blob: 98b3b1d81c12727c165a552b37849858a03b5772 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
name: Deploy infrastructure
on:
push:
branches: [main]
workflow_dispatch:
jobs:
ci:
uses: ./.github/workflows/ci.yaml
secrets: inherit
nixos:
needs: ci
name: Deploy NixOS systems
runs-on: ubuntu-latest
concurrency:
group: deploy
cancel-in-progress: true
steps:
- uses: actions/checkout@v4
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v9
- name: Setup local Nix cache
uses: DeterminateSystems/magic-nix-cache-action@v2
- name: Connect to Tailscale
uses: tailscale/github-action@v2
with:
oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
tags: tag:gha
- name: Copy known_hosts
run: |
set -eux
[ ! -d ~/.ssh ] && mkdir -p ~/.ssh
cp .known_hosts ~/.ssh/known_hosts
- name: Run deploy
run: |
nix develop --accept-flake-config \
--command deploy
opentofu:
needs: nixos
name: Apply OpenTofu plan
runs-on: ubuntu-latest
concurrency:
group: tofu
cancel-in-progress: true
steps:
- uses: actions/checkout@v4
- name: Install Nix
uses: DeterminateSystems/nix-installer-action@v9
- name: Setup local Nix cache
uses: DeterminateSystems/magic-nix-cache-action@v2
- name: Setup OpenTofu cache
uses: terraform-cache/terraform-cache@v1
- name: Authenticate with TF Cloud
run: |
dir="$HOME/.terraform.d"
[ ! -d "$dir" ] && mkdir -p "$dir"
cat > "$dir"/credentials.tfrc.json << EOF
{
"credentials": {
"app.terraform.io": {
"token": "${{ secrets.TF_API_TOKEN }}"
}
}
}
EOF
- name: Generate configuration
run: nix run .#gen-tf
- name: Init workspace
run: |
nix develop --accept-flake-config \
--command tofu init
- name: Validate plan
run: |
nix develop --accept-flake-config \
--command tofu validate
- name: Apply
run: |
nix develop --accept-flake-config \
--command tofu apply -auto-approve
|
