domverse
5d589915f7
All checks were successful
Deploy / deploy (push) Successful in 19s
LAPI does not let machine JWTs hit GET /v1/decisions even after the machine is validated (returns 403 access forbidden). Conversely, bouncer X-Api-Key does not satisfy DELETE /v1/decisions (returns 401 "cookie token is empty"). The webapp now holds both credentials and routes each call to the right authority. Adds LAPI_BOUNCER_KEY env var + Gitea secret. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
62 lines
2.4 KiB
YAML
62 lines
2.4 KiB
YAML
# ──────────────────────────────────────────────────────────────────────────────
|
|
# CrowdSec Admin — Gitea Actions CI/CD
|
|
#
|
|
# Triggers on push to main. Runner builds image + brings stack up via docker
|
|
# compose on the host. Image stays local (no registry push), same pattern as
|
|
# flight-radar.
|
|
#
|
|
# PREREQUISITES (one-time):
|
|
# 1. Host LAPI machine registered (for DELETE auth):
|
|
# sudo cscli machines add crowdsec-admin --password '<PW>' -f -
|
|
# 2. Host LAPI bouncer registered (for GET auth):
|
|
# sudo cscli bouncers add crowdsec-admin
|
|
# 3. Repo secrets set in Gitea → Settings → Secrets:
|
|
# LAPI_MACHINE_ID=crowdsec-admin
|
|
# LAPI_MACHINE_PASSWORD=<PW>
|
|
# LAPI_BOUNCER_KEY=<bouncer key from step 2>
|
|
# 4. DNS: crowdsec.domverse-berlin.eu → host IP.
|
|
# 5. Authentik wildcard forward_domain already covers *.domverse-berlin.eu.
|
|
# ──────────────────────────────────────────────────────────────────────────────
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
COMPOSE_PROJECT: crowdsec-admin
|
|
COMPOSE_FILE: docker-compose.yml
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Write .env for compose
|
|
run: |
|
|
cat > .env <<EOF
|
|
LAPI_MACHINE_ID=${{ secrets.LAPI_MACHINE_ID }}
|
|
LAPI_MACHINE_PASSWORD=${{ secrets.LAPI_MACHINE_PASSWORD }}
|
|
LAPI_BOUNCER_KEY=${{ secrets.LAPI_BOUNCER_KEY }}
|
|
EOF
|
|
chmod 600 .env
|
|
|
|
- name: Deploy with docker compose
|
|
run: |
|
|
echo "=== Deploying commit ${{ gitea.sha }} to ${{ gitea.ref_name }} ==="
|
|
docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up --build -d --remove-orphans
|
|
|
|
- name: Show health
|
|
run: |
|
|
sleep 3
|
|
docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" ps
|
|
docker exec "$COMPOSE_PROJECT" python -c "import urllib.request; print(urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=3).read().decode())" || true
|
|
|
|
- name: Prune dangling images
|
|
run: docker image prune -f
|