Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

.github/workflows/ci-deploy.yml

@@ -0,0 +1,130 @@
+name: CI and deploy
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: tarakan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  test:
+    name: Test
+    runs-on: ubuntu-24.04
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      MIX_ENV: test
+    steps:
+      - name: Check out source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Run pre-commit checks
+        run: |
+          docker run --rm --network host \
+            --volume "$GITHUB_WORKSPACE:/app" \
+            --workdir /app \
+            --env MIX_ENV=test \
+            docker.io/hexpm/elixir:1.20.1-erlang-29.0.2-debian-trixie-20260610-slim \
+            bash -lc '
+              apt-get update
+              apt-get install -y --no-install-recommends build-essential git openssh-client
+              mix local.hex --force
+              mix local.rebar --force
+              mix deps.get
+              mix precommit
+            '
+
+  deploy:
+    name: Deploy production
+    needs: test
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    env:
+      DEPLOY_HOST: 66.42.113.222
+      DEPLOY_USER: tarakan-deploy
+      IMAGE: tarakan-app:${{ github.sha }}
+    steps:
+      - name: Check out source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Build production image
+        run: docker build --pull -f deploy/docker/Dockerfile --tag "$IMAGE" .
+
+      - name: Package production image
+        run: docker save "$IMAGE" | gzip -1 > /tmp/tarakan-image.tar.gz
+
+      - name: Configure deployment SSH
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+          # Prefer secret/var; fall back to the production host key pin.
+          DEPLOY_SSH_HOST_KEY: ${{ secrets.DEPLOY_SSH_HOST_KEY || vars.DEPLOY_SSH_HOST_KEY || '66.42.113.222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINdLaUbq4l8akmbiTurBX3F1nTw8AxJZ1efIN3t2ptGq' }}
+        run: |
+          install -d -m 0700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 0600 ~/.ssh/id_ed25519
+          {
+            printf '%s\n' "$DEPLOY_SSH_HOST_KEY"
+            while IFS= read -r line; do
+              case "$line" in
+                ''|'#'*) continue ;;
+              esac
+              host_field="${line%% *}"
+              rest="${line#* }"
+              if [[ "$host_field" == *@* ]]; then
+                printf '%s %s\n' "${host_field##*@}" "$rest"
+              fi
+            done <<< "$DEPLOY_SSH_HOST_KEY"
+          } > ~/.ssh/known_hosts
+          chmod 0600 ~/.ssh/known_hosts
+
+      - name: Upload release
+        run: |
+          rsync -az --delete-delay \
+            --chown="$DEPLOY_USER:linuxuser" \
+            --chmod=D755,F644 \
+            --exclude='.git/' \
+            --exclude='.env' \
+            --exclude='.deploy/' \
+            --exclude='.secrets/' \
+            --exclude='backups/' \
+            --exclude='_build/' \
+            --exclude='deps/' \
+            --exclude='tmp/' \
+            --exclude='erl_crash.dump' \
+            --exclude='assets/node_modules/' \
+            --exclude='priv/hosted/' \
+            --exclude='priv/mirrors/' \
+            --exclude='priv/ssh/' \
+            --exclude='priv/static/assets/' \
+            --exclude='priv/static/cache_manifest.json' \
+            ./ "$DEPLOY_USER@$DEPLOY_HOST:/opt/tarakan/"
+          # Executable deploy scripts (rsync F644 would strip +x).
+          ssh "$DEPLOY_USER@$DEPLOY_HOST" \
+            "chmod 755 /opt/tarakan/scripts/deploy/*.sh /opt/tarakan/ops/*.sh 2>/dev/null || true"
+          rsync -az /tmp/tarakan-image.tar.gz \
+            "$DEPLOY_USER@$DEPLOY_HOST:/opt/tarakan/.deploy/tarakan-image.tar.gz"
+
+      - name: Activate release
+        run: ssh "$DEPLOY_USER@$DEPLOY_HOST" "cd /opt/tarakan && ./scripts/deploy/deploy.sh '$IMAGE'"