Community bulletin board

.env

@@ -0,0 +1 @@
+DATABASE_URL=sqlite://db.sqlite

.github/workflows/deploy.yaml

@@ -2,11 +2,12 @@ name: Deploy
 on:
   push:
     branches: [main]
+  workflow_dispatch: {}
 
 jobs:
   deploy:
     name: Deploy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
     steps:
@@ -16,14 +17,55 @@ jobs:
           targets: aarch64-unknown-linux-gnu
       - uses: Swatinem/rust-cache@v2
       - name: install gcc-aarch64-linux-gnu
-        run: sudo apt install -y gcc-aarch64-linux-gnu
-      - uses: webfactory/ssh-agent@v0.9.0
+        run: sudo apt update && sudo apt install -y gcc-aarch64-linux-gnu
+
+      - uses: actions/setup-node@v4
         with:
-          ssh-private-key: ${{ secrets.SSH_KEY }}
-      - name: ssh-keyscan
+          node-version: 23
+      - run: npm ci
+      - run: npm run build:styles.min
+
+      - name: Setup SSH key
         run: |
-          mkdir -p ~/.ssh
-          ssh-keyscan wlsd.lightandsound.design > ~/.ssh/known_hosts
+          mkdir ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.ROOT_SSH_PRIVKEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan beta.lightandsound.design > ~/.ssh/known_hosts
           chmod 600 ~/.ssh/known_hosts
-      - name: deploy
-        run: scripts/deploy.sh ec2-user@wlsd.lightandsound.design
+
+      - name: Generate config
+        run: |
+          envsubst < config/prod.toml > config/prod.toml.subst
+          mv config/prod.toml.subst config/prod.toml
+        env:
+          SMTP_USERNAME: ${{ secrets.SMTP_USERNAME }}
+          SMTP_PASSWORD: ${{ secrets.SMTP_PASSWORD }}
+          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}
+          STRIPE_PUBLISHABLE_KEY: ${{ secrets.STRIPE_PUBLISHABLE_KEY }}
+          STRIPE_WEBHOOK_KEY: ${{ secrets.STRIPE_WEBHOOK_KEY }}
+          EMAIL_FROM: ${{ secrets.EMAIL_FROM }}
+          EMAIL_CONTACT_TO: ${{ secrets.EMAIL_CONTACT_TO }}
+          EMAIL_NEWSLETTER_REPLY_TO: ${{ secrets.EMAIL_NEWSLETTER_REPLY_TO }}
+          CF_TURNSTILE_SITE_KEY: ${{ secrets.CF_TURNSTILE_SITE_KEY }}
+          CF_TURNSTILE_SECRET_KEY: ${{ secrets.CF_TURNSTILE_SECRET_KEY }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+
+      - name: Generate content hashes
+        run: |
+          set -euo pipefail
+          find frontend/templates -type f -exec perl -i -pe \
+          's|(/[^?"]+)\?version=CONTENT_HASH|my $hash=`md5sum ./frontend/$1 \| cut -d" " -f1`; chomp($hash); "$1?version=$hash"|ge' {} \;
+
+      - name: Cross compile
+        run: cargo build --release --target aarch64-unknown-linux-gnu
+        env:
+          SQLX_OFFLINE: true
+
+      - name: Deploy
+        id: deploy
+        run: scripts/deploy.sh ec2-user@beta.lightandsound.design
+
+      - name: Rollback on failure
+        if: ${{ failure() && steps.deploy.conclusion == 'failure' }}
+        run: scripts/rollback.sh ec2-user@beta.lightandsound.design

.github/workflows/rollback.yaml

@@ -0,0 +1,21 @@
+name: Rollback
+on:
+  workflow_dispatch: {}
+
+jobs:
+  rollback:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup SSH key
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ secrets.ROOT_SSH_PRIVKEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan beta.lightandsound.design > ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Rollback
+        run: scripts/rollback.sh ec2-user@beta.lightandsound.design

.github/workflows/test.yaml

@@ -1,15 +1,15 @@
 name: Test
 on:
   pull_request:
-  push:
-    branches: ["*"]
 
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -18,36 +18,57 @@ jobs:
 
   rustfmt:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
       - run: cargo fmt --check
 
+  prettier:
+    name: Format frontend
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 23
+      - run: npm ci
+      - run: npm run format:check
+
   clippy:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
       - uses: Swatinem/rust-cache@v2
       - run: cargo clippy -- -D warnings
 
   cross:
     name: Cross-compile
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
+    env:
+      SQLX_OFFLINE: true
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: aarch64-unknown-linux-gnu
       - uses: Swatinem/rust-cache@v2
       - name: install gcc-aarch64-linux-gnu
-        run: sudo apt install -y gcc-aarch64-linux-gnu
+        run: sudo apt update && sudo apt install -y gcc-aarch64-linux-gnu
       - run: cargo build --target aarch64-unknown-linux-gnu

.gitignore

@@ -1,4 +1,16 @@
-/target
+config/*
+!config/prod.toml
+!config/dev.toml
+!config/seed_data.sql
+frontend/static/main.css
+
 Cargo.lock
+target/
 *.sqlite
 *.sqlite-*
+.DS_Store
+deno.lock
+node_modules/
+venv/
+worktree/
+.env.local

.prettierignore

@@ -0,0 +1 @@
+frontend/templates/emails/