diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..43f743f --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,28 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + branches: [main] + +jobs: + test: + name: Typecheck and test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v4 + with: + node-version: '20' + cache: npm + + - name: Install + run: npm ci + + - name: Typecheck + run: npm run typecheck + + - name: Test + run: npm test diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml new file mode 100644 index 0000000..9f3eeb6 --- /dev/null +++ b/.gitea/workflows/deploy.yml @@ -0,0 +1,67 @@ +name: Deploy + +on: + push: + branches: [main] + workflow_dispatch: + +concurrency: + group: deploy-telegram-relay + cancel-in-progress: true + +jobs: + test: + name: Typecheck and test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v4 + with: + node-version: '20' + cache: npm + + - run: npm ci + - run: npm run typecheck + - run: npm test + + deploy: + name: Deploy to VPS + needs: test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Deploy over SSH + env: + SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + VPS_HOST: ${{ secrets.VPS_HOST }} + VPS_USER: ${{ secrets.VPS_USER }} + run: | + set -euo pipefail + test -n "${SSH_KEY:-}" + test -n "${VPS_HOST:-}" + test -n "${VPS_USER:-}" + + sudo apt-get update -qq + sudo apt-get install -y -qq rsync openssh-client + + install -m 700 -d "$HOME/.ssh" + printf '%s\n' "$SSH_KEY" > "$HOME/.ssh/deploy_key" + chmod 600 "$HOME/.ssh/deploy_key" + + SSH=(ssh -i "$HOME/.ssh/deploy_key" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new) + + "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" 'install -d -m 0750 /opt/ghabilee-telegram-relay' + rsync -az --delete \ + -e "ssh -i $HOME/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" \ + --exclude '.git' \ + --exclude 'node_modules' \ + --exclude 'dist' \ + --exclude '.env' \ + ./ "${VPS_USER}@${VPS_HOST}:/opt/ghabilee-telegram-relay/" + + "${SSH[@]}" "${VPS_USER}@${VPS_HOST}" \ + 'chmod +x /opt/ghabilee-telegram-relay/scripts/deploy-on-vps.sh && APP_DIR=/opt/ghabilee-telegram-relay /opt/ghabilee-telegram-relay/scripts/deploy-on-vps.sh' + + rm -f "$HOME/.ssh/deploy_key" diff --git a/README.md b/README.md index 3bdcaa4..8ff580c 100644 --- a/README.md +++ b/README.md @@ -76,6 +76,26 @@ cp .env.example .env docker compose up -d --build ``` +## CI/CD (Gitea Actions) + +On push to `main`: + +1. `.gitea/workflows/ci.yml` — typecheck + tests +2. `.gitea/workflows/deploy.yml` — rsync to VPS + `scripts/deploy-on-vps.sh` + +Repo Actions secrets (Settings → Actions → Secrets): + +| Secret | Value | +| ------ | ----- | +| `DEPLOY_SSH_KEY` | private key that can SSH as `root` on the VPS | +| `VPS_HOST` | `65.108.18.151` (public IP; job runs in Docker) | +| `VPS_USER` | `root` | + +Production app dir: `/opt/ghabilee-telegram-relay` +Nginx host: `telegram-relay.ghabilee.ir` (add DNS A record, then `certbot --nginx -d telegram-relay.ghabilee.ir`) + +Gitea git SSH uses port **222**: `ssh://git@git.ghabilee.ir:222/AliSaZa/telegrambot.git` + ## Env See [`.env.example`](.env.example). Production needs: diff --git a/deploy/docker-compose.production.yml b/deploy/docker-compose.production.yml new file mode 100644 index 0000000..6829d4d --- /dev/null +++ b/deploy/docker-compose.production.yml @@ -0,0 +1,24 @@ +services: + telegram-relay: + build: + context: . + dockerfile: Dockerfile + container_name: ghabilee-telegram-relay + restart: unless-stopped + env_file: + - .env + ports: + # Only localhost — Nginx terminates TLS in front. + - '127.0.0.1:3100:3100' + healthcheck: + test: + [ + 'CMD', + 'node', + '-e', + "fetch('http://127.0.0.1:3100/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))", + ] + interval: 30s + timeout: 5s + retries: 3 + start_period: 15s diff --git a/deploy/nginx/telegram-relay.conf b/deploy/nginx/telegram-relay.conf new file mode 100644 index 0000000..15f3a63 --- /dev/null +++ b/deploy/nginx/telegram-relay.conf @@ -0,0 +1,18 @@ +# Telegram relay — TLS terminated by Nginx, app on 127.0.0.1:3100 +# DNS: point this hostname at 65.108.18.151, then: +# certbot --nginx -d telegram-relay.ghabilee.ir + +server { + listen 80; + listen [::]:80; + server_name telegram-relay.ghabilee.ir; + + location / { + proxy_pass http://127.0.0.1:3100; + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } +} diff --git a/scripts/deploy-on-vps.sh b/scripts/deploy-on-vps.sh new file mode 100755 index 0000000..2ffa86d --- /dev/null +++ b/scripts/deploy-on-vps.sh @@ -0,0 +1,43 @@ +#!/usr/bin/env bash +# Deploy telegram relay on the VPS (idempotent). +# Expects app files already present in APP_DIR (CI rsync or prior clone). +set -euo pipefail + +APP_DIR="${APP_DIR:-/opt/ghabilee-telegram-relay}" + +cd "$APP_DIR" + +install -m 0644 deploy/docker-compose.production.yml "$APP_DIR/docker-compose.yml" + +if [ ! -f "$APP_DIR/.env" ]; then + echo "Missing $APP_DIR/.env — copy from .env.example and fill secrets before serving traffic." >&2 + cp .env.example "$APP_DIR/.env" + chmod 600 "$APP_DIR/.env" + echo "Created placeholder .env; edit it, then re-run deploy." >&2 + exit 2 +fi + +docker compose -f "$APP_DIR/docker-compose.yml" build --pull +docker compose -f "$APP_DIR/docker-compose.yml" up -d --remove-orphans + +install -m 0644 deploy/nginx/telegram-relay.conf /etc/nginx/sites-available/telegram-relay +ln -sfn /etc/nginx/sites-available/telegram-relay /etc/nginx/sites-enabled/telegram-relay +nginx -t +systemctl reload nginx + +for attempt in $(seq 1 30); do + health="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' ghabilee-telegram-relay 2>/dev/null || echo missing)" + echo "health ${attempt}/30: ${health}" + if [ "$health" = "healthy" ] || [ "$health" = "running" ]; then + curl -sf "http://127.0.0.1:3100/health" >/dev/null + echo "Deploy OK" + exit 0 + fi + case "$health" in + unhealthy|exited|dead|missing) exit 1 ;; + esac + sleep 2 +done + +echo "Timed out waiting for healthy container" >&2 +exit 1