mirror of
https://github.com/openfrontio/OpenFrontIO.git
synced 2026-06-25 21:24:36 +00:00
Evan
67f7d09fe5
## What A trusted, server-side HTTP API so a bot authenticated with a shared secret can **create private games, change their settings, start them, kick players, and pause/resume** — without opening a WebSocket or joining as a player. Two endpoints under `/api/adminbot/`, reaching the owning worker via the existing `/wN/` nginx routing. They reuse the existing Zod schemas and `GameServer` methods, mirroring the WebSocket intent flow rather than inventing a new wire protocol. | Endpoint | Purpose | | --- | --- | | `POST /api/adminbot/create_game` | Create a private game; the worker mints a self-owned id and returns it (body: `GameConfigSchema.partial()`) | | `POST /api/adminbot/game/:id/intent` | Send a lobby-management intent (body: base `IntentSchema`) | ## How it works - **Auth:** `ADMIN_BOT_API_KEY` env var via the `x-admin-bot-key` header (timing-safe compare). The whole API is **disabled — 404 — when the var is unset**, so non-configured environments expose nothing. It's distinct from the per-instance `ADMIN_TOKEN`, which an external bot can't know. - **`GameServer.handleIntent`** is the unified intent dispatch for both the WebSocket `case "intent"` path and the admin-bot HTTP API. An `IntentActor` carries identity + authority (per-connection lobby-creator/role checks for the WS path; admin authority for the bot). It honors `update_game_config`, `toggle_game_start_timer`, `kick_player`, and `toggle_pause` — **on private games only** (`isPublic()` → 403). Gameplay intents and `mark_disconnected` are rejected (400). - **Private games only.** `create_game` rejects any `gameType` other than `Private` (Public *and* Singleplayer → 400); an omitted `gameType` defaults to `Private`. - **The bot is never a player.** It sends no `clientID`; the server stamps a placeholder `ADMIN_BOT_CLIENT_ID = "ADMINBOT"` (collision-proof — contains `I`/`O`, which `generateID()` never emits). A gameplay intent stamped with it would resolve to no player, so puppeteering is structurally impossible on top of the explicit 400. - **Determinism unchanged:** the only intent that reaches the sim is `toggle_pause`, via the same `addIntent` → turn queue → `ServerTurnMessage` path the WS uses. ## Notable details for review - **`hostCheats` is assigned unconditionally — on purpose.** `updateGameConfig` sets `this.gameConfig.hostCheats = gameConfig.hostCheats` unconditionally, unlike its sibling fields (which are guarded on `!== undefined`). The WS host clears cheats by re-sending the *full* config with `hostCheats: undefined`, so here `undefined` must mean "clear", not "leave unchanged". **Caveat for the admin bot**, which is a *partial*-update client: a partial `update_game_config` that omits `hostCheats` will clear it — the bot should send `hostCheats` explicitly (or a full config) when it wants to keep a previously-set value. - **Deploy wiring:** `ADMIN_BOT_API_KEY` is piped through the deploy steps' `env:` in `deploy.yml`/`release.yml` → `deploy.sh` heredoc → container via `update.sh`'s `--env-file`. The remaining manual step is creating the GitHub secret itself. ## Tests 19 new tests: - `GameServer.handleIntent` admin-bot behavior (per-intent, private-only, post-start guards, placeholder clientID, rejected gameplay/`mark_disconnected` intents). - `create_game` gameType guard (Public and Singleplayer both rejected). - `requireAdminBotKey` middleware (404 disabled / 401 missing / 401 wrong / pass). tsc + eslint clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
258 lines
9.6 KiB
YAML
258 lines
9.6 KiB
YAML
name: 🏷️ Release
|
|
|
|
on:
|
|
release:
|
|
types:
|
|
- created
|
|
- edited
|
|
- published
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
build:
|
|
name: 🏗️ Build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: 🔗 Log in to Docker Hub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ vars.GHCR_USERNAME }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
- id: build
|
|
env:
|
|
GHCR_REPO: openfront-prod
|
|
GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
|
|
RELEASE_BODY: ${{ github.event.release.body }}
|
|
RELEASE_NAME: ${{ github.event.release.name }}
|
|
RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
|
|
ADDITIONAL_VERSION_TAG: ${{ github.event.action == 'published' && 'latest' || '' }}
|
|
run: |
|
|
set -euxo pipefail
|
|
cat <<EOF >> $GITHUB_STEP_SUMMARY
|
|
Name: ${RELEASE_NAME}
|
|
Tag: ${RELEASE_TAG_NAME}
|
|
Changelog:
|
|
${RELEASE_BODY}
|
|
EOF
|
|
./build.sh prod "${RELEASE_TAG_NAME}" "${RELEASE_NAME}" "${RELEASE_BODY}" /tmp/build-metadata.json
|
|
IMAGE_ID=$(jq -r '."containerimage.digest"' /tmp/build-metadata.json)
|
|
echo "IMAGE_ID=${IMAGE_ID}" >> $GITHUB_OUTPUT
|
|
echo "Image ID: \`${IMAGE_ID}\`" >> $GITHUB_STEP_SUMMARY
|
|
outputs:
|
|
IMAGE_ID: ${{ steps.build.outputs.IMAGE_ID }}
|
|
|
|
deploy-alpha:
|
|
name: 🧪 Deploy to alpha
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
needs: [build]
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: 🔑 Create SSH private key
|
|
env:
|
|
SERVER_HOST_STAGING: ${{ secrets.SERVER_HOST_STAGING }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -euxo pipefail
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
test -n "$SERVER_HOST_STAGING" && ssh-keyscan -H "$SERVER_HOST_STAGING" >> ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/id_rsa
|
|
- name: 🚀 Deploy image
|
|
env:
|
|
GHCR_REPO: openfront-prod
|
|
GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
|
|
DOMAIN: ${{ vars.DOMAIN }}
|
|
CDN_BASE: ${{ vars.CDN_BASE }}
|
|
IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
|
OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
ADMIN_BOT_API_KEY: ${{ secrets.ADMIN_BOT_API_KEY }}
|
|
NUM_WORKERS: ${{ vars.NUM_WORKERS }}
|
|
TURNSTILE_SITE_KEY: ${{ vars.TURNSTILE_SITE_KEY }}
|
|
SERVER_HOST_STAGING: ${{ secrets.SERVER_HOST_STAGING }}
|
|
SSH_KEY: ~/.ssh/id_rsa
|
|
run: |
|
|
set -euxo pipefail
|
|
bash -x ./deploy.sh staging staging "${IMAGE_ID}" alpha
|
|
- name: ⏳ Wait for deployment to start
|
|
env:
|
|
FQDN: alpha.${{ vars.DOMAIN }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
run: |
|
|
echo "::group::Wait for deployment to start"
|
|
set -euxo pipefail
|
|
while [ "$(curl -s -H "X-API-Key: ${API_KEY}" https://${FQDN}/commit.txt)" != "${GITHUB_SHA}" ]; do
|
|
if [ "$SECONDS" -ge 300 ]; then
|
|
echo "Timeout: deployment did not start within 5 minutes"
|
|
exit 1
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "Deployment started in ${SECONDS} seconds" >> $GITHUB_STEP_SUMMARY
|
|
echo "::endgroup::"
|
|
|
|
deploy-beta:
|
|
name: 🐞 Deploy to beta
|
|
runs-on: ubuntu-latest
|
|
needs: [build, deploy-alpha]
|
|
timeout-minutes: 30
|
|
environment: prod-beta
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: 🔑 Create SSH private key
|
|
env:
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -euxo pipefail
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
test -n "$SERVER_HOST_FALK2" && ssh-keyscan -H "$SERVER_HOST_FALK2" >> ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/id_rsa
|
|
- name: 🚀 Deploy image
|
|
env:
|
|
GHCR_REPO: ${{ vars.GHCR_REPO }}
|
|
GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
|
|
DOMAIN: ${{ vars.DOMAIN }}
|
|
CDN_BASE: ${{ vars.CDN_BASE }}
|
|
IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
|
OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
ADMIN_BOT_API_KEY: ${{ secrets.ADMIN_BOT_API_KEY }}
|
|
NUM_WORKERS: ${{ vars.NUM_WORKERS }}
|
|
TURNSTILE_SITE_KEY: ${{ vars.TURNSTILE_SITE_KEY }}
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_KEY: ~/.ssh/id_rsa
|
|
run: |
|
|
set -euxo pipefail
|
|
./deploy.sh prod falk2 "${IMAGE_ID}" beta
|
|
- name: ⏳ Wait for deployment to start
|
|
env:
|
|
FQDN: beta.${{ vars.DOMAIN }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
run: |
|
|
echo "::group::Wait for deployment to start"
|
|
set -euxo pipefail
|
|
while [ "$(curl -s -H "X-API-Key: ${API_KEY}" https://${FQDN}/commit.txt)" != "${GITHUB_SHA}" ]; do
|
|
if [ "$SECONDS" -ge 300 ]; then
|
|
echo "Timeout: deployment did not start within 5 minutes"
|
|
exit 1
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "Deployment started in ${SECONDS} seconds" >> $GITHUB_STEP_SUMMARY
|
|
echo "::endgroup::"
|
|
|
|
deploy-blue:
|
|
name: 🔵 Deploy to blue
|
|
runs-on: ubuntu-latest
|
|
needs: [build, deploy-alpha]
|
|
timeout-minutes: 30
|
|
environment: prod-blue
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: 🔑 Create SSH private key
|
|
env:
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -euxo pipefail
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
test -n "$SERVER_HOST_FALK2" && ssh-keyscan -H "$SERVER_HOST_FALK2" >> ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/id_rsa
|
|
- name: 🚀 Deploy image
|
|
env:
|
|
GHCR_REPO: ${{ vars.GHCR_REPO }}
|
|
GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
|
|
DOMAIN: ${{ vars.DOMAIN }}
|
|
CDN_BASE: ${{ vars.CDN_BASE }}
|
|
IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
|
OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
ADMIN_BOT_API_KEY: ${{ secrets.ADMIN_BOT_API_KEY }}
|
|
NUM_WORKERS: ${{ vars.NUM_WORKERS }}
|
|
TURNSTILE_SITE_KEY: ${{ vars.TURNSTILE_SITE_KEY }}
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_KEY: ~/.ssh/id_rsa
|
|
run: |
|
|
set -euxo pipefail
|
|
./deploy.sh prod falk2 "${IMAGE_ID}" blue
|
|
- name: ⏳ Wait for deployment to start
|
|
env:
|
|
FQDN: blue.${{ vars.DOMAIN }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
run: |
|
|
echo "::group::Wait for deployment to start"
|
|
set -euxo pipefail
|
|
while [ "$(curl -s -H "X-API-Key: ${API_KEY}" https://${FQDN}/commit.txt)" != "${GITHUB_SHA}" ]; do
|
|
if [ "$SECONDS" -ge 300 ]; then
|
|
echo "Timeout: deployment did not start within 5 minutes"
|
|
exit 1
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "Deployment started in ${SECONDS} seconds" >> $GITHUB_STEP_SUMMARY
|
|
echo "::endgroup::"
|
|
|
|
deploy-green:
|
|
name: 🟢 Deploy to green
|
|
runs-on: ubuntu-latest
|
|
needs: [build, deploy-alpha]
|
|
timeout-minutes: 30
|
|
environment: prod-green
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: 🔑 Create SSH private key
|
|
env:
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
|
|
run: |
|
|
set -euxo pipefail
|
|
mkdir -p ~/.ssh
|
|
echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
|
|
test -n "$SERVER_HOST_FALK2" && ssh-keyscan -H "$SERVER_HOST_FALK2" >> ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/id_rsa
|
|
- name: 🚀 Deploy image
|
|
env:
|
|
GHCR_REPO: ${{ vars.GHCR_REPO }}
|
|
GHCR_USERNAME: ${{ vars.GHCR_USERNAME }}
|
|
DOMAIN: ${{ vars.DOMAIN }}
|
|
CDN_BASE: ${{ vars.CDN_BASE }}
|
|
IMAGE_ID: ${{ needs.build.outputs.IMAGE_ID }}
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}
|
|
OTEL_AUTH_HEADER: ${{ secrets.OTEL_AUTH_HEADER }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
ADMIN_BOT_API_KEY: ${{ secrets.ADMIN_BOT_API_KEY }}
|
|
NUM_WORKERS: ${{ vars.NUM_WORKERS }}
|
|
TURNSTILE_SITE_KEY: ${{ vars.TURNSTILE_SITE_KEY }}
|
|
SERVER_HOST_FALK2: ${{ secrets.SERVER_HOST_FALK2 }}
|
|
SSH_KEY: ~/.ssh/id_rsa
|
|
run: |
|
|
set -euxo pipefail
|
|
./deploy.sh prod falk2 "${IMAGE_ID}" green
|
|
- name: ⏳ Wait for deployment to start
|
|
env:
|
|
FQDN: green.${{ vars.DOMAIN }}
|
|
API_KEY: ${{ secrets.API_KEY }}
|
|
run: |
|
|
echo "::group::Wait for deployment to start"
|
|
set -euxo pipefail
|
|
while [ "$(curl -s -H "X-API-Key: ${API_KEY}" https://${FQDN}/commit.txt)" != "${GITHUB_SHA}" ]; do
|
|
if [ "$SECONDS" -ge 300 ]; then
|
|
echo "Timeout: deployment did not start within 5 minutes"
|
|
exit 1
|
|
fi
|
|
sleep 10
|
|
done
|
|
echo "Deployment started in ${SECONDS} seconds" >> $GITHUB_STEP_SUMMARY
|
|
echo "::endgroup::"
|