jacobh2
d05f13a080
The server publishes 8080 on the Kvitt Pi's LAN interfaces and trusts X-Forwarded-For only from HA_HOST, NPM's LAN address (an IPv4 literal, checked by install.sh). KVITT_PUBLIC_HOST (owner-chosen, not icehack.asuscomm.com, which is NPM's proxy host for Home Assistant) builds KVITT_PUBLIC_URL. Only fcm-service-account.json and rclone.conf are installed; install.sh removes the Caddyfile, the Home Assistant SSH key, known_hosts and the certs and caddy_data volumes left by the earlier stack. Health checks: port 8080, then through NPM. The cert-sync image leaves the workflow and build-images.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
62 lines
2.9 KiB
Bash
Executable File
62 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Deploy an image tag on the Kvitt Pi (SPEC §10.3, §10.10). Run ON the Pi: /opt/kvitt/deploy.sh <tag>
|
|
# 1. backup first (backup-now.sh: Drive upload confirmed, last-success updated), because a tag may carry a
|
|
# migration and the Pi cannot tell beforehand (the rule "backup before a deploy with a migration" is applied
|
|
# to every deploy); skipped when no database exists yet, or with --skip-backup (rollback while Drive is down)
|
|
# 2. sets KVITT_TAG in /opt/kvitt/.env (the previous tag is kept in /opt/kvitt/previous-tag)
|
|
# 3. docker compose pull, prints the pulled image digests and appends them to /opt/kvitt/deployed-digests (D-117),
|
|
# docker compose up -d, waits for server to be healthy, prints GET /health on port 8080 and through Nginx
|
|
# Proxy Manager (D-120; a failure through NPM is a warning, the deploy itself succeeded)
|
|
# Rollback after a failed migration: /opt/kvitt/deploy.sh "$(cat /opt/kvitt/previous-tag)"; if a migration had
|
|
# partially applied, restore the pre-deploy backup (infra/RESTORE.md).
|
|
set -euo pipefail
|
|
here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib.sh
|
|
. "$here/lib.sh"
|
|
|
|
skip_backup=0
|
|
tag=""
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--skip-backup) skip_backup=1 ;;
|
|
-h|--help) sed -n '2,11p' "$0"; exit 0 ;;
|
|
-*) die "unknown option $arg" ;;
|
|
*) [[ -z "$tag" ]] || die "usage: $0 <tag> [--skip-backup]"; tag=$arg ;;
|
|
esac
|
|
done
|
|
[[ -n "$tag" ]] || die "usage: $0 <tag> [--skip-backup]"
|
|
[[ "$tag" =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]] || die "not a valid image tag: $tag"
|
|
[[ -f "$KVITT_DIR/.env" ]] || die "$KVITT_DIR/.env is missing: run install.sh first"
|
|
|
|
current=$(env_value KVITT_TAG)
|
|
say "Deploying $tag (running: ${current:-none})"
|
|
|
|
# 1. Backup before the deploy.
|
|
if (( skip_backup == 1 )); then
|
|
say "Backup skipped (--skip-backup)"
|
|
elif [[ "$(service_health server)" == none ]] || ! compose exec -T backup test -f /data/kvitt.sqlite 2>/dev/null; then
|
|
say "No running server with a database: no backup needed"
|
|
else
|
|
"$here/backup-now.sh" || die "the pre-deploy backup failed; nothing deployed (fix the backup, or use --skip-backup knowingly)"
|
|
fi
|
|
|
|
# 2. Tag.
|
|
[[ -n "$current" ]] && printf '%s\n' "$current" > "$KVITT_DIR/previous-tag"
|
|
env_set KVITT_TAG "$tag"
|
|
|
|
# 3. Pull and start.
|
|
if ! compose pull; then
|
|
[[ -n "$current" ]] && env_set KVITT_TAG "$current"
|
|
die "pull of $tag failed; KVITT_TAG left at ${current:-its old value}"
|
|
fi
|
|
record_digests "$tag"
|
|
compose up -d --remove-orphans
|
|
if ! wait_healthy server 180; then
|
|
compose logs --tail 50 server || true
|
|
die "server is not healthy on $tag. Roll back: $KVITT_DIR/deploy.sh ${current:-<previous tag>} --skip-backup"
|
|
fi
|
|
compose ps
|
|
print_health || die "server is healthy but GET /health on port 8080 failed (docker compose logs server)"
|
|
print_proxy_health || say "WARNING: /health through Nginx Proxy Manager failed: Kvitt is not reachable from outside (README, Troubleshooting)"
|
|
say "Deployed $tag."
|