feat: fix networks

.gitea/workflows/deploy.yml

@@ -81,7 +81,22 @@ jobs:
               chmod 700 /root/.ssh
               printf "%s\n" "$SSH_PRIVATE_KEY" | tr -d "\r" > /root/.ssh/id_ed25519
               chmod 600 /root/.ssh/id_ed25519
-              ssh-keyscan -H "${SSH_HOST:-89.167.35.217}" >> /root/.ssh/known_hosts
+
+              REMOTE_HOST="${SSH_HOST:-89.167.35.217}"
+              REMOTE_USER="${SSH_USER:-root}"
+
+              mkdir -p /workdir/.ssh
+              cat > /workdir/.ssh/config <<'"'"'SSH_CONFIG'"'"'
+          Host *
+            IdentityFile /root/.ssh/id_ed25519
+            IdentitiesOnly yes
+            StrictHostKeyChecking yes
+            UserKnownHostsFile /workdir/.ssh/known_hosts
+            GlobalKnownHostsFile /dev/null
+            CheckHostIP no
+          SSH_CONFIG
+              ssh-keyscan -H "$REMOTE_HOST" > /workdir/.ssh/known_hosts
+              chmod 600 /workdir/.ssh/config /workdir/.ssh/known_hosts
 
               mkdir -p .kamal
               cat > .kamal/secrets <<'"'"'SECRETS'"'"'
@@ -94,17 +109,15 @@ jobs:
           SECRETS
               chmod 600 .kamal/secrets
 
-              REMOTE_HOST="${SSH_HOST:-89.167.35.217}"
+              ssh -F /workdir/.ssh/config "$REMOTE_USER@$REMOTE_HOST" <<'"'"'REMOTE'"'"'
-              REMOTE_USER="${SSH_USER:-root}"
-
-              ssh "$REMOTE_USER@$REMOTE_HOST" <<'"'"'REMOTE'"'"'
           set -eu
 
-          docker network inspect kamal >/dev/null 2>&1 || docker network create kamal
+          docker network inspect bemeal_public >/dev/null 2>&1 || docker network create bemeal_public
+          docker network inspect bemeal_internal >/dev/null 2>&1 || docker network create bemeal_internal
 
           for container in bemeal-pgsql bemeal-redis bemeal-meilisearch bemeal-adminer; do
             if docker inspect "$container" >/dev/null 2>&1; then
-              docker network connect kamal "$container" >/dev/null 2>&1 || true
+              docker network connect bemeal_internal "$container" >/dev/null 2>&1 || true
             fi
           done
           REMOTE

config/deploy.yml

@@ -4,15 +4,27 @@ image: daily_meal/bemeal-api
 x-hosts: &hosts
   - <%= ENV.fetch("SSH_HOST", "89.167.35.217") %>
 
+x-web-networks: &web-networks
+  network:
+    - bemeal_public
+    - bemeal_internal
+
+x-worker-networks: &worker-networks
+  network:
+    - bemeal_internal
+
 servers:
   web:
     hosts: *hosts
+    options: *web-networks
   horizon:
     hosts: *hosts
     cmd: php artisan horizon
+    options: *worker-networks
   scheduler:
     hosts: *hosts
     cmd: php artisan schedule:work
+    options: *worker-networks
 
 proxy:
   host: bemeal.leonmorival.com
@@ -29,6 +41,7 @@ registry:
 
 ssh:
   user: <%= ENV.fetch("SSH_USER", "root") %>
+  config: .ssh/config
 
 builder:
   arch: amd64

docker-compose.prod.yml

@@ -17,7 +17,7 @@ services:
       timeout: 5s
       retries: 10
     networks:
-      - kamal
+      - internal
 
   redis:
     image: redis:alpine
@@ -26,7 +26,7 @@ services:
     volumes:
       - redis-data:/data
     networks:
-      - kamal
+      - internal
 
   adminer:
     image: adminer:latest
@@ -35,7 +35,7 @@ services:
     environment:
       ADMINER_DEFAULT_SERVER: bemeal-pgsql
     networks:
-      - kamal
+      - internal
 
   meilisearch:
     image: getmeili/meilisearch:latest
@@ -47,7 +47,7 @@ services:
     volumes:
       - meilisearch-data:/meili_data
     networks:
-      - kamal
+      - internal
 
 volumes:
   pgsql-data:
@@ -61,6 +61,6 @@ volumes:
     name: bemeal_meilisearch_data
 
 networks:
-  kamal:
+  internal:
     external: true
-    name: kamal
+    name: bemeal_internal