From b2900cbc8cb2c5f14eeabbc1289fc75eb401c29f Mon Sep 17 00:00:00 2001 From: missytake Date: Tue, 10 Mar 2026 13:18:25 +0100 Subject: [PATCH] CI: use hetzner-relay github actions --- .github/workflows/test-and-deploy.yaml | 85 ++++++-------------------- 1 file changed, 20 insertions(+), 65 deletions(-) diff --git a/.github/workflows/test-and-deploy.yaml b/.github/workflows/test-and-deploy.yaml index 2f744cb8..cfb5de3a 100644 --- a/.github/workflows/test-and-deploy.yaml +++ b/.github/workflows/test-and-deploy.yaml @@ -1,4 +1,4 @@ -name: deploy on staging2.testrun.org, and run tests +name: deploy on allocated VPS and run tests on: push: @@ -12,14 +12,14 @@ on: - 'LICENSE' jobs: - deploy: - name: deploy on staging2.testrun.org, and run tests + allocate: + uses: chatmail/hpool/.github/workflows/allocate.yml@main + + deploy-and-test: + name: deploy on allocated VPS, and run tests runs-on: ubuntu-latest - timeout-minutes: 30 - environment: - name: staging2.testrun.org - url: https://staging2.testrun.org/ - concurrency: staging2.testrun.org + needs: allocate + timeout-minutes: 10 steps: - uses: actions/checkout@v4 @@ -28,70 +28,25 @@ jobs: mkdir ~/.ssh echo "${{ secrets.STAGING_SSH_KEY }}" >> ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 - ssh-keyscan staging2.testrun.org > ~/.ssh/known_hosts - # save previous acme & dkim state - rsync -avz root@staging2.testrun.org:/var/lib/acme . || true - rsync -avz root@staging2.testrun.org:/etc/dkimkeys . || true - # store previous acme & dkim state on ns.testrun.org, if it contains useful certs - if [ -f dkimkeys/opendkim.private ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" dkimkeys root@ns.testrun.org:/tmp/ || true; fi - if [ "$(ls -A acme/certs)" ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" acme root@ns.testrun.org:/tmp/ || true; fi - # make sure CAA record isn't set - scp -o StrictHostKeyChecking=accept-new .github/workflows/staging.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging2.testrun.org.zone - ssh root@ns.testrun.org sed -i '/CAA/d' /etc/nsd/staging2.testrun.org.zone - ssh root@ns.testrun.org nsd-checkzone staging2.testrun.org /etc/nsd/staging2.testrun.org.zone - ssh root@ns.testrun.org systemctl reload nsd - - - name: rebuild staging2.testrun.org to have a clean VPS - run: | - curl -X POST \ - -H "Authorization: Bearer ${{ secrets.HETZNER_API_TOKEN }}" \ - -H "Content-Type: application/json" \ - -d '{"image":"debian-12"}' \ - "https://api.hetzner.cloud/v1/servers/${{ secrets.STAGING_SERVER_ID }}/actions/rebuild" - - - run: scripts/initenv.sh - - - name: append venv/bin to PATH - run: echo venv/bin >>$GITHUB_PATH - - - name: upload TLS cert after rebuilding - run: | - echo " --- wait until staging2.testrun.org VPS is rebuilt --- " - rm ~/.ssh/known_hosts - while ! ssh -o ConnectTimeout=180 -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org id -u ; do sleep 1 ; done - ssh -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org id -u - # download acme & dkim state from ns.testrun.org - rsync -e "ssh -o StrictHostKeyChecking=accept-new" -avz root@ns.testrun.org:/tmp/acme acme-restore || true - rsync -avz root@ns.testrun.org:/tmp/dkimkeys dkimkeys-restore || true - # restore acme & dkim state to staging2.testrun.org - rsync -avz acme-restore/acme root@staging2.testrun.org:/var/lib/ || true - rsync -avz dkimkeys-restore/dkimkeys root@staging2.testrun.org:/etc/ || true - ssh -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org chown root:root -R /var/lib/acme || true - name: add hpk42 key to staging server - run: ssh root@staging2.testrun.org 'curl -s https://github.com/hpk42.keys >> .ssh/authorized_keys' + run: ssh root@${{ secrets.STAGING_SSH_KEY }} 'curl -s https://github.com/hpk42.keys >> .ssh/authorized_keys' - name: run deploy-chatmail offline tests run: pytest --pyargs cmdeploy - run: | - cmdeploy init staging2.testrun.org + cmdeploy init ${{ secrets.STAGING_SSH_KEY }} sed -i 's/#\s*mtail_address/mtail_address/' chatmail.ini - - run: cmdeploy run --verbose --skip-dns-check - - - name: set DNS entries - run: | - cmdeploy dns --zonefile staging-generated.zone --verbose - cat staging-generated.zone >> .github/workflows/staging.testrun.org-default.zone - cat .github/workflows/staging.testrun.org-default.zone - scp .github/workflows/staging.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging2.testrun.org.zone - ssh root@ns.testrun.org nsd-checkzone staging2.testrun.org /etc/nsd/staging2.testrun.org.zone - ssh root@ns.testrun.org systemctl reload nsd - - - name: cmdeploy test - run: CHATMAIL_DOMAIN2=ci-chatmail.testrun.org cmdeploy test --slow - - - name: cmdeploy dns - run: cmdeploy dns -v + - run: | + git clone https://github.com/chatmail/hetzner-relay ../hetzner-relay + pip install ../hetzner-relay + python3 ../hetzner-relay/main.py --dns --test --vps ${{ needs.allocate.outputs.vps_name }} --run-id $GITHUB_RUN_ID --domain2 chatmail-ci.testrun.org . + rebuild: + needs: [allocate, deploy-and-test] + uses: chatmail/hpool/.github/workflows/rebuild.yml@main + if: always() + with: + vps_name: ${{ needs.allocate.outputs.vps_name }}