renew.yml

name: Renew certificates

on:
    workflow_dispatch:
    schedule:
        - cron: "0 5 * * *" # every day at 5am

env:
    SERVER_ID: "32657111668989263"

jobs:
    renew:
        runs-on: ubuntu-latest
        permissions:
            contents: read

        steps:
            - name: Checkout repository
              uses: actions/checkout@v4

            - name: Retrieve server hostname
              run: |
                  TS_JSON=$(curl "https://api.tailscale.com/api/v2/device/${{ env.SERVER_ID }}" -u "${{ secrets.TS_KEY }}:")
                  HOSTNAME=$(echo $TS_JSON | jq -r '.name')
                  echo "SERVER_HOSTNAME=$HOSTNAME" >> $GITHUB_ENV

            - name: Connect to Tailscale network
              uses: tailscale/github-action@v2
              with:
                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
                  oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
                  tags: tag:ci
                  version: "1.46.0"

            - name: Install SSH key
              run: |
                  install -m 600 -D /dev/null ~/.ssh/id_rsa
                  echo "${{ secrets.CI_PRIVATE_KEY }}" > ~/.ssh/id_rsa
                  ssh-keyscan -H ${{ env.SERVER_HOSTNAME }} > ~/.ssh/known_hosts

            - name: Connect over SSH and deploy
              run: |
                  ssh -t ci@${{ env.SERVER_HOSTNAME }} "cd /app && ./scripts/renew_certificates_docker.sh"

            - name: Nuke SSH keys
              run: rm -rf ~/.ssh