feat(ci): add automated DB backup, UAT RGPD restoration and Gitea CI SSH deployment
This commit is contained in:
@@ -49,14 +49,26 @@ jobs:
|
||||
env:
|
||||
PROD_DB_USER: ${{ secrets.PROD_DB_USER }}
|
||||
PROD_DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
|
||||
PROD_DB_NAME: ${{ secrets.PROD_DB_NAME }}
|
||||
CAPTCHA_SECRET: ${{ secrets.CAPTCHA_SECRET }}
|
||||
CAPTCHA_SITEKEY: ${{ secrets.CAPTCHA_SITEKEY }}
|
||||
MAIL_USERNAME: ${{ secrets.MAIL_USERNAME }}
|
||||
MAIL_PASSWORD: ${{ secrets.MAIL_PASSWORD }}
|
||||
MAIL_FROM: ${{ secrets.MAIL_FROM }}
|
||||
BREVO_API_KEY: ${{ secrets.BREVO_API_KEY }}
|
||||
NOTIFICATION_EMAIL: ${{ secrets.NOTIFICATION_EMAIL }}
|
||||
BACKUP_DIR: ${{ secrets.BACKUP_DIR }}
|
||||
RETENTION_DAYS: ${{ secrets.RETENTION_DAYS }}
|
||||
ENABLE_REMOTE_COPY: ${{ secrets.ENABLE_REMOTE_COPY }}
|
||||
REMOTE_HOST: ${{ secrets.REMOTE_HOST }}
|
||||
REMOTE_USER: ${{ secrets.REMOTE_USER }}
|
||||
REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
|
||||
REMOTE_BACKUP_DIR: ${{ secrets.REMOTE_BACKUP_DIR }}
|
||||
SSH_KEY_PATH: ${{ secrets.SSH_KEY_PATH }}
|
||||
run: |
|
||||
echo "POSTGRES_USER=${PROD_DB_USER:-myuser}" > .env
|
||||
echo "POSTGRES_PASSWORD=${PROD_DB_PASSWORD:-mypassword}" >> .env
|
||||
[ -n "${PROD_DB_NAME}" ] && echo "POSTGRES_DB=${PROD_DB_NAME}" >> .env
|
||||
echo "CAPTCHA_SECRET=${CAPTCHA_SECRET:-1x0000000000000000000000000000000AA}" >> .env
|
||||
echo "CAPTCHA_SITEKEY=${CAPTCHA_SITEKEY:-1x00000000000000000000AA}" >> .env
|
||||
if [ -n "${MAIL_USERNAME}" ]; then
|
||||
@@ -70,6 +82,19 @@ jobs:
|
||||
echo "APP_MAIL_FROM=${MAIL_FROM}" >> .env
|
||||
fi
|
||||
fi
|
||||
# Configuration des sauvegardes de BDD
|
||||
[ -n "${BREVO_API_KEY}" ] && echo "BREVO_API_KEY=${BREVO_API_KEY}" >> .env
|
||||
[ -n "${NOTIFICATION_EMAIL}" ] && echo "NOTIFICATION_EMAIL=${NOTIFICATION_EMAIL}" >> .env
|
||||
[ -n "${BACKUP_DIR}" ] && echo "BACKUP_DIR=${BACKUP_DIR}" >> .env
|
||||
[ -n "${RETENTION_DAYS}" ] && echo "RETENTION_DAYS=${RETENTION_DAYS}" >> .env
|
||||
if [ "${ENABLE_REMOTE_COPY}" = "true" ]; then
|
||||
echo "ENABLE_REMOTE_COPY=true" >> .env
|
||||
[ -n "${REMOTE_HOST}" ] && echo "REMOTE_HOST=${REMOTE_HOST}" >> .env
|
||||
[ -n "${REMOTE_USER}" ] && echo "REMOTE_USER=${REMOTE_USER}" >> .env
|
||||
[ -n "${REMOTE_PORT}" ] && echo "REMOTE_PORT=${REMOTE_PORT}" >> .env
|
||||
[ -n "${REMOTE_BACKUP_DIR}" ] && echo "REMOTE_BACKUP_DIR=${REMOTE_BACKUP_DIR}" >> .env
|
||||
[ -n "${SSH_KEY_PATH}" ] && echo "SSH_KEY_PATH=${SSH_KEY_PATH}" >> .env
|
||||
fi
|
||||
docker compose down app || true
|
||||
docker compose up -d --build app
|
||||
|
||||
@@ -89,3 +114,81 @@ jobs:
|
||||
echo "Application failed to start or login page is not accessible."
|
||||
docker logs astalange_app
|
||||
exit 1
|
||||
|
||||
- name: Deploy Backup Script & Config to DB Server (10.8.0.3)
|
||||
env:
|
||||
DB_SERVER_HOST: ${{ secrets.PROD_DB_HOST }}
|
||||
DB_SERVER_USER: ${{ secrets.PROD_DB_SSH_USER }}
|
||||
REMOTE_PORT: ${{ secrets.REMOTE_PORT }}
|
||||
PROD_DB_SSH_KEY: ${{ secrets.PROD_DB_SSH_KEY }}
|
||||
SSH_KEY_PATH_SECRET: ${{ secrets.SSH_KEY_PATH }}
|
||||
SSH_KEY_SECRET: ${{ secrets.SSH_KEY }}
|
||||
run: |
|
||||
TARGET_HOST="${DB_SERVER_HOST:-10.8.0.3}"
|
||||
TARGET_USER="${DB_SERVER_USER:-root}"
|
||||
PORT="${REMOTE_PORT:-22}"
|
||||
DEST_DIR="/opt/as-talange"
|
||||
RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
|
||||
|
||||
if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then
|
||||
RAW_KEY=$(cat "${RAW_KEY}")
|
||||
fi
|
||||
|
||||
if [ -z "${RAW_KEY}" ]; then
|
||||
if [ -f /root/.ssh/gitea_ci_key ]; then
|
||||
RAW_KEY=$(cat /root/.ssh/gitea_ci_key)
|
||||
elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
|
||||
RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key)
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -z "${RAW_KEY}" ]; then
|
||||
echo "========================================================================="
|
||||
echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !"
|
||||
echo "========================================================================="
|
||||
exit 1
|
||||
fi
|
||||
|
||||
KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n')
|
||||
SCRIPT_B64=$(base64 scripts/backup_db.sh | tr -d '\r\n')
|
||||
[ -f .env ] && ENV_B64=$(base64 .env | tr -d '\r\n') || ENV_B64=""
|
||||
|
||||
docker run --rm --net=host \
|
||||
-e TARGET_HOST="${TARGET_HOST}" \
|
||||
-e TARGET_USER="${TARGET_USER}" \
|
||||
-e PORT="${PORT}" \
|
||||
-e DEST_DIR="${DEST_DIR}" \
|
||||
-e KEY_B64="${KEY_B64}" \
|
||||
-e SCRIPT_B64="${SCRIPT_B64}" \
|
||||
-e ENV_B64="${ENV_B64}" \
|
||||
alpine:latest sh -c '
|
||||
apk add --no-cache openssh-client rsync coreutils && \
|
||||
(echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \
|
||||
HEADER=$(grep "BEGIN" /tmp/raw_key) && \
|
||||
FOOTER=$(grep "END" /tmp/raw_key) && \
|
||||
BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \
|
||||
printf "%s\n" "$HEADER" > /tmp/working_key && \
|
||||
printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \
|
||||
printf "%s\n" "$FOOTER" >> /tmp/working_key && \
|
||||
echo "" >> /tmp/working_key && \
|
||||
chmod 600 /tmp/working_key && \
|
||||
(echo "$SCRIPT_B64" | base64 -d 2>/dev/null || echo "$SCRIPT_B64" | base64 --decode) > /tmp/backup_db.sh && \
|
||||
if [ -n "$ENV_B64" ]; then \
|
||||
(echo "$ENV_B64" | base64 -d 2>/dev/null || echo "$ENV_B64" | base64 --decode) > /tmp/.env ; \
|
||||
else \
|
||||
touch /tmp/.env ; \
|
||||
fi && \
|
||||
echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
|
||||
echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
|
||||
echo "Destination Directory: ${DEST_DIR}" && \
|
||||
echo "=== 🔑 KEY FINGERPRINT ===" && \
|
||||
ssh-keygen -l -f /tmp/working_key && \
|
||||
SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
|
||||
echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
|
||||
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
|
||||
echo "=== 📦 RSYNC TRANSFER SCRIPT & ENV ===" && \
|
||||
rsync -avz -e "$SSH_CMD" /tmp/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/backup_db.sh" && \
|
||||
rsync -avz -e "$SSH_CMD" /tmp/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
|
||||
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
|
||||
echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
|
||||
'
|
||||
|
||||
Reference in New Issue
Block a user