Stan Runge
8eec207f2d
All checks were successful
Test and deploy staging / staging (push) Successful in 2m26s
99 lines
4.0 KiB
Bash
99 lines
4.0 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
sha=${1:?commit SHA required}
|
|
directory=${2:?deployment directory required}
|
|
origin=${3:?public origin required}
|
|
case "$sha" in
|
|
*[!0-9a-f]*|'') echo 'Invalid image tag' >&2; exit 2 ;;
|
|
esac
|
|
case "$directory:$origin" in
|
|
/opt/personal-website:https://stanrunge.dev)
|
|
environment=/etc/personal-website/prod.env ;;
|
|
/opt/personal-website-staging:https://staging.stanrunge.dev)
|
|
environment=/etc/personal-website-staging/staging.env ;;
|
|
*) echo 'Unrecognized deployment target' >&2; exit 2 ;;
|
|
esac
|
|
|
|
image="git.stanrunge.dev/stan/personal-website:$sha"
|
|
compose="$directory/compose.prod.yml"
|
|
if [ "$directory" = /opt/personal-website-staging ]; then
|
|
environment_name=staging
|
|
else
|
|
environment_name=production
|
|
fi
|
|
previous_tag=$(sed -n 's/^IMAGE_TAG=//p' "$directory/.env" | head -n 1)
|
|
switched=0
|
|
rollback() {
|
|
if [ "$switched" -eq 1 ] && [ -n "$previous_tag" ]; then
|
|
echo "Health check failed; restoring prior image tag $previous_tag" >&2
|
|
printf 'IMAGE_TAG=%s\n' "$previous_tag" | sudo tee "$directory/.env" >/dev/null
|
|
sudo docker compose --env-file "$directory/.env" -f "$compose" up -d
|
|
fi
|
|
}
|
|
trap rollback ERR
|
|
|
|
db_version=$(sudo docker run --rm --network backend --env-file "$environment" "$image" \
|
|
bun scripts/print-db-server-version.ts)
|
|
case "$db_version" in
|
|
*[!0-9]*|'') echo 'Could not determine the PostgreSQL server version' >&2; exit 1 ;;
|
|
esac
|
|
if [ "$db_version" -ge 100000 ]; then
|
|
db_major=$((db_version / 10000))
|
|
else
|
|
db_major="$((db_version / 10000)).$(((db_version / 100) % 100))"
|
|
fi
|
|
backup_image="postgres:${db_major}-alpine"
|
|
backup_dir=/var/backups/personal-website
|
|
backup_stamp=$(date -u +%Y%m%dT%H%M%SZ)
|
|
backup_name="${environment_name}-${backup_stamp}-${sha}.dump"
|
|
sudo docker pull "$backup_image"
|
|
# The deploy account can run Docker, but has no general host-file sudo access.
|
|
# A bind volume creates the root-owned directory; restrict it before dumping.
|
|
sudo docker run --rm --network backend --env-file "$environment" \
|
|
--volume "$backup_dir:/backups" \
|
|
--env "BACKUP_FILE=$backup_name" "$backup_image" \
|
|
sh -eu -c 'chmod 0700 /backups; umask 077; pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"'
|
|
sudo docker run --rm --mount "type=bind,source=$backup_dir,target=/backups" \
|
|
"$backup_image" pg_restore --list "/backups/$backup_name" >/dev/null
|
|
echo "Verified $environment_name database backup at $backup_dir/$backup_name"
|
|
|
|
run_database_script() {
|
|
echo "Running $1"
|
|
sudo docker run --rm --network backend --env-file "$environment" "$image" bun "$1"
|
|
}
|
|
|
|
run_database_script scripts/migrate-auth-catalog.ts
|
|
run_database_script scripts/migrate-foundation.ts
|
|
run_database_script scripts/migrate-money-tracker.ts
|
|
run_database_script scripts/migrate-game-tracker.ts
|
|
run_database_script scripts/migrate-tracker-journal.ts
|
|
run_database_script scripts/seed-catalog.ts
|
|
run_database_script scripts/seed-cod-catalog.ts
|
|
run_database_script scripts/seed-pokemon-research.ts
|
|
run_database_script scripts/seed-cod-challenges.ts
|
|
run_database_script scripts/seed-cod-art.ts
|
|
|
|
sudo docker run --rm --network backend --env-file "$environment" "$image" \
|
|
bun scripts/deploy-preflight.ts "$origin"
|
|
|
|
printf 'IMAGE_TAG=%s\n' "$sha" | sudo tee "$directory/.env" >/dev/null
|
|
switched=1
|
|
sudo docker compose --env-file "$directory/.env" -f "$compose" up -d
|
|
|
|
container=$(sudo docker compose --env-file "$directory/.env" -f "$compose" ps -q app)
|
|
expected_image=$(sudo docker image inspect -f '{{.Id}}' "$image")
|
|
actual_image=$(sudo docker inspect -f '{{.Image}}' "$container")
|
|
if [ "$actual_image" != "$expected_image" ]; then
|
|
echo 'Compose did not start the intended image' >&2
|
|
false
|
|
fi
|
|
curl --retry 12 --retry-delay 2 --retry-all-errors --fail --silent --show-error \
|
|
"$origin/login" >/dev/null
|
|
curl --retry 6 --retry-delay 2 --retry-all-errors --fail --silent --show-error \
|
|
"$origin/projects/game-tracker/pokemon" >/dev/null
|
|
curl --retry 6 --retry-delay 2 --retry-all-errors --fail --silent --show-error \
|
|
"$origin/projects/game-tracker/call-of-duty/black-ops-2" >/dev/null
|
|
trap - ERR
|
|
echo "Deployed $sha to $origin"
|