admin-git/DealDocumentScreening
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Deploy job was fixed. Workflow was fixed.
Some checks failed
ci / Lint & typecheck (push) Successful in 30s
Details
ci / Unit tests (push) Successful in 1m7s
Details
deploy / build-and-deploy (push) Failing after 2m12s
Details

Browse source
This commit is contained in:
febux 2026-09-14 02:28:43 +03:00
parent 605c0d68bd
commit 1ae14536e6
4 changed files with 41 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
.forgejo/workflows/deploy.yml
View file

@ -35,7 +35,7 @@ jobs:
steps:
- name: Checkout
run: |
apk add --no-cache git
apk add --no-cache git gettext
git init -q .
git remote add origin ${{ github.server_url }}/${{ github.repository }}.git
git fetch --depth 1 origin ${{ github.sha }}
@ -89,8 +89,11 @@ jobs:
--entrypoint /bin/nomad \
hashicorp/nomad:1.9 job run /tmp/job.hcl
# render ${IMAGE_TAG} via envsubst, then cp into the nomad container
IMAGE_TAG="${{ github.sha }}" envsubst < deploy/nomad/contract-check.nomad.hcl > /tmp/job.hcl
docker cp .ci-tls/ca.crt nomad-deploy:/tmp/ca.crt
docker cp deploy/nomad/contract-check.nomad.hcl nomad-deploy:/tmp/job.hcl
docker cp /tmp/job.hcl nomad-deploy:/tmp/job.hcl
docker start -a nomad-deploy
rc=$?

8
Makefile
View file

@ -306,16 +306,16 @@ shell-bot: ## Open shell inside bot container
# CLI env (NOMAD_ADDR/CACERT/TOKEN) is sourced from /root/.nomadrc on the VPS.
# ─────────────────────────────────────────────────────────────────────────────
NOMAD_JOB := deploy/nomad/contract-check.nomad.hcl
NOMAD_RUN := bash -c '. /root/.nomadrc 2>/dev/null; IMAGE_TAG=$${IMAGE_TAG:-manual} nomad "$$@"' --
NOMAD_RUN := bash -c '. /root/.nomadrc 2>/dev/null; IMAGE_TAG=$${IMAGE_TAG:-manual} envsubst < $(NOMAD_JOB) | nomad "$$@"' --
nomad-validate: ## Validate the Nomad job file
@$(NOMAD_RUN) job validate $(NOMAD_JOB)
@$(NOMAD_RUN) job validate -
nomad-plan: ## Dry-run diff of the next deployment
@$(NOMAD_RUN) job plan $(NOMAD_JOB)
@$(NOMAD_RUN) job plan -
nomad-deploy: ## Deploy to Nomad (usage: IMAGE_TAG=<git-sha> make nomad-deploy)
@$(NOMAD_RUN) job run $(NOMAD_JOB)
@$(NOMAD_RUN) job run -
nomad-status: ## Job status: groups, allocations, deployments
@$(NOMAD_RUN) job status contract-check

17
deploy/nomad/README.md
View file

@ -273,13 +273,20 @@ ssh -L 4646:127.0.0.1:4646 <vps>
## 8. Everyday operations
First submission (the job file requires IMAGE_TAG — it is rendered by the
CLI at submit time; CI exports it automatically):
First submission (the job file uses `${IMAGE_TAG}` — rendered by `envsubst`
at submit time; CI does this automatically):
```bash
IMAGE_TAG=<git-sha> nomad job validate deploy/nomad/contract-check.nomad.hcl
IMAGE_TAG=<git-sha> nomad job plan deploy/nomad/contract-check.nomad.hcl
IMAGE_TAG=<git-sha> nomad job run deploy/nomad/contract-check.nomad.hcl
IMAGE_TAG=<git-sha> envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job validate -
IMAGE_TAG=<git-sha> envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job plan -
IMAGE_TAG=<git-sha> envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job run -
```
Or via Makefile (handles envsubst + nomad env automatically):
```bash
IMAGE_TAG=<git-sha> make nomad-validate
IMAGE_TAG=<git-sha> make nomad-plan
IMAGE_TAG=<git-sha> make nomad-deploy
```
```bash

36
deploy/nomad/contract-check.nomad.hcl
View file

@ -6,11 +6,13 @@
# (15432/17379/5672/9000). The nginx edge cascade is unchanged.
#
# Secrets flow (nothing sensitive lives in this file):
# - registry creds + all app secrets → Nomad Variables at
# - app secrets + connection strings → Nomad Variables at
# nomad/jobs/contract-check (see deploy/nomad/README.md §5), rendered
# agent-side into env / auth files by `template` blocks;
# - image tag is injected CLI-side at submit time:
# IMAGE_TAG=<git-sha> nomad job run deploy/nomad/contract-check.nomad.hcl
# agent-side into env by `template` blocks;
# - image tag + APP_VERSION use ${IMAGE_TAG}, rendered by `envsubst` at
# submit time:
# IMAGE_TAG=<git-sha> envsubst < deploy/nomad/contract-check.nomad.hcl | nomad job run -
# - registry auth: host-level `docker login` on the VPS (README §5).
#
# First deploy: verify with `nomad job validate` + `nomad job plan`, then
# cutover workers one by one (README / docs/DEPLOY.md §15).
@ -81,7 +83,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}"
args = ["alembic", "upgrade", "head"]
# registry auth: host-level `docker login` on the VPS (README §5)
@ -108,7 +110,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-api:${IMAGE_TAG}"
ports = ["http"]
# registry auth: host-level `docker login` on the VPS (README §5)
@ -118,7 +120,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
# All connection strings + app secrets, agent-rendered from Nomad
@ -182,7 +184,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-extract:${IMAGE_TAG}"
# registry auth: host-level `docker login` on the VPS (README §5)
}
@ -191,7 +193,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
template {
@ -241,7 +243,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-analyze:${IMAGE_TAG}"
# registry auth: host-level `docker login` on the VPS (README §5)
}
@ -250,7 +252,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
template {
@ -300,7 +302,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-prescreen:${IMAGE_TAG}"
# registry auth: host-level `docker login` on the VPS (README §5)
}
@ -309,7 +311,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
template {
@ -358,7 +360,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-billing:${IMAGE_TAG}"
# registry auth: host-level `docker login` on the VPS (README §5)
}
@ -367,7 +369,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
template {
@ -410,7 +412,7 @@ job "contract-check" {
driver = "docker"
config {
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:{{ mustEnv \"IMAGE_TAG\" }}"
image = "p2gnl.mu-dungeon.xyz/admin-git/contract-check-worker-notify:${IMAGE_TAG}"
# registry auth: host-level `docker login` on the VPS (README §5)
}
@ -419,7 +421,7 @@ job "contract-check" {
ENV = "prod"
LOG_LEVEL = "INFO"
LOG_FORMAT = "json"
APP_VERSION = "{{ env \"IMAGE_TAG\" }}"
APP_VERSION = "${IMAGE_TAG}"
}
template {