From a3aa1dd07abfbbb27a7dfeeb536a6fcc51709256 Mon Sep 17 00:00:00 2001 From: SayaAndy Date: Wed, 8 Apr 2026 08:22:40 +0700 Subject: feat: update all github actions, golang dependencies, golang to 1.26, alpine to 3.23 --- .github/workflows/build-and-deploy-prod.yml | 15 ++++++++++----- .github/workflows/build-and-deploy-stage.yml | 10 +++++----- 2 files changed, 15 insertions(+), 10 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/build-and-deploy-prod.yml b/.github/workflows/build-and-deploy-prod.yml index 24b6e0e..76012c6 100644 --- a/.github/workflows/build-and-deploy-prod.yml +++ b/.github/workflows/build-and-deploy-prod.yml @@ -13,24 +13,29 @@ jobs: steps: - name: Checkout uses: actions/checkout@v6 + - name: Generate output.css with tailwindcss uses: ZoeyVid/tailwindcss-update@main with: input: static/input.css output: static/output.css params: "--minify" + - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 + - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 + - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.repository_owner }} password: ${{ secrets.GHCR_TOKEN }} + - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile @@ -47,7 +52,7 @@ jobs: needs: [build-and-push] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up SSH connection for pl.saya.today run: | diff --git a/.github/workflows/build-and-deploy-stage.yml b/.github/workflows/build-and-deploy-stage.yml index c6e222b..89000d0 100644 --- a/.github/workflows/build-and-deploy-stage.yml +++ b/.github/workflows/build-and-deploy-stage.yml @@ -21,13 +21,13 @@ jobs: params: "--minify" - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + uses: docker/setup-qemu-action@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.repository_owner }} @@ -38,7 +38,7 @@ jobs: run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . file: ./Dockerfile @@ -54,7 +54,7 @@ jobs: needs: [build-and-push] steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Set up SSH connection for pl.saya.today run: | -- cgit v1.3.1+13 From d3a63ca8a84bf4583bac8f5fd09bd52774bc4158 Mon Sep 17 00:00:00 2001 From: SayaAndy Date: Sat, 2 May 2026 15:06:44 +0700 Subject: feat: migrate to uz.saya.casa --- .github/workflows/build-and-deploy-prod.yml | 6 ++-- .github/workflows/build-and-deploy-stage.yml | 6 ++-- Caddyfile | 50 ++++++++++++++++++++++++++++ caddy.Dockerfile | 10 ++++++ deploy/inventory.yml | 20 +++++------ deploy/playbook.yml | 2 +- 6 files changed, 77 insertions(+), 17 deletions(-) create mode 100644 Caddyfile create mode 100644 caddy.Dockerfile (limited to '.github/workflows') diff --git a/.github/workflows/build-and-deploy-prod.yml b/.github/workflows/build-and-deploy-prod.yml index 76012c6..d89cc76 100644 --- a/.github/workflows/build-and-deploy-prod.yml +++ b/.github/workflows/build-and-deploy-prod.yml @@ -54,7 +54,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Set up SSH connection for pl.saya.today + - name: Set up SSH connection for uz.saya.casa run: | mkdir -p ~/.ssh (cat < ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 sed -i 's/\r$//' ~/.ssh/id_ed25519 - ssh-keyscan -H pl.saya.today >> ~/.ssh/known_hosts + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts - name: Test SSH connection run: | - ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 svc_github@pl.saya.today "echo 'SSH connection successful'" + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 svc_github@uz.saya.casa "echo 'SSH connection successful'" - name: Install Ansible shell: bash diff --git a/.github/workflows/build-and-deploy-stage.yml b/.github/workflows/build-and-deploy-stage.yml index 89000d0..e699856 100644 --- a/.github/workflows/build-and-deploy-stage.yml +++ b/.github/workflows/build-and-deploy-stage.yml @@ -56,7 +56,7 @@ jobs: - name: Checkout uses: actions/checkout@v6 - - name: Set up SSH connection for pl.saya.today + - name: Set up SSH connection for uz.saya.casa run: | mkdir -p ~/.ssh (cat < ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 sed -i 's/\r$//' ~/.ssh/id_ed25519 - ssh-keyscan -H pl.saya.today >> ~/.ssh/known_hosts + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts - name: Test SSH connection run: | - ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 svc_github@pl.saya.today "echo 'SSH connection successful'" + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 svc_github@uz.saya.casa "echo 'SSH connection successful'" - name: Install Ansible shell: bash diff --git a/Caddyfile b/Caddyfile new file mode 100644 index 0000000..5781d74 --- /dev/null +++ b/Caddyfile @@ -0,0 +1,50 @@ +{ + email saya.andy@posteo.com + + order rate_limit before reverse_proxy + + servers { + timeouts { + read_body 10s + read_header 5s + write 30s + idle 2m + } + } +} + +(saya-web) { + header { + Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" + X-Xss-Protection "1; mode=block" + X-Content-Type-Options "nosniff" + X-Frame-Options "DENY" + Content-Security-Policy "upgrade-insecure-requests" + Referrer-Policy "strict-origin-when-cross-origin" + Cache-Control "public, max-age=15, must-revalidate" + Feature-Policy "accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'" + Server "No." + } + + request_body { + max_size 1MB + } + + rate_limit { + zone per_ip { + key {remote_host} + events 600 + window 1m + } + } +} + +stage.saya.uz { + import saya-web + reverse_proxy sayauz-stage:3000 +} + +saya.uz { + import saya-web + reverse_proxy sayauz-prod:3000 +} diff --git a/caddy.Dockerfile b/caddy.Dockerfile new file mode 100644 index 0000000..9f90d8b --- /dev/null +++ b/caddy.Dockerfile @@ -0,0 +1,10 @@ +FROM docker.io/library/caddy:2.11.2-builder-alpine AS builder + +RUN --mount=type=cache,target=/go/pkg/mod \ + --mount=type=cache,target=/root/.cache/go-build \ + xcaddy build v2.11.2 \ + --with github.com/mholt/caddy-ratelimit + +FROM docker.io/library/caddy:2.11.2-alpine + +COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/deploy/inventory.yml b/deploy/inventory.yml index a1ecf5d..d3acab8 100644 --- a/deploy/inventory.yml +++ b/deploy/inventory.yml @@ -3,17 +3,17 @@ all: prod: hosts: node_prod: - ansible_host: pl.saya.today - saya_today_web_name: sayana-web - saya_today_web_hostname: sayana-web - saya_today_web_ipv4_address: 172.16.0.18 - saya_today_web_listen_address: saya.today + ansible_host: uz.saya.casa + saya_today_web_name: sayauz-prod + saya_today_web_hostname: sayauz-prod + saya_today_web_ipv4_address: 172.16.0.17 + saya_today_web_listen_address: saya.uz stage: hosts: node_stage: - ansible_host: pl.saya.today - saya_today_web_name: sayana-demo - saya_today_web_hostname: sayana-demo - saya_today_web_ipv4_address: 172.16.0.17 - saya_today_web_listen_address: demo.saya.today + ansible_host: uz.saya.casa + saya_today_web_name: sayauz-stage + saya_today_web_hostname: sayauz-stage + saya_today_web_ipv4_address: 172.16.0.18 + saya_today_web_listen_address: stage.saya.uz diff --git a/deploy/playbook.yml b/deploy/playbook.yml index b0202bd..8fb9088 100644 --- a/deploy/playbook.yml +++ b/deploy/playbook.yml @@ -2,7 +2,7 @@ - name: Deploy saya-today-web Docker Container hosts: all remote_user: svc_github - + tasks: - name: Create a volume community.docker.docker_volume: -- cgit v1.3.1+13 From 2e53d0a1c5ff42a88acbede28220010f0237e855 Mon Sep 17 00:00:00 2001 From: SayaAndy Date: Sat, 2 May 2026 22:18:41 +0700 Subject: fix: use s3 key pair in prod & stage envs --- .github/workflows/build-and-deploy-prod.yml | 2 +- .github/workflows/build-and-deploy-stage.yml | 2 +- deploy/playbook.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) (limited to '.github/workflows') diff --git a/.github/workflows/build-and-deploy-prod.yml b/.github/workflows/build-and-deploy-prod.yml index d89cc76..381d656 100644 --- a/.github/workflows/build-and-deploy-prod.yml +++ b/.github/workflows/build-and-deploy-prod.yml @@ -80,4 +80,4 @@ jobs: ANSIBLE_HOST_KEY_CHECKING: False working-directory: ./deploy run: | - ansible-playbook -i inventory.yml -l prod playbook.yml --private-key ~/.ssh/id_ed25519 -u svc_github -e saya_today_web_auth_salt="${{ secrets.AUTH_SALT }}" -e saya_today_web_b2_key_id="${{ secrets.B2_KEY_ID }}" -e saya_today_web_b2_application_key="${{ secrets.B2_APPLICATION_KEY }}" -e saya_today_web_environment=prod -e saya_today_web_tag=${{ github.ref_name }} -e saya_today_web_mail_salt="${{ secrets.MAIL_SALT }}" -e saya_today_web_mail_host="${{ secrets.MAIL_HOST }}" -e saya_today_web_mail_address="${{ secrets.MAIL_ADDRESS }}" -e saya_today_web_mail_username="${{ secrets.MAIL_USERNAME }}" -e saya_today_web_mail_password="${{ secrets.MAIL_PASSWORD }}" -e saya_today_google_site_verification="${{ secrets.GOOGLE_SITE_VERIFICATION }}" + ansible-playbook -i inventory.yml -l prod playbook.yml --private-key ~/.ssh/id_ed25519 -u svc_github -e saya_today_web_auth_salt="${{ secrets.AUTH_SALT }}" -e saya_today_web_s3_access_key_id="${{ secrets.S3_ACCESS_KEY_ID }}" -e saya_today_web_s3_secret_access_key="${{ secrets.S3_SECRET_ACCESS_KEY }}" -e saya_today_web_environment=prod -e saya_today_web_tag=${{ github.ref_name }} -e saya_today_web_mail_salt="${{ secrets.MAIL_SALT }}" -e saya_today_web_mail_host="${{ secrets.MAIL_HOST }}" -e saya_today_web_mail_address="${{ secrets.MAIL_ADDRESS }}" -e saya_today_web_mail_username="${{ secrets.MAIL_USERNAME }}" -e saya_today_web_mail_password="${{ secrets.MAIL_PASSWORD }}" -e saya_today_google_site_verification="${{ secrets.GOOGLE_SITE_VERIFICATION }}" diff --git a/.github/workflows/build-and-deploy-stage.yml b/.github/workflows/build-and-deploy-stage.yml index e699856..ffee091 100644 --- a/.github/workflows/build-and-deploy-stage.yml +++ b/.github/workflows/build-and-deploy-stage.yml @@ -86,4 +86,4 @@ jobs: ANSIBLE_HOST_KEY_CHECKING: False working-directory: ./deploy run: | - ansible-playbook -i inventory.yml -l stage playbook.yml --private-key ~/.ssh/id_ed25519 -u svc_github -e saya_today_web_auth_salt="${{ secrets.AUTH_SALT }}" -e saya_today_web_b2_key_id="${{ secrets.B2_KEY_ID }}" -e saya_today_web_b2_application_key="${{ secrets.B2_APPLICATION_KEY }}" -e saya_today_web_environment=stage -e saya_today_web_tag=commit-${{ steps.ghss_vars.outputs.sha_short }} -e saya_today_web_mail_salt="${{ secrets.MAIL_SALT }}" -e saya_today_web_mail_host="${{ secrets.MAIL_HOST }}" -e saya_today_web_mail_address="${{ secrets.MAIL_ADDRESS }}" -e saya_today_web_mail_username="${{ secrets.MAIL_USERNAME }}" -e saya_today_web_mail_password="${{ secrets.MAIL_PASSWORD }}" + ansible-playbook -i inventory.yml -l stage playbook.yml --private-key ~/.ssh/id_ed25519 -u svc_github -e saya_today_web_auth_salt="${{ secrets.AUTH_SALT }}" -e saya_today_web_s3_access_key_id="${{ secrets.S3_ACCESS_KEY_ID }}" -e saya_today_web_s3_secret_access_key="${{ secrets.S3_SECRET_ACCESS_KEY }}" -e saya_today_web_environment=stage -e saya_today_web_tag=commit-${{ steps.ghss_vars.outputs.sha_short }} -e saya_today_web_mail_salt="${{ secrets.MAIL_SALT }}" -e saya_today_web_mail_host="${{ secrets.MAIL_HOST }}" -e saya_today_web_mail_address="${{ secrets.MAIL_ADDRESS }}" -e saya_today_web_mail_username="${{ secrets.MAIL_USERNAME }}" -e saya_today_web_mail_password="${{ secrets.MAIL_PASSWORD }}" diff --git a/deploy/playbook.yml b/deploy/playbook.yml index 9719ed9..b73146a 100644 --- a/deploy/playbook.yml +++ b/deploy/playbook.yml @@ -32,8 +32,8 @@ hostname: "{{ saya_today_web_hostname }}" image: "ghcr.io/sayaandy/saya-today-web:{{ saya_today_web_tag }}" env: - B2_KEY_ID: "{{ saya_today_web_b2_key_id }}" - B2_APPLICATION_KEY: "{{ saya_today_web_b2_application_key }}" + S3_ACCESS_KEY_ID: "{{ saya_today_web_s3_access_key_id }}" + S3_SECRET_ACCESS_KEY: "{{ saya_today_web_s3_secret_access_key }}" ENVIRONMENT: "{{ saya_today_web_environment }}" AUTH_SALT: "{{ saya_today_web_auth_salt }}" MAIL_HOST: "{{ saya_today_web_mail_host }}" -- cgit v1.3.1+13