b8c85be40f
- Supprime rm -f (causait la perte de ~23 vars a chaque deploy) - upsert ecrit KEY=value sans quotes (compatible Docker Compose v2) - CRLF strip avant ecriture (sed s/\r$//) - Sanity-check post-upsert: abort si NEXTAUTH_SECRET/AUTH_GOOGLE_ID/etc manquantes - Header ## AUTO-MANAGED BY CI ## en tete de fichier genere - deploy-prod.sh: sanity-check pre-deploy (NEXTAUTH_URL/SECRET/GOOGLE_ID/SECRET) - Ajoute .env.docker.example (reference complete de toutes les vars) - Ajoute MCP_SERVER_MODE/MCP_SERVER_URL manquantes dans deploy.yaml
142 lines
7.2 KiB
YAML
142 lines
7.2 KiB
YAML
name: Deploy to Production (manual)
|
|
|
|
# Déploiement auto = job "deploy" dans ci.yaml (après CI, sur runner docker-host).
|
|
# Ce workflow sert uniquement au déclenchement manuel sans repasser par la CI.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
name: Deploy production (manual)
|
|
runs-on: docker-host
|
|
steps:
|
|
- name: Sync repo on server
|
|
run: |
|
|
cd /opt/memento
|
|
git fetch origin main
|
|
git reset --hard origin/main
|
|
|
|
- name: Update .env.docker
|
|
env:
|
|
APP_URL: ${{ vars.APP_URL }}
|
|
NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET }}
|
|
ADMIN_EMAIL: ${{ vars.ADMIN_EMAIL }}
|
|
ALLOW_REGISTRATION: ${{ vars.ALLOW_REGISTRATION }}
|
|
POSTGRES_USER: ${{ vars.POSTGRES_USER }}
|
|
POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
|
|
POSTGRES_DB: ${{ vars.POSTGRES_DB }}
|
|
POSTGRES_PORT: ${{ vars.POSTGRES_PORT }}
|
|
AI_PROVIDER_TAGS: ${{ vars.AI_PROVIDER_TAGS }}
|
|
AI_MODEL_TAGS: ${{ vars.AI_MODEL_TAGS }}
|
|
AI_PROVIDER_EMBEDDING: ${{ vars.AI_PROVIDER_EMBEDDING }}
|
|
AI_MODEL_EMBEDDING: ${{ vars.AI_MODEL_EMBEDDING }}
|
|
AI_PROVIDER_CHAT: ${{ vars.AI_PROVIDER_CHAT }}
|
|
AI_MODEL_CHAT: ${{ vars.AI_MODEL_CHAT }}
|
|
CUSTOM_OPENAI_BASE_URL: ${{ vars.CUSTOM_OPENAI_BASE_URL }}
|
|
CUSTOM_OPENAI_API_KEY: ${{ secrets.CUSTOM_OPENAI_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
OLLAMA_BASE_URL: ${{ vars.OLLAMA_BASE_URL }}
|
|
EMAIL_PROVIDER: ${{ vars.EMAIL_PROVIDER }}
|
|
SMTP_FROM: ${{ vars.SMTP_FROM }}
|
|
RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
|
|
SMTP_HOST: ${{ vars.SMTP_HOST }}
|
|
SMTP_PORT: ${{ vars.SMTP_PORT }}
|
|
SMTP_USER: ${{ vars.SMTP_USER }}
|
|
SMTP_PASS: ${{ secrets.SMTP_PASS }}
|
|
SMTP_SECURE: ${{ vars.SMTP_SECURE }}
|
|
SMTP_IGNORE_CERT: ${{ vars.SMTP_IGNORE_CERT }}
|
|
MCP_MODE: ${{ vars.MCP_MODE }}
|
|
MCP_PORT: ${{ vars.MCP_PORT }}
|
|
WEB_SEARCH_PROVIDER: ${{ vars.WEB_SEARCH_PROVIDER }}
|
|
SEARXNG_URL: ${{ vars.SEARXNG_URL }}
|
|
BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
|
|
JINA_API_KEY: ${{ secrets.JINA_API_KEY }}
|
|
AUTH_GOOGLE_ID: ${{ vars.AUTH_GOOGLE_ID }}
|
|
AUTH_GOOGLE_SECRET: ${{ secrets.AUTH_GOOGLE_SECRET }}
|
|
SOCKET_INTERNAL_KEY: ${{ secrets.SOCKET_INTERNAL_KEY }}
|
|
SOCKET_PORT: ${{ vars.SOCKET_PORT }}
|
|
SOCKET_HTTP_PORT: ${{ vars.SOCKET_HTTP_PORT }}
|
|
SOCKET_INTERNAL_URL: ${{ vars.SOCKET_INTERNAL_URL }}
|
|
NEXT_PUBLIC_SOCKET_URL: ${{ vars.NEXT_PUBLIC_SOCKET_URL }}
|
|
TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
|
|
TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
|
|
METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
|
|
GRAFANA_ADMIN_PASSWORD: ${{ secrets.GRAFANA_ADMIN_PASSWORD }}
|
|
MCP_API_KEY: ${{ secrets.MCP_API_KEY }}
|
|
run: |
|
|
ENV_FILE="/opt/memento/.env.docker"
|
|
touch "$ENV_FILE"
|
|
sed -i 's/\r$//' "$ENV_FILE"
|
|
echo "## AUTO-MANAGED BY CI — do not edit manually ##" > "$ENV_FILE"
|
|
upsert() {
|
|
local key="$1" val="$2"
|
|
[ -z "$val" ] && return
|
|
sed -i "/^[[:space:]]*${key}=/d" "$ENV_FILE"
|
|
echo "${key}=${val}" >> "$ENV_FILE"
|
|
}
|
|
upsert NEXTAUTH_URL "$APP_URL"
|
|
upsert NEXTAUTH_SECRET "$NEXTAUTH_SECRET"
|
|
upsert ADMIN_EMAIL "$ADMIN_EMAIL"
|
|
upsert ALLOW_REGISTRATION "$ALLOW_REGISTRATION"
|
|
upsert POSTGRES_USER "$POSTGRES_USER"
|
|
upsert POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
|
|
upsert POSTGRES_DB "$POSTGRES_DB"
|
|
upsert POSTGRES_PORT "$POSTGRES_PORT"
|
|
upsert AI_PROVIDER_TAGS "$AI_PROVIDER_TAGS"
|
|
upsert AI_MODEL_TAGS "$AI_MODEL_TAGS"
|
|
upsert AI_PROVIDER_EMBEDDING "$AI_PROVIDER_EMBEDDING"
|
|
upsert AI_MODEL_EMBEDDING "$AI_MODEL_EMBEDDING"
|
|
upsert AI_PROVIDER_CHAT "$AI_PROVIDER_CHAT"
|
|
upsert AI_MODEL_CHAT "$AI_MODEL_CHAT"
|
|
upsert CUSTOM_OPENAI_BASE_URL "$CUSTOM_OPENAI_BASE_URL"
|
|
upsert CUSTOM_OPENAI_API_KEY "$CUSTOM_OPENAI_API_KEY"
|
|
upsert OPENAI_API_KEY "$OPENAI_API_KEY"
|
|
upsert OLLAMA_BASE_URL "$OLLAMA_BASE_URL"
|
|
upsert EMAIL_PROVIDER "$EMAIL_PROVIDER"
|
|
upsert SMTP_FROM "$SMTP_FROM"
|
|
upsert RESEND_API_KEY "$RESEND_API_KEY"
|
|
upsert SMTP_HOST "$SMTP_HOST"
|
|
upsert SMTP_PORT "$SMTP_PORT"
|
|
upsert SMTP_USER "$SMTP_USER"
|
|
upsert SMTP_PASS "$SMTP_PASS"
|
|
upsert SMTP_SECURE "$SMTP_SECURE"
|
|
upsert SMTP_IGNORE_CERT "$SMTP_IGNORE_CERT"
|
|
upsert MCP_MODE "$MCP_MODE"
|
|
upsert MCP_PORT "$MCP_PORT"
|
|
upsert MCP_SERVER_MODE "$MCP_MODE"
|
|
upsert MCP_SERVER_URL "${APP_URL}/mcp"
|
|
upsert WEB_SEARCH_PROVIDER "$WEB_SEARCH_PROVIDER"
|
|
upsert SEARXNG_URL "$SEARXNG_URL"
|
|
upsert BRAVE_SEARCH_API_KEY "$BRAVE_SEARCH_API_KEY"
|
|
upsert JINA_API_KEY "$JINA_API_KEY"
|
|
upsert AUTH_GOOGLE_ID "$AUTH_GOOGLE_ID"
|
|
upsert AUTH_GOOGLE_SECRET "$AUTH_GOOGLE_SECRET"
|
|
upsert SOCKET_INTERNAL_KEY "$SOCKET_INTERNAL_KEY"
|
|
upsert SOCKET_PORT "$SOCKET_PORT"
|
|
upsert SOCKET_HTTP_PORT "$SOCKET_HTTP_PORT"
|
|
upsert SOCKET_INTERNAL_URL "$SOCKET_INTERNAL_URL"
|
|
upsert NEXT_PUBLIC_SOCKET_URL "$NEXT_PUBLIC_SOCKET_URL"
|
|
upsert REDIS_HOST "redis"
|
|
upsert TELEGRAM_BOT_TOKEN "$TELEGRAM_BOT_TOKEN"
|
|
upsert TELEGRAM_CHAT_ID "$TELEGRAM_CHAT_ID"
|
|
upsert METRICS_TOKEN "$METRICS_TOKEN"
|
|
upsert GRAFANA_ADMIN_PASSWORD "$GRAFANA_ADMIN_PASSWORD"
|
|
upsert MCP_API_KEY "$MCP_API_KEY"
|
|
[ -n "$METRICS_TOKEN" ] && echo "$METRICS_TOKEN" > /opt/memento/monitoring/metrics-token && chmod 600 /opt/memento/monitoring/metrics-token || true
|
|
# Sanity-check: abort if a critical var is missing
|
|
for required in NEXTAUTH_URL NEXTAUTH_SECRET AUTH_GOOGLE_ID AUTH_GOOGLE_SECRET \
|
|
AI_PROVIDER_TAGS AI_MODEL_TAGS AI_PROVIDER_EMBEDDING AI_MODEL_EMBEDDING \
|
|
AI_PROVIDER_CHAT AI_MODEL_CHAT MCP_SERVER_URL; do
|
|
grep -q "^${required}=" "$ENV_FILE" || {
|
|
echo "ERROR: required var $required missing in $ENV_FILE — check Gitea vars/secrets"
|
|
exit 1
|
|
}
|
|
done
|
|
echo "env.docker sanity-check passed ($(wc -l < "$ENV_FILE") lines)"
|
|
|
|
- name: Deploy (full build, no CI artifact)
|
|
env:
|
|
EXPECTED_COMMIT: ${{ github.sha }}
|
|
run: bash /opt/memento/scripts/deploy-prod.sh
|