From 1ae14536e6d6156d0fe1f2c0ec7c258be0974852 Mon Sep 17 00:00:00 2001 From: febux Date: Mon, 14 Sep 2026 02:28:43 +0300 Subject: [PATCH] Deploy job was fixed. Workflow was fixed. --- .forgejo/workflows/deploy.yml | 9 ++++--- Makefile | 8 +++--- deploy/nomad/README.md | 17 +++++++++---- deploy/nomad/contract-check.nomad.hcl | 36 ++++++++++++++------------- 4 files changed, 41 insertions(+), 29 deletions(-) diff --git a/.forgejo/workflows/deploy.yml b/.forgejo/workflows/deploy.yml index b735781..7cca2d3 100644 --- a/.forgejo/workflows/deploy.yml +++ b/.forgejo/workflows/deploy.yml @@ -35,7 +35,7 @@ jobs: steps: - name: Checkout run: | - apk add --no-cache git + apk add --no-cache git gettext git init -q . git remote add origin ${{ github.server_url }}/${{ github.repository }}.git git fetch --depth 1 origin ${{ github.sha }} @@ -89,8 +89,11 @@ jobs: --entrypoint /bin/nomad \ hashicorp/nomad:1.9 job run /tmp/job.hcl - docker cp .ci-tls/ca.crt nomad-deploy:/tmp/ca.crt - docker cp deploy/nomad/contract-check.nomad.hcl nomad-deploy:/tmp/job.hcl + # render ${IMAGE_TAG} via envsubst, then cp into the nomad container + IMAGE_TAG="${{ github.sha }}" envsubst < deploy/nomad/contract-check.nomad.hcl > /tmp/job.hcl + + docker cp .ci-tls/ca.crt nomad-deploy:/tmp/ca.crt + docker cp /tmp/job.hcl nomad-deploy:/tmp/job.hcl docker start -a nomad-deploy rc=$? diff --git a/Makefile b/Makefile index 1889412..0e916ea 100644 --- a/Makefile +++ b/Makefile @@ -306,16 +306,16 @@ shell-bot: ## Open shell inside bot container # CLI env (NOMAD_ADDR/CACERT/TOKEN) is sourced from /root/.nomadrc on the VPS. # ───────────────────────────────────────────────────────────────────────────── NOMAD_JOB := deploy/nomad/contract-check.nomad.hcl -NOMAD_RUN := bash -c '. /root/.nomadrc 2>/dev/null; IMAGE_TAG=$${IMAGE_TAG:-manual} nomad "$$@"' -- +NOMAD_RUN := bash -c '. /root/.nomadrc 2>/dev/null; IMAGE_TAG=$${IMAGE_TAG:-manual} envsubst < $(NOMAD_JOB) | nomad "$$@"' -- nomad-validate: ## Validate the Nomad job file - @$(NOMAD_RUN) job validate $(NOMAD_JOB) + @$(NOMAD_RUN) job validate - nomad-plan: ## Dry-run diff of the next deployment - @$(NOMAD_RUN) job plan $(NOMAD_JOB) + @$(NOMAD_RUN) job plan - nomad-deploy: ## Deploy to Nomad (usage: IMAGE_TAG= make nomad-deploy) - @$(NOMAD_RUN) job run $(NOMAD_JOB) + @$(NOMAD_RUN) job run - nomad-status: ## Job status: groups, allocations, deployments @$(NOMAD_RUN) job status contract-check diff --git a/deploy/nomad/README.md b/deploy/nomad/README.md index 0550f0f..d6fc14e 100644 --- a/deploy/nomad/README.md +++ b/deploy/nomad/README.md @@ -273,13 +273,20 @@ ssh -L 4646:127.0.0.1:4646 ## 8. Everyday operations -First submission (the job file requires IMAGE_TAG — it is rendered by the -CLI at submit time; CI exports it automatically): +First submission (the job file uses `${IMAGE_TAG}` — rendered by `envsubst` +at submit time; CI does this automatically): ```bash -IMAGE_TAG= nomad job validate deploy/nomad/contract-check.nomad.hcl -IMAGE_TAG= nomad job plan deploy/nomad/contract-check.nomad.hcl -IMAGE_TAG= nomad job run deploy/nomad/contract-check.nomad.hcl +IMAGE_TAG= envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job validate - +IMAGE_TAG= envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job plan - +IMAGE_TAG= envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job run - +``` + +Or via Makefile (handles envsubst + nomad env automatically): +```bash +IMAGE_TAG= make nomad-validate +IMAGE_TAG= make nomad-plan +IMAGE_TAG= make nomad-deploy ``` ```bash diff --git a/deploy/nomad/contract-check.nomad.hcl b/deploy/nomad/contract-check.nomad.hcl index 8a48c2d..24b7972 100644 --- a/deploy/nomad/contract-check.nomad.hcl +++ b/deploy/nomad/contract-check.nomad.hcl @@ -6,11 +6,13 @@ # (15432/17379/5672/9000). The nginx edge cascade is unchanged. # # Secrets flow (nothing sensitive lives in this file): -# - registry creds + all app secrets → Nomad Variables at +# - app secrets + connection strings → Nomad Variables at # nomad/jobs/contract-check (see deploy/nomad/README.md §5), rendered -# agent-side into env / auth files by `template` blocks; -# - image tag is injected CLI-side at submit time: -# IMAGE_TAG= nomad job run deploy/nomad/contract-check.nomad.hcl +# agent-side into env by `template` blocks; +# - image tag + APP_VERSION use ${IMAGE_TAG}, rendered by `envsubst` at +# submit time: +# IMAGE_TAG= envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job run - +# - registry auth: host-level `docker login` on the VPS (README §5). # # First deploy: verify with `nomad job validate` + `nomad job plan`, then # cutover workers one by one (README / docs/DEPLOY.md §15). @@ -81,7 +83,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}" args = ["alembic", "upgrade", "head"] # registry auth: host-level `docker login` on the VPS (README §5) @@ -108,7 +110,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}" ports = ["http"] # registry auth: host-level `docker login` on the VPS (README §5) @@ -118,7 +120,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } # All connection strings + app secrets, agent-rendered from Nomad @@ -182,7 +184,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:${IMAGE_TAG}" # registry auth: host-level `docker login` on the VPS (README §5) } @@ -191,7 +193,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } template { @@ -241,7 +243,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:${IMAGE_TAG}" # registry auth: host-level `docker login` on the VPS (README §5) } @@ -250,7 +252,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } template { @@ -300,7 +302,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:${IMAGE_TAG}" # registry auth: host-level `docker login` on the VPS (README §5) } @@ -309,7 +311,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } template { @@ -358,7 +360,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:${IMAGE_TAG}" # registry auth: host-level `docker login` on the VPS (README §5) } @@ -367,7 +369,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } template { @@ -410,7 +412,7 @@ job "contract-check" { driver = "docker" config { - image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}" + image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:${IMAGE_TAG}" # registry auth: host-level `docker login` on the VPS (README §5) } @@ -419,7 +421,7 @@ job "contract-check" { ENV = "prod" LOG_LEVEL = "INFO" LOG_FORMAT = "json" - APP_VERSION = "{{ env \"IMAGE_TAG\" }}" + APP_VERSION = "${IMAGE_TAG}" } template {