2026-07-22 19:20:05 +00:00
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
# LAN-dev deploy: roll the per-service registry-pull stack (see deploy.sh) onto
|
|
|
|
|
# the ~/thermograph-dev overlay instead of prod/beta's loopback-only stack.
|
|
|
|
|
#
|
|
|
|
|
# This script assumes $APP_DIR is a checkout of THIS repo (thermograph-infra),
|
2026-07-22 23:36:21 +00:00
|
|
|
# the same way /opt/thermograph is on prod/beta. That is the live state: the LAN
|
|
|
|
|
# box's ~/thermograph-dev was reprovisioned as an infra checkout during the
|
|
|
|
|
# 2026-07-22 cutover (the app monorepo is archived), provision-dev-lan.sh's
|
|
|
|
|
# REPO_URL defaults to this repo, and the app repos' deploy-dev.yml workflows
|
|
|
|
|
# invoke this script on the thermograph-lan runner. This IS the live LAN-dev
|
|
|
|
|
# deploy path.
|
2026-07-22 19:20:05 +00:00
|
|
|
#
|
|
|
|
|
# Design: a thin wrapper around deploy.sh, not a duplicate. deploy.sh already owns
|
|
|
|
|
# the entire per-service registry-pull mechanism -- secrets sourcing, docker login,
|
|
|
|
|
# the retry-pull loop, --no-deps single-service rolls vs. --remove-orphans `all`,
|
|
|
|
|
# .image-tags.env persistence, and the 8137/8080 health checks. None of that is
|
|
|
|
|
# dev-specific; the only things LAN dev actually changes are WHERE it deploys
|
|
|
|
|
# (a separate checkout + branch) and WHICH compose files are in play (the base
|
|
|
|
|
# file plus docker-compose.dev.yml's uncapped/LAN-published overrides). Both are
|
|
|
|
|
# expressible as environment (APP_DIR/BRANCH that deploy.sh already reads, and
|
|
|
|
|
# docker compose's own COMPOSE_FILE variable), so re-exec'ing deploy.sh with that
|
|
|
|
|
# environment set covers it with no forked copy of the pull/roll/health logic to
|
|
|
|
|
# drift out of sync. If LAN dev ever needs deploy logic that genuinely diverges
|
|
|
|
|
# from prod/beta (not just "different files/directory"), promote this to a
|
|
|
|
|
# standalone script at that point rather than growing special cases into deploy.sh.
|
|
|
|
|
#
|
2026-07-22 23:36:21 +00:00
|
|
|
# Usage, mirrors deploy.sh directly:
|
2026-07-22 19:20:05 +00:00
|
|
|
# # roll just the backend onto a dev-tagged image:
|
|
|
|
|
# ssh dev-box 'SERVICE=backend BACKEND_IMAGE_TAG=sha-<12hex> deploy/deploy-dev.sh'
|
|
|
|
|
# # bring the whole dev stack up (both tags required, same as deploy.sh):
|
|
|
|
|
# ssh dev-box 'SERVICE=all BACKEND_IMAGE_TAG=sha-<a> FRONTEND_IMAGE_TAG=sha-<b> deploy/deploy-dev.sh'
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
|
|
|
|
# Dev context: a separate checkout + branch from prod/beta's /opt/thermograph
|
|
|
|
|
# (main), so a dev deploy never touches or is touched by the prod/beta one.
|
|
|
|
|
APP_DIR="${APP_DIR:-$HOME/thermograph-dev}"
|
|
|
|
|
BRANCH="${BRANCH:-dev}"
|
|
|
|
|
export APP_DIR BRANCH
|
|
|
|
|
|
|
|
|
|
# Point every `docker compose` invocation inside deploy.sh at the LAN-dev overlay
|
|
|
|
|
# (uncapped CPU, backend published on 0.0.0.0:8137, frontend unpublished -- see
|
|
|
|
|
# docker-compose.dev.yml) without deploy.sh needing to know dev exists at all.
|
|
|
|
|
# COMPOSE_FILE is docker compose's own env var for this; ':' is the Linux/macOS
|
|
|
|
|
# path-list separator it expects (';' only on Windows).
|
|
|
|
|
export COMPOSE_FILE="docker-compose.yml:docker-compose.dev.yml"
|
|
|
|
|
|
|
|
|
|
# deploy.sh needs POSTGRES_PASSWORD to interpolate the compose file (both to init
|
|
|
|
|
# the db container and to build backend's THERMOGRAPH_DATABASE_URL) -- normally
|
|
|
|
|
# supplied by /etc/thermograph.env via render-secrets.sh's SOPS render, but dev has
|
|
|
|
|
# no entry in deploy/secrets/ (only common/beta/prod.yaml exist), so
|
|
|
|
|
# render_thermograph_secrets degrades to a no-op here (see render-secrets.sh) and
|
|
|
|
|
# /etc/thermograph.env likely doesn't exist on a fresh dev box either. Postgres is
|
|
|
|
|
# loopback-only inside the compose network on dev (never published, no real
|
|
|
|
|
# credentials on this box), so a fixed default is fine -- same value the monorepo's
|
|
|
|
|
# deploy-dev.sh used historically. Override via the environment if you ever want a
|
|
|
|
|
# different one; this only sets it when nothing else already has.
|
|
|
|
|
export POSTGRES_PASSWORD="${POSTGRES_PASSWORD:-thermograph-dev}"
|
|
|
|
|
|
|
|
|
|
# REGISTRY_TOKEN (for `docker login` in deploy.sh) is a REAL credential -- read
|
|
|
|
|
# access to git.thermograph.org's registry -- and deliberately has NO default here.
|
|
|
|
|
# Until dev gets its own deploy/secrets/dev.yaml entry (see deploy/secrets/README.md)
|
|
|
|
|
# it must come from the calling environment: exported by hand for a manual run, or
|
|
|
|
|
# injected by whatever eventually SSHes in to trigger a dev deploy (analogous to
|
|
|
|
|
# how deploy.yml supplies it for prod/beta today). deploy.sh's own `docker login`
|
|
|
|
|
# step fails loudly if it's unset or wrong -- nothing silently no-ops.
|
|
|
|
|
|
|
|
|
|
echo "==> LAN-dev deploy: APP_DIR=$APP_DIR BRANCH=$BRANCH COMPOSE_FILE=$COMPOSE_FILE"
|
|
|
|
|
exec "$(dirname "$0")/deploy.sh" "$@"
|
