ci(deploy): auto-deploy releases via self-hosted runners#130
Merged
Conversation
The images build on GitHub-hosted runners, but the deploy host is VPN-internal — GitHub cannot push in. Mirror the plexams pattern: a self-hosted runner ON the host polls GitHub outbound and rolls out each release locally. - docker.yml gains a gated `deploy` job (needs the build job, `if: vars.AUTO_DEPLOY == 'true'`, runs-on [self-hosted, glabs-deploy]): syncs the non-secret infra (docker-compose.yml + Caddyfile) into $DEPLOY_DIR, pins GLABS_WEB_TAG in .env, `docker compose pull glabs-web` + `up -d`, force-recreates caddy only if the Caddyfile changed. Secrets (.env, .glabs-web.yaml) and the caddy-data volume are never touched. - deploy/docker-compose.yml gains two gh-runner services under `profiles: [runner]` (one per repo — obcode is a personal account, so runners are repo-scoped; shared label glabs-deploy). The profile keeps them out of the default `up -d`, so a deploy never restarts the runner mid-job. - .env.example: DEPLOY_DIR + GH_RUNNER_PAT. README: "Automatischer Deploy" (one-time host setup, the AUTO_DEPLOY gate, rollback). The glabs.gui deploy job follows in that repo. Until AUTO_DEPLOY=true the image is still built & pushed; the deploy job is simply skipped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nachzug zu Milestone F: Auto-Deploy wie bei plexams. Die Images bauen auf GitHub-hosted Runnern (
docker.yml), aber der Deploy-Host ist VPN-intern — GitHub kommt nicht rein. Lösung: ein self-hosted Runner auf dem Host pollt ausgehend und rollt jeden Release lokal aus.Betrifft beide Repos; das ist der glabs-Teil (Backend-Deploy + Runner-Services + Doku). Der glabs.gui-Deploy-Job folgt separat in dem Repo.
Inhalt
docker.yml— neuer, gateddeploy-Job (needs: build-and-push-image,if: vars.AUTO_DEPLOY == 'true',runs-on: [self-hosted, glabs-deploy]): synct nicht-geheime Infra (docker-compose.yml+Caddyfile) nach$DEPLOY_DIR, pinntGLABS_WEB_TAGin.env,docker compose pull glabs-web+up -d, Caddy nur bei geändertem Caddyfile force-recreate. Secrets (.env,.glabs-web.yaml) +caddy-data-Volume bleiben unangetastet.deploy/docker-compose.yml— zweigh-runner-Services unterprofiles: [runner](je Repo einer — persönlicher Account → repo-scoped; gemeinsames Labelglabs-deploy). Das Profil hält sie aus dem Default-up -draus → ein Deploy startet den Runner nie mitten im eigenen Job neu..env.example—DEPLOY_DIR+GH_RUNNER_PAT. README — Abschnitt „Automatischer Deploy" (einmaliges Host-Setup,AUTO_DEPLOY-Gate, Rollback).Verifikation
docker compose config: Default-Stack ohne Runner (5 Services), Profilrunnerfügtgh-runner+gh-runner-guihinzu;DEPLOY_DIR-Bind-Mount auf beiden Seiten identisch (/home/glabs/glabs/deploy).actionlint: nur die erwartete Info „unbekanntes self-hosted-Labelglabs-deploy" (Custom-Label, wie plexams'plexams-deploy) — kein Fehler.AUTO_DEPLOY=truefahrbar (per Design).ci:-Titel → kein Release-Bump.🤖 Generated with Claude Code