fix(ci): deploy via SSH to NAS instead of Portainer API
act_runner v0.6.1 does not propagate the runner's network namespace to job containers, so the job can never resolve 'portainer' or reach '192.168.1.30:9000'. After trying every combination of container.network_mode / container.network / options in the runner config, the only reliable solution is to skip the in-cluster Portainer API call and do the deploy via SSH directly on the NAS. - New secrets: NAS_SSH_KEY, NAS_HOST, NAS_USER. - The new 'Redeploy stack on Portainer via SSH' step writes the SSH key to ~/.ssh, then pipes docker-compose.prod.yml to 'docker compose -p davidaragon-portfolio -f - up -d' over SSH. - The old Portainer-API step is removed. Smoke-test at the end hits the public port on the host (3001) and logs the HTTP code; we don't fail the job if the public proxy upstream isn't reachable from the runner's network.
This commit is contained in:
+37
-62
@@ -62,73 +62,48 @@ jobs:
|
|||||||
# PORTAINER_ENDPOINT_ID Numeric endpoint ID (usually 1)
|
# PORTAINER_ENDPOINT_ID Numeric endpoint ID (usually 1)
|
||||||
# PORTAINER_STACK_ID Numeric stack ID to delete before recreating
|
# PORTAINER_STACK_ID Numeric stack ID to delete before recreating
|
||||||
# ----------------------------------------------------------------------
|
# ----------------------------------------------------------------------
|
||||||
- name: Redeploy stack on Portainer
|
- name: Redeploy stack on Portainer via SSH
|
||||||
if: github.event_name == 'workflow_dispatch' && inputs.deploy == true
|
if: github.event_name == 'workflow_dispatch' && inputs.deploy == true
|
||||||
env:
|
env:
|
||||||
PORTAINER_TOKEN: ${{ secrets.PORTAINER_TOKEN }}
|
NAS_SSH_KEY: ${{ secrets.NAS_SSH_KEY }}
|
||||||
PORTAINER_ENDPOINT_ID: ${{ secrets.PORTAINER_ENDPOINT_ID }}
|
NAS_HOST: ${{ secrets.NAS_HOST }}
|
||||||
PORTAINER_STACK_ID: ${{ secrets.PORTAINER_STACK_ID }}
|
NAS_USER: ${{ secrets.NAS_USER }}
|
||||||
|
STACK_NAME: davidaragon-portfolio
|
||||||
|
COMPOSE_FILE: docker-compose.prod.yml
|
||||||
run: |
|
run: |
|
||||||
# Portainer, Gitea and the runners all share the `portainer_default`
|
# The act_runner job container can't reach 'portainer' because it
|
||||||
# Docker network on the NAS, so the service name "portainer" resolves
|
# doesn't share the runner's network namespace in v0.6.1. We work
|
||||||
# directly from the job container on port 9000.
|
# around this by SSHing into the NAS (where Portainer is) and
|
||||||
PORTAINER_URL="http://portainer:9000"
|
# using the docker CLI directly to do `docker stack deploy`.
|
||||||
echo "Using PORTAINER_URL=$PORTAINER_URL"
|
set -euo pipefail
|
||||||
if ! curl -sS -o /dev/null -w '%{http_code}' --max-time 5 \
|
|
||||||
"${PORTAINER_URL}/api/status" | grep -q '^200$'; then
|
mkdir -p ~/.ssh
|
||||||
echo "ERROR: Portainer not reachable at $PORTAINER_URL" >&2
|
echo "$NAS_SSH_KEY" > ~/.ssh/id_ed25519
|
||||||
|
chmod 600 ~/.ssh/id_ed25519
|
||||||
|
|
||||||
|
echo "--- Pre-flight: ensure NAS is reachable ---"
|
||||||
|
ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
|
||||||
|
"$NAS_USER@$NAS_HOST" 'hostname && docker version --format "{{.Server.Version}}"' \
|
||||||
|
| head
|
||||||
|
|
||||||
|
echo "--- Reading docker-compose.prod.yml from the repo ---"
|
||||||
|
if [ ! -f "$COMPOSE_FILE" ]; then
|
||||||
|
echo "ERROR: $COMPOSE_FILE not found in repo root" >&2
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "--- Step 1: pre-flight (delete existing stack if present) ---"
|
echo "--- Redeploying stack '$STACK_NAME' on the NAS ---"
|
||||||
DELETE_HTTP_CODE=$(curl -sS -o /tmp/portainer-delete.json -w '%{http_code}' \
|
# The NAS has Portainer and docker compose (v2) available. We stream
|
||||||
-X DELETE \
|
# the compose file over SSH and let docker compose recreate the
|
||||||
-H "X-API-Key: ${PORT...EN}" \
|
# project. We pin the project name to 'davidaragon-portfolio' so the
|
||||||
"${PORTAINER_URL}/api/stacks/${PORTAINER_STACK_ID}?endpointId=${PORTAINER_ENDPOINT_ID}")
|
# volumes and networks of the existing stack are reused.
|
||||||
echo "DELETE HTTP ${DELETE_HTTP_CODE}"
|
cat "$COMPOSE_FILE" | ssh -o StrictHostKeyChecking=no \
|
||||||
if [ "${DELETE_HTTP_CODE}" != "204" ] && [ "${DELETE_HTTP_CODE}" != "404" ]; then
|
"$NAS_USER@$NAS_HOST" \
|
||||||
echo "ERROR: Portainer rejected DELETE on stack ${PORTAINER_STACK_ID}:" >&2
|
"export PATH=/share/CACHEDEV1_DATA/.qpkg/container-station/usr/bin:\$PATH; cd /tmp && docker compose -p '$STACK_NAME' -f - up -d"
|
||||||
cat /tmp/portainer-delete.json >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "--- Step 2: read docker-compose.prod.yml ---"
|
echo "--- Stack '$STACK_NAME' redeployed. Smoke-test: ---"
|
||||||
if [ ! -f docker-compose.prod.yml ]; then
|
sleep 5
|
||||||
echo "ERROR: docker-compose.prod.yml is missing from the repo root" >&2
|
curl -sS -o /dev/null -w 'http://localhost:3001/ -> HTTP=%{http_code}\n' \
|
||||||
exit 1
|
--max-time 5 http://localhost:3001/ || true
|
||||||
fi
|
|
||||||
# Inline the compose file. Portainer expects `composeFileContent` as raw text.
|
|
||||||
COMPOSE_BODY=$(jq -Rs --arg compose "$(cat docker-compose.prod.yml)" \
|
|
||||||
'{composeFileContent: $compose, env: []}' < /dev/null)
|
|
||||||
|
|
||||||
echo "--- Step 3: create fresh stack from docker-compose.prod.yml ---"
|
echo "--- Done ---"
|
||||||
CREATE_HTTP_CODE=$(curl -sS -o /tmp/portainer-create.json -w '%{http_code}' \
|
|
||||||
-X POST \
|
|
||||||
-H "X-API-Key: ${PORTAINER_TOKEN}" \
|
|
||||||
-H "Content-Type: application/json" \
|
|
||||||
--data "${COMPOSE_BODY}" \
|
|
||||||
"${PORTAINER_URL}/api/stacks?endpointId=${PORTAINER_ENDPOINT_ID}&type=2&method=string&name=davidaragon-portfolio")
|
|
||||||
echo "CREATE HTTP ${CREATE_HTTP_CODE}"
|
|
||||||
if [ "${CREATE_HTTP_CODE}" != 201 ]; then
|
|
||||||
echo "ERROR: Portainer rejected stack creation:" >&2
|
|
||||||
cat /tmp/portainer-create.json >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "--- Step 4: smoke-test the freshly deployed stack ---"
|
|
||||||
# Give the container a brief window to start before checking.
|
|
||||||
sleep 8
|
|
||||||
# The Portainer host:9000 is reachable from the job container
|
|
||||||
# (we just proved that with the auto-discovery step above). The
|
|
||||||
# portfolio container itself is published on host port 3001, so
|
|
||||||
# smoke-test through the same host. We don't fail the job if the
|
|
||||||
# proxy upstream isn't reachable from the runner's network.
|
|
||||||
HEALTH=$(curl -sS -o /dev/null -w '%{http_code}' \
|
|
||||||
--max-time 5 \
|
|
||||||
"${PORTAINER_URL%:[0-9]*}:3001/" 2>/dev/null || true)
|
|
||||||
echo "Health check on ${PORTAINER_URL%:[0-9]*}:3001/ returned: ${HEALTH:-<timeout/unreachable>}"
|
|
||||||
# We log but don't fail the job if 3001 isn't reachable — the upstream
|
|
||||||
# proxy (Nginx Proxy Manager → davidaragon.impresion3d.pro) is a better
|
|
||||||
# place to wire a hard-fail check in a future iteration.
|
|
||||||
|
|
||||||
echo "--- Stack recreated successfully. ---"
|
|
||||||
Reference in New Issue
Block a user