syntaxbullet/minabot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: use reliable HTTPS transport for Gitea sync

Browse Source
This commit is contained in:
syntaxbullet
2026-09-07 13:01:32 +02:00
parent b20af6d95c
commit 2598a5b350
3 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
deploy/README.md
View File

@@ -1,6 +1,6 @@
# Automatic production deployment
The server checks `git@git.ayau.me:syntaxbullet/minabot.git`, branch `main`, every
The server checks `https://git.ayau.me/syntaxbullet/minabot.git`, branch `main`, every
minute after the last check finishes. A local commit is deployed after it is
pushed to Gitea. Other branches are not deployed. If several commits arrive
between checks, the latest fetched main commit is built.
@@ -9,9 +9,12 @@ between checks, the latest fetched main commit is built.
git push origin main
```
The server uses a repository-only read key under `/opt/minabot/git-auth`, registered
as `minabot-production-read-only` in Gitea. The personal Mac SSH key is not copied
to the server. Host verification uses the existing trusted Gitea host keys.
The repository is public, so the server fetches over HTTPS without credentials.
Gitea's SSH transport disconnected during transfer, so this checkout also pushes
over HTTPS. Its repository-local credential helper reads the existing `ayau` Tea
login only for this exact HTTPS host/repository; it stores no additional token copy.
The personal Mac SSH key and Tea token are not copied to the server. If the repository
becomes private, provision repository-scoped read credentials before the change.
The pipeline fetches into a bare repository and archives an exact commit into
`/opt/minabot/releases/<sha>`. It builds a test image, runs typecheck and the full

4
deploy/deploy.sh
View File

@@ -6,7 +6,7 @@ root=${MINABOT_DEPLOY_ROOT:-/opt/minabot}
cd "$root"
exec 9>deploy.lock
flock -n 9 || exit 0
export GIT_SSH_COMMAND="ssh -i $root/git-auth/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$root/git-auth/known_hosts -o ConnectTimeout=10 -o ServerAliveInterval=15 -o ServerAliveCountMax=2"
export GIT_TERMINAL_PROMPT=0
repo="$root/git-sync.git"
target=''
switching=false
@@ -53,7 +53,7 @@ trap failed ERR
if [[ ! -d "$repo" ]]; then
git init --bare "$repo"
git --git-dir="$repo" remote add origin git@git.ayau.me:syntaxbullet/minabot.git
git --git-dir="$repo" remote add origin https://git.ayau.me/syntaxbullet/minabot.git
fi
timeout 90 git --git-dir="$repo" fetch --quiet origin +refs/heads/main:refs/remotes/origin/main
target=$(git --git-dir="$repo" rev-parse refs/remotes/origin/main)

12
deploy/git-credential-tea.ts Normal file
View File

@@ -0,0 +1,12 @@
// Repository-local HTTPS credential helper. Git consumes stdout; never log it.
import { join } from 'node:path';
if (process.argv[2] !== 'get') process.exit(0);
const fields = Object.fromEntries((await Bun.stdin.text()).trim().split('\n').map(line => {
const index = line.indexOf('='); return [line.slice(0, index), line.slice(index + 1)];
}));
if (fields.protocol !== 'https' || fields.host !== 'git.ayau.me' || fields.path !== 'syntaxbullet/minabot.git') process.exit(0);
const base = process.env.XDG_CONFIG_HOME || join(process.env.HOME!, 'Library', 'Application Support');
const config = Bun.YAML.parse(await Bun.file(join(base, 'tea', 'config.yml')).text()) as { logins?: { name: string; url: string; user: string; token: string }[] };
const login = config.logins?.find(login => login.name === 'ayau' && login.url.replace(/\/$/, '') === 'https://git.ayau.me');
if (!login?.token || !login.user || /[\r\n]/.test(login.token + login.user)) process.exit(1);
process.stdout.write(`username=${login.user}\npassword=${login.token}\n\n`);