Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(ci): homelab deploy #322

Closed
wants to merge 1 commit into from
Closed

feat(ci): homelab deploy #322

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/clickhouse-monitoring.service
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Assuming:
# - Source code located at: /home/duyet/project/clickhouse-monitoring
# - NVM installed, NODE_VERSION=v22.5.1
# - Port 3000 is available
#
# Put this file at: /etc/systemd/system/clickhouse-monitoring.service
#
# sudo systemctl enable clickhouse-monitoring.service
# sudo systemctl daemon-reload
# sudo systemctl start clickhouse-monitoring.service
# sudo systemctl status clickhouse-monitoring.service

[Unit]
Description=ClickHouse Monitoring

[Service]
Restart=always
RestartSec=3
Environment=NODE_VERSION=v22.5.1
WorkingDirectory=/home/duyet/project/clickhouse-monitoring
# ExecStartPre=/home/duyet/.nvm/nvm-exec yarn build
ExecStart=/home/duyet/.nvm/nvm-exec yarn start -H 0.0.0.0 -p 3000
Type=simple
StandardOutput=append:/var/log/clickhouse-monitoring/clickhouse-monitoring.log
StandardError=app-end:/var/log/clickhouse-monitoring/clickhouse-monitoring.err

[Install]
WantedBy=multi-user.target
42 changes: 42 additions & 0 deletions .github/workflows/homelab.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: Homelab Deploy

on:
push:
branches:
- main
release:
types:
- published
pull_request:
workflow_dispatch:

permissions:
contents: read
id-token: write
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): Consider limiting the scope of the id-token permission.

The 'id-token: write' permission is quite powerful and should be used with caution. If possible, consider limiting its scope to only the necessary actions to minimize security risks.

Suggested change
id-token: write
permissions:
contents: read
id-token: write:actions


jobs:
homelab-deploy:
runs-on: ubuntu-latest
env:
USER: duyet
# Tailscale machine name
MACHINE: duet-ubuntu
# Generate key to get a private key to add to GitHub: ssh-keygen -t ed25519
SSH_KEY: ${{ secrets.SSH_KEY }}
steps:
- name: Tailscale
uses: tailscale/github-action@v2
with:
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
tags: tag:ci

- run: |
set -e
mkdir -p ~/.ssh/
chmod 0700 ~/.ssh
eval $(ssh-agent -s)
ssh-add <(echo "$SSH_KEY")
MACHINE_IP="$(tailscale ip -4 $MACHINE)"
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t $USER@$MACHINE_IP "cd ~/project/clickhouse-monitoring; NODE_VERSION=v22.5.1 /home/duyet/.nvm/nvm-exec yarn build"
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -t $USER@$MACHINE_IP "sudo systemctl restart clickhouse-monitoring.service"
Loading