helm-deploy.yaml

name: Deploy Helm Chart
permissions: read-all

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string

jobs:
  helm_deploy:
      name: Deploy helm chart
      environment: ${{ inputs.environment }}
      runs-on: ubuntu-latest
      steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Install SSH key
        uses: shimataro/ssh-key-action@d4fffb50872869abe2d9a9098a6d9c5aa7d16be4 # v2
        with:
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          name: id_ed25519 # optional
          known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
          if_key_exists: fail # replace / ignore / fail; optional (defaults to fail)
      
      - name: Setup WireGuard
        run:  |
          sudo apt install wireguard
          echo "${{ secrets.WIREGUARD_PRIVATE_KEY }}" > privatekey
          sudo ip link add dev wg1 type wireguard
          sudo ip address add dev wg1 ${{ secrets.WIREGUARD_OVERLAY_NETWORK_IP }} peer ${{ secrets.SSH_TARGET_IP }}
          sudo wg set wg1 listen-port 48123 private-key privatekey peer ${{ secrets.WIREGUARD_PEER_PUBLIC_KEY }} allowed-ips 0.0.0.0/0 endpoint ${{ secrets.WIREGUARD_ENDPOINT }}
          sudo ip link set up dev wg1

      - name: Install Helm Chart
        run: |
          scp ${{ secrets.SSH_USER }}@${{ secrets.SSH_TARGET_IP }}:~/.kube/config ./
          helm upgrade \
            los \
            ./infra/los \
            --install \
            --kubeconfig ./config \
            --kube-apiserver https://${{ secrets.SSH_TARGET_IP }}:6443 \
            -n ${{ vars.APP_NAMESPACE }} \
            --create-namespace \
            -f ./infra/los/values.yaml \
            --set backend.database_url="${{ secrets.BACKEND_DATABASE_URL }}" \
            --set backend.los_database_url="${{ secrets.BACKEND_LOS_DATABASE_URL }}" \
            --set backend.database_user="${{ secrets.BACKEND_DATABASE_USER }}" \
            --set backend.database_password="${{ secrets.BACKEND_DATABASE_PASSWORD }}" \
            --set los_backend.fqdn="${{ vars.BACKEND_FQDN }}" \
            --set los.fqdn="${{ vars.FQDN }}"
          
          # Rolling restart
          kubectl --kubeconfig ./config --server https://${{ secrets.SSH_TARGET_IP }}:6443 -n ${{ vars.APP_NAMESPACE }} rollout restart deploy