fix: limit testnet capabilities #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy | |
| # Deploys the docker-compose stack to the Hetzner host via Ansible. The host has | |
| # no public SSH, so the runner joins the tailnet (Tailscale) and reaches it over | |
| # Tailscale SSH. Secrets come from GitHub Actions Secrets (no Ansible Vault). | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Never let two deploys race on the same host. | |
| concurrency: | |
| group: deploy-production | |
| cancel-in-progress: false | |
| jobs: | |
| deploy: | |
| runs-on: ubuntu-latest | |
| environment: production | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Connect to Tailscale | |
| uses: tailscale/github-action@v3 | |
| with: | |
| oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} | |
| oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} | |
| # `tag:dashtec-ci` must exist in the tailnet ACL's tagOwners, and the | |
| # ACL must allow it to SSH to `tag:dashtec` as root with | |
| # `action: accept` (not `check`, which needs a browser approval). | |
| # Both live in foundation-iac/rpc.aztec.foundation/tailscale.tf, which | |
| # owns the tailnet ACL singleton for the whole tailnet. | |
| # | |
| # This was `tag:ci`, which no tagOwner ever granted — the OAuth client | |
| # could not mint it, so this step failed on every run and the deploy | |
| # never reached Ansible. Renamed to match the `tag:eth-rpc-ci` | |
| # convention rather than claim a bare `tag:ci` in a shared tailnet. | |
| tags: tag:dashtec-ci | |
| - name: Install Ansible | |
| run: pipx install --include-deps ansible | |
| - name: Write inventory | |
| run: | | |
| cat > ansible/inventory.ini <<EOF | |
| [dashtec] | |
| ${{ vars.DEPLOY_HOST || 'dashtec-host' }} ansible_user=root | |
| [dashtec:vars] | |
| ansible_python_interpreter=/usr/bin/python3 | |
| EOF | |
| - name: Run Ansible | |
| working-directory: ansible | |
| run: ansible-playbook site.yml | |
| env: | |
| ANSIBLE_HOST_KEY_CHECKING: "False" | |
| # Per-network secrets injected into the committed config.json. | |
| # L1 execution RPC (Ponder, collectors, Aztec node) and L1 beacon API | |
| # (Aztec node only — it fetches the blobs carrying checkpoint data). | |
| # There is no *_SENTINEL_PROXY_URL any more: the dashboard now talks to | |
| # the Aztec node we run ourselves in docker-compose. | |
| MAINNET_ETHEREUM_RPC_URL: ${{ secrets.MAINNET_ETHEREUM_RPC_URL }} | |
| MAINNET_L1_CONSENSUS_HOST_URLS: ${{ secrets.MAINNET_L1_CONSENSUS_HOST_URLS }} | |
| MAINNET_SESSION_PASSWORD: ${{ secrets.MAINNET_SESSION_PASSWORD }} | |
| TESTNET_ETHEREUM_RPC_URL: ${{ secrets.TESTNET_ETHEREUM_RPC_URL }} | |
| TESTNET_L1_CONSENSUS_HOST_URLS: ${{ secrets.TESTNET_L1_CONSENSUS_HOST_URLS }} | |
| TESTNET_SESSION_PASSWORD: ${{ secrets.TESTNET_SESSION_PASSWORD }} | |
| # OAuth, shared across networks (one app each). IDs are public | |
| # (variables); secrets are sensitive. | |
| DISCORD_CLIENT_ID: ${{ vars.DISCORD_CLIENT_ID }} | |
| DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }} | |
| X_CLIENT_ID: ${{ vars.X_CLIENT_ID }} | |
| X_CLIENT_SECRET: ${{ secrets.X_CLIENT_SECRET }} |