thepraandClaude Opus 5.5
ccc3597699
Infrastructure/Http adds the client the roadmap's S3 and S4 ask for: - the connect callback resolves the name itself and refuses loopback, private, link-local, CGNAT, documentation, multicast, ULA, NAT64, 6to4, Teredo and IPv4-mapped/compatible forms, then connects to the vetted address, so DNS rebinding cannot swap it afterwards; - redirects are followed by hand, at most three, each one re-checked; - bodies are capped at 1 MB after decompression, only JSON media types are read, every request has a 15 s budget, and a refused URL is not asked again for five minutes. Actor and WebFinger fetches and inbox deliveries all use it. Test networks can switch on Federation:AllowPrivateNetworks/AllowPlainHttp; startup refuses both in Production. PrivaPub.Tests (xUnit v3) starts with the address table and the fetcher's limits against an in-process peer; build.yml and deploy.yml run it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
92 lines
3.8 KiB
YAML
92 lines
3.8 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
|
|
env:
|
|
UNIT: privapub
|
|
WEB_ROOT: /var/www/privapub.thepra.dev
|
|
BACKUPS: /var/backups/privapub.thepra.dev
|
|
LOCAL_URL: http://127.0.0.1:6970
|
|
PUBLIC_URL: https://privapub.thepra.dev
|
|
|
|
jobs:
|
|
site:
|
|
name: privapub.thepra.dev
|
|
runs-on: build
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Resolve the build identity
|
|
run: |
|
|
echo "BUILD_COMMIT=$(echo "$GITHUB_SHA" | cut -c1-8)" >> "$GITHUB_ENV"
|
|
echo "BUILD_REF=${GITHUB_REF_NAME:-master}" >> "$GITHUB_ENV"
|
|
echo "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
|
|
|
|
- name: Test
|
|
run: dotnet test PrivaPub.sln -c Release
|
|
|
|
- name: Publish
|
|
run: |
|
|
rm -rf "$GITHUB_WORKSPACE/publish"
|
|
dotnet publish PrivaPub/PrivaPub.csproj -c Release -r linux-x64 --self-contained true \
|
|
-o "$GITHUB_WORKSPACE/publish" \
|
|
-p:BuildCommit="$BUILD_COMMIT" -p:BuildRef="$BUILD_REF" -p:BuildTimeUtc="$BUILD_TIME"
|
|
|
|
- name: Assert the publish actually produced a build
|
|
run: |
|
|
P="$GITHUB_WORKSPACE/publish"
|
|
for f in PrivaPub PrivaPub.dll PrivaPub.ClientModels.dll appsettings.Production.json Data/languagesNative.json; do
|
|
[ -e "$P/$f" ] || { echo "::error::publish output is missing $f"; exit 1; }
|
|
done
|
|
grep -q '"includedFrameworks"' "$P/PrivaPub.runtimeconfig.json" \
|
|
|| { echo "::error::publish is not self-contained"; exit 1; }
|
|
age=$(( $(date +%s) - $(stat -c %Y "$P/PrivaPub.dll") ))
|
|
[ "$age" -lt 3600 ] || { echo "::error::PrivaPub.dll is ${age}s old - the publish reused a stale artifact"; exit 1; }
|
|
echo "publish OK, $(du -sh "$P" | cut -f1)"
|
|
|
|
- name: Snapshot the live directory
|
|
run: |
|
|
STAMP=$(date +%Y%m%d-%H%M%S)
|
|
rsync -a "$WEB_ROOT/" "$BACKUPS/site-$STAMP/"
|
|
echo "SNAPSHOT=$BACKUPS/site-$STAMP" >> "$GITHUB_ENV"
|
|
ls -1dt "$BACKUPS"/site-* 2>/dev/null | tail -n +4 | xargs -r rm -rf || true
|
|
|
|
- name: Stop, sync, start
|
|
run: |
|
|
sudo systemctl stop "$UNIT"
|
|
rsync -a --delete --exclude 'appsettings.Development.json' "$GITHUB_WORKSPACE/publish/" "$WEB_ROOT/"
|
|
chgrp www-data "$WEB_ROOT/appsettings.Production.json"
|
|
chmod 640 "$WEB_ROOT/appsettings.Production.json"
|
|
chmod +x "$WEB_ROOT/PrivaPub"
|
|
sudo systemctl start "$UNIT"
|
|
|
|
- name: Health check, roll back on failure
|
|
run: |
|
|
ok=0
|
|
for i in $(seq 1 40); do
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$LOCAL_URL/build.json" || true)
|
|
if [ "$code" = "200" ]; then ok=1; break; fi
|
|
sleep 3
|
|
done
|
|
if [ "$ok" != "1" ]; then
|
|
echo "::error::the site did not come back healthy - rolling back to $SNAPSHOT"
|
|
sudo systemctl stop "$UNIT"
|
|
rsync -a --delete "$SNAPSHOT/" "$WEB_ROOT/"
|
|
sudo systemctl start "$UNIT" || true
|
|
exit 1
|
|
fi
|
|
|
|
- name: Verify what is being served
|
|
run: |
|
|
served=$(curl -fsS "$PUBLIC_URL/build.json" | python3 -c "import json,sys; print(json.load(sys.stdin).get('commit',''))")
|
|
[ "$served" = "$BUILD_COMMIT" ] || { echo "::error::served build is '$served', expected '$BUILD_COMMIT'"; exit 1; }
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -H 'Accept: application/activity+json' "$PUBLIC_URL/peasants/privapub")
|
|
[ "$code" = "200" ] || { echo "::error::the instance actor answered $code"; exit 1; }
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' "$PUBLIC_URL/.well-known/nodeinfo")
|
|
[ "$code" = "200" ] || { echo "::error::nodeinfo answered $code"; exit 1; }
|
|
echo "::notice::serving $served"
|