randy
e13d1a1e97
Upload/delete/move/create-folder now require logging in via Gitea OAuth2 (only MAPTOOL_ALLOWED_GITEA_USER is granted write access); reading stays public. Deploy secrets (session secret, OAuth2 client credentials, allowed user) are written to .env from Gitea Actions repo secrets on every deploy instead of living on the server by hand. Also switch the container's bind address to "[::]" (dual-stack) so the app is reachable over IPv6, not just IPv4.
92 lines
3.5 KiB
YAML
92 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# No ruby-version input: the action auto-detects it from
|
|
# .ruby-version when the input is omitted (not "file", which isn't
|
|
# a recognized value and fails with "Unknown engine file").
|
|
- uses: ruby/setup-ruby@v1
|
|
with:
|
|
bundler-cache: true
|
|
|
|
- name: Ruby syntax check
|
|
run: find app.rb config lib -name "*.rb" -print0 | xargs -0 -n1 ruby -c
|
|
|
|
- name: App loads without errors
|
|
run: bundle exec ruby -e 'require_relative "app"'
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
|
|
- name: JS syntax check
|
|
run: find public/js -name "*.js" -print0 | xargs -0 -n1 node --check
|
|
|
|
# Handled by a separate, native (non-Docker) runner registered with the
|
|
# single "deploy:host" label (see docs/deployment.adoc) — it runs directly
|
|
# on the server, so it has docker/git/etc. from the host, no socket/bind
|
|
# mount tricks needed. The Docker-based runner keeps handling `check`.
|
|
deploy:
|
|
needs: check
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
runs-on: deploy
|
|
steps:
|
|
# Not actions/checkout@v4: keeping this plain-git checkout from when
|
|
# the job ran in a Node-less container — no reason to add a Node
|
|
# dependency back in for something this already does.
|
|
- name: Checkout
|
|
run: |
|
|
rm -rf .git * .[!.]* 2>/dev/null
|
|
git init -q
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
git -c http.extraHeader="Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
|
|
fetch --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
# Clears out everything in the target except data/ (uploaded GPX
|
|
# files, offline.pmtiles) and copies the fresh checkout over, dropping
|
|
# .git afterwards. Dotfiles like .env (deployment secrets) are left
|
|
# alone too — the glob below doesn't match them — and neither is ever
|
|
# part of the git checkout in the first place, since both are
|
|
# gitignored.
|
|
- name: Sync to /srv/docker/maptool
|
|
run: |
|
|
mkdir -p /srv/docker/maptool
|
|
for f in /srv/docker/maptool/*; do
|
|
[ "$(basename "$f")" = "data" ] && continue
|
|
rm -rf "$f"
|
|
done
|
|
cp -a . /srv/docker/maptool/
|
|
rm -rf /srv/docker/maptool/.git
|
|
|
|
# Regenerated on every deploy from repo secrets (Settings -> Actions
|
|
# -> Secrets) rather than created once by hand on the server — see
|
|
# docs/deployment.adoc. Values are masked in the job log by Gitea
|
|
# automatically since they come from `secrets`. Secret names here
|
|
# can't start with "GITEA_"/"GITHUB_" — Gitea reserves those prefixes
|
|
# — hence OAUTH_CLIENT_* rather than GITEA_OAUTH_CLIENT_*; the .env
|
|
# var names on the right of `=` are unaffected, still what app.rb
|
|
# actually reads.
|
|
- name: Write .env
|
|
run: |
|
|
cat > /srv/docker/maptool/.env <<EOF
|
|
SESSION_SECRET=${{ secrets.SESSION_SECRET }}
|
|
GITEA_OAUTH_CLIENT_ID=${{ secrets.OAUTH_CLIENT_ID }}
|
|
GITEA_OAUTH_CLIENT_SECRET=${{ secrets.OAUTH_CLIENT_SECRET }}
|
|
MAPTOOL_ALLOWED_GITEA_USER=${{ secrets.MAPTOOL_ALLOWED_GITEA_USER }}
|
|
EOF
|
|
chmod 600 /srv/docker/maptool/.env
|
|
|
|
- name: Deploy
|
|
run: |
|
|
cd /srv/docker/maptool
|
|
docker compose -p maptool up --build -d
|