deploy-single-server.yml

name: Deploy ingester (single server)

# Rolls the otlp-ingester on a self-hosted EC2/Lightsail box running
# deploy/single-server/docker-compose.yml — SSHes in, refreshes
# docker-compose.yml, pulls the image, and recreates the service. ClickHouse
# and Caddy are left untouched (only the otlp-ingester service is recreated);
# in particular the Caddyfile is never overwritten — boxes customize it with
# extra routes, and a routine ingester roll must not clobber that.
#
# Repo VARIABLES required:
#   SINGLE_SERVER_HOST          the box's IP or hostname
#   SINGLE_SERVER_USER          SSH user (e.g. ubuntu)
#   SINGLE_SERVER_PATH          remote directory holding docker-compose.yml + .env
#   SINGLE_SERVER_AUTODEPLOY_ENABLED   "true" to deploy on pushes to main
# Repo SECRETS required:
#   SINGLE_SERVER_SSH_KEY       private key matching an authorized_keys entry on the box

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - "packages/otlp-ingester/**"
      - "deploy/single-server/**"
      - ".github/workflows/deploy-single-server.yml"

permissions:
  contents: read

concurrency:
  group: deploy-single-server
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    if: github.event_name == 'workflow_dispatch' || vars.SINGLE_SERVER_AUTODEPLOY_ENABLED == 'true'
    steps:
      - name: Deploy over SSH
        uses: appleboy/ssh-action@v1.2.0
        with:
          host: ${{ vars.SINGLE_SERVER_HOST }}
          username: ${{ vars.SINGLE_SERVER_USER }}
          key: ${{ secrets.SINGLE_SERVER_SSH_KEY }}
          script: |
            set -euo pipefail
            cd "${{ vars.SINGLE_SERVER_PATH }}"
            curl -fsSL -o docker-compose.yml https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/deploy/single-server/docker-compose.yml
            docker compose pull otlp-ingester
            docker compose up -d otlp-ingester
            docker image prune -f