name: Deploy Pounce on: push: branches: - main jobs: deploy: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Setup SSH run: | mkdir -p ~/.ssh echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key ssh-keyscan -H 185.142.213.170 >> ~/.ssh/known_hosts 2>/dev/null - name: Sync Backend Code run: | rsync -avz --delete \ -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \ --exclude '__pycache__' \ --exclude '*.pyc' \ --exclude '.git' \ backend/ \ administrator@185.142.213.170:/tmp/pounce-backend/ - name: Sync Frontend Code run: | rsync -avz --delete \ -e "ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no" \ --exclude 'node_modules' \ --exclude '.next' \ --exclude '.git' \ frontend/ \ administrator@185.142.213.170:/tmp/pounce-frontend/ - name: Build and Deploy env: DATABASE_URL: ${{ secrets.DATABASE_URL }} SECRET_KEY: ${{ secrets.SECRET_KEY }} SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }} STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }} STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }} GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} GH_OAUTH_SECRET: ${{ secrets.GH_OAUTH_SECRET }} CZDS_USERNAME: ${{ secrets.CZDS_USERNAME }} CZDS_PASSWORD: ${{ secrets.CZDS_PASSWORD }} run: | ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no administrator@185.142.213.170 << 'DEPLOY_SCRIPT' # Build backend cd /tmp/pounce-backend sudo docker build -t pounce-backend:latest . || exit 1 # Build frontend cd /tmp/pounce-frontend sudo docker build \ --build-arg NEXT_PUBLIC_API_URL=https://api.pounce.ch \ --build-arg BACKEND_URL=http://pounce-backend:8000 \ -t pounce-frontend:latest . || exit 1 echo "✅ Images built successfully" DEPLOY_SCRIPT - name: Deploy Containers env: DATABASE_URL: ${{ secrets.DATABASE_URL }} SECRET_KEY: ${{ secrets.SECRET_KEY }} SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }} STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }} STRIPE_WEBHOOK_SECRET: ${{ secrets.STRIPE_WEBHOOK_SECRET }} GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }} GH_OAUTH_SECRET: ${{ secrets.GH_OAUTH_SECRET }} CZDS_USERNAME: ${{ secrets.CZDS_USERNAME }} CZDS_PASSWORD: ${{ secrets.CZDS_PASSWORD }} run: | ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no administrator@185.142.213.170 << DEPLOY_CONTAINERS # Deploy Backend sudo docker stop pounce-backend 2>/dev/null || true sudo docker rm pounce-backend 2>/dev/null || true sudo mkdir -p /data/pounce/zones sudo chmod -R 777 /data/pounce/zones sudo docker run -d \ --name pounce-backend \ --network n0488s44osgoow4wgo04ogg0 \ --restart unless-stopped \ --shm-size=8g \ -v /data/pounce/zones:/data \ -e DATABASE_URL="${DATABASE_URL}" \ -e SECRET_KEY="${SECRET_KEY}" \ -e JWT_SECRET="${SECRET_KEY}" \ -e REDIS_URL="redis://pounce-redis:6379/0" \ -e ENABLE_SCHEDULER="true" \ -e ENVIRONMENT="production" \ -e CORS_ORIGINS="https://pounce.ch,https://www.pounce.ch" \ -e COOKIE_SECURE="true" \ -e SITE_URL="https://pounce.ch" \ -e CZDS_DATA_DIR="/data/czds" \ -e CZDS_USERNAME="${CZDS_USERNAME}" \ -e CZDS_PASSWORD="${CZDS_PASSWORD}" \ -e SMTP_HOST="smtp.zoho.eu" \ -e SMTP_PORT="465" \ -e SMTP_USER="hello@pounce.ch" \ -e SMTP_PASSWORD="${SMTP_PASSWORD}" \ -e SMTP_FROM_EMAIL="hello@pounce.ch" \ -e SMTP_USE_SSL="true" \ -e STRIPE_SECRET_KEY="${STRIPE_SECRET_KEY}" \ -e STRIPE_PUBLISHABLE_KEY="pk_live_51ScLbjCtFUamNRpNeFugrlTIYhszbo8GovSGiMnPwHpZX9p3SGtgG8iRHYRIlAtg9M9sl3mvT5r8pwXP3mOsPALG00Wk3j0wH4" \ -e STRIPE_PRICE_TRADER="price_1ScRlzCtFUamNRpNQdMpMzxV" \ -e STRIPE_PRICE_TYCOON="price_1SdwhSCtFUamNRpNEXTSuGUc" \ -e STRIPE_WEBHOOK_SECRET="${STRIPE_WEBHOOK_SECRET}" \ -e GOOGLE_CLIENT_ID="865146315769-vi7vcu91d3i7huv8ikjun52jo9ob7spk.apps.googleusercontent.com" \ -e GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}" \ -e GOOGLE_REDIRECT_URI="https://pounce.ch/api/v1/oauth/google/callback" \ -e GITHUB_CLIENT_ID="Ov23liBjROk39vYXi3G5" \ -e GITHUB_CLIENT_SECRET="${GH_OAUTH_SECRET}" \ -e GITHUB_REDIRECT_URI="https://pounce.ch/api/v1/oauth/github/callback" \ -l "traefik.enable=true" \ -l "traefik.http.routers.pounce-api.rule=Host(\\\`api.pounce.ch\\\`)" \ -l "traefik.http.routers.pounce-api.entryPoints=https" \ -l "traefik.http.routers.pounce-api.tls=true" \ -l "traefik.http.routers.pounce-api.tls.certresolver=letsencrypt" \ -l "traefik.http.services.pounce-api.loadbalancer.server.port=8000" \ pounce-backend:latest sudo docker network connect coolify pounce-backend 2>/dev/null || true # Deploy Frontend sudo docker stop pounce-frontend 2>/dev/null || true sudo docker rm pounce-frontend 2>/dev/null || true sudo docker run -d \ --name pounce-frontend \ --network coolify \ --restart unless-stopped \ -l "traefik.enable=true" \ -l "traefik.http.routers.pounce-web.rule=Host(\\\`pounce.ch\\\`) || Host(\\\`www.pounce.ch\\\`)" \ -l "traefik.http.routers.pounce-web.entryPoints=https" \ -l "traefik.http.routers.pounce-web.tls=true" \ -l "traefik.http.routers.pounce-web.tls.certresolver=letsencrypt" \ -l "traefik.http.services.pounce-web.loadbalancer.server.port=3000" \ pounce-frontend:latest sudo docker network connect n0488s44osgoow4wgo04ogg0 pounce-frontend 2>/dev/null || true echo "✅ Containers deployed" DEPLOY_CONTAINERS - name: Health Check run: | sleep 20 curl -sf https://api.pounce.ch/api/v1/health || echo "Backend starting..." curl -sf https://pounce.ch || echo "Frontend starting..." - name: Cleanup run: | ssh -i ~/.ssh/deploy_key administrator@185.142.213.170 "sudo docker image prune -f; sudo docker container prune -f" - name: Summary run: | echo "==========================================" echo "🎉 DEPLOYMENT SUCCESSFUL!" echo "==========================================" echo "Commit: ${{ github.sha }}" echo "Frontend: https://pounce.ch" echo "Backend: https://api.pounce.ch" echo "=========================================="