You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
95 lines
4.0 KiB
95 lines
4.0 KiB
name: Configure offband.app domains
|
|
|
|
# One-time (idempotent) setup: attaches custom domains to the offband-app
|
|
# Pages project and creates the proxied CNAME records.
|
|
#
|
|
# offband.app -> offband-app.pages.dev (production branch)
|
|
# dev.offband.app -> dev.offband-app.pages.dev (dev branch alias)
|
|
#
|
|
# The dev record deliberately targets the BRANCH ALIAS rather than the
|
|
# project root. Cloudflare's documented behaviour: a custom domain CNAME'd
|
|
# to <project>.pages.dev always serves production, so pointing dev at
|
|
# dev.<project>.pages.dev is what makes it serve the dev branch. This only
|
|
# works with Cloudflare-managed DNS and a PROXIED record; an unproxied or
|
|
# external record silently falls through to production.
|
|
#
|
|
# Manual trigger only. Domains do not need reconfiguring on every deploy,
|
|
# and this touches DNS.
|
|
#
|
|
# Mirrors OffbandMesh/offband-site/.github/workflows/configure-domains.yml,
|
|
# which is the working reference for offband.org.
|
|
#
|
|
# NOTE: offband.org belongs to a DIFFERENT Pages project (offband-site) in
|
|
# the same Cloudflare account. This workflow only ever touches the
|
|
# offband.app zone. See #339.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
domains:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
API: https://api.cloudflare.com/client/v4
|
|
ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
|
|
PAGES_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
|
|
DNS_TOKEN: ${{ secrets.CLOUDFLARE_DNS_ZONE_TOKEN }}
|
|
PROJECT: offband-app
|
|
ZONE: offband.app
|
|
steps:
|
|
- name: Attach custom domains and create DNS records
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
ZID=$(curl -s -H "Authorization: Bearer $DNS_TOKEN" \
|
|
"$API/zones?name=$ZONE" | jq -r '.result[0].id // empty')
|
|
if [ -z "$ZID" ]; then
|
|
echo "::error::Could not resolve zone id for $ZONE. Check CLOUDFLARE_DNS_ZONE_TOKEN has Zone:Read."
|
|
exit 1
|
|
fi
|
|
echo "zone $ZONE -> ${ZID:0:6}…"
|
|
|
|
# name -> CNAME target. Apex serves production; dev serves the
|
|
# dev branch alias. Cloudflare flattens the apex CNAME.
|
|
attach() {
|
|
NAME="$1"; TARGET="$2"
|
|
echo "── $NAME -> $TARGET ──"
|
|
|
|
REC=$(curl -s -H "Authorization: Bearer $DNS_TOKEN" \
|
|
"$API/zones/$ZID/dns_records?type=CNAME&name=$NAME" \
|
|
| jq -r '.result[0].id // empty')
|
|
BODY=$(jq -n --arg n "$NAME" --arg c "$TARGET" \
|
|
'{type:"CNAME",name:$n,content:$c,proxied:true}')
|
|
|
|
if [ -n "$REC" ]; then
|
|
curl -s -X PUT -H "Authorization: Bearer $DNS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$API/zones/$ZID/dns_records/$REC" --data "$BODY" \
|
|
| jq -r 'if .success then " DNS: updated" else " DNS ERR: " + (.errors|tostring) end'
|
|
else
|
|
curl -s -X POST -H "Authorization: Bearer $DNS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$API/zones/$ZID/dns_records" --data "$BODY" \
|
|
| jq -r 'if .success then " DNS: created" else " DNS ERR: " + (.errors|tostring) end'
|
|
fi
|
|
|
|
curl -s -X POST -H "Authorization: Bearer $PAGES_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$API/accounts/$ACCOUNT_ID/pages/projects/$PROJECT/domains" \
|
|
--data "$(jq -n --arg n "$NAME" '{name:$n}')" \
|
|
| jq -r 'if .success then " Pages: attached (" + (.result.status // "pending") + ")" else " Pages: " + (.errors|tostring) end'
|
|
}
|
|
|
|
attach "$ZONE" "${PROJECT}.pages.dev"
|
|
attach "dev.$ZONE" "dev.${PROJECT}.pages.dev"
|
|
|
|
curl -s -X PATCH -H "Authorization: Bearer $DNS_TOKEN" \
|
|
-H "Content-Type: application/json" \
|
|
"$API/zones/$ZID/settings/always_use_https" --data '{"value":"on"}' \
|
|
| jq -r 'if .success then "AlwaysHTTPS: on" else "AlwaysHTTPS (skip): " + (.errors|tostring) end'
|
|
|
|
echo "configure-web-domains complete"
|