deploy.yml

name: Deploy

on:
  push:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    environment: production
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    outputs:
      image-tags: ${{ steps.meta.outputs.tags }}
      image-labels: ${{ steps.meta.outputs.labels }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the Container registry
        uses: docker/[email protected]
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/[email protected]
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}
      - name: Build and push Docker image
        id: push
        uses: docker/[email protected]
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    strategy:
      matrix:
        include:
          - region: eu
            host: 188.245.54.0
          - region: us-west
            host: 5.78.70.0
          - region: us-east
            host: 5.161.207.0
          - region: ap-south
            host: 5.223.45.0
    steps:
      - uses: actions/checkout@v4

      - uses: docker/[email protected]
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup SSH keys
        uses: webfactory/[email protected]
        with:
          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

      - name: Setup SSH config
        run: |
          ssh-keyscan -H ${{ matrix.host }} >> ~/.ssh/known_hosts

      - name: Deploy to ${{ matrix.region }}
        env:
          PORT: ${{ vars.PORT }}
          ORIGIN: ${{ vars.ORIGIN }}
          BODY_SIZE_LIMIT: ${{ vars.BODY_SIZE_LIMIT }}
          IMGPROXY_HOST: ${{ vars.IMGPROXY_HOST }}
          PUBLIC_CDN_URL: ${{ vars.PUBLIC_CDN_URL }}
          S3_BUCKET: ${{ vars.S3_BUCKET }}
          S3_ENDPOINT: ${{ vars.S3_ENDPOINT }}
          S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
          S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
          AUTH_RESEND_KEY: ${{ secrets.AUTH_RESEND_KEY }}
          AUTH_GITHUB_ID: ${{ secrets.AUTH_GITHUB_ID }}
          AUTH_GITHUB_SECRET: ${{ secrets.AUTH_GITHUB_SECRET }}
          IMGPROXY_SIGNATURE: ${{ secrets.IMGPROXY_SIGNATURE }}
          STRIPE_KEY: ${{ secrets.STRIPE_KEY }}
          STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }}
          AI21_API_KEY: ${{ secrets.AI21_API_KEY }}
          REDIS_URL: ${{ secrets.REDIS_URL }}
          IMAGE_TAG: sha-${{ github.sha }}
        run: |
          docker context create ${{ matrix.region }} --docker "host=ssh://root@${{ matrix.host }}"

          REGION=${{ matrix.region }} docker \
            --context ${{ matrix.region }} \
            stack deploy \
            --with-registry-auth \
            --prune \
            --detach=false \
            --compose-file=compose.yml \
            --compose-file=infra/compose.${{ matrix.region }}.yml \
            "inhalt-${{ matrix.region }}"