deploy.yml

name: 03.Deploy Application to Server

on:
  workflow_dispatch:
    inputs:
        version:
          description: "Docker image version"
          required: true
          default: "latest"

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      # Step 1: Checkout del repository
      - name: Checkout the repo
        uses: actions/checkout@v4
        with:
          submodules: recursive
          token: ${{ secrets.GHCR_TOKEN }}

      - name: Remove old config directory
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            if [ -d "/opt/config/" ]; then
              rm -r /opt/config/
            fi

      # Step 2: Creazione dei file di configurazione
      - name: Create config directory
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            mkdir -p /opt/config/

      - name: Create main config file (django.cfg)
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            echo "DEBUG=${{ secrets.DEBUG }}" >> /opt/config/django.cfg
            echo "SECRET_KEY=${{ secrets.SECRET_KEY }}" >> /opt/config/django.cfg
            echo "DJANGO_ALLOWED_HOSTS=${{ secrets.DJANGO_ALLOWED_HOSTS }}" >> /opt/config/django.cfg
            echo "SQL_ENGINE=${{ secrets.SQL_ENGINE }}" >> /opt/config/django.cfg
            echo "DATABASE=${{ secrets.DATABASE }}" >> /opt/config/django.cfg
            echo "POSTGRES_DB=${{ secrets.POSTGRES_DB }}" >> /opt/config/django.cfg
            echo "POSTGRES_USER=${{ secrets.POSTGRES_USER }}" >> /opt/config/django.cfg
            echo "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" >> /opt/config/django.cfg
            echo "SQL_HOST=${{ secrets.SQL_HOST }}" >> /opt/config/django.cfg
            echo "SQL_PORT=${{ secrets.SQL_PORT }}" >> /opt/config/django.cfg
            echo "GOLD_POSTGRES_DB=${{ secrets.GOLD_POSTGRES_DB }}" >> /opt/config/django.cfg
            echo "GOLD_POSTGRES_USER=${{ secrets.GOLD_POSTGRES_USER }}" >> /opt/config/django.cfg
            echo "GOLD_POSTGRES_PASSWORD=${{ secrets.GOLD_POSTGRES_PASSWORD }}" >> /opt/config/django.cfg
            echo "GOLD_SQL_HOST=${{ secrets.GOLD_SQL_HOST }}" >> /opt/config/django.cfg
            echo "GOLD_SQL_PORT=${{ secrets.GOLD_SQL_PORT }}" >> /opt/config/django.cfg
            echo "EMAIL=${{ secrets.EMAIL }}" >> /opt/config/django.cfg
            echo "DOMAIN=${{ secrets.DOMAIN }}" >> /opt/config/django.cfg

      - name: Creation of config file for Postgres (db.cfg)
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            echo "POSTGRES_DB=${{ secrets.POSTGRES_DB }}" >> /opt/config/db.cfg
            echo "POSTGRES_USER=${{ secrets.POSTGRES_USER }}" >> /opt/config/db.cfg
            echo "POSTGRES_PASSWORD=${{ secrets.POSTGRES_PASSWORD }}" >> /opt/config/db.cfg
            echo "SQL_HOST=${{ secrets.SQL_HOST }}" >> /opt/config/db.cfg
            echo "SQL_PORT=${{ secrets.SQL_PORT }}" >> /opt/config/db.cfg

      - name: Creation of config file for Gold Postgres (gold.cfg)
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            echo "POSTGRES_DB=${{ secrets.GOLD_POSTGRES_DB }}" >> /opt/config/gold.cfg
            echo "POSTGRES_USER=${{ secrets.GOLD_POSTGRES_USER }}" >> /opt/config/gold.cfg
            echo "POSTGRES_PASSWORD=${{ secrets.GOLD_POSTGRES_PASSWORD }}" >> /opt/config/gold.cfg
            echo "SQL_HOST=${{ secrets.GOLD_SQL_HOST }}" >> /opt/config/gold.cfg
            echo "SQL_PORT=${{ secrets.GOLD_SQL_PORT }}" >> /opt/config/gold.cfg

      # Step 3: SCP Docker Compose file al server
      - name: SCP Docker Compose file
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          source: "./docker-compose.prod.yml"
          target: "/opt/"
 
      - name: Ensure directories for volumes exist
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            sudo mkdir -p /opt/web/static
            sudo mkdir -p /opt/web/media
            sudo chown -R $USER:$USER /opt/web/static
            sudo chown -R $USER:$USER /opt/web/media
        

      - name: Pull containers from GHCR
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            IMAGE_NAME="${{ env.REGISTRY }}/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
            echo ${{ secrets.GHCR_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
            docker pull $IMAGE_NAME

      - name: Start container
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |      
            docker compose -f /opt/docker-compose.prod.yml down
            docker compose -f /opt/docker-compose.prod.yml up -d --force-recreate

      - name: Start Djangoq cluster
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |      
           docker compose -f /opt/docker-compose.prod.yml exec -d web sh -c "python manage.py qcluster"

      - name: Run Django migrations
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            docker compose -f /opt/docker-compose.prod.yml exec web python manage.py makemigrations --noinput
            docker compose -f /opt/docker-compose.prod.yml exec web python manage.py migrate --noinput
            docker compose -f /opt/docker-compose.prod.yml exec web python manage.py migrate --noinput --database=gold

      # Prima del collectstatic, aggiungiamo uno step per sistemare i permessi
      - name: Fix static directory permissions
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            # Ricrea la directory con i permessi corretti
            sudo chown -R $USER:$USER /opt/web/static
            sudo chmod -R 777 /opt/web/static  # Temporaneamente diamo permessi ampi

      - name: Run Django collectstatic
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            docker compose -f /opt/docker-compose.prod.yml exec web python manage.py collectstatic --noinput --clear

      # Dopo il collectstatic, ripristiniamo i permessi più restrittivi
      - name: Restore secure permissions
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            sudo chmod -R 755 /opt/web/static

      # Step 5: Configurazione di Nginx
      - name: SCP Nginx configuration
        uses: appleboy/scp-action@v0.1.7
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          source: "nginx/nginx.conf"
          target: "/etc/nginx/sites-available/"
          strip_components: 1

      - name: Update Nginx configuration
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            
            rm -f /etc/nginx/sites-enabled/nginx.conf
            rm -f /etc/nginx/sites-enabled/nginx.dev.conf
            rm -f /etc/nginx/sites-enabled/default
            ln -s /etc/nginx/sites-available/nginx.conf /etc/nginx/sites-enabled/nginx.conf

            sed -i "s/localhost/${{ secrets.DOMAIN }}/g" /etc/nginx/sites-available/nginx.conf
            ln -s /etc/nginx/sites-available/nginx.conf /etc/nginx/sites-enabled
            if nginx -t; then
              sudo systemctl restart nginx
            else
              echo "Nginx configuration test failed. Deployment aborted."
              exit 1
            fi

      # Step 6: Certbot per SSL
      - name: Setup Certbot for SSL
        uses: appleboy/ssh-action@v0.1.3
        with:
          host: ${{ secrets.HOST }}
          username: ${{ secrets.USERNAME }}
          key: ${{ secrets.PRIVATE_KEY }}
          script: |
            # Converte la stringa di domini in array e costruisce i parametri per certbot
            DOMAINS="${{ secrets.DOMAIN }}"
            DOMAIN_PARAMS=""
            for domain in $DOMAINS; do
              DOMAIN_PARAMS="$DOMAIN_PARAMS --domains $domain"
            done
            
            # Prendi il primo dominio come dominio principale
            PRIMARY_DOMAIN=$(echo $DOMAINS | cut -d' ' -f1)
            
            # Rimuovi certificato esistente
            sudo rm -rf /etc/letsencrypt/live/$PRIMARY_DOMAIN*
            sudo rm -rf /etc/letsencrypt/archive/$PRIMARY_DOMAIN*
            sudo rm -rf /etc/letsencrypt/renewal/$PRIMARY_DOMAIN*
            
            # Installazione Certbot se non presente
            if ! command -v certbot &> /dev/null; then
              sudo apt-get update
              sudo apt-get remove certbot -y
              sudo snap install --classic certbot
              sudo ln -sf /snap/bin/certbot /usr/bin/certbot
            fi
            
            # Verifica che Nginx sia in ascolto sulla porta 80
            sudo systemctl stop nginx
            sudo systemctl start nginx
            
            # Ottieni nuovo certificato
            sudo certbot --nginx \
              --non-interactive \
              --agree-tos \
              --email ${{ secrets.EMAIL }} \
              $DOMAIN_PARAMS \
              --keep-until-expiring \
              --redirect
            
            # Verifica la configurazione di Nginx
            sudo nginx -t && sudo systemctl restart nginx