330 lines
14 KiB
Bash
330 lines
14 KiB
Bash
#!/usr/bin/env bash
|
|
# Deploy netOrk to one or more servers in parallel.
|
|
#
|
|
# Usage:
|
|
# ./deploy.sh [--version=<tag>] [server1 server2 ...]
|
|
#
|
|
# --version overrides the per-server NETORK_VERSION from deploy.env for this
|
|
# run only — useful to test one commit (--version=main-<sha>) without moving
|
|
# a server to a different release channel.
|
|
#
|
|
# Default targets and registry credentials are read from deploy.env next to
|
|
# this script (see deploy.env.example). DEPLOY_ENV_FILE points elsewhere.
|
|
#
|
|
# The servers pull pre-built images from REGISTRY_HOST. Nothing is built or
|
|
# copied from a working tree: the compose files come out of the engine image
|
|
# for the tag being deployed, and migrations run from that same image.
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
ENV_FILE="${DEPLOY_ENV_FILE:-${HERE}/deploy.env}"
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
# shellcheck source=/dev/null
|
|
source "$ENV_FILE"
|
|
fi
|
|
|
|
DEPLOY_SERVERS="${DEPLOY_SERVERS:-}"
|
|
UI_SERVER="${UI_SERVER:-}"
|
|
REGISTRY_HOST="${REGISTRY_HOST:-}"
|
|
REGISTRY_USER="${REGISTRY_USER:-}"
|
|
REGISTRY_PASSWORD="${REGISTRY_PASSWORD:-}"
|
|
NETORK_VERSION="${NETORK_VERSION:-latest}"
|
|
|
|
# The compose files the engine image carries under /app/deploy/.
|
|
COMPOSE_FILES="docker-compose.yml docker-compose.registry.yml"
|
|
|
|
read -ra SERVERS <<< "$DEPLOY_SERVERS"
|
|
|
|
# Run one step on a server, and let its failure stop the deploy.
|
|
#
|
|
# ssh reports the exit status of the *remote* command — and when that command
|
|
# ends in a pipe, the status is the last stage's, not the work's:
|
|
#
|
|
# ssh "$SERVER" "docker compose pull … 2>&1 | grep -E 'Pulled|Already|Error'"
|
|
#
|
|
# A failed pull prints a line containing `Error`, grep matches it and exits 0,
|
|
# and the deploy walks on to swap the containers. `set -o pipefail` cannot help:
|
|
# that pipeline ran in the remote shell, and from here the ssh succeeded.
|
|
#
|
|
# So the remote side stays pipe-free and the filtering happens here, where the
|
|
# status is still the one the command returned.
|
|
#
|
|
# run_remote <server> <what it is> <grep -E pattern, or "" for a tail> <command>
|
|
run_remote() {
|
|
local server=$1 label=$2 pattern=$3 command=$4
|
|
local output status
|
|
|
|
output="$(ssh -n "$server" "$command" 2>&1)" && status=0 || status=$?
|
|
|
|
if [[ $status -ne 0 ]]; then
|
|
printf '%s\n' "$output" | tail -25 | sed "s/^/[${server}] /" >&2
|
|
echo "[${server}] FAILED (exit ${status}): ${label}" >&2
|
|
return "$status"
|
|
fi
|
|
|
|
if [[ -n "$pattern" ]]; then
|
|
printf '%s\n' "$output" | grep -E "$pattern" | sed "s/^/[${server}] /" || true
|
|
else
|
|
printf '%s\n' "$output" | tail -6 | sed "s/^/[${server}] /"
|
|
fi
|
|
}
|
|
|
|
VERSION_OVERRIDE=""
|
|
EXPLICIT_SERVERS=()
|
|
i=1
|
|
while [[ $i -le $# ]]; do
|
|
arg="${!i}"
|
|
case "$arg" in
|
|
--version)
|
|
i=$(( i + 1 ))
|
|
VERSION_OVERRIDE="${!i:-}"
|
|
;;
|
|
--version=*) VERSION_OVERRIDE="${arg#--version=}" ;;
|
|
-*)
|
|
echo "Unknown option: ${arg}" >&2
|
|
exit 2
|
|
;;
|
|
*) EXPLICIT_SERVERS+=("$arg") ;;
|
|
esac
|
|
i=$(( i + 1 ))
|
|
done
|
|
if [[ ${#EXPLICIT_SERVERS[@]} -gt 0 ]]; then
|
|
SERVERS=("${EXPLICIT_SERVERS[@]}")
|
|
fi
|
|
|
|
# ── Version validation ───────────────────────────────────────────────────────
|
|
# A deploy only pulls images — it never verifies the pulled tag actually
|
|
# corresponds to a real, recently-built image for the commit/branch you think
|
|
# you're deploying. A stale or accidentally-reused tag (or a typo'd branch
|
|
# name that happens to collide with some ancient leftover tag) is pulled
|
|
# silently, with the only symptom surfacing later at `alembic upgrade head`,
|
|
# by which point containers are already switched over. Reject anything that
|
|
# doesn't match a tag format netOrk's CI actually publishes: latest,
|
|
# latest-dev, main-<sha>, feature-<branch> (feature/* only), or a release
|
|
# version (X.Y.Z). See NetOrk/netork#55.
|
|
VALID_VERSION_RE='^(latest|latest-dev|main-[0-9a-f]{7,40}|feature-[A-Za-z0-9._-]+|[0-9]+\.[0-9]+\.[0-9]+)$'
|
|
|
|
_validate_version() {
|
|
local version="$1"
|
|
if [[ ! "$version" =~ $VALID_VERSION_RE ]]; then
|
|
echo "Refusing to deploy version '${version}': not a tag CI publishes (expected latest," \
|
|
"latest-dev, main-<sha>, feature-<branch>, or X.Y.Z)." >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
if [[ -n "$VERSION_OVERRIDE" ]]; then
|
|
_validate_version "$VERSION_OVERRIDE"
|
|
fi
|
|
|
|
if [[ -z "$REGISTRY_HOST" ]]; then
|
|
echo "REGISTRY_HOST is not set (deploy.env or environment): nowhere to pull images from." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ${#SERVERS[@]} -eq 0 ]]; then
|
|
echo "No servers given: pass them as arguments or set DEPLOY_SERVERS in deploy.env." >&2
|
|
exit 1
|
|
fi
|
|
|
|
deploy_server() {
|
|
local SERVER="$1"
|
|
|
|
# Per-server lookup — falls back to global values
|
|
local KEY="${SERVER//./_}"
|
|
local USER_VAR="REGISTRY_USER_${KEY}"
|
|
local PASS_VAR="REGISTRY_PASSWORD_${KEY}"
|
|
local VER_VAR="NETORK_VERSION_${KEY}"
|
|
local SERVER_USER="${!USER_VAR:-${REGISTRY_USER}}"
|
|
local SERVER_PASS="${!PASS_VAR:-${REGISTRY_PASSWORD}}"
|
|
local SERVER_VERSION="${VERSION_OVERRIDE:-${!VER_VAR:-${NETORK_VERSION}}}"
|
|
_validate_version "$SERVER_VERSION" || return 1
|
|
|
|
local ENGINE_IMAGE="${REGISTRY_HOST}/netork/engine:${SERVER_VERSION}"
|
|
|
|
# The password goes over ssh's stdin. Inside the ssh argument it would be
|
|
# part of the remote shell's command line, readable through `ps` by every
|
|
# user on the host for as long as the login runs.
|
|
echo "[${SERVER}] Logging in to registry..."
|
|
# shellcheck disable=SC2029 # host and user are meant to expand here
|
|
printf '%s\n' "$SERVER_PASS" \
|
|
| ssh "$SERVER" "docker login '${REGISTRY_HOST}' -u '${SERVER_USER}' --password-stdin 2>&1" \
|
|
| sed "s/^/[${SERVER}] /"
|
|
|
|
# The compose files are versioned with the images they start, so they are
|
|
# taken from the engine image of this very tag rather than from whatever
|
|
# checkout happens to run the deploy. Both are written to .new first and only
|
|
# moved into place once both were read, so a failure leaves the previous pair
|
|
# intact. An image built before the files moved into it has no /app/deploy/.
|
|
echo "[${SERVER}] Fetching compose files from ${ENGINE_IMAGE}..."
|
|
run_remote "$SERVER" "fetching compose files from ${ENGINE_IMAGE}" 'Status|Error' \
|
|
"mkdir -p ~/netork && cd ~/netork && \
|
|
docker pull '${ENGINE_IMAGE}' && \
|
|
for f in ${COMPOSE_FILES}; do \
|
|
docker run --rm --entrypoint cat '${ENGINE_IMAGE}' /app/deploy/\$f > \$f.new \
|
|
|| { rm -f \$f.new; echo \"${ENGINE_IMAGE} carries no /app/deploy/\$f — the tag predates compose files in the engine image\"; exit 3; }; \
|
|
done && \
|
|
for f in ${COMPOSE_FILES}; do mv \$f.new \$f; done"
|
|
|
|
# Services running netOrk's own images. flower belongs here: it is the engine
|
|
# image with a different command, so leaving it out let the monitoring UI run
|
|
# nine days behind the workers it monitors, on an image that had since been
|
|
# untagged. See NetOrk/netork#95.
|
|
local SERVICES="netork-api netork-worker netork-poll-worker netork-ansible-worker netork-beat flower"
|
|
if [[ " $UI_SERVER " == *" $SERVER "* ]]; then
|
|
SERVICES="${SERVICES} netork-ui"
|
|
fi
|
|
|
|
# Containers on upstream images. Reconciled, not force-recreated (below).
|
|
# postgres and redis are deliberately absent: restarting a database on every
|
|
# deploy would be worse than any compose change one could miss.
|
|
local INFRA_SERVICES="registry apt-cacher-ng signal-api"
|
|
|
|
echo "[${SERVER}] Pulling images..."
|
|
run_remote "$SERVER" "pulling images for ${SERVER_VERSION}" 'Pulled|Already|Error' \
|
|
"cd ~/netork && \
|
|
REGISTRY_HOST='${REGISTRY_HOST}' NETORK_VERSION='${SERVER_VERSION}' \
|
|
docker compose -f docker-compose.yml -f docker-compose.registry.yml pull ${SERVICES}"
|
|
|
|
# --force-recreate is deliberate: `docker compose up -d` decides what to
|
|
# replace from the service definition's config hash, and the image reference
|
|
# (`.../ui:latest-dev`) does not change when the tag is moved to a new image.
|
|
# A deploy then leaves the old container running while reporting success —
|
|
# observed on netork-ui, which kept serving a stale image after its tag had
|
|
# already advanced. Recreating unconditionally costs a restart per deploy,
|
|
# which a deliberate rollout wants anyway. See NetOrk/netork#90.
|
|
echo "[${SERVER}] Starting containers..."
|
|
run_remote "$SERVER" "recreating ${SERVICES}" "" \
|
|
"cd ~/netork && \
|
|
REGISTRY_HOST='${REGISTRY_HOST}' NETORK_VERSION='${SERVER_VERSION}' \
|
|
docker compose -f docker-compose.yml -f docker-compose.registry.yml \
|
|
up -d --no-deps --force-recreate ${SERVICES}"
|
|
|
|
# Infrastructure containers, deliberately left out of the force-recreate
|
|
# above. Plain `up -d`: compose compares each service definition against the
|
|
# running container and recreates only what actually changed, so an edit to a
|
|
# healthcheck or an option in docker-compose.yml takes effect while a
|
|
# container nobody touched is left alone. signal-api is the reason this is
|
|
# not --force-recreate: it holds netOrk's Signal device link and recreating
|
|
# it every deploy is churn nobody asked for. See NetOrk/netork#95.
|
|
#
|
|
# `|| true`: infrastructure is reconciled opportunistically and its failure
|
|
# is not a reason to abandon a deploy that has already succeeded — but it
|
|
# prints as a failure instead of scrolling past.
|
|
echo "[${SERVER}] Reconciling infrastructure containers..."
|
|
run_remote "$SERVER" "reconciling ${INFRA_SERVICES}" "" \
|
|
"cd ~/netork && \
|
|
REGISTRY_HOST='${REGISTRY_HOST}' NETORK_VERSION='${SERVER_VERSION}' \
|
|
docker compose -f docker-compose.yml -f docker-compose.registry.yml \
|
|
up -d --no-deps ${INFRA_SERVICES}" || true
|
|
|
|
# Verify the containers actually run the image we just pulled. `docker
|
|
# compose up -d` reports "Running" (not "Started") when it decides nothing
|
|
# changed, and `pull` prints "Pulled" even when the tag was already local —
|
|
# so a deploy that had no effect at all is indistinguishable from a real one
|
|
# in the output above. Both the wrong-tag case (NETORK_VERSION pointing at a
|
|
# tag CI never republished) and a silently failed pull land here.
|
|
# See NetOrk/netork#88.
|
|
echo "[${SERVER}] Verifying containers run the pulled image..."
|
|
local VERIFY_PAIRS="netork-api:engine flower:engine"
|
|
if [[ " $UI_SERVER " == *" $SERVER "* ]]; then
|
|
VERIFY_PAIRS="${VERIFY_PAIRS} netork-ui:ui"
|
|
fi
|
|
|
|
local MISMATCH
|
|
MISMATCH=$(ssh -n "$SERVER" "cd ~/netork && for pair in ${VERIFY_PAIRS}; do \
|
|
svc=\${pair%%:*}; repo=\${pair##*:}; \
|
|
want=\$(docker image inspect --format '{{.Id}}' '${REGISTRY_HOST}/netork/'\${repo}':${SERVER_VERSION}' 2>/dev/null || true); \
|
|
cid=\$(REGISTRY_HOST='${REGISTRY_HOST}' NETORK_VERSION='${SERVER_VERSION}' \
|
|
docker compose -f docker-compose.yml -f docker-compose.registry.yml ps -q \${svc} 2>/dev/null || true); \
|
|
got=\$(docker inspect --format '{{.Image}}' \${cid} 2>/dev/null || true); \
|
|
if [ -z \"\${want}\" ] || [ -z \"\${got}\" ] || [ \"\${want}\" != \"\${got}\" ]; then echo \${svc}; fi; \
|
|
done" || true)
|
|
|
|
if [[ -n "$MISMATCH" ]]; then
|
|
echo "[${SERVER}] ERROR: still running an older image after deploy: ${MISMATCH//$'\n'/ }" >&2
|
|
echo "[${SERVER}] Wanted tag '${SERVER_VERSION}'. On main pushes CI publishes" >&2
|
|
echo "[${SERVER}] 'latest-dev' and 'main-<sha>'; ':latest' only on version tags." >&2
|
|
return 1
|
|
fi
|
|
echo "[${SERVER}] Verified: containers run ${SERVER_VERSION}."
|
|
|
|
# docker compose substitutes REGISTRY_HOST / NETORK_VERSION from the project
|
|
# .env when they are not in the environment. This script passes both inline,
|
|
# but a hand-typed `docker compose up -d flower` on the host needs them there
|
|
# or dies on "invalid reference format". Values are rewritten in place, so
|
|
# the file does not grow a new line per deploy.
|
|
#
|
|
# Only now. This used to run before the pull, so a deploy that failed on a tag
|
|
# the registry does not have still left the host recording that tag — and the
|
|
# next `docker compose up` a human ran there reached for an image that does
|
|
# not exist. The file is a record of what this server runs, so it is written
|
|
# once that is true: after the swap and after the image-id check agreed.
|
|
echo "[${SERVER}] Recording registry settings in ~/netork/.env..."
|
|
# shellcheck disable=SC2087 # registry and version expand here; \$ escapes run remotely
|
|
ssh "$SERVER" "bash -s" <<REMOTE_ENV
|
|
set -eu
|
|
cd ~/netork
|
|
touch .env
|
|
# Append to a file that does not end in a newline, and the last line grows a
|
|
# suffix instead of gaining a neighbour.
|
|
[ ! -s .env ] || [ -z "\$(tail -c1 .env)" ] || printf '\n' >> .env
|
|
for kv in "REGISTRY_HOST=${REGISTRY_HOST}" "NETORK_VERSION=${SERVER_VERSION}"; do
|
|
key=\${kv%%=*}
|
|
if grep -q "^\${key}=" .env; then
|
|
sed -i "s|^\${key}=.*|\${kv}|" .env
|
|
else
|
|
printf '%s\n' "\${kv}" >> .env
|
|
fi
|
|
done
|
|
REMOTE_ENV
|
|
|
|
# netOrk migrates *after* the swap — its API tolerates the gap. What it does
|
|
# not tolerate is the migration failing unnoticed: the new code is already
|
|
# serving, so a missing column is a 500 on every request that touches it
|
|
# until someone looks. Loud, and non-zero. The revisions are the image's own.
|
|
echo "[${SERVER}] Running migrations..."
|
|
run_remote "$SERVER" "alembic upgrade head (containers are ALREADY swapped)" "" \
|
|
"cd ~/netork && docker compose exec -T netork-api alembic upgrade head"
|
|
|
|
echo "[${SERVER}] Pruning unused images..."
|
|
ssh -n "$SERVER" "docker image prune -af 2>&1 | tail -1" | sed "s/^/[${SERVER}] /"
|
|
|
|
echo "[${SERVER}] Done."
|
|
}
|
|
|
|
# ── Dispatch ──────────────────────────────────────────────────────────────────
|
|
|
|
echo "Deploying from ${REGISTRY_HOST} to: ${SERVERS[*]}"
|
|
|
|
export -f deploy_server _validate_version run_remote
|
|
export UI_SERVER REGISTRY_HOST REGISTRY_USER REGISTRY_PASSWORD NETORK_VERSION VERSION_OVERRIDE \
|
|
VALID_VERSION_RE COMPOSE_FILES
|
|
# Export all per-server credential vars so subshells can resolve them
|
|
while IFS='=' read -r key _; do
|
|
if [[ "$key" =~ ^(REGISTRY_(USER|PASSWORD)|NETORK_VERSION)_ ]]; then
|
|
export "${key?}"
|
|
fi
|
|
done < <(compgen -v)
|
|
|
|
PIDS=()
|
|
for SERVER in "${SERVERS[@]}"; do
|
|
deploy_server "$SERVER" &
|
|
PIDS+=($!)
|
|
done
|
|
|
|
FAILED=()
|
|
for i in "${!PIDS[@]}"; do
|
|
if ! wait "${PIDS[$i]}"; then
|
|
FAILED+=("${SERVERS[$i]}")
|
|
fi
|
|
done
|
|
|
|
if [[ ${#FAILED[@]} -gt 0 ]]; then
|
|
echo "FAILED on: ${FAILED[*]}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "All servers deployed successfully."
|