blob: 1a67bcaf30cdd8d85116d45cbc7ffa331a1fc79b (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
name: infra
on:
workflow_call:
inputs:
limit:
description: 'Ansible hosts'
type: string
default: all
required: false
workflow_dispatch:
inputs:
limit:
description: 'Ansible hosts'
type: string
default: all
required: false
jobs:
maintenance:
runs-on: ubuntu-latest
env:
AWS_ACCESS_KEY_ID: '${{ secrets.AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '${{ secrets.AWS_SECRET_ACCESS_KEY }}'
DIGITALOCEAN_TOKEN: '${{ secrets.DIGITALOCEAN_TOKEN }}'
YC_SERVICE_ACCOUNT_KEY_FILE: '${{ secrets.YC_SERVICE_ACCOUNT_KEY_FILE }}'
steps:
- name: Set up Terraform
uses: hashicorp/setup-terraform@v4
- name: Configure SSH
run: |
mkdir -p ~/.ssh
cat > ~/.ssh/config <<'EOF'
StrictHostKeyChecking no
EOF
- name: Set up ssh-agent
uses: webfactory/ssh-agent@v0.10.0
with:
ssh-private-key: '${{ secrets.SSH_KEY }}'
- name: Checkout
run: |
git clone -q ssh://git@bitbucket.org/egor-tensin/infra.git
- name: Configure git
run: |
git config --global user.name 'Egor Tensin'
git config --global user.email 'egor@tensin.name'
- name: Run maintenance
run: |
make -C infra maintenance 'LIMIT=${{ inputs.limit }}'
- name: Set up WireGuard
uses: egor-tensin/setup-wireguard@v1
with:
endpoint: '${{ secrets.WG_ENDPOINT }}'
endpoint_public_key: '${{ secrets.WG_ENDPOINT_PUBLIC }}'
ips: '${{ secrets.WG_IPS }}'
allowed_ips: '${{ secrets.WG_ALLOWED_IPS }}'
private_key: '${{ secrets.WG_PRIVATE }}'
preshared_key: '${{ secrets.WG_PRESHARED }}'
- name: Install dependencies
run: |
sudo apt-get update
sudo DEBIAN_FRONTEND=noninteractive apt-get install -yq --no-install-recommends nmap
- name: Check ports
run: |
sudo ./infra/utils/check_ports.py
|
