byrsapty
eb6225f2f8
- step_compose_files() now uses GRAYLOG_ADMIN_PASSWORD as the actual admin password on a fresh install if set, instead of always generating a random one. Solves the CI secret-staleness problem at the root: pin a password once and it's correct both at creation time and on every later re-run, instead of a fresh install randomly generating a password the stored secret then has to be manually kept in sync with. - deploy-from-scratch.yml gained a `cores` workflow_dispatch input (default 4), passed through to create-graylog-lxc.sh's --cores flag. Only takes effect when the container is actually created fresh, same as every other --cores usage in this project. - Documented both in README.md/README.uk.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
name: Deploy Graylog from scratch (host-level)
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
cores:
|
|
description: 'CPU cores for the container (only takes effect when creating it fresh - a no-op on an already-existing container)'
|
|
required: false
|
|
default: '4'
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: proxmox-host
|
|
steps:
|
|
# No actions/checkout: same reasoning as deploy.yml - this runner has
|
|
# no Node.js and shouldn't need one just for CI checkout.
|
|
#
|
|
# Destroying the existing container (pct destroy) is deliberately NOT
|
|
# part of this workflow - that stays a manual, deliberate step run by
|
|
# a human on the Proxmox host. This workflow only re-runs the
|
|
# idempotent create+install path, safe to trigger any time: if VMID
|
|
# 200 already exists it just repairs/updates it in place; if it was
|
|
# destroyed manually beforehand, this recreates it from scratch.
|
|
- name: Deploy from scratch
|
|
env:
|
|
CI_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
DISCORD_WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
|
|
# Only used on a re-run after the one-time credentials file was
|
|
# already consumed by an earlier successful run (fresh installs
|
|
# generate their own password and don't need this). Without it,
|
|
# a repeat run of this workflow against an already-initialized
|
|
# Graylog dies at resolve_admin_password with "Cannot find admin
|
|
# password" - confirmed live.
|
|
GRAYLOG_ADMIN_PASSWORD: ${{ secrets.GRAYLOG_ADMIN_PASSWORD }}
|
|
CORES: ${{ inputs.cores }}
|
|
run: |
|
|
rm -rf /tmp/graylog-deploy-ci-host
|
|
git clone --depth 1 --branch main "https://x-access-token:${CI_TOKEN}@git.zotac.keenetic.link/zotac/graylog-deploy.git" /tmp/graylog-deploy-ci-host
|
|
cd /tmp/graylog-deploy-ci-host
|
|
chmod +x create-graylog-lxc.sh
|
|
./create-graylog-lxc.sh \
|
|
--vmid 200 \
|
|
--ip 10.254.254.202/24 \
|
|
--gw 10.254.254.235 \
|
|
--vlan 1254 \
|
|
--disk 50 \
|
|
--cores "$CORES" \
|
|
--template-storage local-btrfs \
|
|
--rootfs-storage EX-Ceph \
|
|
--external-uri http://93.171.241.5:9000/ \
|
|
--discord-webhook "$DISCORD_WEBHOOK_URL"
|