80 lines
2.9 KiB
Bash
80 lines
2.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# One-time bootstrap of the DEV environment on vps1.
|
||
|
|
#
|
||
|
|
# sudo bash infra/deploy/provision-dev.sh
|
||
|
|
#
|
||
|
|
# Replaces provision-dev-lan.sh, which bootstrapped dev on the operator's
|
||
|
|
# desktop as a sudo-free systemd --user stack with `linger`. Dev is a normal
|
||
|
|
# fleet environment now: a checkout at /opt/thermograph-dev, secrets rendered
|
||
|
|
# from the SOPS vault at deploy time, deployed over SSH by CI like beta and
|
||
|
|
# prod. The desktop hosts no Thermograph environment at all.
|
||
|
|
#
|
||
|
|
# What dev keeps that beta and prod do not:
|
||
|
|
# - It renders dev.yaml ALONE, never layering common.yaml (the fleet's shared
|
||
|
|
# production credentials). vps1 also runs Forgejo and its CI, and dev runs
|
||
|
|
# whatever branch is in flight — see the long note in render-secrets.sh.
|
||
|
|
# - It is MESH-ONLY: published on 10.10.0.2:8137 (wg0), never 0.0.0.0. No DNS
|
||
|
|
# record, no Caddy site, no TLS. Anything that can reach it is already on
|
||
|
|
# the WireGuard mesh.
|
||
|
|
#
|
||
|
|
# Idempotent; re-run it after changing the branch or repointing the remote.
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
SELF_DIR=$(cd "$(dirname "$0")" && pwd)
|
||
|
|
# shellcheck source=infra/deploy/env-topology.sh
|
||
|
|
. "$SELF_DIR/env-topology.sh"
|
||
|
|
thermograph_topology dev
|
||
|
|
|
||
|
|
REPO_URL="${REPO_URL:-http://10.10.0.2:3080/emi/thermograph.git}"
|
||
|
|
APP_DIR="${APP_DIR:-$TG_APP_DIR}"
|
||
|
|
BRANCH="${BRANCH:-$TG_BRANCH}"
|
||
|
|
|
||
|
|
if [ "$(id -u)" -ne 0 ]; then
|
||
|
|
echo "!! run this as root (it writes /opt and /etc/thermograph)" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "==> Checkout: $APP_DIR on $BRANCH"
|
||
|
|
if [ -d "$APP_DIR/.git" ]; then
|
||
|
|
git -C "$APP_DIR" remote set-url origin "$REPO_URL"
|
||
|
|
git -C "$APP_DIR" fetch --prune origin "$BRANCH"
|
||
|
|
git -C "$APP_DIR" checkout -B "$BRANCH" "origin/$BRANCH"
|
||
|
|
else
|
||
|
|
git clone --branch "$BRANCH" "$REPO_URL" "$APP_DIR"
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo "==> Marking this checkout's environment"
|
||
|
|
mkdir -p /etc/thermograph
|
||
|
|
# The host marker still exists for by-hand runs. vps1 runs exactly one
|
||
|
|
# environment, so a marker is sufficient here — unlike vps2, where beta and prod
|
||
|
|
# share a box and THERMOGRAPH_ENV must be passed explicitly.
|
||
|
|
printf 'dev\n' > /etc/thermograph/secrets-env
|
||
|
|
# Dev is compose, not Swarm. env-topology.sh is what actually decides this; the
|
||
|
|
# marker is only the fallback for a checkout that predates it.
|
||
|
|
rm -f /etc/thermograph/deploy-mode
|
||
|
|
|
||
|
|
if [ ! -f /etc/thermograph/age.key ]; then
|
||
|
|
cat >&2 <<'EOF'
|
||
|
|
!! No age key at /etc/thermograph/age.key.
|
||
|
|
!! Dev cannot render its vault without it, and deploy-dev.sh will fall back to
|
||
|
|
!! the un-vaulted defaults. Copy the key over (0400 root:root), then re-run:
|
||
|
|
!! install -m 0400 -o root -g root age.key /etc/thermograph/age.key
|
||
|
|
EOF
|
||
|
|
fi
|
||
|
|
|
||
|
|
cat <<EOF
|
||
|
|
|
||
|
|
Done. Dev is checked out at $APP_DIR on $BRANCH.
|
||
|
|
|
||
|
|
Deploy it:
|
||
|
|
SERVICE=all BACKEND_IMAGE_TAG=sha-<a> FRONTEND_IMAGE_TAG=sha-<b> \\
|
||
|
|
$APP_DIR/infra/deploy/deploy-dev.sh
|
||
|
|
|
||
|
|
Reach it (mesh only):
|
||
|
|
http://${TG_BIND_ADDR}:8137
|
||
|
|
|
||
|
|
Confirm it is NOT publicly exposed — this must show ${TG_BIND_ADDR}:8137 and
|
||
|
|
never 0.0.0.0:8137:
|
||
|
|
ss -ltnp | grep 8137
|
||
|
|
EOF
|