argoyleandClaude Opus 5.5
a41e44367a
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace sites), the way Shiny deploys to Frostmoln staging. Frostmoln enforces restricted Pod Security, so the served image is nginx-unprivileged (uid 101, port 8080) with a matching securityContext. The ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
48 lines
1.8 KiB
YAML
48 lines
1.8 KiB
YAML
name: unbound-site
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: buildtool/setup-buildtools-action@v1
|
|
- name: Build and push
|
|
run: unset GITEA_TOKEN && build && push
|
|
|
|
deploy-prod-frostmoln:
|
|
needs: build
|
|
if: gitea.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
|
|
GITEA_REPOSITORY: ${{ gitea.repository }}
|
|
FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
|
|
environment: prod
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: buildtool/setup-buildtools-action@v1
|
|
- name: Install fm
|
|
run: |
|
|
sudo install -d -m 0755 /etc/apt/keyrings
|
|
sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
|
|
sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
|
|
sudo apt-get update && sudo apt-get install -y fm
|
|
- name: Deploy to Frostmoln production
|
|
env:
|
|
FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
|
|
# The cluster API is private: the kubeconfig's exec plugin opens an fm
|
|
# tunnel on demand. fm reads the key from its config file, not the env.
|
|
run: |
|
|
fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
|
|
fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
|
|
KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n sites
|