jpscott84/drinktracker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix deploy: sudo to root once and su down, not sudo -u

Browse Source 
sudoers grants drinkadmin NOPASSWD only as root, so every 'sudo -u
drinktracker' in the deploy prompted for a password. Restructured to
pipe one script per phase to 'sudo -n bash -s' and use su inside, which
needs no privilege change and cuts the SSH round-trips.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
JP
2026-08-08 17:59:48 +00:00
parent 87f951bf94
commit 80fd99bc40
1 changed files with 64 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
deploy/deploy.sh
View File

@@ -31,6 +31,14 @@ SSH=(ssh -o BatchMode=yes -o ConnectTimeout=10 -i "$SSH_KEY" "$HOST")
say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; } say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; }
die() { printf '\n\033[1;31mFAILED: %s\033[0m\n' "$*" >&2; exit 1; } die() { printf '\n\033[1;31mFAILED: %s\033[0m\n' "$*" >&2; exit 1; }
# Run a script (on stdin) as root on the LXC, with these vars exported.
# sudoers grants drinkadmin NOPASSWD only as root, so we sudo once and `su` down
# to the service user inside rather than using `sudo -u`.
remote_root() {
"${SSH[@]}" "sudo -n env APP_DIR='$APP_DIR' SVC_USER='$SVC_USER' SHA='${SHA:-}' \
SHORT='${SHORT:-}' KEEP='$KEEP_RELEASES' bash -s"
}
health_poll() { health_poll() {
for i in $(seq 1 30); do for i in $(seq 1 30); do
code=$("${SSH[@]}" "curl -s -o /dev/null -w '%{http_code}' -m 5 $HEALTH_URL" || echo 000) code=$("${SSH[@]}" "curl -s -o /dev/null -w '%{http_code}' -m 5 $HEALTH_URL" || echo 000)
@@ -43,17 +51,19 @@ health_poll() {
# ─── Rollback: repoint the symlink, no rebuild ─────────────────────── # ─── Rollback: repoint the symlink, no rebuild ───────────────────────
if [ "$ROLLBACK" -eq 1 ]; then if [ "$ROLLBACK" -eq 1 ]; then
say "Available releases (newest last)" say "Rolling back"
"${SSH[@]}" "ls -1tr $APP_DIR/releases" CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename")
PREV=$("${SSH[@]}" "ls -1t $APP_DIR/releases | grep -v '^$CURRENT\$' | head -1") PREV=$("${SSH[@]}" "ls -1t $APP_DIR/releases | grep -v '^$CURRENT\$' | head -1")
[ -n "$PREV" ] || die "no other release to roll back to" [ -n "$PREV" ] || die "no other release to roll back to"
echo " current=$CURRENT -> rolling back to $PREV" echo " current=$CURRENT -> $PREV"
if [ "$ASSUME_YES" -ne 1 ]; then if [ "$ASSUME_YES" -ne 1 ]; then
read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; } read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
fi fi
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$PREV $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'" SHORT="$PREV" remote_root <<'EOF'
"${SSH[@]}" "sudo -n systemctl restart drinktracker" set -e
su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
systemctl restart drinktracker
EOF
health_poll || die "app unhealthy after rollback - journalctl -u drinktracker" health_poll || die "app unhealthy after rollback - journalctl -u drinktracker"
say "Rolled back to $PREV" say "Rolled back to $PREV"
exit 0 exit 0
@@ -82,67 +92,73 @@ for unit in postgresql@16-main minio drinktracker; do
done done
if [ "$ASSUME_YES" -ne 1 ]; then if [ "$ASSUME_YES" -ne 1 ]; then
CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename") CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
echo " current release $CURRENT, deploying $SHORT" echo " current release $CURRENT, deploying $SHORT"
read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; } read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
fi fi
# ─── Build (out-of-place; the running release keeps serving) ───────── # ─── Build and assemble (out-of-place; old release keeps serving) ────
say "Syncing and building on $HOST" say "Syncing, building and assembling $SHORT"
"${SSH[@]}" "sudo -n -u $SVC_USER git -C $APP_DIR/repo fetch --quiet origin main && sudo -n -u $SVC_USER git -C $APP_DIR/repo reset --hard $SHA --quiet && sudo -n -u $SVC_USER git -C $APP_DIR/repo log --oneline -1" BUILD="$BUILD" remote_root <<'EOF'
set -e
su -s /bin/bash "$SVC_USER" <<INNER
set -e
git -C "$APP_DIR/repo" fetch --quiet origin main
git -C "$APP_DIR/repo" reset --hard "$SHA" --quiet
git -C "$APP_DIR/repo" log --oneline -1
if [ "$BUILD" -eq 1 ]; then cd "$APP_DIR/repo"
export npm_config_cache="$APP_DIR/.npm" NODE_OPTIONS=--max-old-space-size=3072
# Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs # Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
# evaluates rewrites() at build time, so sourcing the env here would bake a different # evaluates rewrites() at build time, so sourcing the env here would bake a different
# /minio-images destination into routes-manifest.json. # /minio-images destination into routes-manifest.json.
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
set -e
cd $APP_DIR/repo
export npm_config_cache=$APP_DIR/.npm NODE_OPTIONS=--max-old-space-size=3072
npm ci --prefer-offline --no-audit --fund=false npm ci --prefer-offline --no-audit --fund=false
npx prisma generate npx prisma generate
npm run build npm run build
'" || die "build failed"
fi
say "Assembling release $SHORT"
# Mirrors Dockerfile:24-30 - standalone bundle plus static and public copied in. # Mirrors Dockerfile:24-30 - standalone bundle plus static and public copied in.
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc ' REL="$APP_DIR/releases/$SHORT"
set -e rm -rf "\$REL" && mkdir -p "\$REL/.next/cache"
REL=$APP_DIR/releases/$SHORT cp -a "$APP_DIR/repo/.next/standalone/." "\$REL"/
rm -rf \$REL && mkdir -p \$REL/.next/cache cp -a "$APP_DIR/repo/.next/static" "\$REL/.next/static"
cp -a $APP_DIR/repo/.next/standalone/. \$REL/ cp -a "$APP_DIR/repo/public" "\$REL/public"
cp -a $APP_DIR/repo/.next/static \$REL/.next/static du -sh "\$REL"
cp -a $APP_DIR/repo/public \$REL/public INNER
du -sh \$REL EOF
'" || die "release assembly failed" [ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "build/assembly failed"
# ─── Schema ────────────────────────────────────────────────────────── # ─── Schema ──────────────────────────────────────────────────────────
say "Backing up database before schema push" say "Backing up database, then applying schema"
"${SSH[@]}" "sudo -n install -d -m 0750 /var/backups/drinktracker && sudo -n -u postgres pg_dump drinkman | gzip -9 | sudo -n tee /var/backups/drinktracker/pre-$SHORT.sql.gz >/dev/null && sudo -n ls -lh /var/backups/drinktracker/pre-$SHORT.sql.gz" remote_root <<'EOF'
set -e
install -d -m 0750 /var/backups/drinktracker
sudo -u postgres pg_dump drinkman | gzip -9 > "/var/backups/drinktracker/pre-$SHORT.sql.gz"
ls -lh "/var/backups/drinktracker/pre-$SHORT.sql.gz"
say "Applying schema"
# db push, NOT migrate deploy: production has no _prisma_migrations table, so # db push, NOT migrate deploy: production has no _prisma_migrations table, so
# migrate deploy would try to apply the init migration against populated tables. # migrate deploy would try to apply the init migration against populated tables.
# --accept-data-loss means removing a field from schema.prisma DROPS the column. # --accept-data-loss means removing a field from schema.prisma DROPS the column.
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc ' su -s /bin/bash "$SVC_USER" -c "set -a; . /etc/drinktracker/drinktracker.env; set +a; cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss"
set -a; . /etc/drinktracker/drinktracker.env; set +a EOF
cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss [ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "schema step failed"
'" || die "prisma db push failed"
# ─── Swap and restart ──────────────────────────────────────────────── # ─── Swap and restart ────────────────────────────────────────────────
say "Swapping to $SHORT and restarting" say "Swapping to $SHORT and restarting"
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'" remote_root <<'EOF'
"${SSH[@]}" "sudo -n systemctl restart drinktracker" set -e
health_poll || die "app unhealthy - check: ${SSH[*]} 'journalctl -u drinktracker -n 50'" su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
systemctl restart drinktracker
EOF
health_poll || die "app unhealthy - check: ${SSH[*]} 'sudo journalctl -u drinktracker -n 50'"
# ─── Verify ────────────────────────────────────────────────────────── # ─── Verify and prune ────────────────────────────────────────────────
say "Verifying" say "Verifying"
"${SSH[@]}" "curl -s -o /dev/null -w ' public=%{http_code}\n' -m 15 https://drinktracker.tenseconddelay.net/ || true" "${SSH[@]}" "curl -s -o /dev/null -w ' public=%{http_code}\n' -m 15 https://drinktracker.tenseconddelay.net/ || true"
"${SSH[@]}" "sudo -n journalctl -u drinktracker --since '2 min ago' | grep '\[switchboard\]' | tail -3 || echo ' (no AI calls yet)'" remote_root <<'EOF'
journalctl -u drinktracker --since '3 min ago' | grep '\[switchboard\]' | tail -3 || echo " (no AI calls in window)"
say "Pruning old releases (keeping $KEEP_RELEASES)" cd "$APP_DIR/releases" && ls -1t | tail -n +$((KEEP+1)) | xargs -r rm -rf
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'cd $APP_DIR/releases && ls -1t | tail -n +$((KEEP_RELEASES+1)) | xargs -r rm -rf; ls -1t'" echo " releases kept:"; ls -1t "$APP_DIR/releases" | sed 's/^/ /'
EOF
say "Deployed $SHORT" say "Deployed $SHORT"
echo "Roll back with: ./deploy/deploy.sh --rollback" echo "Roll back with: ./deploy/deploy.sh --rollback"