deploy.yml

name: Deploy

# Deploys the docker-compose stack to the Hetzner host via Ansible. The host has
# no public SSH, so the runner joins the tailnet (Tailscale) and reaches it over
# Tailscale SSH. Secrets come from GitHub Actions Secrets (no Ansible Vault).

on:
  push:
    branches: [main]
  workflow_dispatch:

# Never let two deploys race on the same host.
concurrency:
  group: deploy-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Connect to Tailscale
        uses: tailscale/github-action@v3
        with:
          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
          # The tailnet ACL must allow `tag:ci` to SSH to the server's tag as
          # root with `action: accept` (not `check`, which needs interactivity).
          tags: tag:ci

      - name: Install Ansible
        run: pipx install --include-deps ansible

      - name: Write inventory
        run: |
          cat > ansible/inventory.ini <<EOF
          [dashtec]
          ${{ vars.DEPLOY_HOST || 'dashtec-host' }} ansible_user=root
          [dashtec:vars]
          ansible_python_interpreter=/usr/bin/python3
          EOF

      - name: Run Ansible
        working-directory: ansible
        run: ansible-playbook site.yml
        env:
          ANSIBLE_HOST_KEY_CHECKING: "False"
          # Per-network secrets injected into the committed config.json.
          MAINNET_ETHEREUM_RPC_URL: ${{ secrets.MAINNET_ETHEREUM_RPC_URL }}
          MAINNET_SENTINEL_PROXY_URL: ${{ secrets.MAINNET_SENTINEL_PROXY_URL }}
          MAINNET_SESSION_PASSWORD: ${{ secrets.MAINNET_SESSION_PASSWORD }}
          TESTNET_ETHEREUM_RPC_URL: ${{ secrets.TESTNET_ETHEREUM_RPC_URL }}
          TESTNET_SENTINEL_PROXY_URL: ${{ secrets.TESTNET_SENTINEL_PROXY_URL }}
          TESTNET_SESSION_PASSWORD: ${{ secrets.TESTNET_SESSION_PASSWORD }}
          # OAuth, shared across networks (one app each). IDs are public
          # (variables); secrets are sensitive.
          DISCORD_CLIENT_ID: ${{ vars.DISCORD_CLIENT_ID }}
          DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
          X_CLIENT_ID: ${{ vars.X_CLIENT_ID }}
          X_CLIENT_SECRET: ${{ secrets.X_CLIENT_SECRET }}