Require TLS 1.3 on client-facing ports #180
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: deploy on staging-ipv4.testrun.org, and run tests | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| paths-ignore: | |
| - 'scripts/**' | |
| - '**/README.md' | |
| - 'CHANGELOG.md' | |
| - 'LICENSE' | |
| jobs: | |
| deploy: | |
| name: deploy on staging-ipv4.testrun.org, and run tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| concurrency: | |
| group: ci-ipv4-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ !contains(github.ref, '$GITHUB_REF') }} | |
| steps: | |
| - uses: jsok/serialize-workflow-action@v1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/checkout@v4 | |
| - name: prepare SSH | |
| run: | | |
| mkdir ~/.ssh | |
| echo "${{ secrets.STAGING_SSH_KEY }}" >> ~/.ssh/id_ed25519 | |
| chmod 600 ~/.ssh/id_ed25519 | |
| ssh-keyscan staging-ipv4.testrun.org > ~/.ssh/known_hosts | |
| # save previous acme & dkim state | |
| rsync -avz [email protected]:/var/lib/acme acme-ipv4 || true | |
| rsync -avz [email protected]:/etc/dkimkeys dkimkeys-ipv4 || true | |
| # store previous acme & dkim state on ns.testrun.org, if it contains useful certs | |
| if [ -f dkimkeys-ipv4/dkimkeys/opendkim.private ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" dkimkeys-ipv4 [email protected]:/tmp/ || true; fi | |
| if [ "$(ls -A acme-ipv4/acme/certs)" ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" acme-ipv4 [email protected]:/tmp/ || true; fi | |
| # make sure CAA record isn't set | |
| scp .github/workflows/staging-ipv4.testrun.org-default.zone [email protected]:/etc/nsd/staging-ipv4.testrun.org.zone | |
| ssh -o StrictHostKeyChecking=accept-new [email protected] sed -i '/CAA/d' /etc/nsd/staging-ipv4.testrun.org.zone | |
| ssh [email protected] nsd-checkzone staging-ipv4.testrun.org /etc/nsd/staging-ipv4.testrun.org.zone | |
| ssh [email protected] systemctl reload nsd | |
| - name: rebuild staging-ipv4.testrun.org to have a clean VPS | |
| run: | | |
| curl -X POST \ | |
| -H "Authorization: Bearer ${{ secrets.HETZNER_API_TOKEN }}" \ | |
| -H "Content-Type: application/json" \ | |
| -d '{"image":"debian-12"}' \ | |
| "https://api.hetzner.cloud/v1/servers/${{ secrets.STAGING_SERVER_ID }}/actions/rebuild" | |
| - run: scripts/initenv.sh | |
| - name: append venv/bin to PATH | |
| run: echo venv/bin >>$GITHUB_PATH | |
| - name: upload TLS cert after rebuilding | |
| run: | | |
| echo " --- wait until staging-ipv4.testrun.org VPS is rebuilt --- " | |
| rm ~/.ssh/known_hosts | |
| while ! ssh -o ConnectTimeout=180 -o StrictHostKeyChecking=accept-new -v [email protected] id -u ; do sleep 1 ; done | |
| ssh -o StrictHostKeyChecking=accept-new -v [email protected] id -u | |
| # download acme & dkim state from ns.testrun.org | |
| rsync -e "ssh -o StrictHostKeyChecking=accept-new" -avz [email protected]:/tmp/acme-ipv4 acme-restore || true | |
| rsync -avz [email protected]:/tmp/dkimkeys-ipv4 dkimkeys-restore || true | |
| # restore acme & dkim state to staging2.testrun.org | |
| rsync -avz acme-restore/acme-ipv4/acme [email protected]:/var/lib/ || true | |
| rsync -avz dkimkeys-restore/dkimkeys-ipv4/dkimkeys [email protected]:/etc/ || true | |
| ssh -o StrictHostKeyChecking=accept-new -v [email protected] chown root:root -R /var/lib/acme || true | |
| - name: run formatting checks | |
| run: cmdeploy fmt -v | |
| - name: run deploy-chatmail offline tests | |
| run: pytest --pyargs cmdeploy | |
| - run: | | |
| cmdeploy init staging-ipv4.testrun.org | |
| sed -i 's#disable_ipv6 = False#disable_ipv6 = True#' chatmail.ini | |
| - run: cmdeploy run | |
| - name: set DNS entries | |
| run: | | |
| ssh -o StrictHostKeyChecking=accept-new -v [email protected] chown opendkim:opendkim -R /etc/dkimkeys | |
| cmdeploy dns --zonefile staging-generated.zone | |
| cat staging-generated.zone >> .github/workflows/staging-ipv4.testrun.org-default.zone | |
| cat .github/workflows/staging-ipv4.testrun.org-default.zone | |
| scp .github/workflows/staging-ipv4.testrun.org-default.zone [email protected]:/etc/nsd/staging-ipv4.testrun.org.zone | |
| ssh [email protected] nsd-checkzone staging-ipv4.testrun.org /etc/nsd/staging-ipv4.testrun.org.zone | |
| ssh [email protected] systemctl reload nsd | |
| - name: cmdeploy test | |
| run: CHATMAIL_DOMAIN2=nine.testrun.org cmdeploy test --slow | |
| - name: cmdeploy dns | |
| run: cmdeploy dns -v | |