Let a server pull images
$ grim server:ghcr-login --host=vps1A release builds the image on your side and the server pulls it from ghcr.io. The images are private, so the server needs credentials of its own. You reach for this command when grim server:setup ran without --ghcr-token, when a deploy stops because the registry refuses the pull, or when the token on the server has expired and a new one has to go to every server you have.
Usage
$ grim server:ghcr-login --host=vps1 # asks for the token, input hidden
$ grim server:ghcr-login --host=vps1 --token=ghp_xxx # no prompt, for scripts
$ grim server:ghcr-login --all # every server you have registered
$ grim server:ghcr-login --host=vps1 --user=acme # log in under another GitHub nameRun it from anywhere. The server must be in your ~/.grim/servers.json, which is where grim server:setup put it. One of --host and --all is required.
Arguments and options
Register or refresh GHCR credentials on a server (so docker can pull private ghcr.io/{owner}/grim-* images)
Usage
grim server:ghcr-login [--host HOST] [--token TOKEN] [--user USER] [--all]Options
| Option | Description |
|---|---|
--host=HOST |
Server alias or host |
--token=TOKEN |
GitHub classic PAT with read:packages scope (interactive prompt when omitted) |
--user=USER |
GitHub username (defaults to your grim-cli auth user) |
--all |
Apply to every server registered in ~/.grim/servers.json |
What it actually does
- Picks the servers. The one behind
--host, or with--allevery server inservers.json. - Picks the GitHub name.
--user, or the account you logged in with throughgrim auth:login. - Asks for the token, unless
--tokencarries it. The prompt hides what you type and reminds you which kind of token is accepted. - Logs in on each server. Connects as that server's service user, which is
deployon a production server, checks that Docker is there and runsdocker login ghcr.io. Docker keeps the credentials in that user's home, where every later pull finds them. - Prints one result per server,
✓ Login Succeededor Docker's own error. If any server failed, the command exits with an error and tells you to repeat it for that host.
Pitfalls
GHCR takes a classic token only
A fine-grained token is accepted by GitHub and still cannot pull an image. Create a classic token with the read:packages scope. When the images belong to an organisation, the token's owner needs read access to that organisation's packages.
--all means every server, dev boxes included
--all walks the whole of servers.json and logs in each server's own service user, dev on a shared dev box. That is what you want after rotating one team token. It is not what you want when production and development are meant to use different tokens.
A token on the command line stays in your shell history
--token exists for scripts. At a terminal, leave it out and paste the token at the hidden prompt. Without a terminal there is no prompt, and the command stops with --token is required when running non-interactively.
After it finishes
The server can pull. Repeat the release or the deploy that failed.
$ grim releaseRelated spells
grim server:setup
Raise a production server
Turn a bare Ubuntu or Debian VPS into a host for deployed projects, with Docker, MySQL, nginx, Traefik and a deploy user.
grim server:status
Look over a server
List the servers you have registered, or look at one of them: its containers, its disk, Traefik and its projects.
grim release
Ship in one pass
Test, build, push and deploy the project to an environment with a single command and a single tag.
grim deploy
Send an image to a server
Roll a pushed image tag out to one environment over SSH, verify the app answers, and fall back to the previous tag when it does not.
grim auth:login
Log grim in to GitHub
Give grim a GitHub token, from your gh login or a personal access token, and hand the same token to Composer and Docker.