185,18 @@ jobs:
                  - 'caddy.header.X-Content-Type-Options=nosniff'
                  - 'caddy.header.Referrer-Policy=strict-origin-when-cross-origin'
                  - 'caddy.header.X-Frame-Options=DENY'
-              networks:
-                - fluxer-shared
-              healthcheck:
-                test: ['CMD', 'curl', '-f', 'http://localhost:8080/']
-                interval: 30s
-                timeout: 10s
-                retries: 3
-                start_period: 40s
+              networks: [fluxer-shared]
+              healthcheck: *healthcheck

          networks:
            fluxer-shared:
              external: true
          COMPOSEEOF

-            docker stack deploy -c compose.yaml fluxer-admin
-            docker service update --image ${IMAGE_TAG} fluxer-admin_app
+          docker stack deploy \
+            --with-registry-auth \
+            --detach=false \
+            --resolve-image never \
+            -c compose.yaml \
+            "${STACK}"
          EOF