fed307e75c
All checks were successful
PR build (required check) / changes (pull_request) Successful in 7s
secrets-guard / encrypted (pull_request) Successful in 5s
PR build (required check) / build-backend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / gate (pull_request) Successful in 2s
Dev was mesh-only: bound to 10.10.0.2, no DNS record, no Caddy site. A public
record now exists for it, so it gets a real front door instead of a name that
resolves to a timeout.
Three things keep that acceptable on a box that also runs Forgejo and its CI
runner, and all three are load-bearing together:
- the stack binds LOOPBACK, so the site block is the only route in — not even
the mesh reaches the app directly, which is what makes the guard total
rather than decorative,
- HTTP basic auth, so a stumbled-upon URL is not a running build,
- X-Robots-Tag: noindex, so dev never competes with thermograph.org for the
same content in a search index.
The credential in Caddyfile.vps1 is a bcrypt hash, not a password.
80 lines
3 KiB
Bash
Executable file
80 lines
3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# One-time bootstrap of the DEV environment on vps1.
|
|
#
|
|
# sudo bash infra/deploy/provision-dev.sh
|
|
#
|
|
# Replaces provision-dev-lan.sh, which bootstrapped dev on the operator's
|
|
# desktop as a sudo-free systemd --user stack with `linger`. Dev is a normal
|
|
# fleet environment now: a checkout at /opt/thermograph-dev, secrets rendered
|
|
# from the SOPS vault at deploy time, deployed over SSH by CI like beta and
|
|
# prod. The desktop hosts no Thermograph environment at all.
|
|
#
|
|
# What dev keeps that beta and prod do not:
|
|
# - It renders dev.yaml ALONE, never layering common.yaml (the fleet's shared
|
|
# production credentials). vps1 also runs Forgejo and its CI, and dev runs
|
|
# whatever branch is in flight — see the long note in render-secrets.sh.
|
|
# - It binds LOOPBACK, never 0.0.0.0. Caddy fronts it at dev.thermograph.org
|
|
# with TLS, basic auth and X-Robots-Tag: noindex (deploy/Caddyfile.vps1).
|
|
# Binding loopback is what makes that guard total rather than decorative:
|
|
# the site block is the only route in.
|
|
#
|
|
# Idempotent; re-run it after changing the branch or repointing the remote.
|
|
set -euo pipefail
|
|
|
|
SELF_DIR=$(cd "$(dirname "$0")" && pwd)
|
|
# shellcheck source=infra/deploy/env-topology.sh
|
|
. "$SELF_DIR/env-topology.sh"
|
|
thermograph_topology dev
|
|
|
|
REPO_URL="${REPO_URL:-http://10.10.0.2:3080/emi/thermograph.git}"
|
|
APP_DIR="${APP_DIR:-$TG_APP_DIR}"
|
|
BRANCH="${BRANCH:-$TG_BRANCH}"
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "!! run this as root (it writes /opt and /etc/thermograph)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Checkout: $APP_DIR on $BRANCH"
|
|
if [ -d "$APP_DIR/.git" ]; then
|
|
git -C "$APP_DIR" remote set-url origin "$REPO_URL"
|
|
git -C "$APP_DIR" fetch --prune origin "$BRANCH"
|
|
git -C "$APP_DIR" checkout -B "$BRANCH" "origin/$BRANCH"
|
|
else
|
|
git clone --branch "$BRANCH" "$REPO_URL" "$APP_DIR"
|
|
fi
|
|
|
|
echo "==> Marking this checkout's environment"
|
|
mkdir -p /etc/thermograph
|
|
# The host marker still exists for by-hand runs. vps1 runs exactly one
|
|
# environment, so a marker is sufficient here — unlike vps2, where beta and prod
|
|
# share a box and THERMOGRAPH_ENV must be passed explicitly.
|
|
printf 'dev\n' > /etc/thermograph/secrets-env
|
|
# Dev is compose, not Swarm. env-topology.sh is what actually decides this; the
|
|
# marker is only the fallback for a checkout that predates it.
|
|
rm -f /etc/thermograph/deploy-mode
|
|
|
|
if [ ! -f /etc/thermograph/age.key ]; then
|
|
cat >&2 <<'EOF'
|
|
!! No age key at /etc/thermograph/age.key.
|
|
!! Dev cannot render its vault without it, and deploy-dev.sh will fall back to
|
|
!! the un-vaulted defaults. Copy the key over (0400 root:root), then re-run:
|
|
!! install -m 0400 -o root -g root age.key /etc/thermograph/age.key
|
|
EOF
|
|
fi
|
|
|
|
cat <<EOF
|
|
|
|
Done. Dev is checked out at $APP_DIR on $BRANCH.
|
|
|
|
Deploy it:
|
|
SERVICE=all BACKEND_IMAGE_TAG=sha-<a> FRONTEND_IMAGE_TAG=sha-<b> \\
|
|
$APP_DIR/infra/deploy/deploy-dev.sh
|
|
|
|
Reach it:
|
|
https://dev.thermograph.org (basic auth; see deploy/Caddyfile.vps1)
|
|
|
|
Confirm the app itself is NOT directly exposed — this must show
|
|
${TG_BIND_ADDR}:8137 and never 0.0.0.0:8137, so Caddy is the only way in:
|
|
ss -ltnp | grep 8137
|
|
EOF
|