homelab-platform/.github/workflows/provision-infisical.yml at main · BlakeHastings/homelab-platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Provision Infisical VM
#
# Provisions the infisical-vm on Proxmox and deploys self-hosted Infisical.
# Infisical is platform infrastructure — it provides centralized secret storage
# for all provisioning workflows across all projects.
#
# Run once. Re-running is safe (idempotent).
#
# vm_ip must match the DHCP reservation you set for MAC BC:24:11:00:01:01.
#
# Secrets are pulled via Infisical/secrets-action with GitHub OIDC. The repo
# must have variables INFISICAL_IDENTITY_ID and INFISICAL_PROJECT_SLUG set.
#
# After this workflow completes (on first install):
#   1. Open http://<vm_ip> and complete the Infisical setup wizard
#   2. Create a project and add all homelab secrets organized into
#      /proxmox, /terraform, /ansible folders
#   3. Create one machine identity per consuming repo, with OIDC auth
#      trust-bound to that repo

name: Provision Infisical

on:
  workflow_dispatch:
    inputs:
      vm_ip:
        description: "IP address of the infisical-vm (must match DHCP reservation for MAC BC:24:11:00:01:01)"
        required: true
        type: string

permissions:
  id-token: write
  contents: read

jobs:
  provision:
    uses: BlakeHastings/homelab-platform/.github/workflows/provision-vm.yml@main
    with:
      vm_name: "infisical-vm"
      cpu_cores: 2
      memory_mb: 4096
      disk_gb: 40
      terraform_working_dir: "terraform/nodes/infisical-vm"
      observability_server_ip: "observability-vm.lan"   # Alloy ships container logs + journal here
      infisical_identity_id:  ${{ vars.INFISICAL_IDENTITY_ID }}
      infisical_project_slug: ${{ vars.INFISICAL_PROJECT_SLUG }}

  deploy:
    name: "Deploy Infisical"
    needs: provision
    runs-on: [self-hosted, self-hosted-infra]
    permissions:
      id-token: write
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Load Ansible secrets from Infisical
        uses: Infisical/secrets-action@v1.0.15
        with:
          method: oidc
          identity-id:    ${{ vars.INFISICAL_IDENTITY_ID }}
          project-slug:   ${{ vars.INFISICAL_PROJECT_SLUG }}
          env-slug:       prod
          secret-path:    /ansible
          domain:         ${{ vars.INFISICAL_DOMAIN || 'http://192.168.0.161' }}
          export-type:    env

      - name: Write SSH private key
        run: |
          mkdir -p "$HOME/.ssh"
          printf '%s\n' "$ANSIBLE_PRIVATE_KEY" > "$HOME/.ssh/deploy_key"
          chmod 600 "$HOME/.ssh/deploy_key"

      - name: Run Ansible
        env:
          ANSIBLE_HOST_KEY_CHECKING: "False"
          # Ansible 2.16+ tries to add the private key to an ssh-agent; default
          # ssh_agent="none" fails immediately with "Cannot utilize private_key
          # with SSH_AGENT disabled". "auto" makes Ansible spawn an agent on
          # demand. See homelab-bootstrap skill's "Ansible 2.16+ SSH_AGENT" note.
          ANSIBLE_SSH_AGENT: "auto"
        run: |
          ansible-playbook \
            -i "${{ inputs.vm_ip }}," \
            ansible/infisical.yml \
            -e "ansible_user=ubuntu" \
            -e "ansible_ssh_private_key_file=$HOME/.ssh/deploy_key" \
            -e "ansible_ssh_common_args='-o StrictHostKeyChecking=no'" \
            -e "infisical_url=http://${{ inputs.vm_ip }}"

      - name: Cleanup SSH key
        if: always()
        run: rm -f "$HOME/.ssh/deploy_key"