Fix deploy: sudo to root once and su down, not sudo -u
sudoers grants drinkadmin NOPASSWD only as root, so every 'sudo -u drinktracker' in the deploy prompted for a password. Restructured to pipe one script per phase to 'sudo -n bash -s' and use su inside, which needs no privilege change and cuts the SSH round-trips. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
JP
112
deploy/deploy.sh
112
deploy/deploy.sh
@@ -31,6 +31,14 @@ SSH=(ssh -o BatchMode=yes -o ConnectTimeout=10 -i "$SSH_KEY" "$HOST")
|
||||
say() { printf '\n\033[1;36m==> %s\033[0m\n' "$*"; }
|
||||
die() { printf '\n\033[1;31mFAILED: %s\033[0m\n' "$*" >&2; exit 1; }
|
||||
|
||||
# Run a script (on stdin) as root on the LXC, with these vars exported.
|
||||
# sudoers grants drinkadmin NOPASSWD only as root, so we sudo once and `su` down
|
||||
# to the service user inside rather than using `sudo -u`.
|
||||
remote_root() {
|
||||
"${SSH[@]}" "sudo -n env APP_DIR='$APP_DIR' SVC_USER='$SVC_USER' SHA='${SHA:-}' \
|
||||
SHORT='${SHORT:-}' KEEP='$KEEP_RELEASES' bash -s"
|
||||
}
|
||||
|
||||
health_poll() {
|
||||
for i in $(seq 1 30); do
|
||||
code=$("${SSH[@]}" "curl -s -o /dev/null -w '%{http_code}' -m 5 $HEALTH_URL" || echo 000)
|
||||
@@ -43,17 +51,19 @@ health_poll() {
|
||||
|
||||
# ─── Rollback: repoint the symlink, no rebuild ───────────────────────
|
||||
if [ "$ROLLBACK" -eq 1 ]; then
|
||||
say "Available releases (newest last)"
|
||||
"${SSH[@]}" "ls -1tr $APP_DIR/releases"
|
||||
CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename")
|
||||
say "Rolling back"
|
||||
CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
|
||||
PREV=$("${SSH[@]}" "ls -1t $APP_DIR/releases | grep -v '^$CURRENT\$' | head -1")
|
||||
[ -n "$PREV" ] || die "no other release to roll back to"
|
||||
echo " current=$CURRENT -> rolling back to $PREV"
|
||||
echo " current=$CURRENT -> $PREV"
|
||||
if [ "$ASSUME_YES" -ne 1 ]; then
|
||||
read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
|
||||
fi
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$PREV $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'"
|
||||
"${SSH[@]}" "sudo -n systemctl restart drinktracker"
|
||||
SHORT="$PREV" remote_root <<'EOF'
|
||||
set -e
|
||||
su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
|
||||
systemctl restart drinktracker
|
||||
EOF
|
||||
health_poll || die "app unhealthy after rollback - journalctl -u drinktracker"
|
||||
say "Rolled back to $PREV"
|
||||
exit 0
|
||||
@@ -82,67 +92,73 @@ for unit in postgresql@16-main minio drinktracker; do
|
||||
done
|
||||
|
||||
if [ "$ASSUME_YES" -ne 1 ]; then
|
||||
CURRENT=$("${SSH[@]}" "readlink $APP_DIR/current | xargs basename")
|
||||
CURRENT=$("${SSH[@]}" "basename \$(readlink $APP_DIR/current)")
|
||||
echo " current release $CURRENT, deploying $SHORT"
|
||||
read -r -p " proceed? [y/N] " r; [[ "$r" =~ ^[Yy]$ ]] || { echo aborted; exit 1; }
|
||||
fi
|
||||
|
||||
# ─── Build (out-of-place; the running release keeps serving) ─────────
|
||||
say "Syncing and building on $HOST"
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER git -C $APP_DIR/repo fetch --quiet origin main && sudo -n -u $SVC_USER git -C $APP_DIR/repo reset --hard $SHA --quiet && sudo -n -u $SVC_USER git -C $APP_DIR/repo log --oneline -1"
|
||||
# ─── Build and assemble (out-of-place; old release keeps serving) ────
|
||||
say "Syncing, building and assembling $SHORT"
|
||||
BUILD="$BUILD" remote_root <<'EOF'
|
||||
set -e
|
||||
su -s /bin/bash "$SVC_USER" <<INNER
|
||||
set -e
|
||||
git -C "$APP_DIR/repo" fetch --quiet origin main
|
||||
git -C "$APP_DIR/repo" reset --hard "$SHA" --quiet
|
||||
git -C "$APP_DIR/repo" log --oneline -1
|
||||
|
||||
if [ "$BUILD" -eq 1 ]; then
|
||||
# Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
|
||||
# evaluates rewrites() at build time, so sourcing the env here would bake a different
|
||||
# /minio-images destination into routes-manifest.json.
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
|
||||
set -e
|
||||
cd $APP_DIR/repo
|
||||
export npm_config_cache=$APP_DIR/.npm NODE_OPTIONS=--max-old-space-size=3072
|
||||
npm ci --prefer-offline --no-audit --fund=false
|
||||
npx prisma generate
|
||||
npm run build
|
||||
'" || die "build failed"
|
||||
fi
|
||||
cd "$APP_DIR/repo"
|
||||
export npm_config_cache="$APP_DIR/.npm" NODE_OPTIONS=--max-old-space-size=3072
|
||||
# Built WITHOUT the env file, deliberately - same as the Dockerfile. next.config.mjs
|
||||
# evaluates rewrites() at build time, so sourcing the env here would bake a different
|
||||
# /minio-images destination into routes-manifest.json.
|
||||
npm ci --prefer-offline --no-audit --fund=false
|
||||
npx prisma generate
|
||||
npm run build
|
||||
|
||||
say "Assembling release $SHORT"
|
||||
# Mirrors Dockerfile:24-30 - standalone bundle plus static and public copied in.
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
|
||||
set -e
|
||||
REL=$APP_DIR/releases/$SHORT
|
||||
rm -rf \$REL && mkdir -p \$REL/.next/cache
|
||||
cp -a $APP_DIR/repo/.next/standalone/. \$REL/
|
||||
cp -a $APP_DIR/repo/.next/static \$REL/.next/static
|
||||
cp -a $APP_DIR/repo/public \$REL/public
|
||||
du -sh \$REL
|
||||
'" || die "release assembly failed"
|
||||
REL="$APP_DIR/releases/$SHORT"
|
||||
rm -rf "\$REL" && mkdir -p "\$REL/.next/cache"
|
||||
cp -a "$APP_DIR/repo/.next/standalone/." "\$REL"/
|
||||
cp -a "$APP_DIR/repo/.next/static" "\$REL/.next/static"
|
||||
cp -a "$APP_DIR/repo/public" "\$REL/public"
|
||||
du -sh "\$REL"
|
||||
INNER
|
||||
EOF
|
||||
[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "build/assembly failed"
|
||||
|
||||
# ─── Schema ──────────────────────────────────────────────────────────
|
||||
say "Backing up database before schema push"
|
||||
"${SSH[@]}" "sudo -n install -d -m 0750 /var/backups/drinktracker && sudo -n -u postgres pg_dump drinkman | gzip -9 | sudo -n tee /var/backups/drinktracker/pre-$SHORT.sql.gz >/dev/null && sudo -n ls -lh /var/backups/drinktracker/pre-$SHORT.sql.gz"
|
||||
say "Backing up database, then applying schema"
|
||||
remote_root <<'EOF'
|
||||
set -e
|
||||
install -d -m 0750 /var/backups/drinktracker
|
||||
sudo -u postgres pg_dump drinkman | gzip -9 > "/var/backups/drinktracker/pre-$SHORT.sql.gz"
|
||||
ls -lh "/var/backups/drinktracker/pre-$SHORT.sql.gz"
|
||||
|
||||
say "Applying schema"
|
||||
# db push, NOT migrate deploy: production has no _prisma_migrations table, so
|
||||
# migrate deploy would try to apply the init migration against populated tables.
|
||||
# --accept-data-loss means removing a field from schema.prisma DROPS the column.
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -lc '
|
||||
set -a; . /etc/drinktracker/drinktracker.env; set +a
|
||||
cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss
|
||||
'" || die "prisma db push failed"
|
||||
su -s /bin/bash "$SVC_USER" -c "set -a; . /etc/drinktracker/drinktracker.env; set +a; cd $APP_DIR/repo && npx prisma db push --skip-generate --accept-data-loss"
|
||||
EOF
|
||||
[ "${PIPESTATUS[0]:-0}" -eq 0 ] || die "schema step failed"
|
||||
|
||||
# ─── Swap and restart ────────────────────────────────────────────────
|
||||
say "Swapping to $SHORT and restarting"
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current'"
|
||||
"${SSH[@]}" "sudo -n systemctl restart drinktracker"
|
||||
health_poll || die "app unhealthy - check: ${SSH[*]} 'journalctl -u drinktracker -n 50'"
|
||||
remote_root <<'EOF'
|
||||
set -e
|
||||
su -s /bin/bash "$SVC_USER" -c "ln -sfn $APP_DIR/releases/$SHORT $APP_DIR/current.new && mv -Tf $APP_DIR/current.new $APP_DIR/current"
|
||||
systemctl restart drinktracker
|
||||
EOF
|
||||
health_poll || die "app unhealthy - check: ${SSH[*]} 'sudo journalctl -u drinktracker -n 50'"
|
||||
|
||||
# ─── Verify ──────────────────────────────────────────────────────────
|
||||
# ─── Verify and prune ────────────────────────────────────────────────
|
||||
say "Verifying"
|
||||
"${SSH[@]}" "curl -s -o /dev/null -w ' public=%{http_code}\n' -m 15 https://drinktracker.tenseconddelay.net/ || true"
|
||||
"${SSH[@]}" "sudo -n journalctl -u drinktracker --since '2 min ago' | grep '\[switchboard\]' | tail -3 || echo ' (no AI calls yet)'"
|
||||
|
||||
say "Pruning old releases (keeping $KEEP_RELEASES)"
|
||||
"${SSH[@]}" "sudo -n -u $SVC_USER bash -c 'cd $APP_DIR/releases && ls -1t | tail -n +$((KEEP_RELEASES+1)) | xargs -r rm -rf; ls -1t'"
|
||||
remote_root <<'EOF'
|
||||
journalctl -u drinktracker --since '3 min ago' | grep '\[switchboard\]' | tail -3 || echo " (no AI calls in window)"
|
||||
cd "$APP_DIR/releases" && ls -1t | tail -n +$((KEEP+1)) | xargs -r rm -rf
|
||||
echo " releases kept:"; ls -1t "$APP_DIR/releases" | sed 's/^/ /'
|
||||
EOF
|
||||
|
||||
say "Deployed $SHORT"
|
||||
echo "Roll back with: ./deploy/deploy.sh --rollback"
|
||||
|
||||
Reference in New Issue
Block a user