df409f88b3
All checks were successful
PR build (required check) / changes (pull_request) Successful in 6s
secrets-guard / encrypted (pull_request) Successful in 4s
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / validate-observability (pull_request) Successful in 20s
PR build (required check) / build-frontend (pull_request) Successful in 37s
PR build (required check) / build-backend (pull_request) Successful in 51s
PR build (required check) / gate (pull_request) Successful in 1s
Repos moved to the Jinemi org; the container packages did not follow, since
Forgejo does not transfer packages with a repo. The deploy path still resolved
`emi/thermograph/*` — a user_redirect to admin_emi — while build-push.yml
derives its push path from ${github.repository}, now jinemi/thermograph. The
next backend or frontend build would have published somewhere no deploy looks.
Point the image paths at jinemi/thermograph/* (lowercase: OCI references admit
no uppercase, which is why build-push.yml already pipes through tr), the clone
URLs at Jinemi/thermograph, and the registry logins at admin_emi — the account
that actually owns the tokens, rather than the redirect.
The live tags and both ci-runner tags were copied into the Jinemi namespace
first, so the switch has something to pull. thermograph-infra,
thermograph-observability and the retired */app packages stay under admin_emi;
they did not move.
80 lines
3.1 KiB
Bash
Executable file
80 lines
3.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# One-time bootstrap of the DEV environment on vps1.
|
|
#
|
|
# sudo bash infra/deploy/provision-dev.sh
|
|
#
|
|
# Replaces provision-dev-lan.sh, which bootstrapped dev on the operator's
|
|
# desktop as a sudo-free systemd --user stack with `linger`. Dev is a normal
|
|
# fleet environment now: a checkout at /opt/thermograph-dev, secrets rendered
|
|
# from the SOPS vault at deploy time, deployed over SSH by CI like beta and
|
|
# prod. The desktop hosts no Thermograph environment at all.
|
|
#
|
|
# What dev keeps that beta and prod do not:
|
|
# - It renders dev.yaml ALONE, never layering common.yaml (the fleet's shared
|
|
# production credentials). vps1 also runs Forgejo and its CI, and dev runs
|
|
# whatever branch is in flight — see the long note in render-secrets.sh.
|
|
# - It binds LOOPBACK, never 0.0.0.0. Caddy fronts it at dev.thermograph.org
|
|
# with TLS, basic auth and X-Robots-Tag: noindex (deploy/Caddyfile.vps1).
|
|
# Binding loopback is what makes that guard total rather than decorative:
|
|
# the site block is the only route in.
|
|
#
|
|
# Idempotent; re-run it after changing the branch or repointing the remote.
|
|
set -euo pipefail
|
|
|
|
SELF_DIR=$(cd "$(dirname "$0")" && pwd)
|
|
# shellcheck source=infra/deploy/env-topology.sh
|
|
. "$SELF_DIR/env-topology.sh"
|
|
thermograph_topology dev
|
|
|
|
REPO_URL="${REPO_URL:-http://10.10.0.2:3080/Jinemi/thermograph.git}"
|
|
APP_DIR="${APP_DIR:-$TG_APP_DIR}"
|
|
BRANCH="${BRANCH:-$TG_BRANCH}"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "!! run this as root (it writes /opt and /etc/thermograph)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Checkout: $APP_DIR on $BRANCH"
|
|
if [ -d "$APP_DIR/.git" ]; then
|
|
git -C "$APP_DIR" remote set-url origin "$REPO_URL"
|
|
git -C "$APP_DIR" fetch --prune origin "$BRANCH"
|
|
git -C "$APP_DIR" checkout -B "$BRANCH" "origin/$BRANCH"
|
|
else
|
|
git clone --branch "$BRANCH" "$REPO_URL" "$APP_DIR"
|
|
fi
|
|
|
|
echo "==> Marking this checkout's environment"
|
|
mkdir -p /etc/thermograph
|
|
# The host marker still exists for by-hand runs. vps1 runs exactly one
|
|
# environment, so a marker is sufficient here — unlike vps2, where beta and prod
|
|
# share a box and THERMOGRAPH_ENV must be passed explicitly.
|
|
printf 'dev\n' > /etc/thermograph/secrets-env
|
|
# Dev is compose, not Swarm. env-topology.sh is what actually decides this; the
|
|
# marker is only the fallback for a checkout that predates it.
|
|
rm -f /etc/thermograph/deploy-mode
|
|
|
|
if [ ! -f /etc/thermograph/age.key ]; then
|
|
cat >&2 <<'EOF'
|
|
!! No age key at /etc/thermograph/age.key.
|
|
!! Dev cannot render its vault without it, and deploy-dev.sh will fall back to
|
|
!! the un-vaulted defaults. Copy the key over (0400 root:root), then re-run:
|
|
!! install -m 0400 -o root -g root age.key /etc/thermograph/age.key
|
|
EOF
|
|
fi
|
|
|
|
cat <<EOF
|
|
|
|
Done. Dev is checked out at $APP_DIR on $BRANCH.
|
|
|
|
Deploy it:
|
|
SERVICE=all BACKEND_IMAGE_TAG=sha-<a> FRONTEND_IMAGE_TAG=sha-<b> \\
|
|
$APP_DIR/infra/deploy/deploy-dev.sh
|
|
|
|
Reach it:
|
|
https://dev.thermograph.org (basic auth; see deploy/Caddyfile.vps1)
|
|
|
|
Confirm the app itself is NOT directly exposed — this must show
|
|
${TG_BIND_ADDR}:8137 and never 0.0.0.0:8137, so Caddy is the only way in:
|
|
ss -ltnp | grep 8137
|
|
EOF
|