Initial commit: self-hosted SFP server deployment repository

Provides GitHub Actions workflows for customers to initialize, update, and monitor their self-hosted SFP Pro server instances. Includes a composite action for CLI installation from Gitea and SSH setup. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-14 11:08:06 +10:00
commit 718cb1c4e1
8 changed files with 861 additions and 0 deletions
@@ -0,0 +1,105 @@
+name: 'Setup SFP CLI and SSH'
+description: 'Downloads SFP CLI from Gitea releases and configures SSH access to the target server'
+
+inputs:
+  gitea-token:
+    description: 'Token for authenticating to source.flxbl.io Gitea API'
+    required: true
+  ssh-private-key:
+    description: 'SSH private key for connecting to the remote server'
+    required: true
+  ssh-host:
+    description: 'Hostname or IP of the target server'
+    required: true
+  cli-version:
+    description: 'SFP CLI version to install (default: latest non-draft release)'
+    required: false
+    default: 'latest'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install SFP CLI from Gitea
+      shell: bash
+      env:
+        GITEA_TOKEN: ${{ inputs.gitea-token }}
+        CLI_VERSION: ${{ inputs.cli-version }}
+      run: |
+        echo "::group::Install SFP CLI"
+
+        GITEA_API="https://source.flxbl.io/api/v1/repos/flxbl/sfp-pro/releases"
+
+        if [ "$CLI_VERSION" = "latest" ]; then
+          echo "Fetching latest release from Gitea..."
+          RELEASE_INFO=$(curl -sf -H "Authorization: token $GITEA_TOKEN" \
+            "${GITEA_API}?limit=10")
+
+          if [ $? -ne 0 ] || [ -z "$RELEASE_INFO" ]; then
+            echo "Failed to fetch releases from Gitea API"
+            exit 1
+          fi
+
+          # Find first non-draft release that has a .deb asset
+          DEB_URL=$(echo "$RELEASE_INFO" | jq -r '
+            [.[] | select(.draft == false)] | first |
+            .assets[] | select(.name | test("_linux_amd64\\.deb$")) |
+            .browser_download_url')
+        else
+          echo "Fetching release matching version: $CLI_VERSION..."
+          RELEASE_INFO=$(curl -sf -H "Authorization: token $GITEA_TOKEN" \
+            "${GITEA_API}?limit=50")
+
+          if [ $? -ne 0 ] || [ -z "$RELEASE_INFO" ]; then
+            echo "Failed to fetch releases from Gitea API"
+            exit 1
+          fi
+
+          # Find release with matching version in asset names
+          DEB_URL=$(echo "$RELEASE_INFO" | jq -r --arg ver "$CLI_VERSION" '
+            [.[] | select(.draft == false) |
+             select(.assets[]? | .name | contains($ver))] | first |
+            .assets[] | select(.name | test("_linux_amd64\\.deb$")) |
+            .browser_download_url')
+        fi
+
+        if [ -z "$DEB_URL" ] || [ "$DEB_URL" = "null" ]; then
+          echo "No .deb package found for version: $CLI_VERSION"
+          echo "Available releases:"
+          echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | .[0:5] | .[] | "  - \(.tag_name): \([.assets[].name] | join(", "))"'
+          exit 1
+        fi
+
+        echo "Downloading SFP CLI from: $DEB_URL"
+        curl -L -f -H "Authorization: token $GITEA_TOKEN" -o /tmp/sfp-pro.deb "$DEB_URL"
+
+        if [ $? -ne 0 ]; then
+          echo "Failed to download SFP CLI package"
+          exit 1
+        fi
+
+        echo "Installing SFP CLI..."
+        sudo dpkg -i /tmp/sfp-pro.deb || sudo apt-get install -f -y
+        rm -f /tmp/sfp-pro.deb
+
+        echo "SFP CLI installed:"
+        sfp --version
+
+        echo "::endgroup::"
+
+    - name: Setup SSH
+      shell: bash
+      env:
+        SSH_PRIVATE_KEY: ${{ inputs.ssh-private-key }}
+        SSH_HOST: ${{ inputs.ssh-host }}
+      run: |
+        echo "::group::Setup SSH"
+
+        mkdir -p ~/.ssh
+        echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
+        chmod 600 ~/.ssh/deploy_key
+
+        echo "Adding $SSH_HOST to known hosts..."
+        ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+        echo "SSH configured for $SSH_HOST"
+        echo "::endgroup::"
@@ -0,0 +1,165 @@
+name: Check for Updates
+
+on:
+  schedule:
+    - cron: '0 8 * * 1' # Weekly on Monday at 8 AM UTC
+  workflow_dispatch:
+
+jobs:
+  check:
+    name: 'Check for new version'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check latest version on Gitea
+        id: check
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          echo "Checking for latest SFP Server release..."
+
+          RELEASE_INFO=$(curl -sf -H "Authorization: token $GITEA_TOKEN" \
+            "https://source.flxbl.io/api/v1/repos/flxbl/sfp-pro/releases?limit=10")
+
+          if [ $? -ne 0 ] || [ -z "$RELEASE_INFO" ]; then
+            echo "Failed to fetch releases from Gitea API"
+            exit 1
+          fi
+
+          # Get latest non-draft release
+          LATEST_TAG=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .tag_name // "unknown"')
+          LATEST_DATE=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .published_at // "unknown"')
+          LATEST_BODY=$(echo "$RELEASE_INFO" | jq -r '[.[] | select(.draft == false)] | first | .body // ""')
+
+          echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
+          echo "latest_date=$LATEST_DATE" >> $GITHUB_OUTPUT
+
+          # Save release body for the issue
+          echo "$LATEST_BODY" > /tmp/release_notes.md
+
+          echo "Latest release: $LATEST_TAG (published: $LATEST_DATE)"
+
+      - name: Check current deployed version
+        id: current
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
+        run: |
+          SSH_HOST="${{ vars.SSH_HOST }}"
+          SSH_USER="${{ vars.SSH_USER || 'root' }}"
+          TENANT="${{ vars.TENANT_NAME }}"
+          BASE_DIR="${{ vars.BASE_DIR || './sfp-server' }}"
+
+          if [ -z "$SSH_HOST" ] || [ -z "$SSH_PRIVATE_KEY" ]; then
+            echo "SSH not configured, skipping deployed version check"
+            echo "current_tag=unknown" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          mkdir -p ~/.ssh
+          echo "$SSH_PRIVATE_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -H "$SSH_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+
+          CURRENT_TAG=$(ssh -i ~/.ssh/deploy_key "$SSH_USER@$SSH_HOST" \
+            "grep '^IMAGE_TAG=' ${BASE_DIR}/tenants/${TENANT}/.env 2>/dev/null | cut -d= -f2" \
+            2>/dev/null || echo "unknown")
+
+          echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
+          echo "Currently deployed: $CURRENT_TAG"
+
+      - name: Generate summary
+        run: |
+          LATEST="${{ steps.check.outputs.latest_tag }}"
+          CURRENT="${{ steps.current.outputs.current_tag }}"
+
+          echo "## SFP Server Version Check" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| | Version |" >> $GITHUB_STEP_SUMMARY
+          echo "|---|---------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Latest Available | \`$LATEST\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Currently Deployed | \`$CURRENT\` |" >> $GITHUB_STEP_SUMMARY
+
+          if [ "$LATEST" != "$CURRENT" ] && [ "$CURRENT" != "unknown" ] && [ "$LATEST" != "unknown" ]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "A newer version is available. Run the **Update SFP Server** workflow to update." >> $GITHUB_STEP_SUMMARY
+          elif [ "$CURRENT" = "unknown" ]; then
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Could not determine currently deployed version." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Server is up to date." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Create or update issue if update available
+        if: steps.check.outputs.latest_tag != steps.current.outputs.current_tag && steps.current.outputs.current_tag != 'unknown' && steps.check.outputs.latest_tag != 'unknown'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = 'New SFP Server Version Available';
+            const latest = '${{ steps.check.outputs.latest_tag }}';
+            const current = '${{ steps.current.outputs.current_tag }}';
+            const fs = require('fs');
+            const releaseNotes = fs.existsSync('/tmp/release_notes.md')
+              ? fs.readFileSync('/tmp/release_notes.md', 'utf8')
+              : '';
+
+            const body = [
+              `## New Version Available`,
+              ``,
+              `| | Version |`,
+              `|---|---------|`,
+              `| **Latest** | \`${latest}\` |`,
+              `| **Current** | \`${current}\` |`,
+              ``,
+              `### How to Update`,
+              `1. Go to **Actions** > **Update SFP Server**`,
+              `2. Click **Run workflow**`,
+              `3. Optionally specify the docker tag: \`${latest}\``,
+              ``,
+              releaseNotes ? `### Release Notes\n\n${releaseNotes}` : '',
+              ``,
+              `---`,
+              `*This issue was automatically created by the version check workflow.*`
+            ].join('\n');
+
+            // Check for existing open issue
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'update-available',
+            });
+
+            const existing = issues.data.find(i => i.title === title);
+
+            if (existing) {
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: existing.number,
+                body: body,
+              });
+              console.log(`Updated issue #${existing.number}`);
+            } else {
+              // Create label if it doesn't exist
+              try {
+                await github.rest.issues.createLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: 'update-available',
+                  color: '0075ca',
+                  description: 'A new SFP Server version is available',
+                });
+              } catch (e) {
+                // Label may already exist
+              }
+
+              const issue = await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: title,
+                body: body,
+                labels: ['update-available'],
+              });
+              console.log(`Created issue #${issue.data.number}`);
+            }
@@ -0,0 +1,131 @@
+name: Initialize SFP Server
+
+on:
+  workflow_dispatch:
+    inputs:
+      force:
+        description: 'Force re-initialization (destroys existing data)'
+        type: boolean
+        default: false
+      tls_mode:
+        description: 'TLS certificate mode'
+        type: choice
+        options:
+          - 'custom'
+          - 'letsencrypt'
+        default: 'custom'
+
+jobs:
+  init:
+    name: 'Initialize server'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate required variables
+        run: |
+          MISSING=""
+          [ -z "${{ vars.SSH_HOST }}" ] && MISSING="$MISSING SSH_HOST"
+          [ -z "${{ vars.TENANT_NAME }}" ] && MISSING="$MISSING TENANT_NAME"
+          [ -z "${{ vars.DOMAIN }}" ] && MISSING="$MISSING DOMAIN"
+          [ -z "${{ vars.DOCKER_REGISTRY }}" ] && MISSING="$MISSING DOCKER_REGISTRY"
+
+          if [ -n "$MISSING" ]; then
+            echo "Missing required GitHub Variables:$MISSING"
+            echo ""
+            echo "Configure these in: Settings > Secrets and variables > Actions > Variables"
+            exit 1
+          fi
+
+      - name: Setup SFP CLI and SSH
+        uses: ./.github/actions/setup-sfp
+        with:
+          gitea-token: ${{ secrets.GITEA_TOKEN }}
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+          ssh-host: ${{ vars.SSH_HOST }}
+          cli-version: ${{ vars.SFP_CLI_VERSION || 'latest' }}
+
+      - name: Initialize server
+        env:
+          DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
+          DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+          ORIGIN_CERT: ${{ secrets.ORIGIN_CERT }}
+          ORIGIN_KEY: ${{ secrets.ORIGIN_KEY }}
+        run: |
+          TENANT="${{ vars.TENANT_NAME }}"
+          DOMAIN="${{ vars.DOMAIN }}"
+          SSH_USER="${{ vars.SSH_USER || 'root' }}"
+          SSH_HOST="${{ vars.SSH_HOST }}"
+          TLS_MODE="${{ inputs.tls_mode }}"
+          WORKERS="${{ vars.WORKERS || '1' }}"
+          BASE_DIR="${{ vars.BASE_DIR || './sfp-server' }}"
+
+          echo "Initializing SFP Server"
+          echo "  Tenant:   $TENANT"
+          echo "  Domain:   $DOMAIN"
+          echo "  Host:     $SSH_HOST"
+          echo "  TLS Mode: $TLS_MODE"
+          echo "  Workers:  $WORKERS"
+          echo "  Registry: $DOCKER_REGISTRY"
+
+          # Build the init command
+          INIT_CMD="sfp server init"
+          INIT_CMD="$INIT_CMD --tenant \"$TENANT\""
+          INIT_CMD="$INIT_CMD --mode prod"
+          INIT_CMD="$INIT_CMD --domain \"$DOMAIN\""
+          INIT_CMD="$INIT_CMD --tls-mode \"$TLS_MODE\""
+          INIT_CMD="$INIT_CMD --workers $WORKERS"
+          INIT_CMD="$INIT_CMD --base-dir \"$BASE_DIR\""
+          INIT_CMD="$INIT_CMD --supabase-mode self-hosted"
+          INIT_CMD="$INIT_CMD --secrets-provider custom"
+          INIT_CMD="$INIT_CMD --no-interactive"
+          INIT_CMD="$INIT_CMD --ssh-connection \"$SSH_USER@$SSH_HOST\""
+          INIT_CMD="$INIT_CMD --identity-file ~/.ssh/deploy_key"
+
+          # Add image override if IMAGE_FQDN is configured
+          IMAGE_FQDN="${{ vars.IMAGE_FQDN }}"
+          IMAGE_TAG="${{ vars.IMAGE_TAG || 'latest' }}"
+          if [ -n "$IMAGE_FQDN" ]; then
+            INIT_CMD="$INIT_CMD --image \"${IMAGE_FQDN}:${IMAGE_TAG}\""
+          fi
+
+          # Add force flag if requested
+          if [ "${{ inputs.force }}" = "true" ]; then
+            INIT_CMD="$INIT_CMD --force"
+          fi
+
+          eval "$INIT_CMD"
+
+      - name: Output init results
+        if: always()
+        run: |
+          TENANT="${{ vars.TENANT_NAME }}"
+          RESULT_FILE="sfp-server-init-${TENANT}.json"
+
+          echo "## SFP Server Initialization" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ -f "$RESULT_FILE" ]; then
+            echo "### Results" >> $GITHUB_STEP_SUMMARY
+            echo '```json' >> $GITHUB_STEP_SUMMARY
+            cat "$RESULT_FILE" | jq '.' >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Configuration" >> $GITHUB_STEP_SUMMARY
+          echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Tenant | $TENANT |" >> $GITHUB_STEP_SUMMARY
+          echo "| Domain | ${{ vars.DOMAIN }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Host | ${{ vars.SSH_HOST }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| TLS Mode | ${{ inputs.tls_mode }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Registry | ${{ vars.DOCKER_REGISTRY }} |" >> $GITHUB_STEP_SUMMARY
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
+          echo "1. Verify the server is accessible at \`https://${{ vars.DOMAIN }}\`" >> $GITHUB_STEP_SUMMARY
+          echo "2. Configure integrations (GitHub OAuth, GitHub App, Slack) via the integration API or by editing \`.env\` on the server" >> $GITHUB_STEP_SUMMARY
+          echo "3. Use the **Update SFP Server** workflow for future updates" >> $GITHUB_STEP_SUMMARY
@@ -0,0 +1,114 @@
+name: Update SFP Server
+
+on:
+  workflow_dispatch:
+    inputs:
+      docker_tag:
+        description: 'Docker image tag to deploy (leave empty to use IMAGE_TAG variable or "latest")'
+        required: false
+        default: ''
+      skip_drain:
+        description: 'Skip waiting for active workflows to complete'
+        type: boolean
+        default: false
+      drain_timeout:
+        description: 'Max seconds to wait for active workflows to complete'
+        required: false
+        default: '3600'
+      skip_backup:
+        description: 'Skip backup of current configuration before update'
+        type: boolean
+        default: false
+
+jobs:
+  update:
+    name: 'Update server'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate required variables
+        run: |
+          MISSING=""
+          [ -z "${{ vars.SSH_HOST }}" ] && MISSING="$MISSING SSH_HOST"
+          [ -z "${{ vars.TENANT_NAME }}" ] && MISSING="$MISSING TENANT_NAME"
+          [ -z "${{ vars.DOCKER_REGISTRY }}" ] && MISSING="$MISSING DOCKER_REGISTRY"
+
+          if [ -n "$MISSING" ]; then
+            echo "Missing required GitHub Variables:$MISSING"
+            echo ""
+            echo "Configure these in: Settings > Secrets and variables > Actions > Variables"
+            exit 1
+          fi
+
+      - name: Setup SFP CLI and SSH
+        uses: ./.github/actions/setup-sfp
+        with:
+          gitea-token: ${{ secrets.GITEA_TOKEN }}
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+          ssh-host: ${{ vars.SSH_HOST }}
+          cli-version: ${{ vars.SFP_CLI_VERSION || 'latest' }}
+
+      - name: Update server
+        env:
+          DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
+          DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_REGISTRY_TOKEN }}
+        run: |
+          TENANT="${{ vars.TENANT_NAME }}"
+          SSH_USER="${{ vars.SSH_USER || 'root' }}"
+          SSH_HOST="${{ vars.SSH_HOST }}"
+          BASE_DIR="${{ vars.BASE_DIR || './sfp-server' }}"
+
+          # Resolve image tag: workflow input > variable > "latest"
+          TAG="${{ inputs.docker_tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="${{ vars.IMAGE_TAG || 'latest' }}"
+          fi
+
+          echo "Updating SFP Server"
+          echo "  Tenant:   $TENANT"
+          echo "  Host:     $SSH_HOST"
+          echo "  Tag:      $TAG"
+          echo "  Registry: $DOCKER_REGISTRY"
+
+          # Build the update command
+          UPDATE_CMD="sfp server update"
+          UPDATE_CMD="$UPDATE_CMD --tenant \"$TENANT\""
+          UPDATE_CMD="$UPDATE_CMD --base-dir \"$BASE_DIR\""
+          UPDATE_CMD="$UPDATE_CMD --secrets-provider custom"
+          UPDATE_CMD="$UPDATE_CMD --ssh-connection \"$SSH_USER@$SSH_HOST\""
+          UPDATE_CMD="$UPDATE_CMD --identity-file ~/.ssh/deploy_key"
+          UPDATE_CMD="$UPDATE_CMD --docker-tag \"$TAG\""
+
+          if [ "${{ inputs.skip_drain }}" = "true" ]; then
+            UPDATE_CMD="$UPDATE_CMD --skip-drain"
+          else
+            UPDATE_CMD="$UPDATE_CMD --drain-timeout ${{ inputs.drain_timeout }}"
+          fi
+
+          if [ "${{ inputs.skip_backup }}" = "true" ]; then
+            UPDATE_CMD="$UPDATE_CMD --skip-backup"
+          fi
+
+          eval "$UPDATE_CMD"
+
+      - name: Output update results
+        if: always()
+        run: |
+          TAG="${{ inputs.docker_tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="${{ vars.IMAGE_TAG || 'latest' }}"
+          fi
+
+          echo "## SFP Server Update" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Setting | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|---------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Tenant | ${{ vars.TENANT_NAME }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Host | ${{ vars.SSH_HOST }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Image Tag | $TAG |" >> $GITHUB_STEP_SUMMARY
+          echo "| Registry | ${{ vars.DOCKER_REGISTRY }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Skip Drain | ${{ inputs.skip_drain }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Skip Backup | ${{ inputs.skip_backup }} |" >> $GITHUB_STEP_SUMMARY