deploy-server.yml

name: Deploy server to Hetzner

permissions:
  contents: read

"on":
  push:
    branches:
      - main
    paths:
      - 'server/**'

  workflow_dispatch:

concurrency:
  group: lingo-server-production
  cancel-in-progress: false

jobs:
  deploy:
    runs-on: ubuntu-latest
    timeout-minutes: 10

    environment:
      name: production
      url: https://hivelingo.greateck.com

    steps:
      - name: Deploy over SSH
        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262

        env:
          LINGO_PATH: ${{ secrets.HETZNER_LINGO_PATH }}
          DEPLOY_SHA: ${{ github.sha }}
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          DIRECT_URL: ${{ secrets.DIRECT_URL }}
          HIVE_APP_ACCOUNT: ${{ secrets.HIVE_APP_ACCOUNT }}
          HIVE_APP_POSTING_KEY: ${{ secrets.HIVE_APP_POSTING_KEY }}
          SESSION_JWT_SECRET: ${{ secrets.SESSION_JWT_SECRET }}
          ALLOWED_ORIGINS: ${{ vars.ALLOWED_ORIGINS }}
          PUZZLE_WORD_LENGTHS: ${{ vars.PUZZLE_WORD_LENGTHS }}

        with:
          host: ${{ secrets.HETZNER_HOST }}
          username: ${{ secrets.HETZNER_SSH_USER }}
          key: ${{ secrets.HETZNER_SSH_KEY }}

          fingerprint: SHA256:vNTEuyEtLoo/Ha7niDE2WRxjahvxMHbQcHdmXdy/Rqg

          envs: LINGO_PATH,DEPLOY_SHA,DATABASE_URL,DIRECT_URL,HIVE_APP_ACCOUNT,HIVE_APP_POSTING_KEY,SESSION_JWT_SECRET,ALLOWED_ORIGINS,PUZZLE_WORD_LENGTHS

          script: |
            bash -se <<'DEPLOY_SCRIPT'
            set -Eeuo pipefail

            cd "$LINGO_PATH"

            PREVIOUS_SHA="$(git rev-parse HEAD)"

            rollback() {
              exit_code=$?

              trap - ERR
              set +e

              echo "Deployment failed. Rolling back to ${PREVIOUS_SHA}..."

              cd "$LINGO_PATH"
              git checkout --force "$PREVIOUS_SHA"

              cd server
              npm ci --omit=dev
              mkdir -p logs

              sudo systemctl restart lingo

              echo "Rollback attempt finished."
              exit "$exit_code"
            }

            trap rollback ERR

            echo "Fetching release commit ${DEPLOY_SHA}..."

            git fetch origin main
            git cat-file -e "${DEPLOY_SHA}^{commit}"
            git checkout --force "$DEPLOY_SHA"

            cd server

            echo "Checking required valid-guesses data..."

            if [ ! -s data/valid-guesses.txt ]; then
              echo "ERROR: data/valid-guesses.txt is missing or empty"
              false
            fi

            echo "Writing .env from CI secrets (no hand-placed file)..."
            umask 077
            printf '%s\n' \
              "PORT=3001" \
              "NODE_ENV=production" \
              "DATABASE_URL=${DATABASE_URL}" \
              "DIRECT_URL=${DIRECT_URL}" \
              "HIVE_NETWORK=mainnet" \
              "HIVE_APP_ACCOUNT=${HIVE_APP_ACCOUNT}" \
              "HIVE_APP_POSTING_KEY=${HIVE_APP_POSTING_KEY}" \
              "HIVE_ENGINE_NODE=https://api.hive-engine.com/rpc" \
              "LINGO_TOKEN_SYMBOL=LINGO" \
              "SESSION_JWT_SECRET=${SESSION_JWT_SECRET}" \
              "ALLOWED_ORIGINS=${ALLOWED_ORIGINS}" \
              "PUZZLE_WORD_LENGTHS=${PUZZLE_WORD_LENGTHS}" > .env

            for required in DATABASE_URL DIRECT_URL HIVE_APP_ACCOUNT HIVE_APP_POSTING_KEY SESSION_JWT_SECRET ALLOWED_ORIGINS; do
              if ! grep -q "^${required}=." .env; then
                echo "ERROR: ${required} resolved empty - check the repo secret/variable"
                false
              fi
            done

            echo "Installing production dependencies..."
            npm ci --omit=dev

            mkdir -p logs

            echo "Restarting API..."

            sudo systemctl restart lingo

            APP_PORT="$(
              node --env-file=.env -e "process.stdout.write(process.env.PORT || '3001')"
            )"

            case "$APP_PORT" in
              ''|*[!0-9]*)
                echo "ERROR: invalid PORT value"
                false
                ;;
            esac

            echo "Waiting for API health check on port ${APP_PORT}..."

            HEALTHY=false

            for attempt in 1 2 3 4 5 6; do
              if curl --fail --silent --show-error \
                "http://127.0.0.1:${APP_PORT}/health" > /dev/null; then
                HEALTHY=true
                break
              fi

              echo "Health check attempt ${attempt}/6 failed."

              if [ "$attempt" -lt 6 ]; then
                sleep 5
              fi
            done

            if [ "$HEALTHY" != "true" ]; then
              echo "ERROR: API did not become healthy."

              sudo systemctl status lingo --no-pager || true
              journalctl -u lingo -n 50 --no-pager || true

              false
            fi

            trap - ERR

            echo "Deployment successful: ${DEPLOY_SHA}"

            DEPLOY_SCRIPT