feat(deploy): add full CD pipeline infrastructure for DeepDrftHome

Four Gitea workflows (deploy-public, deploy-manager, deploy-api, package-install) and a complete deploy/ folder: bootstrap, install, ssh-wrapper, three deploy scripts, setup-step10-creds, three systemd user units, two nginx vhost templates. Models Skipper's deploy infrastructure with key deviations: flat csproj paths, dual PostgreSQL databases, FileDatabase vault directory (never touched on deploy), EF bundle covers DeepDrftContext only (AuthBlocks self-migrates at boot), deploy-api reads DB connection from host credentials not CI args.
2026-06-04 10:45:50 -04:00
parent 0d85f23f0e
commit 9bb11e47c7
16 changed files with 1590 additions and 0 deletions
@@ -0,0 +1,127 @@
+name: Deploy DeepDrftAPI
+
+on:
+  push:
+    branches: [master, dev]
+    paths:
+      - 'DeepDrftAPI/**'
+      - 'DeepDrftData/**'
+      - 'DeepDrftContent/**'
+      - 'DeepDrftModels/**'
+      - '.gitea/workflows/deploy-api.yml'
+      - 'deploy/systemd/deepdrftapi.service'
+
+jobs:
+  build:
+    name: Build, Publish & Bundle
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Install dotnet-ef tool
+        run: |
+          dotnet tool install --global dotnet-ef
+          echo "$HOME/.dotnet/tools" >> $GITHUB_PATH
+
+      - name: Restore
+        run: dotnet restore DeepDrftAPI/DeepDrftAPI.csproj -r linux-x64
+
+      # Build with RID so --no-build is valid for the Publish step below.
+      - name: Build
+        run: dotnet build DeepDrftAPI/DeepDrftAPI.csproj -c Release -r linux-x64 --self-contained --no-restore
+
+      # Add: dotnet test DeepDrftTests/DeepDrftTests.csproj when API integration tests exist.
+
+      - name: Publish (self-contained linux-x64)
+        run: |
+          dotnet publish DeepDrftAPI/DeepDrftAPI.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained \
+            --no-build \
+            -o DeepDrftAPI/publish
+
+      # DeepDrftContextFactory reads environment/connections.json at design time.
+      # Write a parseable dummy so the factory does not throw during bundle construction.
+      # The bundle only needs the provider type, not a live database connection.
+      - name: Write dummy connections file for EF bundle
+        run: |
+          mkdir -p DeepDrftAPI/environment
+          echo '{"ConnectionStrings":{"DefaultConnection":"Host=localhost;Database=dummy;Username=dummy","Auth":"Host=localhost;Database=dummy;Username=dummy"}}' > DeepDrftAPI/environment/connections.json
+
+      # EF bundle: self-contained binary that applies DeepDrftContext migrations on the host
+      # without the .NET SDK. AuthBlocks' Identity DB is NOT covered here — it self-migrates
+      # via UseAuthBlocksStartupAsync() on first boot.
+      - name: Bundle EF migrations
+        run: |
+          dotnet ef migrations bundle \
+            --project DeepDrftData/DeepDrftData.csproj \
+            --startup-project DeepDrftAPI/DeepDrftAPI.csproj \
+            --context DeepDrftContext \
+            --configuration Release \
+            --output deepdrft-migrations-bundle \
+            --self-contained \
+            -r linux-x64
+
+      - name: Package
+        run: tar -czf deepdrft-api.tar.gz -C DeepDrftAPI/publish .
+
+      - name: Upload artifacts (archive + bundle)
+        uses: actions/upload-artifact@v3
+        with:
+          name: deepdrft-api
+          path: |
+            deepdrft-api.tar.gz
+            deepdrft-migrations-bundle
+          retention-days: 1
+
+  deploy:
+    name: Deploy
+    needs: build
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev')
+    env:
+      DEPLOY_HOST: ${{ github.ref == 'refs/heads/master' && 'prod.cerebellumsoftworks.com' || 'dch7.cerebellumsoftworks.com' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v3
+        with:
+          name: deepdrft-api
+          path: staging/
+
+      - name: Install SSH tooling
+        run: apt-get update && apt-get install -y --no-install-recommends openssh-client rsync
+
+      - name: Configure SSH
+        env:
+          PROD_KEY: ${{ secrets.DEEPDRFT_PROD_SSH_DEPLOY }}
+          BETA_KEY: ${{ secrets.DEEPDRFT_DCH7_SSH_DEPLOY }}
+        run: |
+          mkdir -p ~/.ssh
+          if [ "$DEPLOY_HOST" = "prod.cerebellumsoftworks.com" ]; then
+            echo "$PROD_KEY" > ~/.ssh/deepdrft_ed25519
+          else
+            echo "$BETA_KEY" > ~/.ssh/deepdrft_ed25519
+          fi
+          chmod 600 ~/.ssh/deepdrft_ed25519
+          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts || { echo "ssh-keyscan failed for $DEPLOY_HOST"; exit 1; }
+
+      - name: Rsync archive, bundle, and unit file to staging
+        run: |
+          chmod +x staging/deepdrft-migrations-bundle
+          rsync -e "ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes" \
+            staging/deepdrft-api.tar.gz \
+            staging/deepdrft-migrations-bundle \
+            deploy/systemd/deepdrftapi.service \
+            deepdrft@$DEPLOY_HOST:
+
+      - name: Trigger deploy on host
+        run: |
+          ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes \
+            deepdrft@$DEPLOY_HOST deploy-api
@@ -0,0 +1,82 @@
+name: Deploy DeepDrftManager
+
+on:
+  push:
+    branches: [master, dev]
+    paths:
+      - 'DeepDrftManager/**'
+      - 'DeepDrftShared.Client/**'
+      - 'DeepDrftModels/**'
+      - '.gitea/workflows/deploy-manager.yml'
+
+jobs:
+  build:
+    name: Build & Publish
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      # No test project scoped to DeepDrftManager — add one and wire it here when ready.
+
+      - name: Publish (self-contained linux-x64)
+        run: |
+          dotnet publish DeepDrftManager/DeepDrftManager.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained \
+            -o DeepDrftManager/publish
+
+      - name: Package
+        run: tar -czf deepdrft-manager.tar.gz -C DeepDrftManager/publish .
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: deepdrft-manager
+          path: deepdrft-manager.tar.gz
+          retention-days: 1
+
+  deploy:
+    name: Deploy
+    needs: build
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev')
+    env:
+      DEPLOY_HOST: ${{ github.ref == 'refs/heads/master' && 'prod.cerebellumsoftworks.com' || 'dch7.cerebellumsoftworks.com' }}
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: deepdrft-manager
+
+      - name: Install SSH tooling
+        run: apt-get update && apt-get install -y --no-install-recommends openssh-client rsync
+
+      - name: Configure SSH
+        env:
+          PROD_KEY: ${{ secrets.DEEPDRFT_PROD_SSH_DEPLOY }}
+          BETA_KEY: ${{ secrets.DEEPDRFT_DCH7_SSH_DEPLOY }}
+        run: |
+          mkdir -p ~/.ssh
+          if [ "$DEPLOY_HOST" = "prod.cerebellumsoftworks.com" ]; then
+            echo "$PROD_KEY" > ~/.ssh/deepdrft_ed25519
+          else
+            echo "$BETA_KEY" > ~/.ssh/deepdrft_ed25519
+          fi
+          chmod 600 ~/.ssh/deepdrft_ed25519
+          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts || { echo "ssh-keyscan failed for $DEPLOY_HOST"; exit 1; }
+
+      - name: Rsync archive to staging
+        run: |
+          rsync -e "ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes" \
+            deepdrft-manager.tar.gz \
+            deepdrft@$DEPLOY_HOST:
+
+      - name: Trigger deploy on host
+        run: |
+          ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes \
+            deepdrft@$DEPLOY_HOST deploy-manager
@@ -0,0 +1,86 @@
+name: Deploy DeepDrftPublic
+
+on:
+  push:
+    branches: [master, dev]
+    paths:
+      - 'DeepDrftPublic/**'
+      - 'DeepDrftPublic.Client/**'
+      - 'DeepDrftShared.Client/**'
+      - 'DeepDrftModels/**'
+      - '.gitea/workflows/deploy-public.yml'
+
+jobs:
+  build:
+    name: Build & Publish
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Install wasm-tools workload
+        run: dotnet workload install wasm-tools
+
+      # No test project scoped to DeepDrftPublic — add one and wire it here when ready.
+
+      - name: Publish (self-contained linux-x64)
+        run: |
+          dotnet publish DeepDrftPublic/DeepDrftPublic.csproj \
+            -c Release \
+            -r linux-x64 \
+            --self-contained \
+            -o DeepDrftPublic/publish
+
+      - name: Package
+        run: tar -czf deepdrft-public.tar.gz -C DeepDrftPublic/publish .
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: deepdrft-public
+          path: deepdrft-public.tar.gz
+          retention-days: 1
+
+  deploy:
+    name: Deploy
+    needs: build
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/dev')
+    env:
+      DEPLOY_HOST: ${{ github.ref == 'refs/heads/master' && 'prod.cerebellumsoftworks.com' || 'dch7.cerebellumsoftworks.com' }}
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: deepdrft-public
+
+      - name: Install SSH tooling
+        run: apt-get update && apt-get install -y --no-install-recommends openssh-client rsync
+
+      - name: Configure SSH
+        env:
+          PROD_KEY: ${{ secrets.DEEPDRFT_PROD_SSH_DEPLOY }}
+          BETA_KEY: ${{ secrets.DEEPDRFT_DCH7_SSH_DEPLOY }}
+        run: |
+          mkdir -p ~/.ssh
+          if [ "$DEPLOY_HOST" = "prod.cerebellumsoftworks.com" ]; then
+            echo "$PROD_KEY" > ~/.ssh/deepdrft_ed25519
+          else
+            echo "$BETA_KEY" > ~/.ssh/deepdrft_ed25519
+          fi
+          chmod 600 ~/.ssh/deepdrft_ed25519
+          ssh-keyscan -H "$DEPLOY_HOST" >> ~/.ssh/known_hosts || { echo "ssh-keyscan failed for $DEPLOY_HOST"; exit 1; }
+
+      - name: Rsync archive to staging
+        run: |
+          rsync -e "ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes" \
+            deepdrft-public.tar.gz \
+            deepdrft@$DEPLOY_HOST:
+
+      - name: Trigger deploy on host
+        run: |
+          ssh -i ~/.ssh/deepdrft_ed25519 -o StrictHostKeyChecking=yes \
+            deepdrft@$DEPLOY_HOST deploy-public
@@ -0,0 +1,65 @@
+name: Package install tarball
+
+# Authentication: uses the built-in gitea.token (auto-injected per run).
+# No manual secret required.
+
+on:
+  push:
+    branches: [master, dev]
+    paths:
+      - 'deploy/**'
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build install tarball
+        run: |
+          tar -czf deepdrft-install.tar.gz \
+            --exclude=deploy/bootstrap.sh \
+            --transform 's|^deploy/||' \
+            deploy/
+
+      - name: Create Gitea release
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          GITEA_SERVER_URL: ${{ gitea.server_url }}
+          GITEA_REPO: ${{ gitea.repository }}
+        run: |
+          SHORT_SHA="${GITHUB_SHA::7}"
+          if [ "$GITHUB_REF" = "refs/heads/master" ]; then
+            TAG="install-$(date +%Y%m%d)-${SHORT_SHA}"
+            PRERELEASE="false"
+          else
+            TAG="beta-$(date +%Y%m%d)-${SHORT_SHA}"
+            PRERELEASE="true"
+          fi
+
+          # Create the release via Gitea API
+          RELEASE_URL=$(curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_SERVER_URL}/api/v1/repos/${GITEA_REPO}/releases" \
+            -d "{
+              \"tag_name\": \"${TAG}\",
+              \"name\": \"Install package ${TAG}\",
+              \"body\": \"Self-contained install tarball. Commit: ${GITHUB_SHA}\",
+              \"draft\": false,
+              \"prerelease\": ${PRERELEASE}
+            }" | jq -r '.upload_url')
+
+          # upload_url from Gitea includes {?name,label} template — strip it
+          UPLOAD_BASE="${RELEASE_URL%\{*\}}"
+
+          curl -s -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            "${UPLOAD_BASE}?name=deepdrft-install.tar.gz" \
+            --data-binary @deepdrft-install.tar.gz
+
+          echo "Released as tag: ${TAG}"
+          echo "Asset URL: ${GITEA_SERVER_URL}/${GITEA_REPO}/releases/download/${TAG}/deepdrft-install.tar.gz"