wangjia
1a346c32c1
deploy-pangolin / deploy (push) Has been cancelled
- edge: 容器化 nginx 接管 80/443,逐字移植现网 vhost(blog/jiu/marzban/pay)+ stream SNI 分流 - singbox: Hysteria2(host 网络,UDP 443) - certbot: DNS-01(Cloudflare)续期,容器化 - xray: REALITY 仅 profile newnode(本台沿用 Marzban) - deploy.sh 幂等且切换感知;cutover.sh 一次性停宿主 nginx 切容器(可秒级回滚) - 弃用方案A 的 host nginx-apply/sudoers/root-setup - 部署目录改 ~/pangolin(免 root);CI 注入 CF_API_TOKEN EC2 实测:edge nginx -t 通过(真实证书)、compose 校验通过 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
name: deploy-pangolin
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'deploy/**'
|
|
- '.gitea/workflows/deploy.yml'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
deploy:
|
|
# ⚠️ 改成你 NAS 上 act_runner 的实际 label(Gitea→Settings→Actions→Runners)
|
|
runs-on: nas
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Ensure ssh/rsync
|
|
run: |
|
|
if ! command -v rsync >/dev/null || ! command -v ssh >/dev/null; then
|
|
(command -v apt-get >/dev/null && apt-get update -y && apt-get install -y openssh-client rsync) \
|
|
|| (command -v apk >/dev/null && apk add --no-cache openssh-client rsync)
|
|
fi
|
|
|
|
- name: SSH 私钥(指向 EC2)
|
|
run: |
|
|
mkdir -p ~/.ssh && chmod 700 ~/.ssh
|
|
printf '%s\n' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2_key
|
|
chmod 600 ~/.ssh/ec2_key
|
|
ssh-keyscan -H "${{ secrets.EC2_HOST }}" >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
|
|
- name: 同步 deploy/ 到 EC2(保留 secrets)
|
|
run: |
|
|
rsync -az \
|
|
--exclude 'secrets' \
|
|
--exclude 'singbox/config.json' \
|
|
--exclude 'xray/config.json' \
|
|
-e "ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new" \
|
|
deploy/ "${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:pangolin/"
|
|
|
|
- name: 远程部署(免 root,幂等)
|
|
run: |
|
|
ssh -i ~/.ssh/ec2_key -o StrictHostKeyChecking=accept-new \
|
|
"${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}" \
|
|
"export CF_API_TOKEN='${{ secrets.CF_API_TOKEN }}'; cd ~/pangolin && chmod +x scripts/*.sh && ./scripts/deploy.sh"
|