134 lines
5 KiB
YAML
134 lines
5 KiB
YAML
name: Continuous Integration
|
|
|
|
on:
|
|
push:
|
|
schedule:
|
|
- cron: "0 0 * * TUE"
|
|
|
|
concurrency: ${{ github.workflow }}-${{ github.ref }}
|
|
|
|
env:
|
|
platforms: "linux/amd64,linux/arm64,linux/arm/v6,linux/arm/v7"
|
|
|
|
jobs:
|
|
ci:
|
|
name: Continuous Integration
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Get date
|
|
id: date
|
|
uses: josStorer/get-current-time@v2
|
|
with:
|
|
format: YYYY-MM-DD
|
|
|
|
- name: Install wireguard
|
|
run: sudo apt-get install wireguard
|
|
|
|
- name: Download WireGuard config
|
|
run: echo '${{ secrets.WIREGUARD_CONF }}' > wireguard.conf
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build local image for testing
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
pull: true
|
|
load: true
|
|
tags: wireguard
|
|
|
|
- name: Test tunnel
|
|
run: |
|
|
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
|
normal_ip=$(docker run --rm curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
|
wireguard_ip=$(docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
|
if [ "$normal_ip" = "$wireguard_ip" ]; then echo "normal ip and wireguard ip are the same" && exit 1; fi
|
|
docker stop wireguard
|
|
|
|
- name: Test kill switch
|
|
run: |
|
|
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
|
docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
|
docker exec wireguard wg-quick down wg0
|
|
! docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
|
docker stop wireguard
|
|
|
|
- name: Test local subnets
|
|
run: |
|
|
ip_address=$(ip route get 1.2.3.4 | awk '{print $7}')
|
|
docker run --rm -d --name nginx -p 8080:80 nginx
|
|
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -e LOCAL_SUBNETS=$ip_address/32 wireguard
|
|
sleep 3
|
|
docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 $ip_address:8080
|
|
docker stop wireguard nginx
|
|
|
|
- name: Test exposed ports
|
|
run: |
|
|
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -p 8080:80 wireguard
|
|
docker run --rm -d --name nginx --net=container:wireguard nginx
|
|
sleep 3
|
|
curl --retry 3 --retry-delay 5 localhost:8080
|
|
docker stop wireguard nginx
|
|
|
|
- name: Log into Docker Hub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: jordanpotter
|
|
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
|
|
|
|
- name: Log into GitHub Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Get metadata for image
|
|
id: metadata
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: |
|
|
jordanpotter/wireguard
|
|
ghcr.io/${{ github.repository }}
|
|
tags: |
|
|
type=raw,value=${{ steps.date.outputs.formattedTime }},enable=${{ github.event_name == 'schedule' }}
|
|
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
|
|
|
|
- name: Build images
|
|
if: ${{ github.ref != 'refs/heads/main' }}
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
pull: true
|
|
push: false
|
|
tags: ${{ steps.metadata.outputs.tags }}
|
|
labels: ${{ steps.metadata.outputs.labels }}
|
|
platforms: ${{ env.platforms }}
|
|
|
|
- name: Build and push images
|
|
if: ${{ github.ref == 'refs/heads/main' }}
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
pull: true
|
|
push: true
|
|
tags: ${{ steps.metadata.outputs.tags }}
|
|
labels: ${{ steps.metadata.outputs.labels }}
|
|
platforms: ${{ env.platforms }}
|
|
|
|
- name: Update Docker Hub description
|
|
if: ${{ github.ref == 'refs/heads/main' }}
|
|
uses: peter-evans/dockerhub-description@v3
|
|
with:
|
|
repository: jordanpotter/wireguard
|
|
username: jordanpotter
|
|
password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
|
|
short-description: ${{ github.event.repository.description }}
|