deploy configuration

.github/workflows/build-test-push.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 env:
-  IMAGE_NAME: batty1039.startdedicated.net:5000/cms
+  IMAGE_NAME: batty1039.startdedicated.net:5000/go-tell
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:

.github/workflows/deploy-rancher.yml

@@ -26,7 +26,7 @@ permissions:
   contents: read
 
 concurrency:
-  group: cms-${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'production' }}
+  group: go-tell-${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'production' }}
   cancel-in-progress: false
 
 jobs:
@@ -47,6 +47,9 @@ jobs:
       CMS_ALLOWED_ORIGINS: ${{ vars.CMS_ALLOWED_ORIGINS }}
       CMS_SSO_HEADER: ${{ vars.CMS_SSO_HEADER }}
       CMS_SSO_COOKIE: ${{ vars.CMS_SSO_COOKIE }}
+      GO_LOOSE_CLIENT_ID: ${{ secrets.GO_LOOSE_CLIENT_ID }}
+      GO_LOOSE_CLIENT_SECRET: ${{ secrets.GO_LOOSE_CLIENT_SECRET }}
+      LOCAL_CA_CERT: ${{ secrets.LOCAL_CA_CERT }}
       RANCHER_NAMESPACE: ${{ vars.RANCHER_NAMESPACE }}
 
     steps:
@@ -79,7 +82,11 @@ jobs:
             echo "REGISTRY_USERNAME and REGISTRY_PASSWORD are required" >&2
             exit 1
           fi
-          namespace="${RANCHER_NAMESPACE:-cms-$TARGET_ENVIRONMENT}"
+          if [ -z "$GO_LOOSE_CLIENT_ID" ] || [ -z "$GO_LOOSE_CLIENT_SECRET" ]; then
+            echo "GO_LOOSE_CLIENT_ID and GO_LOOSE_CLIENT_SECRET are required: they come from the Go Loose console" >&2
+            exit 1
+          fi
+          namespace="${RANCHER_NAMESPACE:-go-tell-$TARGET_ENVIRONMENT}"
           if [ -n "$PUBLISHED_SHA" ]; then
             image_tag="$PUBLISHED_SHA"
           else
@@ -88,9 +95,9 @@ jobs:
           allowed_origins="$CMS_ALLOWED_ORIGINS"
           if [ -z "$allowed_origins" ]; then
             if [ "$TARGET_ENVIRONMENT" = "production" ]; then
-              allowed_origins="https://cms.urpi.be"
+              allowed_origins="https://tell.dev"
             else
-              allowed_origins="http://localhost:30081"
+              allowed_origins="http://localhost:30010"
             fi
           fi
           {
@@ -112,28 +119,42 @@ jobs:
           set -eu
           kubectl create namespace "$DEPLOY_NAMESPACE" \
             --dry-run=client -o yaml | kubectl apply -f -
-          kubectl -n "$DEPLOY_NAMESPACE" create secret docker-registry cms-registry \
+          kubectl -n "$DEPLOY_NAMESPACE" create secret docker-registry go-tell-registry \
             --docker-server=batty1039.startdedicated.net:5000 \
             --docker-username="$REGISTRY_USERNAME" \
             --docker-password="$REGISTRY_PASSWORD" \
             --dry-run=client -o yaml | kubectl apply -f -
 
+      - name: Publish the internal certificate authority
+        if: ${{ env.LOCAL_CA_CERT != '' }}
+        run: |
+          set -eu
+          printf '%s' "$LOCAL_CA_CERT" | base64 --decode > "$RUNNER_TEMP/local-ca.crt"
+          kubectl -n "$DEPLOY_NAMESPACE" create secret generic local-ca \
+            --from-file=ca.crt="$RUNNER_TEMP/local-ca.crt" \
+            --dry-run=client -o yaml | kubectl apply -f -
+
       - name: Deploy Helm release
         run: |
           set -eu
-          values_file="deploy/helm/cms/values-$TARGET_ENVIRONMENT.yaml"
+          values_file="deploy/helm/go-tell/values-$TARGET_ENVIRONMENT.yaml"
           set -- \
             --set-string "image.tag=$IMAGE_TAG" \
-            --set "imagePullSecrets[0].name=cms-registry" \
+            --set "imagePullSecrets[0].name=go-tell-registry" \
             --set-string "app.allowedOrigins=$RESOLVED_ALLOWED_ORIGINS" \
-            --set-string "secrets.ssoToken=$CMS_SSO_TOKEN"
+            --set-string "secrets.ssoToken=$CMS_SSO_TOKEN" \
+            --set-string "goLoose.clientID=$GO_LOOSE_CLIENT_ID" \
+            --set-string "goLoose.clientSecret=$GO_LOOSE_CLIENT_SECRET"
+          if [ -n "$LOCAL_CA_CERT" ]; then
+            set -- "$@" --set-string goLoose.ca.existingSecret=local-ca
+          fi
           if [ -n "$CMS_SSO_HEADER" ]; then
             set -- "$@" --set-string "app.ssoHeader=$CMS_SSO_HEADER"
           fi
           if [ -n "$CMS_SSO_COOKIE" ]; then
             set -- "$@" --set-string "app.ssoCookie=$CMS_SSO_COOKIE"
           fi
-          helm upgrade --install cms deploy/helm/cms \
+          helm upgrade --install go-tell deploy/helm/go-tell \
             --namespace "$DEPLOY_NAMESPACE" \
             --values "$values_file" \
             --atomic \
@@ -143,6 +164,6 @@ jobs:
 
       - name: Verify deployment
         run: |
-          kubectl -n "$DEPLOY_NAMESPACE" rollout status deployment/cms \
+          kubectl -n "$DEPLOY_NAMESPACE" rollout status deployment/go-tell \
             --timeout=5m
-          helm test cms --namespace "$DEPLOY_NAMESPACE" --logs
+          helm test go-tell --namespace "$DEPLOY_NAMESPACE" --logs