arcodangeandClaude Opus 5.5
ef74673037
dflook/terraform-apply est une action CONTENEUR ; depuis 93e7abf (2026-08-26) les conteneurs de job reçoivent --add-host, et Docker refuse de lancer le conteneur de l'action dans le réseau du job (« conflicting options: custom host-to-IP mapping and the network mode », run 10014 sur pi3). Le dernier apply réussi datait du 2026-07-24 (pi1). OpenTofu s'installe désormais par opentofu/setup-opentofu (JavaScript) et tourne dans ubuntu-latest-ca. Un dispatch peut demander mode=plan pour lire le plan sans rien appliquer ; un push applique comme avant.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
96 lines
3.5 KiB
YAML
96 lines
3.5 KiB
YAML
---
|
|
# template source: https://github.com/bretfisher/docker-build-workflow/blob/main/templates/call-docker-build.yaml
|
|
name: IAC
|
|
|
|
on: #[push,pull_request]
|
|
workflow_dispatch:
|
|
inputs:
|
|
mode:
|
|
description: "plan : montrer ce qui changerait, sans rien appliquer ; apply : appliquer"
|
|
type: choice
|
|
options: [apply, plan]
|
|
default: apply
|
|
push: &tofuPaths
|
|
paths:
|
|
- 'iac/*.tf'
|
|
- 'iac/*.tfvars'
|
|
- 'iac/**/*.tf'
|
|
- 'iac/**/*.tfvars'
|
|
pull_request: *tofuPaths
|
|
|
|
# cancel any previously-started, yet still active runs of this workflow on the same branch
|
|
concurrency:
|
|
group: ${{ github.ref }}-${{ github.workflow }}
|
|
cancel-in-progress: true
|
|
|
|
.vault_step: &vault_step
|
|
name: read vault secret
|
|
uses: https://gitea.arcodange.lab/arcodange-org/vault-action.git@main
|
|
id: vault-secrets
|
|
with:
|
|
url: https://vault.arcodange.lab
|
|
caCertificate: ${{ secrets.HOMELAB_CA_CERT }}
|
|
jwtGiteaOIDC: ${{ needs.gitea_vault_auth.outputs.gitea_vault_jwt }}
|
|
role: gitea_cicd
|
|
method: jwt
|
|
path: gitea_jwt
|
|
secrets: |
|
|
kvv1/google/credentials credentials | GOOGLE_CREDENTIALS ;
|
|
kvv1/admin/gitea token | GITEA_TOKEN ;
|
|
kvv1/admin/cloudflare iam_token | CLOUDFLARE_API_TOKEN ;
|
|
kvv1/admin/ovh/app * | OVH_ ;
|
|
jobs:
|
|
gitea_vault_auth:
|
|
name: Auth with gitea for vault
|
|
runs-on: ubuntu-latest-ca
|
|
outputs:
|
|
gitea_vault_jwt: ${{steps.gitea_vault_jwt.outputs.id_token}}
|
|
steps:
|
|
|
|
- name: Auth with gitea for vault
|
|
id: gitea_vault_jwt
|
|
run: |
|
|
echo -n "${{ secrets.vault_oauth__sh_b64 }}" | base64 -d | bash
|
|
|
|
tofu:
|
|
name: Tofu
|
|
needs:
|
|
- gitea_vault_auth
|
|
runs-on: ubuntu-latest-ca
|
|
env:
|
|
OPENTOFU_VERSION: 1.8.2
|
|
TERRAFORM_VAULT_AUTH_JWT: ${{ needs.gitea_vault_auth.outputs.gitea_vault_jwt }}
|
|
VAULT_CACERT: "${{ github.workspace }}/homelab.pem"
|
|
steps:
|
|
- *vault_step
|
|
- uses: actions/checkout@v4
|
|
- name: prepare vault self signed cert
|
|
run: echo -n "${{ secrets.HOMELAB_CA_CERT }}" | base64 -d > $VAULT_CACERT
|
|
# ⚠ PLUS DE `dflook/terraform-apply` (2026-10-08) : c'est une action CONTENEUR, et
|
|
# depuis 93e7abf (2026-08-26) les conteneurs de job reçoivent `--add-host` (résolution
|
|
# figée de la forge, 03_cicd.yml). Docker refuse alors de lancer le conteneur de
|
|
# l'action dans le réseau du job : « conflicting options: custom host-to-IP mapping
|
|
# and the network mode » — le dernier apply réussi datait du 2026-07-24 (pi1).
|
|
# OpenTofu tourne donc DANS le conteneur du job (ubuntu-latest-ca, qui connaît la CA
|
|
# du homelab), installé par une action JavaScript.
|
|
- name: install OpenTofu
|
|
uses: opentofu/setup-opentofu@v1
|
|
with:
|
|
tofu_version: ${{ env.OPENTOFU_VERSION }}
|
|
tofu_wrapper: false
|
|
- name: tofu init
|
|
working-directory: iac
|
|
run: tofu init -input=false
|
|
- name: tofu plan
|
|
working-directory: iac
|
|
env:
|
|
TF_VAR_gitea_cacert_file: "${{ github.workspace }}/homelab.pem"
|
|
run: tofu plan -input=false -out=plan.tfplan
|
|
# Un `push` (sans entrée) applique, comme avant ; un dispatch en `plan` s'arrête ici.
|
|
- name: tofu apply
|
|
if: ${{ github.event_name != 'workflow_dispatch' || inputs.mode != 'plan' }}
|
|
working-directory: iac
|
|
env:
|
|
TF_VAR_gitea_cacert_file: "${{ github.workspace }}/homelab.pem"
|
|
run: tofu apply -input=false plan.tfplan
|