feat: new deployment for prod server

.github/workflows/prod-build-deploy-api.yml

@@ -0,0 +1,92 @@
+name: Deploy API to Production
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'apps/api/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: production-deploy
+  cancel-in-progress: true
+
+jobs:
+  build-and-push:
+    name: Build and Push Docker Image to GHCR
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.set-tag.outputs.image_tag }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU for cross-platform builds
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push multi-arch image
+        run: |
+          docker buildx build \
+            --platform linux/amd64,linux/arm64 \
+            --push \
+            -t ghcr.io/${{ github.repository_owner }}/core-api:latest \
+            ./apps/api
+
+  run-migrations:
+    name: Run Goose Migrations
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Goose
+        run: |
+          curl -L https://github.com/pressly/goose/releases/latest/download/goose_linux_amd64 --output goose
+          chmod +x goose
+          sudo mv goose /usr/local/bin/goose
+
+      - name: Run migrations
+        run: |
+          goose -dir ./apps/api/internal/db/migrations postgres "${{ secrets.PROD_DB_URL }}" up
+
+  deploy:
+    name: Deploy to Production Server
+    runs-on: ubuntu-latest
+    needs: [build-and-push, run-migrations]
+
+    steps:
+      - name: SSH proxy commmand
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.SSH_HOST_SWAMPHACKS }}
+          username: ${{ secrets.SSH_USERNAME_SWAMPHACKS }}
+          key: ${{ secrets.SSH_KEY_SWAMPHACKS }}
+          port: ${{ secrets.SSH_PORT_SWAMPHACKS }}
+          proxy_host: ${{ secrets.SSH_HOST_JUMP }}
+          proxy_username: ${{ secrets.SSH_USERNAME_JUMP }}
+          proxy_key: ${{ secrets.SSH_KEY_JUMP }}
+          proxy_port: ${{ secrets.SSH_PORT_JUMP }}
+        script: |
+          cd /home/admin/core/infra
+          git pull
+          infisical export --env=prod --format=dotenv --path="/api" --projectId=${{ secrets.INFISICAL_PROJECT_ID }} > ./secrets/.env.api
+          docker compose pull api
+          docker compose up -d --no-deps --force-recreate api

infra/secrets/README.md

@@ -0,0 +1,13 @@
+## Secrets for production and development builds will go in the folder
+
+The following environments will be generated using the Infiscal CLI tool. What is Infiscal? That is our secret manager!
+
+- .env.api
+- .env.web
+- .env.dev.api
+- .env.dev.web
+
+...  and more!
+
+### Add more?
+Please let the core maintainers when it comes to adding more env variables!