78 lines
2.6 KiB
Markdown
78 lines
2.6 KiB
Markdown
# CI/CD
|
|
|
|
!!! TODO
|
|
This documentation might not be complete
|
|
|
|
|
|
!!! INFO
|
|
There are plenty of things you need
|
|
to customize accordingly like hosts and
|
|
usernames and preferred directories.
|
|
|
|
|
|
## Server side of things
|
|
|
|
``` console
|
|
Install required stuff and things on Debian based system
|
|
$ sudo apt-get install rsync
|
|
Make a user to have limited access
|
|
$ sudo useradd adduser --home /varasto/verkkojuuri --system --shell /bin/sh verkkojuuri
|
|
$ cd /varasto/verkkojuuri
|
|
$ sudo -u verkkojuuri ssh-keygen
|
|
$ sudo -u verkkojuuri cat .ssh/id_rsa
|
|
copy the result to your Forgejo as an action secret ssh_private_key
|
|
$ sudo -u verkkojuuri cat .ssh/id_rsa.pub
|
|
copy the result to your Forgejo as an action variable ssh_public_key
|
|
$ sudo -u verkkojuuri ssh-keygen -p
|
|
enter new password to protect the private key or delete it
|
|
or something security blah blah... No really, assume this is accessed!
|
|
(you just did and you are not verkkojuuri so think about it)
|
|
sudo -u verkkojuuri cp .ssh/id_rsa.pub .ssh/authorized_keys
|
|
this let's us trust the key
|
|
$ sudo usermod -aG ssh verkkojuuri
|
|
give us permission to get connected via ssh (might not be needed)
|
|
```
|
|
|
|
!!! WARNING
|
|
You might want to check out `rssh`, `scponly` or similar
|
|
more restricted shell to use with the account.
|
|
|
|
Change it afterwards using `sudo usermod -s /Sbin/HELL verkkojuuri`
|
|
|
|
## Forgejo side of things
|
|
|
|
Then you just like build and like rsync the files
|
|
using a forgejo action runner passing it the relevant
|
|
secrets. In practise you'll make it execute
|
|
|
|
``` console
|
|
$ mkdocs build
|
|
$ rsync -rclthv --exclude --delete-after .git site/ verkkojuuri@jakest.us:site
|
|
probs needs flags to allow skipping host verification key or maybe install them
|
|
using action variables
|
|
```
|
|
|
|
Oh you need it more detailed, okay.
|
|
|
|
1. Set *secret* `SSH_PRIVATE_KEY` to have non-password-protected ssh private key
|
|
(you should have done that in previousu steps).
|
|
2. Set following *variables*
|
|
- `SSH_USER`: verkkojuuri
|
|
- `SSH_HOST`: jakest.us
|
|
- `SSH_PATH`: site
|
|
3. Setup the action itself (refer to workflow actions in
|
|
[my repo](https://git.jakest.us/jt/saitti/)
|
|
perhaps)
|
|
4. Enjoy
|
|
|
|
|
|
And well yeah serve them files with Apache or whatever.
|
|
That's out of the scope of this document.
|
|
|
|
## Credits
|
|
Thank you Nexy and Tulir for your help!
|
|
|
|
- Nexy's blogpost: [https://blog.nexy7574.co.uk/2025/01/22/new-infrastructure/](https://blog.nexy7574.co.uk/2025/01/22/new-infrastructure/)
|
|
- Tulir's relevant stuff:
|
|
- [https://github.com/maunium/mau.fi/blob/main/.gitlab-ci.yml](https://github.com/maunium/mau.fi/blob/main/.gitlab-ci.yml)
|
|
- [https://github.com/mautrix/docs/blob/master/.gitlab-ci.yml](https://github.com/mautrix/docs/blob/master/.gitlab-ci.yml)
|