112 lines
4.3 KiB
Text
112 lines
4.3 KiB
Text
name: MT5 Helm GitOps Deploy
|
||
|
||
on:
|
||
push:
|
||
branches: [ "main" ]
|
||
tags: [ "*" ]
|
||
workflow_dispatch:
|
||
|
||
env:
|
||
# Gleiche Registry wie im boday_tf-Projekt, zwei Namen:
|
||
# PUSH_REGISTRY: wie der Runner sie erreicht
|
||
# PULL_REGISTRY: wie k3s/containerd sie erreicht (registries.yaml, CA unter certs.d)
|
||
PUSH_REGISTRY: localhost:3005
|
||
PULL_REGISTRY: registry.local
|
||
# Host-Header für Traefik-Ingress des Web-UI (leer = kein Ingress, kein Health-Check per HTTP)
|
||
INGRESS_HOST: mt5.local
|
||
|
||
jobs:
|
||
build-and-deploy:
|
||
if: false
|
||
runs-on: ubuntu-latest
|
||
container: catthehacker/ubuntu:act-latest
|
||
steps:
|
||
- name: Checkout Code
|
||
uses: actions/checkout@v4
|
||
|
||
# HINWEIS: Terraform-Binary kommt wie bei boday_tf über das globale Runner-Volume (:ro)
|
||
|
||
- name: Trust Local Nginx Certificate Inside Container
|
||
run: |
|
||
mkdir -p /usr/local/share/ca-certificates/
|
||
cp nginx_ssl/nginx.crt /usr/local/share/ca-certificates/nginx-sandbox.crt 2>/dev/null || echo "Nutze Workspace-Zertifikat"
|
||
update-ca-certificates
|
||
|
||
# Docker verlangt Image-Namen in Kleinbuchstaben – "MetaTrader5-Docker-Image" würde sonst scheitern
|
||
- name: Compute Image Name
|
||
run: |
|
||
IMAGE_PATH="$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
|
||
echo "IMAGE=${PUSH_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
|
||
echo "PULL_IMAGE=${PULL_REGISTRY}/${IMAGE_PATH}" >> "$GITHUB_ENV"
|
||
echo "Push: ${PUSH_REGISTRY}/${IMAGE_PATH}"
|
||
echo "Pull: ${PULL_REGISTRY}/${IMAGE_PATH}"
|
||
|
||
- name: Log in to Local Registry
|
||
run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ${PUSH_REGISTRY} -u ${{ github.actor }} --password-stdin
|
||
|
||
# Ein Build, zwei Tags (das Image ist ~4 GB – doppelt bauen kostet unnötig Zeit)
|
||
- name: Build MT5 Image
|
||
run: |
|
||
docker build --platform linux/amd64 \
|
||
-t ${IMAGE}:${{ github.sha }} \
|
||
-t ${IMAGE}:latest \
|
||
.
|
||
|
||
- name: Push MT5 Image
|
||
run: |
|
||
docker push ${IMAGE}:${{ github.sha }}
|
||
docker push ${IMAGE}:latest
|
||
|
||
- name: Prepare Kubernetes Access
|
||
run: |
|
||
echo "${{ secrets.KUBECONFIG_DATA }}" > ./kind_kubeconfig
|
||
chmod 600 ./kind_kubeconfig
|
||
|
||
# Erster Rollout kann bis 15 Min dauern (Wine + MT5 Installation nach /config)
|
||
# init mit Retry, weil der DNS-Resolver sporadisch "server misbehaving" liefert
|
||
- name: Terraform Deploy
|
||
env:
|
||
# Web-UI-Login (KasmVNC) – wie bisher
|
||
TF_VAR_vnc_user: ${{ secrets.MT5_VNC_USER || 'trader' }}
|
||
TF_VAR_vnc_password: ${{ secrets.MT5_VNC_PASSWORD }}
|
||
# Broker-Login für MT5 – landet als login.ini im Pod und wird beim Start geladen
|
||
TF_VAR_mt5_login: ${{ secrets.MT5USER }}
|
||
TF_VAR_mt5_password: ${{ secrets.MT5PASSWORD }}
|
||
TF_VAR_mt5_server: ${{ secrets.MT5_SERVER }}
|
||
run: |
|
||
terraform --version
|
||
for i in 1 2 3; do
|
||
terraform init && break
|
||
if [ "$i" = "3" ]; then echo "terraform init nach 3 Versuchen fehlgeschlagen"; exit 1; fi
|
||
echo "init fehlgeschlagen, Versuch $i – neuer Anlauf in 10s"
|
||
sleep 10
|
||
done
|
||
terraform apply -auto-approve \
|
||
-var="image_repository=${PULL_IMAGE}" \
|
||
-var="app_version=${{ github.sha }}" \
|
||
-var="ingress_host=${INGRESS_HOST}"
|
||
|
||
# KasmVNC antwortet ohne Login mit 401 – daher mit Basic Auth prüfen und auf den Erststart warten
|
||
- name: Verify App Health
|
||
if: env.INGRESS_HOST != ''
|
||
env:
|
||
VNC_USER: ${{ secrets.MT5_VNC_USER || 'trader' }}
|
||
VNC_PASS: ${{ secrets.MT5_VNC_PASSWORD }}
|
||
run: |
|
||
for i in $(seq 1 40); do
|
||
CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 \
|
||
-u "${VNC_USER}:${VNC_PASS}" -H "Host: ${INGRESS_HOST}" \
|
||
http://local-k3s-platform:80/ || true)
|
||
echo "Versuch ${i}: HTTP ${CODE}"
|
||
if [ "${CODE}" = "200" ]; then
|
||
echo "Erfolg: MetaTrader 5 Web-UI läuft via Helm im GitOps-Standard!"
|
||
exit 0
|
||
fi
|
||
sleep 15
|
||
done
|
||
echo "MT5 Web-UI nach 10 Minuten nicht erreichbar"
|
||
exit 1
|
||
|
||
- name: Cleanup Kubeconfig
|
||
if: always()
|
||
run: rm -f ./kind_kubeconfig
|