feat(ci): deploy stage

1 files changed, 156 insertions, 0 deletions

diff --git a/Jenkinsfile b/Jenkinsfile
index 050d041..e54d972 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -153,5 +153,161 @@ spec:
                 }
             }
         }
+        stage('Deploy (Stage)') {
+            when { branch 'stage' }
+            agent {
+                kubernetes {
+                    defaultContainer 'ansible'
+                    yaml """
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: jenkins
+spec:
+  containers:
+    - name: ansible
+      image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2
+      command: [ 'cat' ]
+      tty: true
+      resources:
+        requests:
+          cpu: "500m"
+          memory: 1Gi
+"""
+                }
+            }
+            steps {
+                checkout scm
+                container('ansible') {
+                    script {
+                        env.GIT_COMMIT_SHORT = env.GIT_COMMIT ? env.GIT_COMMIT.take(7) : "unknown"
+
+                        def secretVars = [
+                            'sayauz-web-stage-auth-salt'                 : 'AUTH_SALT',
+                            'sayauz-web-stage-s3-access-key-id'          : 'S3_ACCESS_KEY_ID',
+                            'sayauz-web-stage-s3-secret-access-key'      : 'S3_SECRET_ACCESS_KEY',
+                            'sayauz-web-stage-mail-salt'                 : 'MAIL_SALT',
+                            'sayauz-web-stage-mail-host'                 : 'MAIL_HOST',
+                            'sayauz-web-stage-mail-address'              : 'MAIL_ADDRESS',
+                            'sayauz-web-stage-mail-username'             : 'MAIL_USERNAME',
+                            'sayauz-web-stage-mail-password'             : 'MAIL_PASSWORD'
+                        ]
+                        def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) }
+                        bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-jenkins', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER')
+
+                        withCredentials(bindings) {
+                            sh '''
+                                ansible-galaxy collection install community.docker
+
+                                mkdir -p ~/.ssh
+                                cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519
+                                chmod 600 ~/.ssh/id_ed25519
+                                ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts
+
+                                ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'"
+
+                                cd deploy
+                                ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \
+                                    playbook.yml \
+                                    -i inventory.yml \
+                                    -l stage \
+                                    --private-key ~/.ssh/id_ed25519 \
+                                    -u "$SSH_USER" \
+                                    -e saya_today_web_auth_salt="$AUTH_SALT" \
+                                    -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \
+                                    -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \
+                                    -e saya_today_web_environment=stage \
+                                    -e saya_today_web_tag=commit-$GIT_COMMIT_SHORT \
+                                    -e saya_today_web_mail_salt="$MAIL_SALT" \
+                                    -e saya_today_web_mail_host="$MAIL_HOST" \
+                                    -e saya_today_web_mail_address="$MAIL_ADDRESS" \
+                                    -e saya_today_web_mail_username="$MAIL_USERNAME" \
+                                    -e saya_today_web_mail_password="$MAIL_PASSWORD"
+                            '''
+                        }
+                    }
+                }
+            }
+        }
+        stage('Deploy (Prod)') {
+            when { buildingTag() }
+            agent {
+                kubernetes {
+                    defaultContainer 'ansible'
+                    yaml """
+apiVersion: v1
+kind: Pod
+metadata:
+  namespace: jenkins
+spec:
+  containers:
+    - name: ansible
+      image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2
+      command: [ 'cat' ]
+      tty: true
+      resources:
+        requests:
+          cpu: "500m"
+          memory: 1Gi
+"""
+                }
+            }
+            steps {
+                checkout scm
+                container('ansible') {
+                    script {
+                        def secretVars = [
+                            'sayauz-web-prod-auth-salt'                 : 'AUTH_SALT',
+                            'sayauz-web-prod-s3-access-key-id'          : 'S3_ACCESS_KEY_ID',
+                            'sayauz-web-prod-s3-secret-access-key'      : 'S3_SECRET_ACCESS_KEY',
+                            'sayauz-web-prod-mail-salt'                 : 'MAIL_SALT',
+                            'sayauz-web-prod-mail-host'                 : 'MAIL_HOST',
+                            'sayauz-web-prod-mail-address'              : 'MAIL_ADDRESS',
+                            'sayauz-web-prod-mail-username'             : 'MAIL_USERNAME',
+                            'sayauz-web-prod-mail-password'             : 'MAIL_PASSWORD',
+                            'sayauz-web-prod-verification-google'       : 'GOOGLE_VERIFICATION',
+                            'sayauz-web-prod-verification-yandex'       : 'YANDEX_VERIFICATION',
+                            'sayauz-web-prod-verification-bing'         : 'BING_VERIFICATION'
+                        ]
+                        def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) }
+                        bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-jenkins', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER')
+
+                        withCredentials(bindings) {
+                            sh '''
+                                ansible-galaxy collection install community.docker
+
+                                mkdir -p ~/.ssh
+                                cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519
+                                chmod 600 ~/.ssh/id_ed25519
+                                ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts
+
+                                ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'"
+
+                                cd deploy
+                                ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \
+                                    playbook.yml \
+                                    -i inventory.yml \
+                                    -l prod \
+                                    --private-key ~/.ssh/id_ed25519 \
+                                    -u "$SSH_USER" \
+                                    -e saya_today_web_auth_salt="$AUTH_SALT" \
+                                    -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \
+                                    -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \
+                                    -e saya_today_web_environment=prod \
+                                    -e saya_today_web_tag=$TAG_NAME \
+                                    -e saya_today_web_mail_salt="$MAIL_SALT" \
+                                    -e saya_today_web_mail_host="$MAIL_HOST" \
+                                    -e saya_today_web_mail_address="$MAIL_ADDRESS" \
+                                    -e saya_today_web_mail_username="$MAIL_USERNAME" \
+                                    -e saya_today_web_mail_password="$MAIL_PASSWORD" \
+                                    -e saya_today_google_verification="$GOOGLE_VERIFICATION" \
+                                    -e saya_today_yandex_verification="$YANDEX_VERIFICATION" \
+                                    -e saya_today_bing_verification="$BING_VERIFICATION"
+                            '''
+                        }
+                    }
+                }
+            }
+        }
     }
 }