Deploy static dashboard on push

Author: iPior

.github/workflows/deploy.yml

@@ -0,0 +1,78 @@
+name: Deploy static site
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deploy-static-site
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Build and deploy
+    runs-on: ubuntu-latest
+
+    env:
+      DEPLOY_HOST: ${{ secrets.DASHBOARD_DEPLOY_HOST }}
+      DEPLOY_USER: ${{ secrets.DASHBOARD_DEPLOY_USER }}
+      DEPLOY_KEY: ${{ secrets.DASHBOARD_DEPLOY_KEY }}
+      DEPLOY_PATH: ${{ secrets.DASHBOARD_DEPLOY_PATH }}
+      DEPLOY_PORT: ${{ secrets.DASHBOARD_DEPLOY_PORT || '22' }}
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.8.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build static files
+        run: pnpm run build
+
+      - name: Configure SSH
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          test -n "$DEPLOY_HOST"
+          test -n "$DEPLOY_USER"
+          test -n "$DEPLOY_KEY"
+          test -n "$DEPLOY_PATH"
+
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+          ssh-keyscan -p "$DEPLOY_PORT" "$DEPLOY_HOST" >> ~/.ssh/known_hosts
+
+      - name: Replace Caddy static files
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          SSH_TARGET="${DEPLOY_USER}@${DEPLOY_HOST}"
+          SSH_COMMAND="ssh -i ~/.ssh/deploy_key -p ${DEPLOY_PORT}"
+          REMOTE_PATH="${DEPLOY_PATH%/}"
+
+          $SSH_COMMAND "$SSH_TARGET" "mkdir -p '$REMOTE_PATH'"
+
+          rsync -az --delete \
+            --exclude 'links.json' \
+            -e "$SSH_COMMAND" \
+            dist/ "$SSH_TARGET:$REMOTE_PATH/"

README.md

@@ -21,3 +21,16 @@ The static output is written to `dist/` and can be served by any static file ser
 To add links, edit `public/links.json`. That file is ignored by git; `public/links.example.json` is the safe
 committed template. Anyone who can load the deployed dashboard can also read `/links.json`, so only deploy it
 where those links can be visible to viewers.
+
+## Deployment
+
+Pushes to `main` rebuild the static files with GitHub Actions and sync `dist/` to the Caddy web root over SSH.
+The sync preserves `links.json` on the server, so keep the production copy at the root Caddy serves.
+
+Required repository secrets:
+
+- `DASHBOARD_DEPLOY_HOST`
+- `DASHBOARD_DEPLOY_USER`
+- `DASHBOARD_DEPLOY_KEY`
+- `DASHBOARD_DEPLOY_PATH`
+- `DASHBOARD_DEPLOY_PORT` optional, defaults to `22`