deploy.yaml

name: Deploy

concurrency:
  group: production

on:
  workflow_dispatch:

jobs:
  deployment:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://pix.cloud.ut.ee/
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          submodules: true

      - name: Set up Ansible
        run: |
          sudo apt-get update
          sudo apt-get install --only-upgrade openssl
          sudo apt-get install -y python3-pip
          pip3 install -U pip ansible pyyaml
          ansible --version
          docker --version

      - name: Set known hosts
        id: known_hosts
        run: |
          ssh-keyscan -t ed25519 193.40.11.243 > $GITHUB_OUTPUT
          ssh-keyscan -t ed25519 193.40.11.123 >> $GITHUB_OUTPUT
          ssh-keyscan -t ed25519 193.40.11.119 >> $GITHUB_OUTPUT

      - name: Install SSH key
        uses: shimataro/ssh-key-action@v2
        env:
          KNOWN_HOSTS: ${{ join(steps.known_hosts.outputs.*, '\n') }}
        with:
          key: "${{ secrets.PIX_SSH_KEY }}"
          name: "pix"
          known_hosts: ${{ env.KNOWN_HOSTS }}
          config: |
            Host pix.cloud.ut.ee
              HostName 193.40.11.243
              User ubuntu
              IdentityFile ~/.ssh/pix

            Host pix-w1.cloud.ut.ee
                HostName 193.40.11.123 
                User ubuntu
                IdentityFile ~/.ssh/pix

            Host pix-w2.cloud.ut.ee
                HostName 193.40.11.119
                User ubuntu
                IdentityFile ~/.ssh/pix

      - name: Unpack secrets to "./secrets/"
        run: |
          echo "${{ secrets.SECRETS_TAR_GZ_B64 }}" | base64 -d | tar xz

      - name: Deploy with Ansible
        run: |
          ansible-playbook -i ansible/hosts.yaml --private-key ~/.ssh/pix ansible/deploy.yaml