JUNOHUB-test/.github/workflows/deploy-ec2.yml

name: build-deploy-junohub-ec2

env:
  IMAGE_NAME: junohub-app
  CONTAINER_NAME: junohub-app
  # Absolute directory on the EC2 instance where app + compose live
  REMOTE_DIR: /home/ubuntu/JUNO

on:
  workflow_dispatch:
  push:
    branches:
      - main
    paths-ignore:
      - '*.md'
      - '.gitignore'
      - 'docs/**'
      - 'README.md'

jobs:
  build-and-deploy:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Next.js embeds NEXT_PUBLIC_* at build time. Create .env from EC2_ENV so the Docker build sees it.
      - name: Create .env for build
        run: |
          cat > .env << 'ENVFILE'
          ${{ secrets.EC2_ENV }}
          ENVFILE
          echo "NEXT_PUBLIC_VAPID_PUBLIC_KEY is set: $(grep -q 'NEXT_PUBLIC_VAPID_PUBLIC_KEY=.' .env && echo yes || echo no)"          

      - name: Build application image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: Dockerfile
          push: false
          load: true
          tags: ${{ env.IMAGE_NAME }}:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Save application image
        run: |
          mkdir -p docker
          docker save -o docker/junohub-app_latest.tar ${{ env.IMAGE_NAME }}:latest
          echo "✅ Saved application image"          

      - name: Set up environment file
        run: |
          # Base env for production container
          echo "IMAGE_NAME=${{ env.IMAGE_NAME }}" > .env
          echo "CONTAINER_NAME=${{ env.CONTAINER_NAME }}" >> .env
          echo "NODE_ENV=production" >> .env

          # Append project-specific environment from EC2_ENV secret
          # EC2_ENV should contain additional KEY=VALUE lines. We use a here-doc
          # so the secret content is treated as literal text and not executed.
          cat <<'EOF' >> .env
          ${{ secrets.EC2_ENV }}
          EOF

          echo "Environment file created with EC2_ENV contents appended."          

      - name: Setup SSH
        run: |
          # Set up the SSH key from GitHub Secrets
          echo "${{ secrets.EC2_SSH_KEY }}" | tr -d '\r' > ssh_key.pem
          chmod 400 ssh_key.pem          

      - name: Setup directories on server
        run: |
          ssh -i ssh_key.pem -o StrictHostKeyChecking=no ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'ENDSSH'
          # Create directory for docker-compose file, .env and image tar
          mkdir -p ${{ env.REMOTE_DIR }}
          echo "✅ Remote directory ensured at ${{ env.REMOTE_DIR }}"
          ENDSSH          

      - name: Copy deployment files to server
        run: |
          # Copy docker-compose (app + Postgres), and .env
          scp -i ssh_key.pem -o StrictHostKeyChecking=no docker-compose.yml ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/docker-compose.yml
          scp -i ssh_key.pem -o StrictHostKeyChecking=no .env ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/.env

          # Copy application image tar
          echo "Copying Docker image to server..."
          scp -i ssh_key.pem -o StrictHostKeyChecking=no docker/junohub-app_latest.tar ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }}:${{ env.REMOTE_DIR }}/junohub-app_latest.tar
          echo "✅ Successfully copied Docker image to server"          

      - name: Deploy with rolling update
        run: |
          ssh -i ssh_key.pem -o StrictHostKeyChecking=no ${{ secrets.EC2_USER }}@${{ secrets.EC2_HOST }} << 'ENDSSH'
          set -e
          cd ${{ env.REMOTE_DIR }}

          # Basic disk space check (do not touch volumes)
          echo "=== DISK SPACE CHECK ==="
          df -h
          AVAILABLE_SPACE=$(df -BG / | tail -1 | awk '{print $4}' | sed 's/G//')
          if [ "$AVAILABLE_SPACE" -lt 5 ]; then
            echo "⚠️  Low disk space: ${AVAILABLE_SPACE}GB available. Cleaning up dangling images..."
            docker system prune -af --volumes=false || true
            docker image prune -af || true
            df -h
          fi

          # Verify Docker image tar exists
          if [ ! -f junohub-app_latest.tar ]; then
            echo "ERROR: No application image tar found. Cannot deploy without pre-built image."
            exit 1
          fi

          echo "=== LOADING APPLICATION DOCKER IMAGE ==="
          docker load -i junohub-app_latest.tar
          rm -f junohub-app_latest.tar
          echo "✅ Application image loaded"

          # Rolling update with docker compose (app + Postgres)
          echo "=== ROLLING UPDATE (docker compose up -d) ==="
          if ! docker compose -f docker-compose.yml --env-file .env up -d --remove-orphans; then
            echo "ERROR: Deployment failed"
            docker compose -f docker-compose.yml down || true
            exit 1
          fi

          echo "✅ Deployment successful! Current services:"
          docker compose -f docker-compose.yml --env-file .env ps

          # Final cleanup (preserve volumes; prune dangling images only)
          docker system prune -f --volumes=false || true
          ENDSSH          

      - name: Local cleanup
        if: always()
        run: |
          rm -f ssh_key.pem
          rm -f .env
          rm -f docker/*.tar || true
          docker system prune -f || true