Merge pull request #77 from dothq/staging

Add automatic certificate renewal workflow

.github/workflows/renew.yml

@@ -0,0 +1,48 @@
+name: Renew certificates
+
+on:
+    push:
+        branches: ["production"]
+    workflow_dispatch:
+    schedule:
+        - cron: "0 5 * * *" # every day at 5am
+
+env:
+    SERVER_ID: "32657111668989263"
+
+jobs:
+    renew:
+        runs-on: ubuntu-latest
+        permissions:
+            contents: read
+
+        steps:
+            - name: Checkout repository
+              uses: actions/checkout@v3
+
+            - name: Retrieve server hostname
+              run: |
+                  TS_JSON=$(curl "https://api.tailscale.com/api/v2/device/${{ env.SERVER_ID }}" -u "${{ secrets.TS_KEY }}:")
+                  HOSTNAME=$(echo $TS_JSON | jq -r '.name')
+                  echo "SERVER_HOSTNAME=$HOSTNAME" >> $GITHUB_ENV
+
+            - name: Connect to Tailscale network
+              uses: tailscale/github-action@v2
+              with:
+                  oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+                  oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+                  tags: tag:ci
+                  version: "1.46.0"
+
+            - name: Install SSH key
+              run: |
+                  install -m 600 -D /dev/null ~/.ssh/id_rsa
+                  echo "${{ secrets.CI_PRIVATE_KEY }}" > ~/.ssh/id_rsa
+                  ssh-keyscan -H ${{ env.SERVER_HOSTNAME }} > ~/.ssh/known_hosts
+
+            - name: Connect over SSH and deploy
+              run: |
+                  ssh -t ci@${{ env.SERVER_HOSTNAME }} "cd /app && ./scripts/renew_certificates_docker.sh"
+
+            - name: Nuke SSH keys
+              run: rm -rf ~/.ssh

scripts/renew_certificates_docker.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -e
+
+docker exec -it certbot certbot renew
+docker compose down
+docker compose up -d