Christopher Mühl
19468d38d8
Replace low-level S3 operations with native Attic client for better performance, simplicity, and proper Nix binary cache protocol support. Changes: - Replace 'nix copy' + S3 with 'attic push' - Remove S3_ACCESS_KEY, S3_SECRET_KEY, NIX_SIGNING_KEY requirements - Add ATTIC_TOKEN requirement (explicit per-repo security) - Default to 'ci' cache instead of 'toph' - Update Nomad fetch task to pull from Attic instead of S3 - Simplify push-nix-cache to single attic push command - Update documentation with new security model Security: - ATTIC_TOKEN must be explicitly provided as Forgejo secret - Prevents untrusted repos from pushing to cache - Separate ci/toph caches for different trust levels Benefits: - Simpler: Single command instead of sign + copy + sync - Faster: Native Attic protocol vs S3 object storage - Safer: Explicit opt-in prevents unauthorized cache writes - Standards-compliant: Proper Nix binary cache protocol Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
110 lines
3.3 KiB
YAML
110 lines
3.3 KiB
YAML
name: Deploy Static Site
|
|
description: Build site with Nix, push tarball to S3, deploy via Nomad with shared static-server image
|
|
|
|
# Required env vars: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, NOMAD_TOKEN, ATTIC_TOKEN
|
|
# NOMAD_ADDR is injected by the Forgejo runner via container.options
|
|
|
|
inputs:
|
|
domain:
|
|
description: 'Domain the site is served at (e.g. toph.so)'
|
|
required: true
|
|
|
|
flake-output:
|
|
description: 'Flake output to build (e.g. default, docs)'
|
|
required: false
|
|
default: 'default'
|
|
|
|
server-image:
|
|
description: 'OCI image for the static server'
|
|
required: false
|
|
default: 'registry.toph.so/static-server:latest'
|
|
|
|
datacenter:
|
|
description: 'Nomad datacenter'
|
|
required: false
|
|
default: 'contabo'
|
|
|
|
s3-endpoint:
|
|
description: 'S3 endpoint URL'
|
|
required: false
|
|
default: 'https://s3.toph.so'
|
|
|
|
s3-bucket:
|
|
description: 'S3 bucket for site tarballs'
|
|
required: false
|
|
default: 'nix-cache'
|
|
|
|
cache-name:
|
|
description: 'Attic cache name'
|
|
required: false
|
|
default: 'ci'
|
|
|
|
smoke-test:
|
|
description: 'Run a smoke test against the domain after deploy'
|
|
required: false
|
|
default: 'true'
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Build site
|
|
shell: bash
|
|
run: nix build ".#${{ inputs.flake-output }}" --out-link result-site
|
|
|
|
- name: Push Nix closure to Attic cache
|
|
uses: https://git.toph.so/toph/ci-actions/push-nix-cache@main
|
|
with:
|
|
store-path: ./result-site
|
|
cache-name: ${{ inputs.cache-name }}
|
|
env:
|
|
ATTIC_TOKEN: ${{ env.ATTIC_TOKEN }}
|
|
|
|
- name: Upload site tarball to S3
|
|
shell: bash
|
|
run: |
|
|
SITE_HASH=$(git rev-parse --short=12 HEAD)
|
|
echo "SITE_HASH=${SITE_HASH}" >> $GITHUB_ENV
|
|
tar czf /tmp/site.tar.gz -C result-site .
|
|
aws s3 cp \
|
|
--endpoint-url "${{ inputs.s3-endpoint }}" \
|
|
/tmp/site.tar.gz \
|
|
"s3://${{ inputs.s3-bucket }}/sites/${{ inputs.domain }}/${SITE_HASH}.tar.gz"
|
|
|
|
- name: Resolve server image digest
|
|
shell: bash
|
|
run: |
|
|
DIGEST=$(skopeo inspect --format '{{.Digest}}' "docker://${{ inputs.server-image }}")
|
|
IMAGE_REPO="${{ inputs.server-image }}"
|
|
IMAGE_REPO="${IMAGE_REPO%%:*}"
|
|
echo "SERVER_IMAGE_PINNED=${IMAGE_REPO}@${DIGEST}" >> $GITHUB_ENV
|
|
|
|
- name: Deploy Nomad job
|
|
shell: bash
|
|
run: |
|
|
echo "NOMAD_ADDR=${NOMAD_ADDR}"
|
|
curl -sf --max-time 5 "${NOMAD_ADDR}/v1/status/leader" || echo "Nomad unreachable"
|
|
nix eval --raw --impure \
|
|
--expr "import \"${{ github.action_path }}/nomad-job.nix\"" \
|
|
| nomad job run -json -
|
|
env:
|
|
DOMAIN: ${{ inputs.domain }}
|
|
SITE_HASH: ${{ env.SITE_HASH }}
|
|
SERVER_IMAGE: ${{ env.SERVER_IMAGE_PINNED }}
|
|
DATACENTER: ${{ inputs.datacenter }}
|
|
S3_BUCKET: ${{ inputs.s3-bucket }}
|
|
|
|
- name: Smoke test
|
|
if: inputs.smoke-test == 'true'
|
|
shell: bash
|
|
run: |
|
|
echo "Waiting for deployment..."
|
|
for i in $(seq 1 12); do
|
|
if curl -sf --max-time 5 "https://${{ inputs.domain }}/" > /dev/null; then
|
|
echo "OK — https://${{ inputs.domain }}/ is up"
|
|
exit 0
|
|
fi
|
|
echo "Attempt ${i}/12 — retrying in 5s..."
|
|
sleep 5
|
|
done
|
|
echo "Smoke test failed: https://${{ inputs.domain }}/ did not respond"
|
|
exit 1
|