github actions

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    open-pull-requests-limit: 25
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: npm
+    directory: /
+    open-pull-requests-limit: 25
+    schedule:
+      interval: weekly

.github/workflows/main.yml

@@ -0,0 +1,92 @@
+name: Build and Deploy
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Node packages
+        run: npm install
+
+      - name: Build assets
+        run: npm run build
+        env:
+          NODE_ENV: production
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          push: true
+          context: .
+          file: Dockerfile
+          tags: ghcr.io/jamie-mh/stratumwebsite:latest,ghcr.io/jamie-mh/stratumwebsite:${{ github.ref_name }}
+
+  deploy:
+    runs-on: ubuntu-latest
+    needs: build
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up SSH
+        run: |
+          mkdir ~/.ssh
+          echo "${{ secrets.DEPLOY_KEY }}" > ~/.ssh/deploy.key
+          chmod 700 ~/.ssh
+          chmod 600 ~/.ssh/deploy.key
+
+          cat >>~/.ssh/config <<END
+          Host stratum
+              HostName ${{ secrets.DEPLOY_HOST }}
+              User ${{ secrets.DEPLOY_USER }}
+              IdentityFile ~/.ssh/deploy.key
+              StrictHostKeyChecking no
+              ControlMaster auto
+              ControlPath ~/.ssh/control-%C
+              ControlPersist yes
+          END
+
+      - name: Prepare secrets
+        run: |
+          for file in secrets/*.gpg ; do
+            gpg --batch --output $(echo $file | sed 's/\.gpg/\.txt/g') --passphrase '${{ secrets.SECRETS_PASSPHRASE }}' --decrypt $file
+          done
+
+          ssh stratum -f 'mkdir ~/secrets'
+          rsync -avzr --delete --exclude='*.gpg' ./secrets stratum:~/
+          ssh stratum -f 'chmod -R 740 ~/secrets'
+          
+      - name: Prepare Compose file
+        run: |
+          # Deploy current tag and adjust secrets location
+          sed -i 's/stratumwebsite:latest/stratumwebsite:${{ github.ref_name }}/' compose.yaml
+          sed -i 's|./secrets|/home/${{ secrets.DEPLOY_USER }}/secrets|g' compose.yaml
+
+      - name: Deploy
+        run: |
+          export DOCKER_HOST=ssh://stratum
+          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+
+          docker compose -f compose.yaml pull
+          docker compose -f compose.yaml down
+          docker compose -f compose.yaml up --no-deps -d
+          docker image prune -f