Поднимаем свой сайт на Hugo с публикацией контента через Obsidian

ssh -p 2222 ivan@hugo.r4ven.me

sudo -s

mkdir -vp /opt/hugo/{hugo,angie}_data && cd /opt/hugo/

nvim docker-compose.yml

---

services:

  angie:
    #image: docker.angie.software/angie:latest
    image: docker.angie.software/angie:1.10.2-alpine
    container_name: angie
    restart: on-failure
    stop_grace_period: 1m
    deploy: &default_deploy
      resources:
        limits:
          cpus: '0.70'
          memory: 512M
        reservations:
          cpus: '0.2'
          memory: 256M
    logging: &default_logging
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"
    hostname: angie
    environment:
      - TZ=Europe/Moscow
    #command: ["angie", "-g", "daemon off;"]
    volumes:
      - ./angie_data/angie.conf:/etc/angie/angie.conf:ro
      - ./angie_data/conf.d/:/etc/angie/conf.d/:ro
      - ./angie_data/certs/:/var/lib/angie/acme/
      - ./hugo_data/hugo.r4ven.me/public/:/usr/share/angie/html/:ro
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"

  hugo:
    #image: docker.io/hugomods/hugo
    image: hugomods/hugo:debian-0.151.0
    container_name: hugo
    restart: on-failure
    stop_grace_period: 1m
    deploy: *default_deploy
    logging: *default_logging
    hostname: hugo
    environment:
      - TZ=Europe/Moscow
    working_dir: /src/hugo.r4ven.me
    volumes:
      - ./hugo_data/:/src/
    command: ["hugo", "--minify", "--gc"]

nvim ./angie_data/angie.conf

user angie;
worker_processes auto;
worker_rlimit_nofile 65536;

load_module modules/ngx_http_zstd_filter_module.so;
load_module modules/ngx_http_zstd_static_module.so;
load_module modules/ngx_http_brotli_filter_module.so;
load_module modules/ngx_http_brotli_static_module.so;

events {
    worker_connections 65536;
}

http {
    include       /etc/angie/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout 20;
    server_tokens   off;

    brotli on;
    brotli_comp_level 5;

    zstd on;
    zstd_comp_level 7;

    gzip on;
    gzip_comp_level 6;
    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
    # application/rss+xml

    access_log /var/log/angie/access.log;
    error_log  /var/log/angie/error.log notice;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "accelerometer=(), camera=(), microphone=()" always;
    add_header X-Frame-Options "DENY" always;

    # DNS-резолвер для ACME
    resolver 8.8.8.8 8.8.4.4 ipv6=off;

    acme_client le https://acme-v02.api.letsencrypt.org/directory
        email=kar-kar@r4ven.me
        key_type=ecdsa
        renew_before_expiry=30d
        # renew_on_load=on
        ;

    server {
        listen 80;
        server_name hugo.r4ven.me;

        location /.well-known/acme-challenge/ {
            root /usr/share/angie/html;
        }

        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        http3 on;

        server_name hugo.r4ven.me;

        acme le;

        ssl_certificate     $acme_cert_le;
        ssl_certificate_key $acme_cert_key_le;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 1d;

        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

        root /usr/share/angie/html;
        index index.html;

        location /.well-known/acme-challenge/ {
            root /usr/share/angie/html;
        }

        location ~* \.(?:css|js|mjs|png|jpg|jpeg|gif|webp|svg|ico|ttf|otf|woff|woff2)$ {
            access_log off;
            expires 1y;
            add_header Cache-Control "public, max-age=31536000, immutable";
            try_files $uri =404;
        }

        location = / {
            add_header Cache-Control "public, max-age=3600, stale-while-revalidate=300";
            try_files /index.html =404;
        }

        location ~* \.html$ {
            add_header Cache-Control "public, max-age=3600, stale-while-revalidate=300";
            try_files $uri =404;
        }

        # gzip_static   on;
        # brotli_static on;

        open_file_cache max=10000 inactive=60s;
        open_file_cache_valid 30s;
        open_file_cache_min_uses 2;
        open_file_cache_errors on;

        error_page 404 /404.html;
        error_page 500 502 503 504 /500.html;
    }

    include /etc/angie/conf.d/*.conf;
}

sed 's|email=kar-kar@r4ven.me;|email=user@example.com;|' \
    ./angie_data/angie.conf

sed 's|server_name hugo.r4ven.me;|server_name example.com;|g' \
    ./angie_data/angie.conf

docker compose up -d angie

docker compose ps

docker compose logs -f

ls -lR ./angie_data/certs/

curl -I https://hugo.r4ven.me

openssl s_client -connect hugo.r4ven.me:443 < /dev/null 2> /dev/null | openssl x509 -text | head -n 20

docker compose run --rm -w /src hugo new site hugo.r4ven.me

git clone https://github.com/tom2almighty/hugo-narrow.git \
    ./hugo_data/hugo.r4ven.me/themes/hugo-narrow

cp -r ./hugo_data/hugo.r4ven.me/themes/hugo-narrow/exampleSite/* \
    ./hugo_data/hugo.r4ven.me/

rm -f ./hugo_data/hugo.r4ven.me/hugo.toml

rm -rf ./hugo_data/hugo.r4ven.me/themes/hugo-narrow/.git

sed -i "s|^baseURL.*|baseURL: 'https://hugo.r4ven.me'|" \
    ./hugo_data/hugo.r4ven.me/hugo.yaml

cat << EOF > ./hugo_data/hugo.r4ven.me/content/posts/first-post.md
---
title: "My First Post"
date: 2025-06-13
draft: false
categories: ["Blog"]
tags: ["Hugo", "Tutorial"]
---

## Hello, world!
EOF

cat << EOF > ./hugo_data/hugo.r4ven.me/content/posts/second-post.md
---
title: "My second Post"
date: 2025-07-20
draft: false
categories: ["Test"]
tags: ["Hugo", "Howto"]
---

## Hello, friend!
EOF

ls -l ./hugo_data/hugo.r4ven.me/content/posts/

docker compose up hugo

curl https://hugo.r4ven.me/posts/first-post/

curl https://hugo.r4ven.me/posts/second-post/

systemctl edit --full --force hugo.service

[Unit]
Description=Hugo service
Requires=docker.service
After=docker.service

[Service]
Restart=on-failure
RestartSec=5
ExecStart=/usr/bin/docker compose -f /opt/hugo/docker-compose.yml up
ExecStop=/usr/bin/docker compose -f /opt/hugo/docker-compose.yml down

[Install]
WantedBy=multi-user.target

docker compose down

systemctl enable --now hugo

docker compose ps

systemctl status hugo

journalctl -fu hugo

mkdir -vp ~/.ssh/ && chmod 700 ~/.ssh/

ssh-keygen -q -N "" -t ed25519 -f ~/.ssh/id_ed25519_github_repo

ls -l ~/.ssh/

cat << EOF >> ~/.ssh/config
Host github.com
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_ed25519_github_repo
    IdentitiesOnly yes
EOF

cat ~/.ssh/id_ed25519_github_repo.pub

apt update && apt install -y git

cd /opt/hugo/

git init

echo 'hugo_data/hugo.r4ven.me/public/' > .gitignore

echo 'hugo_data/hugo.r4ven.me/content/.obsidian/' >> .gitignore

echo 'hugo_data/hugo.r4ven.me/.hugo_build.lock' >> .gitignore

echo 'angie_data/certs/' >> .gitignore

find ./hugo_data/hugo.r4ven.me/ -type d -empty -exec touch {}/.gitkeep \;

git add ./

git commit -m "Hugo initial commit"

git branch -M main

git remote add origin git@github.com:r4ven-me/hugo.git

git push -u origin main

git clone git@github.com:r4ven-me/hugo.git ~/Hugo

mkdir -p ~/Hugo/.github/workflows

cd ~/Hugo

nvim .github/workflows/deploy.yml

---

name: Deploy Hugo site
on:
  push:
    branches: [ "main" ]
  workflow_dispatch:

env:
  HUGO_VERSION: 0.151.0

defaults:
  run:
    shell: bash

jobs:
  build:
    name: Build and test Hugo site
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: hugo_data/hugo.r4ven.me

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: Set up Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: ${{ env.HUGO_VERSION }}
          extended: true

      - name: Build site
        run: hugo --minify --gc

      - name: Validate Hugo output
        run: |
          # Проверка папки
          if [ ! -d "public" ]; then
            echo "❌ No 'public' directory!"
          exit 1
          fi
          # Проверка index.html
          if [ ! -f "public/index.html" ]; then
            echo "❌ No index.html generated!"
            exit 1
          fi
          # Проверка размера
          if [ ! -s "public/index.html" ]; then
            echo "❌ index.html is empty!"
            exit 1
          fi
          # Проверка количества файлов
          FILE_COUNT=$(find public -type f | wc -l)
          if [ "$FILE_COUNT" -lt 5 ]; then
            echo "❌ Too few files ($FILE_COUNT) in public/ — probably build failed!"
            exit 1
          fi
          echo "✅ Hugo output looks OK: $FILE_COUNT files generated."

      - name: Check generated HTML
        run: |
          sudo apt install -y ruby ruby-dev
          sudo gem install html-proofer
          sudo htmlproofer ./public --disable-external --allow-missing-href

  deploy:
    name: Deploy to remote server
    needs: build
    if: success()
    runs-on: ubuntu-latest

    steps:
      - name: Run a multi-line script
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.KEY }}" > ~/.ssh/id_ed25519
          chmod 700 ~/.ssh/
          chmod 600 ~/.ssh/id_ed25519
          echo -e "Host *\nStrictHostKeyChecking no\n" > ~/.ssh/config
          ssh ${{ secrets.HOST }} -p ${{ secrets.PORT }} -l ${{ secrets.USER }}
          rm -rf ~/.ssh

  notify:
    runs-on: ubuntu-latest
    needs: [build, deploy]
    if: always()
    steps:
      - name: Send Telegram summary
        uses: appleboy/telegram-action@master
        with:
          to: ${{ secrets.TELEGRAM_ID }}
          token: ${{ secrets.TELEGRAM_TOKEN }}
          message: |
            🚀 **CI/CD Summary**
            Repository: ${{ github.repository }}
            Commit: ${{ github.sha }}
            Author: ${{ github.actor }}
            Message: ${{ github.event.head_commit.message }}
            --------------------------------
            🧱 Build:  ${{ needs.build.result }}
            📦 Deploy: ${{ needs.deploy.result }}

sed -i 's|hugo.r4ven.me|example.com|g' .github/workflows/deploy.yml

ssh-keygen -q -N "" -t ed25519 -f ~/.ssh/id_ed25519_github_cicd

cat ~/.ssh/id_ed25519_github_cicd

-----BEGIN OPENSSH PRIVATE KEY-----
...
-----END OPENSSH PRIVATE KEY-----

cat ~/.ssh/id_ed25519_github_cicd.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvDu1omD1WwG1K68/mkvnBw/d4xRpREHDH4ytMDOl20

mkdir -p ~/.ssh/

chmod 700 ~/.ssh/

echo 'command="sudo /opt/hugo/deploy.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvDu1omD1WwG1K68/mkvnBw/d4xRpREHDH4ytMDOl20' >> ~/.ssh/authorized_keys

visudo -f /etc/sudoers.d/90_hugo

echo -e '#!/usr/bin/bash\necho Pong' > /opt/hugo/deploy.sh

chmod 700 /opt/hugo/deploy.sh

ssh -p 2222 -i ~/.ssh/id_ed25519_github_cicd ivan@hugo.r4ven.me

nvim ./deploy.sh

#!/usr/bin/env bash

# Безопасные параметры выполнения скрипта:
# -E: trap наследуется функциями
# -e: выход при любой ошибке
# -u: ошибка при использовании неинициализированных переменных
# -o pipefail: возврат кода ошибки последней команды в конвейере
set -Eeuo pipefail

# Явное определение PATH, чтобы избежать проблем с поиском бинарников
export PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin"


# Переменные проекта
PROJECT_NAME="hugo"           # Имя проекта/сервиса Hugo
PROJECT_WEB="angie"           # Имя веб-сервера проекта
PROJECT_DIR="/opt/hugo"       # Директория проекта


# Параметры логирования
LOG_TO_STDOUT=1       # вывод логов в stdout
LOG_TO_FILE=0         # логирование в файл (<script_name>.log)
LOG_TO_SYSLOG=0       # логирование в syslog с тегом <script_name>


# Основные переменные скрипта
SCRIPT_PID=$$    # PID текущего скрипта
# Абсолютный путь к директории скрипта
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" &> /dev/null && pwd -P)
SCRIPT_NAME="$(basename "${BASH_SOURCE[0]}")"    # Имя скрипта
SCRIPT_LOG="${SCRIPT_DIR}/${SCRIPT_NAME%.*}.log" # Файл лога
SCRIPT_LOG_PREFIX='[%Y-%m-%d %H:%M:%S.%3N]'     # Формат времени для логов
SCRIPT_LOCK="${SCRIPT_DIR}/${SCRIPT_NAME%.*}.lock" # Файл блокировки


# Функция очистки ресурсов при завершении или ошибках
cleanup() {
    trap - SIGINT SIGTERM SIGHUP SIGQUIT ERR EXIT  # сброс ловушек

    # Закрываем дескриптор блокировки, если был открыт
    [[ -n "${fd_lock-}" ]] && exec {fd_lock}>&-

    # Удаляем файл блокировки, если он принадлежит текущему процессу
    if [[ -f "$SCRIPT_LOCK" && $(< "$SCRIPT_LOCK") -eq $SCRIPT_PID ]]; then
        rm -f "$SCRIPT_LOCK"
    fi
}


# Функция логирования
logging() {
    while IFS= read -r line; do
        # Форматируем строку лога с временной меткой
        log_line="$(date +"${SCRIPT_LOG_PREFIX}") - $line"

        # Выводим лог в stdout, если включено
        if (( "$LOG_TO_STDOUT" )); then echo "$log_line"; fi

        # Логируем в файл, если включено
        if (( "$LOG_TO_FILE" )); then echo "$log_line" >> "$SCRIPT_LOG"; fi

        # Логируем в syslog, если включено
        if (( "$LOG_TO_SYSLOG" )); then logger -t "$SCRIPT_NAME" -- "$line"; fi
    done
}


# Функция блокировки скрипта для предотвращения параллельного запуска
lock_script() {
    # Открываем дескриптор файла блокировки для записи
    exec {fd_lock}>> "${SCRIPT_LOCK}"

    # Пытаемся получить эксклюзивный lock, если не удалось — выходим
    if ! flock -n "$fd_lock"; then
        echo "Another script instance is already running, exiting..."
        exit 1
    fi

    # Записываем PID текущего скрипта в файл блокировки
    echo "$SCRIPT_PID" > "$SCRIPT_LOCK"
}


# Основная функция деплоя
deploy() {
    echo "Check git and docker binaries"
    # Проверка наличия git и docker
    if ! command -v git; then echo >&2 "Git is not installed"; fi
    if ! command -v docker; then echo >&2 "Docker is not installed"; fi

    # Переходим в директорию проекта, если есть права на запись
    if [[ -w "$PROJECT_DIR" ]]; then
        cd "$PROJECT_DIR"
    else
        echo "No such directory: $PROJECT_DIR"
        exit 1
    fi

    # Если есть git репозиторий — обновляем его
    if [[ -d .git ]]; then
        echo "Pull changes from main branch"
        git checkout main
        git fetch --all
        git reset --hard origin/main
    else
        echo "No git files found"
        exit 1
    fi

    echo "Restart $PROJECT_NAME service"
    #systemctl restart "$PROJECT_NAME"   # можно использовать systemctl
    docker compose up hugo               # запуск сервиса через Docker Compose

    sleep 3  # небольшой таймаут

    echo "Waiting for site generation..."
    # Ждем, пока сервис Hugo завершит работу
    while docker compose ps --services --filter "status=running" | grep -q "^$PROJECT_NAME$"; do
        echo "Waiting for site generation..."
        sleep 1
    done

    echo 'Done!'

    # Проверяем, что веб-сервер запущен
    echo "Checking if webserver container is running"
    if docker compose ps --services --filter "status=running" | grep -q "^$PROJECT_WEB$"; then
        echo 'Up!'
    else
        echo "Container with $PROJECT_WEB webserver is not running"
        exit 1
    fi

    sleep 3

    # Вывод последних логов сервиса
    echo "Some output of running service"
    LOG=$(journalctl -n 50 --no-pager -u "$PROJECT_NAME")
    echo "------------------------------"
    echo "$LOG"
    echo "------------------------------"
}


# Главная функция скрипта
main() {
    # Ловим сигналы и ошибки, вызываем cleanup
    trap 'RC=$?; cleanup; exit $RC' SIGINT SIGHUP SIGTERM SIGQUIT ERR EXIT
    # Перенаправляем stdout и stderr в функцию логирования
    exec > >(logging) 2>&1
    lock_script   # блокируем скрипт
    deploy        # запускаем деплой
}


# Точка входа
if main; then
    sleep 1
    echo "Deploy completed successfully"
    exit 0
else
    echo "Deploy failed"
    exit 1
fi

chmod 700 ./deploy.sh

git add .

git commit -m 'Get test deploy!'

git push origin main

cd /opt/hugo

git fetch --all

git reset --hard origin/main

less deploy.sh

cd ~/Hugo

cat << EOF > ./hugo_data/hugo.r4ven.me/content/posts/my-third-post.md
---
title: "My third Post"
date: 2025-08-20
draft: false
categories: ["Test"]
tags: ["Hugo", "Guide"]
---

## Hello, R4ven!
EOF

git add . && git commit -m 'Get real deploy!' && git push