claude-botandClaude Opus 5.5
5528ccbd0b
Pipeline branch filters and PR bases, Flux GitRepository ref, image automation checkout and push, restore-test, vmtest and bootstrap.sh. Merge right before the master -> main rename. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
55 lines
2.3 KiB
YAML
55 lines
2.3 KiB
YAML
when:
|
|
# Deploy only on main (merge) + manual — never auto-deploy from a branch.
|
|
- event: push
|
|
branch: main
|
|
path:
|
|
- "ansible/roles/netbird-proxy/**"
|
|
# install-netbird-proxy.yml also applies the netbird-proxy-watchdog role,
|
|
# so changes to it must redeploy this host too.
|
|
- "ansible/roles/netbird-proxy-watchdog/**"
|
|
# install-netbird-proxy.yml also applies the edge bouncer.
|
|
- "ansible/roles/crowdsec-edge-bouncer/**"
|
|
- "ansible/plays/install-netbird-proxy.yml"
|
|
# The variables that steer those roles, not just the roles themselves.
|
|
# Without these two, a change that only touches inventory never deploys
|
|
# and nothing says so: arming the bouncer lives in host_vars, and its
|
|
# LAPI key lives in group_vars, so both would sit in git looking applied
|
|
# while the hosts kept running the previous configuration.
|
|
#
|
|
# pve_hosts.yml is deliberately NOT listed. It is the single inventory
|
|
# file for the whole fleet, so listing it would redeploy the proxies for
|
|
# any unrelated host edit. The cost is that a change to [netbird_proxy]
|
|
# group membership needs a manual deployment run.
|
|
- "ansible/inventory/host_vars/proxy-*.yml"
|
|
- "ansible/inventory/group_vars/netbird_proxy/**"
|
|
- ".woodpecker/deploy-netbird-proxy.yml"
|
|
- event: deployment
|
|
evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-netbird-proxy"'
|
|
|
|
timeout: 30
|
|
|
|
steps:
|
|
- name: deploy-netbird-proxy
|
|
image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
|
|
environment:
|
|
ANSIBLE_FORCE_COLOR: "true"
|
|
ANSIBLE_HOST_KEY_CHECKING: "false"
|
|
ANSIBLE_ROLES_PATH: "../roles:./roles"
|
|
SSH_PRIVATE_KEY:
|
|
from_secret: ssh_private_key
|
|
VAULT_PASS:
|
|
from_secret: vault_pass
|
|
PROXMOX_TOKEN_ID:
|
|
from_secret: proxmox_token_id
|
|
PROXMOX_TOKEN_SECRET:
|
|
from_secret: proxmox_token_secret
|
|
commands:
|
|
- mkdir -p ~/.ssh
|
|
- echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
|
|
- chmod 600 ~/.ssh/id_ed25519
|
|
- printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
|
|
- cd ansible
|
|
- echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
|
|
- export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
|
|
- ansible-playbook -i inventory/ plays/install-netbird-proxy.yml -v
|