Files
ermnvldmr.com/.github/workflows/services-docs-next-required.yml
T
deytenit 710873e72c feat(infra): add K3s GitOps infrastructure and Packer golden image build (#25)
### Summary of Changes

This PR introduces a declarative, GitOps-managed cloud infrastructure
for the monorepo using K3s, Flux v2, and HashiCorp Packer:

1. **Packer Golden Image Builder (`ci/packer/`)**:
- Automated Debian 12 minimal base OS image creation using QEMU builder,
UEFI firmware, GPT partition scheme, and 2M cluster size `.qcow2`
conversion.
- Cloud-init, `virtio` kernel drivers, and serial console (`ttyS0`,
115200 baud).
- Pre-installed K3s binary (`v1.31.2+k3s1`) with isolated first-boot
token and cert generation.
   - Full identity sanitization (`machine-id` and SSH host key resets).

2. **First-Boot Cloud-Init Bootstrapping
(`ci/cloud-init/user-data.yaml`)**:
- Configures K3s with `servicelb` disabled and TLS SANs for custom
domains and static IP.
- Waits for API readiness, initializes `flux-system` namespace, injects
`sops-age` secret, and triggers Flux sync.

3. **SOPS & GitOps Root Orchestration (`.sops.yaml`,
`ci/k8s/clusters/production/`)**:
- SOPS encryption configuration targeting Kubernetes secrets with `age`
key recipient.
- Flux v2 `GitRepository` and `Kustomization` manifests tracking `next`.

4. **Infrastructure & Networking (`ci/k8s/base/`,
`ci/k8s/infrastructure/`)**:
   - Dedicated `com-ermnvldmr` namespace.
- `cert-manager` HTTP-01 `ClusterIssuer` (`letsencrypt-prod` &
`letsencrypt-staging`).
- Traefik Ingress routing for `ermnvldmr.com`, `www.ermnvldmr.com`,
`docs.ermnvldmr.com`, and `analytics.ermnvldmr.com`.

5. **PostgreSQL & Applications (`ci/k8s/apps/`)**:
- PostgreSQL 16 StatefulSet on 5Gi `local-path` persistent storage with
low-memory tuning.
- Deployments for `www` (pinned `sha-6d33b71`), `docs` (pinned
`sha-91f5245`), and `umami` (pinned `postgresql-v2.14.0`) with
zero-downtime rolling update strategy.

6. **CI/CD Workflows (`.github/workflows/`)**:
- `ci - next/build-golden-image`: Workflow to build and upload
`com-ermnvldmr-debian-12-k3s-amd64-<tag>.qcow2` to static S3
`/dev/images/`.
- Updated `services-www-releases-dispatch-release.yml` and
`services-docs-next-required.yml` with GitOps deployment steps.
2026-08-23 02:11:54 +03:00

116 lines
2.7 KiB
YAML

name: services/docs - next/required
on:
push:
branches: [next]
paths:
- 'services/docs/**'
concurrency:
group: ci-docs-${{ github.ref_name }}
cancel-in-progress: true
permissions:
contents: read
actions: read
jobs:
setup-hugo:
name: Setup - Hugo
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: recursive
fetch-depth: 0
- name: Setup Hugo
uses: peaceiris/actions-hugo@v2
with:
hugo-version: 'latest'
extended: true
build-hugo:
name: Build - Hugo Site
needs: setup-hugo
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: recursive
fetch-depth: 0
- name: Setup Hugo
uses: peaceiris/actions-hugo@v2
with:
hugo-version: 'latest'
extended: true
- name: Build Hugo site
working-directory: services/docs
run: hugo --gc --minify
release-docker:
name: Release - Docker Image
needs: build-hugo
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
submodules: recursive
- name: Log in to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ghcr.io/${{ github.repository }}/docs
tags: |
type=raw,value=latest
type=sha,format=short
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
file: ci/docker/docs/Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
deploy:
name: Deploy - Kubernetes (GitOps)
needs: release-docker
runs-on: ubuntu-latest
if: github.event_name == 'push' && github.ref == 'refs/heads/next'
permissions:
contents: write
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
ref: next
token: ${{ secrets.GITHUB_TOKEN }}
- name: Setup Kustomize
uses: imranismail/setup-kustomize@v2
with:
kustomize-version: "5.3.0"
- name: Deploy via GitOps
run: |
DOCS_TAG="sha-$(echo ${{ github.sha }} | cut -c1-7)"
bash ci/scripts/deploy-gitops.sh docs "${DOCS_TAG}"