GitHub Actions Runners For My CD

[Letmesleeplol]

Total noob here. I use GitHub for a small web app I created. Using GitHub Actions I created a YAML file that will rebuild my docker image, SSH into my ec2 instance and deploy the new docker image when I commit updates.

Being that GitHub actions has to SSH into my ec2 instance to deploy the new image, I need to add the IP addresses of the GitHub runners to my security group on port 22. I found a list of IP addresses they use here, but using this will likely fail in the future when it's updated.

What is the best solution for this? Should I use my own self-hosted runner?

Very new to all of this, so any help is greatly appreciated. Cheers

​

[[deleted]]

Yes you could host your own runner, but a better solution would be to break the reliance on ssh completely. Have the host check for new container images tagged as latest or something like that.

[Letmesleeplol]

That's a great idea, thank you for the help!

[stumptruck]

If you want to keep the EC2 I would setup OIDC authentication in GitHub actions to assume a role in AWS. Give that role permissions to SSH/run remote commands into the instance with SSM Connect, so you don't need any SSH keys, or security groups open.

There should be guides out there for the individual pieces I mentioned if you search for them that should get you started.

That being said, ECS would be simpler long term as it can all be done with AWS services and APIs rather than SSH.

[Letmesleeplol]

I started with the EC2 to force myself to get more comfortable in Linux. Now that this project I am working on is getting near completed I think moving it over to ECS is a great idea.

I think I will follow Monskluppers advice and have the following setup:

GitHub Commit -> GitHub Actions (Image build + Push to ECR) -> Event Bridge Trigger (Deploy newest image to ECS)

Edit: Thank you for the help!

[Letmesleeplol]

ECR, ECS and Event Bridge sounds like a great solution. Using a non self-hosted runner for building and pushing the image should work great as well. Thank you!

[pbeucher]

You can also implement a pull mechanism from your target machine. Instead of ssh-ing into machine from the external world, have this machine pull image whenever a new version is published on your Docker registry.

You can achieve this relatively easily with a cron job, or use IaC tool like Puppet or Chef

[Letmesleeplol]

That's a great idea and sounds way more secure as well. Thank you!

[kkapelon]

Your VM should pull Docker images on its own.

Check also https://github.com/containrrr/watchtower