74 lines
2.6 KiB
YAML
74 lines
2.6 KiB
YAML
---
|
||
kind: pipeline
|
||
type: docker
|
||
name: ssh-test
|
||
|
||
steps:
|
||
- name: ssh-test
|
||
image: google/cloud-sdk:latest
|
||
entrypoint:
|
||
- bash
|
||
- -c
|
||
- |
|
||
set -euo pipefail
|
||
|
||
mkdir -p ~/.ssh
|
||
|
||
# ── Inject known-hosts and SSH key ───────────────────────────────
|
||
gcloud secrets versions access latest \
|
||
--secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
|
||
| base64 -d > ~/.ssh/known_hosts
|
||
chmod 644 ~/.ssh/known_hosts
|
||
|
||
gcloud secrets versions access latest \
|
||
--secret=STAGING_SSH_KEY --project=aptivaai-dev \
|
||
| base64 -d > ~/.ssh/id_ed25519
|
||
chmod 600 ~/.ssh/id_ed25519
|
||
|
||
echo "🔑 SSH prerequisites installed"
|
||
|
||
# ── SSH into staging and deploy ──────────────────────────────────
|
||
ssh -o StrictHostKeyChecking=yes \
|
||
-i ~/.ssh/id_ed25519 \
|
||
jcoakley@10.128.0.12 \
|
||
'set -euo pipefail
|
||
PROJECT=aptivaai-dev
|
||
ENV=staging # ← or “dev”, “prod”, etc.
|
||
IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=$PROJECT)
|
||
export IMG_TAG
|
||
|
||
# pull every secret in the SECRETS array
|
||
declare -a SECRETS=(
|
||
JWT_SECRET OPENAI_API_KEY ONET_USERNAME ONET_PASSWORD
|
||
STRIPE_SECRET_KEY STRIPE_PUBLISHABLE_KEY STRIPE_WH_SECRET
|
||
STRIPE_PRICE_PREMIUM_MONTH STRIPE_PRICE_PREMIUM_YEAR
|
||
STRIPE_PRICE_PRO_MONTH STRIPE_PRICE_PRO_YEAR
|
||
DB_HOST DB_NAME DB_PORT DB_USER DB_PASSWORD
|
||
DB_SSL_CERT DB_SSL_KEY DB_SSL_CA
|
||
TWILIO_ACCOUNT_SID TWILIO_AUTH_TOKEN TWILIO_MESSAGING_SERVICE_SID
|
||
KMS_KEY_NAME DEK_PATH
|
||
)
|
||
for S in "${SECRETS[@]}"; do
|
||
# no quotes on the left‑hand side
|
||
export ${S}="$(gcloud secrets versions access latest \
|
||
--secret="${S}_${ENV}" --project="$PROJECT")"
|
||
done
|
||
export FROM_SECRETS_MANAGER=true
|
||
|
||
cd /home/jcoakley/aptiva-staging-app
|
||
# build the --preserve-env list dynamically so new vars flow through
|
||
preserve=$(IFS=,; echo IMG_TAG,FROM_SECRETS_MANAGER,${SECRETS[*]})
|
||
sudo --preserve-env="$preserve" docker compose pull
|
||
sudo --preserve-env="$preserve" docker compose up -d --force-recreate --remove-orphans
|
||
|
||
echo "✅ Staging stack refreshed with tag $IMG_TAG"
|
||
'
|
||
|
||
secrets:
|
||
- STAGING_SSH_KEY
|
||
- STAGING_KNOWN_HOSTS
|
||
|
||
when:
|
||
event:
|
||
- push
|