AkurAI-PassVault / .akurai.yml

Latest change 7c78f978fe08927d630148b42144b05c1b01ba99 - feat: add authenticated PassVault UI by Ólafur Búi Ólafsson

version: 1
jobs:
  - name: verify
    executor: native
    branches: [main]
    run:
      - RUSTUP_HOME=/home/olafurbui/.rustup CARGO_HOME=/home/olafurbui/.cargo PATH=/home/olafurbui/.cargo/bin:/usr/bin:/bin cargo fmt --all -- --check
      - RUSTUP_HOME=/home/olafurbui/.rustup CARGO_HOME=/home/olafurbui/.cargo PATH=/home/olafurbui/.cargo/bin:/usr/bin:/bin cargo clippy --all-targets --all-features -- -D warnings
      - RUSTUP_HOME=/home/olafurbui/.rustup CARGO_HOME=/home/olafurbui/.cargo PATH=/home/olafurbui/.cargo/bin:/usr/bin:/bin cargo test --all

  - name: package
    needs: [verify]
    executor: native
    branches: [main]
    run: RUSTUP_HOME=/home/olafurbui/.rustup CARGO_HOME=/home/olafurbui/.cargo PATH=/home/olafurbui/.cargo/bin:/usr/bin:/bin cargo build --release --target x86_64-unknown-linux-musl -p akurai-passvault
    artifacts:
      - target/x86_64-unknown-linux-musl/release/akurai-passvault

  - name: deploy
    needs: [package]
    executor: native
    environment: production
    approval: true
    branches: [main]
    run: |
      export HOME=/home/olafurbui
      export PATH=/home/olafurbui/.local/bin:/usr/bin:/bin
      HOST=akurai-ec2
      BIN=target/x86_64-unknown-linux-musl/release/akurai-passvault
      test -f "$BIN" || { echo "missing packaged binary: $BIN" >&2; exit 1; }

      echo "==> provision OIDC configuration"
      bash scripts/provision-oidc.sh

      echo "==> ship binary (backup previous)"
      scp -q "$BIN" "$HOST:/tmp/akurai-passvault.new"
      ssh "$HOST" 'sudo mkdir -p /opt/akurai-passvault/bin /var/lib/akurai-passvault /etc/akurai-passvault && { [ -f /opt/akurai-passvault/bin/akurai-passvault ] && sudo cp -p /opt/akurai-passvault/bin/akurai-passvault /opt/akurai-passvault/bin/akurai-passvault.prev || true; } && sudo install -m 755 -o ubuntu -g ubuntu /tmp/akurai-passvault.new /opt/akurai-passvault/bin/akurai-passvault && rm -f /tmp/akurai-passvault.new'

      echo "==> systemd unit"
      scp -q deploy/akurai-passvault.service "$HOST:/tmp/akurai-passvault.service"
      ssh "$HOST" 'sudo install -m 644 /tmp/akurai-passvault.service /etc/systemd/system/akurai-passvault.service && rm -f /tmp/akurai-passvault.service && sudo systemctl daemon-reload && sudo systemctl enable akurai-passvault.service'

      echo "==> nginx vhost"
      scp -q deploy/akurai-passvault.nginx.conf "$HOST:/tmp/akurai-passvault.nginx"
      ssh "$HOST" 'sudo install -m 644 /tmp/akurai-passvault.nginx /etc/nginx/sites-available/akurai-passvault.olibuijr.com && sudo ln -sf /etc/nginx/sites-available/akurai-passvault.olibuijr.com /etc/nginx/sites-enabled/akurai-passvault.olibuijr.com && rm -f /tmp/akurai-passvault.nginx && sudo nginx -t && sudo systemctl reload nginx'

      echo "==> env guard"
      ssh "$HOST" 'sudo test -f /etc/akurai-passvault/env'

      echo "==> restart service"
      ssh "$HOST" 'sudo systemctl restart akurai-passvault.service'

      echo "==> self healthcheck (rollback on failure)"
      sleep 3
      if ! ssh "$HOST" 'curl -fsS http://127.0.0.1:8102/api/health' >/dev/null; then
        echo "self health failed; rolling back to previous binary" >&2
        ssh "$HOST" 'sudo cp -p /opt/akurai-passvault/bin/akurai-passvault.prev /opt/akurai-passvault/bin/akurai-passvault && sudo systemctl restart akurai-passvault.service'
        exit 1
      fi

      echo "==> cross-environment health sweep"
      akurai-health-sweep --self akurai-passvault