From b587b7c0cbad02ec57cd64380d265eaa8777ad60 Mon Sep 17 00:00:00 2001 From: Saya Andy Date: Thu, 30 Jul 2026 01:19:29 +0700 Subject: feat(ci): deploy stage --- Jenkinsfile | 156 ++++++++++++++++++++++++++++++++++++++++++++++++++++ deploy/playbook.yml | 4 +- 2 files changed, 158 insertions(+), 2 deletions(-) diff --git a/Jenkinsfile b/Jenkinsfile index 050d041..e54d972 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -153,5 +153,161 @@ spec: } } } + stage('Deploy (Stage)') { + when { branch 'stage' } + agent { + kubernetes { + defaultContainer 'ansible' + yaml """ +apiVersion: v1 +kind: Pod +metadata: + namespace: jenkins +spec: + containers: + - name: ansible + image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2 + command: [ 'cat' ] + tty: true + resources: + requests: + cpu: "500m" + memory: 1Gi +""" + } + } + steps { + checkout scm + container('ansible') { + script { + env.GIT_COMMIT_SHORT = env.GIT_COMMIT ? env.GIT_COMMIT.take(7) : "unknown" + + def secretVars = [ + 'sayauz-web-stage-auth-salt' : 'AUTH_SALT', + 'sayauz-web-stage-s3-access-key-id' : 'S3_ACCESS_KEY_ID', + 'sayauz-web-stage-s3-secret-access-key' : 'S3_SECRET_ACCESS_KEY', + 'sayauz-web-stage-mail-salt' : 'MAIL_SALT', + 'sayauz-web-stage-mail-host' : 'MAIL_HOST', + 'sayauz-web-stage-mail-address' : 'MAIL_ADDRESS', + 'sayauz-web-stage-mail-username' : 'MAIL_USERNAME', + 'sayauz-web-stage-mail-password' : 'MAIL_PASSWORD' + ] + def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) } + bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-jenkins', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER') + + withCredentials(bindings) { + sh ''' + ansible-galaxy collection install community.docker + + mkdir -p ~/.ssh + cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts + + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'" + + cd deploy + ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \ + playbook.yml \ + -i inventory.yml \ + -l stage \ + --private-key ~/.ssh/id_ed25519 \ + -u "$SSH_USER" \ + -e saya_today_web_auth_salt="$AUTH_SALT" \ + -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \ + -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \ + -e saya_today_web_environment=stage \ + -e saya_today_web_tag=commit-$GIT_COMMIT_SHORT \ + -e saya_today_web_mail_salt="$MAIL_SALT" \ + -e saya_today_web_mail_host="$MAIL_HOST" \ + -e saya_today_web_mail_address="$MAIL_ADDRESS" \ + -e saya_today_web_mail_username="$MAIL_USERNAME" \ + -e saya_today_web_mail_password="$MAIL_PASSWORD" + ''' + } + } + } + } + } + stage('Deploy (Prod)') { + when { buildingTag() } + agent { + kubernetes { + defaultContainer 'ansible' + yaml """ +apiVersion: v1 +kind: Pod +metadata: + namespace: jenkins +spec: + containers: + - name: ansible + image: ghcr.io/ansible/community-ansible-dev-tools:v26.7.2 + command: [ 'cat' ] + tty: true + resources: + requests: + cpu: "500m" + memory: 1Gi +""" + } + } + steps { + checkout scm + container('ansible') { + script { + def secretVars = [ + 'sayauz-web-prod-auth-salt' : 'AUTH_SALT', + 'sayauz-web-prod-s3-access-key-id' : 'S3_ACCESS_KEY_ID', + 'sayauz-web-prod-s3-secret-access-key' : 'S3_SECRET_ACCESS_KEY', + 'sayauz-web-prod-mail-salt' : 'MAIL_SALT', + 'sayauz-web-prod-mail-host' : 'MAIL_HOST', + 'sayauz-web-prod-mail-address' : 'MAIL_ADDRESS', + 'sayauz-web-prod-mail-username' : 'MAIL_USERNAME', + 'sayauz-web-prod-mail-password' : 'MAIL_PASSWORD', + 'sayauz-web-prod-verification-google' : 'GOOGLE_VERIFICATION', + 'sayauz-web-prod-verification-yandex' : 'YANDEX_VERIFICATION', + 'sayauz-web-prod-verification-bing' : 'BING_VERIFICATION' + ] + def bindings = secretVars.collect { id, varName -> string(credentialsId: id, variable: varName) } + bindings << sshUserPrivateKey(credentialsId: 'sayauz-svc-jenkins', keyFileVariable: 'SSH_KEY_FILE', usernameVariable: 'SSH_USER') + + withCredentials(bindings) { + sh ''' + ansible-galaxy collection install community.docker + + mkdir -p ~/.ssh + cp "$SSH_KEY_FILE" ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + ssh-keyscan -H uz.saya.casa >> ~/.ssh/known_hosts + + ssh -o ConnectTimeout=10 -i ~/.ssh/id_ed25519 "$SSH_USER@uz.saya.casa" "echo 'SSH connection successful'" + + cd deploy + ANSIBLE_HOST_KEY_CHECKING=False ansible-playbook \ + playbook.yml \ + -i inventory.yml \ + -l prod \ + --private-key ~/.ssh/id_ed25519 \ + -u "$SSH_USER" \ + -e saya_today_web_auth_salt="$AUTH_SALT" \ + -e saya_today_web_s3_access_key_id="$S3_ACCESS_KEY_ID" \ + -e saya_today_web_s3_secret_access_key="$S3_SECRET_ACCESS_KEY" \ + -e saya_today_web_environment=prod \ + -e saya_today_web_tag=$TAG_NAME \ + -e saya_today_web_mail_salt="$MAIL_SALT" \ + -e saya_today_web_mail_host="$MAIL_HOST" \ + -e saya_today_web_mail_address="$MAIL_ADDRESS" \ + -e saya_today_web_mail_username="$MAIL_USERNAME" \ + -e saya_today_web_mail_password="$MAIL_PASSWORD" \ + -e saya_today_google_verification="$GOOGLE_VERIFICATION" \ + -e saya_today_yandex_verification="$YANDEX_VERIFICATION" \ + -e saya_today_bing_verification="$BING_VERIFICATION" + ''' + } + } + } + } + } } } diff --git a/deploy/playbook.yml b/deploy/playbook.yml index f725335..c5c71fa 100644 --- a/deploy/playbook.yml +++ b/deploy/playbook.yml @@ -6,7 +6,7 @@ vars: docker_volumes: - "{{ saya_today_web_name }}-volume:/data:rw" - + tasks: - name: Initialize Unix socket volume when: >- @@ -42,7 +42,7 @@ MAIL_PASSWORD: "{{ saya_today_web_mail_password }}" MAIL_SALT: "{{ saya_today_web_mail_salt }}" FQDN: "{{ saya_today_web_listen_address }}" - GOOGLE_SITE_VERIFICATION: "{{ saya_today_google_site_verification | default('') }}" + GOOGLE_VERIFICATION: "{{ saya_today_google_verification | default('') }}" YANDEX_VERIFICATION: "{{ saya_today_yandex_verification | default('') }}" BING_VERIFICATION: "{{ saya_today_bing_verification | default('') }}" network_mode: caddy -- cgit v1.3.1+13