69 lines
2.9 KiB
YAML
69 lines
2.9 KiB
YAML
steps:
|
|
- name: ssh-test
|
|
image: google/cloud-sdk:latest
|
|
entrypoint:
|
|
- bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
|
|
mkdir -p ~/.ssh
|
|
|
|
# ── Inject known-hosts and SSH key ───────────────────────────────
|
|
gcloud secrets versions access latest \
|
|
--secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
|
|
| base64 -d > ~/.ssh/known_hosts
|
|
chmod 644 ~/.ssh/known_hosts
|
|
|
|
gcloud secrets versions access latest \
|
|
--secret=STAGING_SSH_KEY --project=aptivaai-dev \
|
|
| base64 -d > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
|
|
echo "🔑 SSH prerequisites installed"
|
|
|
|
# ── SSH into staging and deploy ──────────────────────────────────
|
|
ssh -o StrictHostKeyChecking=yes \
|
|
-i ~/.ssh/id_ed25519 \
|
|
jcoakley@10.128.0.12 \
|
|
'set -euo pipefail; \
|
|
cd /home/jcoakley/aptiva-staging-app; \
|
|
|
|
# ── Pull canonical IMG_TAG ────────────────────────────────
|
|
IMG_TAG=$(gcloud secrets versions access latest \
|
|
--secret=IMG_TAG --project=aptivaai-dev); \
|
|
export IMG_TAG; \
|
|
echo "📦 IMG_TAG=$IMG_TAG"; \
|
|
|
|
# ── Inject sensitive secrets runtime-only ─────────────────
|
|
ENV=staging; \
|
|
PROJECT=aptivaai-dev; \
|
|
SECRETS=( \
|
|
JWT_SECRET OPENAI_API_KEY ONET_USERNAME ONET_PASSWORD \
|
|
STRIPE_SECRET_KEY STRIPE_PUBLISHABLE_KEY STRIPE_WH_SECRET \
|
|
STRIPE_PRICE_PREMIUM_MONTH STRIPE_PRICE_PREMIUM_YEAR \
|
|
STRIPE_PRICE_PRO_MONTH STRIPE_PRICE_PRO_YEAR \
|
|
DB_HOST DB_PORT DB_USER DB_PASSWORD \
|
|
TWILIO_ACCOUNT_SID TWILIO_AUTH_TOKEN TWILIO_MESSAGING_SERVICE_SID \
|
|
); \
|
|
for S in "${SECRETS[@]}"; do \
|
|
export "$S"="$(gcloud secrets versions access latest \
|
|
--secret="${S}_${ENV}" --project="$PROJECT")"; \
|
|
done; \
|
|
export FROM_SECRETS_MANAGER=true; \
|
|
|
|
# ── Compose with env preserved ────────────────────────────
|
|
preserve=IMG_TAG,FROM_SECRETS_MANAGER,$(IFS=,; echo "${SECRETS[*]}"); \
|
|
echo "🚀 docker compose up with envs: $preserve"; \
|
|
sudo --preserve-env="$preserve" docker compose pull; \
|
|
sudo --preserve-env="$preserve" docker compose up -d --force-recreate --remove-orphans; \
|
|
echo "✅ Staging stack refreshed with tag $IMG_TAG"'
|
|
|
|
secrets:
|
|
- STAGING_SSH_KEY
|
|
- STAGING_KNOWN_HOSTS
|
|
|
|
when:
|
|
event:
|
|
- push
|