使用GitHub Actions工作流连接到远程服务器使用OpenVPN。

huangapple
go评论94阅读模式
英文:

connecting to a remote server using openvpn in a github actions workflow

问题

这是我的GitHub Actions中的CI工作流程：

  1. name: CI
  3. on:
  4.   push:
  5.     branches: ["main"]
  7. jobs:
  8.   docker-build:
  9.     runs-on: ubuntu-latest
  10.     steps:
  11.       - uses: actions/checkout@v3
  13.       - name: Install Poetry
  14.         uses: snok/install-poetry@v1
  16.       - name: create requirements
  17.         run: poetry export --without-hashes --format=requirements.txt > requirements.txt
  19.       - name: Login to Docker Hub
  20.         uses: docker/login-action@v2
  21.         with:
  22.           username: ${{ secrets.DOCKERHUB_USERNAME }}
  23.           password: ${{ secrets.DOCKERHUB_PASSWORD }}
  25.       - name: Build and push image
  26.         uses: docker/build-push-action@v3
  27.         with:
  28.           context: .
  29.           push: true
  30.           tags: ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}
  32.       - name: Deploy to Staging
  33.         uses: appleboy/ssh-action@v0.1.10
  34.         env: 
  35.           OVPN_CONFIG: ${{ secrets.VPN_CONFIG }}
  36.           VPN_USERNAME: ${{ secrets.VPN_USERNAME }}
  37.           VPN_PASSWORD: ${{ secrets.VPN_PASSWORD }}
  38.         with:
  39.           host: ${{ secrets.STAGING_SERVER_HOST }}
  40.           username: ${{ secrets.STAGING_SERVER_USERNAME }}
  41.           password: ${{ secrets.STAGING_SERVER_PASSWORD }}   
  42.           envs: OVPN_CONFIG,VPN_USERNAME,VPN_PASSWORD
  43.           script: |
  44.             echo "${OVPN_CONFIG}" > vpn-config.ovpn
  45.             echo "${VPN_USERNAME}" > vpn-credentials.txt
  46.             echo "${VPN_PASSWORD}" >> vpn-credentials.txt            
  47.       
  48.             openvpn --config vpn-config.ovpn --auth-user-pass vpn-credentials.txt
  49.             sleep 5
  51.             ls -la
  53.             docker pull ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}:latest
  54.             docker run -d ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}:latest
  55.       
  56.             # Cleanup: Delete the temporary VPN credentials file
  57.             rm vpn-credentials.txt

这个工作流程用于构建Docker镜像并在每次推送到主分支时将其上传到Docker Hub，这部分工作正常运行。然后，我希望使用SSH连接到预计托管应用程序的服务器，但为了实现这一点，我必须使用OpenVPN建立VPN连接。这部分似乎有问题，因为连接似乎没有建立。我在这里做错了什么吗？

以下是部分工作流程日志：

  1. ***[command]/usr/bin/docker run --name ed866e71fb8133109f4ad988af16a3b2ab46f2_a1dfd1 --label ed866e --workdir /github/workspace --rm -e "VENV" -e "OVPN_CONFIG" -e "VPN_USERNAME" -e "VPN_PASSWORD" ...
  2. ======CMD======
  3. echo "${OVPN_CONFIG}" > vpn-config.ovpn
  4. echo "${VPN_USERNAME}" > vpn-credentials.txt
  5. echo "${VPN_PASSWORD}" >> vpn-credentials.txt
  7. openvpn --config vpn-config.ovpn --*** vpn-credentials.txt
  8. sleep 5
  10. ls -la
  12. *** docker pull ***/***:latest
  13. *** docker run -d --name meteor-bot ***/***:latest
  15. *** Cleanup: Delete the temporary VPN credentials file
  16. rm vpn-credentials.txt
  17. ======END======
  18. 2023/06/15 17:14:46 dial tcp ***:22: i/o timeout
英文:

This is my CI workflow in Github Actions:

  1. name: CI
  3. on:
  4.   push:
  5.     branches: [ "main" ]
  7. jobs:
  8.   docker-build:
  9.     runs-on: ubuntu-latest
  10.     steps:
  11.       - uses: actions/checkout@v3
  13.       - name: Install Poetry
  14.         uses: snok/install-poetry@v1
  16.       - name: create requirements
  17.         run: poetry export --without-hashes --format=requirements.txt > requirements.txt
  19.       - name: Login to Docker Hub
  20.         uses: docker/login-action@v2
  21.         with:
  22.           username: ${{ secrets.DOCKERHUB_USERNAME }}
  23.           password: ${{ secrets.DOCKERHUB_PASSWORD }}
  24.           
  25.       - name: Build and push image
  26.         uses: docker/build-push-action@v3
  27.         with:
  28.           context: .
  29.           push: true
  30.           tags: ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}
  31.         
  32.       - name: Deploy to Staging
  33.         uses: appleboy/ssh-action@v0.1.10
  34.         env: 
  35.           OVPN_CONFIG: ${{ secrets.VPN_CONFIG }}
  36.           VPN_USERNAME: ${{ secrets.VPN_USERNAME }}
  37.           VPN_PASSWORD: ${{ secrets.VPN_PASSWORD }}
  38.         with:
  39.           host: ${{ secrets.STAGING_SERVER_HOST }}
  40.           username: ${{ secrets.STAGING_SERVER_USERNAME }}
  41.           password: ${{ secrets.STAGING_SERVER_PASSWORD }}   
  42.           envs: OVPN_CONFIG,VPN_USERNAME,VPN_PASSWORD
  43.           script: |
  44.             echo "${OVPN_CONFIG}" > vpn-config.ovpn
  45.             echo "${VPN_USERNAME}" > vpn-credentials.txt
  46.             echo "${VPN_PASSWORD}" >> vpn-credentials.txt
  47.       
  48.             openvpn --config vpn-config.ovpn --auth-user-pass vpn-credentials.txt
  49.             sleep 5
  51.             ls -la
  53.             docker pull ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}:latest
  54.             docker run -d ${{ secrets.DOCKERHUB_NAME }}/${{ secrets.DOCKERHUB_REPOSITORY }}:latest
  55.       
  56.             # Cleanup: Delete the temporary VPN credentials file
  57.             rm vpn-credentials.txt

The workflow is intended to build a Docker image and upload it to Docker Hub after every push to the main branch, which is working correctly.
After that i want to connect to the server that's supposed to host the app using SSH but in order to do that I have to establish a VPN connection using OpenVPN. This is what's giving me trouble because the connection doesn't seem to get established.
Am i doing something wrong here?
Here's some of the worklow logs:

  1. ***[command]/usr/bin/docker run --name ed866e71fb8133109f4ad988af16a3b2ab46f2_a1dfd1 --label ed866e --workdir /github/workspace --rm -e "VENV" -e "OVPN_CONFIG" -e "VPN_USERNAME" -e "VPN_PASSWORD" -e "INPUT_HOST" -e "INPUT_USERNAME" -e "INPUT_PASSWORD" -e "INPUT_ENVS" -e "INPUT_SCRIPT" -e "INPUT_PORT" -e "INPUT_PASSPHRASE" -e "INPUT_SYNC" -e "INPUT_USE_INSECURE_CIPHER" -e "INPUT_CIPHER" -e "INPUT_TIMEOUT" -e "INPUT_COMMAND_TIMEOUT" -e "INPUT_KEY" -e "INPUT_KEY_PATH" -e "INPUT_FINGERPRINT" -e "INPUT_PROXY_HOST" -e "INPUT_PROXY_PORT" -e "INPUT_PROXY_USERNAME" -e "INPUT_PROXY_PASSWORD" -e "INPUT_PROXY_PASSPHRASE" -e "INPUT_PROXY_TIMEOUT" -e "INPUT_PROXY_KEY" -e "INPUT_PROXY_KEY_PATH" -e "INPUT_PROXY_FINGERPRINT" -e "INPUT_PROXY_CIPHER" -e "INPUT_PROXY_USE_INSECURE_CIPHER" -e "INPUT_SCRIPT_STOP" -e "INPUT_ENVS_FORMAT" -e "INPUT_DEBUG" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/***/***":"/github/workspace" ed866e:71fb8133109f4ad988af16a3b2ab46f2
  2. ======CMD======
  3. echo "${OVPN_CONFIG}" > vpn-config.ovpn
  4. echo "${VPN_USERNAME}" > vpn-credentials.txt
  5. echo "${VPN_PASSWORD}" >> vpn-credentials.txt
  7. openvpn --config vpn-config.ovpn --*** vpn-credentials.txt
  8. sleep 5
  10. ls -la
  12. *** docker pull ***/***:latest
  13. *** docker run -d --name meteor-bot ***/***:latest
  15. *** Cleanup: Delete the temporary VPN credentials file
  16. rm vpn-credentials.txt
  17. ======END======
  18. 2023/06/15 17:14:46 dial tcp ***:22: i/o timeout

答案1

得分: 1

这是使用分离的 OpenVPN 操作的示例：

  1. name: OpenVPN
  3. on:
  4.   workflow_dispatch:
  5.   
  6. jobs:
  7.   deploy:
  8.     runs-on: ubuntu-latest
  9.     steps:
  10.       - name: Checkout
  11.         uses: actions/checkout@v3
  12.       - name: Install OpenVPN
  13.         run: |
  14.           sudo apt update
  15.           sudo apt install -y openvpn openvpn-systemd-resolved
  16.           
  17.       - name: Setup VPN config
  18.         run: |
  19.           echo "${{ secrets.OVPN_CA }}" > ca.crt
  20.           echo "${{ secrets.OVPN_CERT }}" > user.crt
  21.           
  22.       - name: Connect to VPN
  23.         uses: "kota65535/github-openvpn-connect-action@v2"
  24.         with:
  25.           config_file: .github/workflows/ovpn/client.ovpn
  26.           username: ${{ secrets.OVPN_USERNAME }}
  27.           password: ${{ secrets.OVPN_PASSWORD }}
  28.           client_key: ${{ secrets.OVPN_USER_KEY }}
  30.       - name: multiple command
  31.         uses: appleboy/ssh-action@v0.1.10
  32.         with:
  33.           host: ${{ secrets.SSH_RELAY }}
  34.           username: ${{ secrets.SSH_RELAY_USER }}
  35.           password: ${{ secrets.SSH_RELAY_PWD }}
  36.           port: ${{ secrets.SSH_RELAY_PORT }}
  37.           script: |
  38.             whoami
  39.             ls -al
  41.       - name: Kill VPN connection
  42.         if: always()
  43.         run: |
  44.           sudo killall openvpn
英文:

Here is an example using a separated OpenVPN action:

  1. name: OpenVPN
  3. on:
  4.   workflow_dispatch:
  5.   
  6. jobs:
  7.   deploy:
  8.     runs-on: ubuntu-latest
  9.     steps:
  10.       - name: Checkout
  11.         uses: actions/checkout@v3
  12.       - name: Install OpenVPN
  13.         run: |
  14.           sudo apt update
  15.           sudo apt install -y openvpn openvpn-systemd-resolved
  16.           
  17.       - name: Setup VPN config
  18.         run: |
  19.           echo "${{ secrets.OVPN_CA }}" > ca.crt
  20.           echo "${{ secrets.OVPN_CERT }}" > user.crt
  21.           
  22.       - name: Connect to VPN
  23.         uses: "kota65535/github-openvpn-connect-action@v2"
  24.         with:
  25.           config_file: .github/workflows/ovpn/client.ovpn
  26.           username: ${{ secrets.OVPN_USERNAME }}
  27.           password: ${{ secrets.OVPN_PASSWORD }}
  28.           client_key: ${{ secrets.OVPN_USER_KEY }}
  30.       - name: multiple command
  31.         uses: appleboy/ssh-action@v0.1.10
  32.         with:
  33.           host: ${{ secrets.SSH_RELAY }}
  34.           username: ${{ secrets.SSH_RELAY_USER }}
  35.           password: ${{ secrets.SSH_RELAY_PWD }}
  36.           port: ${{ secrets.SSH_RELAY_PORT }}
  37.           script: |
  38.             whoami
  39.             ls -al
  41.       - name: Kill VPN connection
  42.         if: always()
  43.         run: |
  44.           sudo killall openvpn

答案2

得分: 0

结果证明，在尝试SSH之前，我需要实际建立VPN连接，而不是将其作为SSH脚本的一部分使用，因此我只是添加了这一步骤：

  1.       - name: 建立VPN连接
  2.         run: |
  3.             sudo apt update
  4.             sudo apt install -y openvpn openvpn-systemd-resolved
  5.             echo "${{ secrets.VPN_CONFIG }}" > vpn-config.ovpn
  6.             echo "${{ secrets.VPN_USERNAME }}" > vpn-credentials.txt
  7.             echo "${{ secrets.VPN_PASSWORD }}" >> vpn-credentials.txt
  8.             sudo openvpn --config vpn-config.ovpn --auth-user-pass vpn-credentials.txt --daemon
  9.             sleep 15
英文:

Turns out I needed to actually establish the VPN connection before attempting SSH not use it as part of the script inside the SSH so I just added this step:

  1.       - name: Establish VPN connection
  2.         run: |
  3.             sudo apt update
  4.             sudo apt install -y openvpn openvpn-systemd-resolved
  5.             echo "${{ secrets.VPN_CONFIG }}" > vpn-config.ovpn
  6.             echo "${{ secrets.VPN_USERNAME }}" > vpn-credentials.txt
  7.             echo "${{ secrets.VPN_PASSWORD }}" >> vpn-credentials.txt
  8.             sudo openvpn --config vpn-config.ovpn --auth-user-pass vpn-credentials.txt --daemon
  9.             sleep 15
  10.

huangapple
  • 本文由 发表于 2023年6月16日 01:29:24
  • 转载请务必保留本文链接：https://go.coder-hub.com/76484161.html
  • continuous-integration
  • git
  • github-actions
  • openvpn
  • ssh
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定