emi
92e74c585a
All checks were successful
Sync infra to hosts / sync-beta (push) Successful in 13s
Sync infra to hosts / sync-prod (push) Successful in 12s
secrets-guard / encrypted (push) Successful in 7s
shell-lint / shellcheck (push) Successful in 8s
Build + push frontend image (Forgejo registry) / build-push (push) Successful in 53s
Deploy frontend to beta VPS / deploy (push) Successful in 1m16s
secrets-guard / encrypted (pull_request) Successful in 5s
shell-lint / shellcheck (pull_request) Successful in 6s
Ports frontend/ (Jinja2/FastAPI, ~1180 LOC) to Go with html/template. No climate math, no DB, no auth -- every route fetches from the backend's /content/* API. Verified with a golden-HTML diff, not just unit tests: both the Python original and the Go rewrite were run against the same committed fixtures and every route compared byte-for-byte, confirmed programmatically. That process caught defects unit tests alone missed, since map[string]any has no compile-time field check: - Render-context keys were snake_case throughout while the templates read PascalCase fields. A missing map key doesn't error, it silently renders empty -- title, meta description, canonical URL, OpenGraph tags, and the homepage's entire ranked list were blank on every page despite every route returning 200. Fixed by renaming every key to match each template's own documented field contract, and passing API structs straight through wherever their fields already matched (removes a whole layer of future drift risk). - Three pages 500'd: ToolHref needed a composed href, not a bare "lat,lon" fragment; the records table needed the raw API struct. - JSON-LD was double-encoded: <script type="application/ld+json"> is JAVASCRIPT context to html/template's escaper regardless of the script's type attribute, so template.HTML gets re-escaped as a quoted JS string. Needed template.JS. The glossary term page's JSON-LD was never built at all -- added. - html/template silently strips literal HTML and JS comments from parsed output (verified in isolation) -- both need a FuncMap function returning template.HTML/template.JS to survive. Packaging: 187MB -> 22.6MB. Two defects caught before reaching a host: the Swarm stack's entrypoint override with no explicit command drops the image's CMD entirely (every deploy would have exited 127), and COPY --chown by name fails under the classic Docker builder on Alpine. Both fixed. go build/vet/test -race clean; docker build passes its embedded test step under both BuildKit and the classic builder; shellcheck 0 findings.
51 lines
2.1 KiB
Bash
Executable file
51 lines
2.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Stack-task entrypoint shim: source the host-rendered secrets env, then hand
|
|
# off to the image's real entrypoint.
|
|
#
|
|
# Why: `docker stack deploy` does not support compose's `env_file:`, and
|
|
# enumerating every vault key in the stack yml's `environment:` blocks would
|
|
# drift the moment a key is added to deploy/secrets/. Instead deploy-stack.sh
|
|
# installs a uid-10001-readable copy of the rendered env at
|
|
# /etc/thermograph/stack.env, the stack bind-mounts it (with this script) into
|
|
# every app task, and this shim exports each KEY=value — but ONLY for keys not
|
|
# already set, so the yml's `environment:` blocks keep compose's env_file
|
|
# precedence (environment always wins). Same set-if-unset contract as the
|
|
# image's own /run/secrets shim in deploy/entrypoint.sh, which still runs
|
|
# after this and stays a no-op here.
|
|
set -euo pipefail
|
|
|
|
ENV_FILE="${THERMOGRAPH_HOST_ENV:-/host/thermograph.env}"
|
|
|
|
if [ -f "$ENV_FILE" ]; then
|
|
while IFS= read -r line || [ -n "$line" ]; do
|
|
case "$line" in
|
|
''|'#'*) continue ;;
|
|
*=*)
|
|
key="${line%%=*}"
|
|
# Only sane identifiers; only if not already set by `environment:`.
|
|
case "$key" in
|
|
*[!A-Za-z0-9_]*|'') continue ;;
|
|
esac
|
|
if [ -z "${!key:-}" ]; then
|
|
export "$key=${line#*=}"
|
|
fi
|
|
;;
|
|
esac
|
|
done < "$ENV_FILE"
|
|
fi
|
|
|
|
# Hand off: the backend image has a real entrypoint script and takes that
|
|
# branch. Anything else needs an explicit `command:` in the stack yml's
|
|
# service block -- overriding `entrypoint:` here drops the image's own CMD
|
|
# entirely (Docker/Swarm does not merge them), so `$@` is empty unless the
|
|
# stack file supplies one. The frontend service does exactly that. The
|
|
# uvicorn fallback below is what ran, silently, whenever that expectation
|
|
# didn't hold; it is Python-specific and kept only as a loud, familiar-looking
|
|
# failure for a misconfigured non-Python image, not a real handoff path.
|
|
if [ -x /app/deploy/entrypoint.sh ]; then
|
|
exec /app/deploy/entrypoint.sh "$@"
|
|
elif [ "$#" -gt 0 ]; then
|
|
exec "$@"
|
|
else
|
|
exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-8080}"
|
|
fi
|