mirror of
https://github.com/ALLFATHER-BV/wadamesh.git
synced 2026-09-25 19:54:58 +00:00
Kaj SchittecatandClaude Opus 5
b2030528a0
The matrix was only reachable from a corner button and a line buried in the channel explainer. It now has a card in "Docs, tools and help", next to the others, which is where people actually look. The tracking issue is dropped: the matrix lives on the site and no write credential for it exists anywhere. The publishing code stays in place and dormant, so it is one line in /etc/wadamesh-reports.env if that changes, and the service and deploy script now say publishes:false is the intended state rather than a missing piece. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
4.2 KiB
Bash
Executable File
95 lines
4.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# wadamesh report service deploy: install/refresh the beta test-report service
|
|
# (deploy/report-service.py) on the firmware VPS, behind the existing
|
|
# firmware.wadamesh.com vhost at /report/.
|
|
#
|
|
# What it does, all of it idempotent:
|
|
# * rsyncs the service into /opt/wadamesh-reports
|
|
# * checks flask + requests are importable by the system python
|
|
# * installs the systemd unit, enables and restarts it
|
|
# * refreshes the firmware vhost (which now proxies /report/) and reloads nginx
|
|
#
|
|
# The SQLite database at /opt/wadamesh-reports/reports.db is never touched, so a
|
|
# redeploy keeps every report.
|
|
#
|
|
# Usage:
|
|
# WADAMESH_VPS=user@your-vps scripts/deploy-reports.sh
|
|
# WADAMESH_VPS=user@your-vps scripts/deploy-reports.sh --dry-run
|
|
#
|
|
# The GitHub token is NOT deployed by this script and is not in the repo. It
|
|
# lives on the box in /etc/wadamesh-reports.env:
|
|
#
|
|
# WADA_GH_TOKEN=<token> # fine-grained, this repo only, issues: read+write
|
|
# WADA_GH_REPO=ALLFATHER-BV/wadamesh
|
|
#
|
|
# Without it the service runs normally and simply never publishes to GitHub, so
|
|
# reports are still collected and the site still shows them. That is the current
|
|
# arrangement on purpose: the matrix lives at wadamesh.com/beta and no token for
|
|
# it exists. `publishes:false` from /report/health is expected.
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
DEST="${WADAMESH_VPS:?set WADAMESH_VPS=user@host}"
|
|
APP_DIR="${WADAMESH_REPORTS_PATH:-/opt/wadamesh-reports}"
|
|
# Same escape hatch rsync has: the VPS key is not the default identity here.
|
|
# SSH="ssh -i ~/.ssh/your_key" RSYNC_RSH="$SSH" scripts/deploy-reports.sh
|
|
SSH="${SSH:-ssh}"
|
|
|
|
if [ "${1:-}" = "--dry-run" ]; then
|
|
echo "would deploy:"
|
|
echo " $ROOT/deploy/report-service.py -> $DEST:$APP_DIR/"
|
|
echo " $ROOT/deploy/wadamesh-reports.service -> $DEST:/etc/systemd/system/"
|
|
echo " $ROOT/deploy/nginx/firmware.wadamesh.com.conf -> $DEST:/etc/nginx/sites-available/firmware.wadamesh.com.conf"
|
|
exit 0
|
|
fi
|
|
|
|
python3 - "$ROOT/deploy/report-service.py" <<'PY'
|
|
import ast, sys
|
|
ast.parse(open(sys.argv[1]).read()) # never ship a file that will not import
|
|
print("report-service.py parses")
|
|
PY
|
|
|
|
# The vhost on the box has drifted ahead of the repo before (/apps/ and
|
|
# /bringup/ were added live and never committed). Pushing a stale copy would
|
|
# 404 the app store, so compare first and stop rather than overwrite.
|
|
LIVE_CONF=$($SSH "$DEST" "cat /etc/nginx/sites-available/firmware.wadamesh.com.conf" 2>/dev/null || true)
|
|
for needed in $(printf '%s\n' "$LIVE_CONF" | grep -oE 'location [=~ ]*/[a-z.-]+/?' | sort -u); do
|
|
if ! grep -qF "$needed" "$ROOT/deploy/nginx/firmware.wadamesh.com.conf"; then
|
|
echo "ABORT: the live vhost has '$needed' and the repo copy does not." >&2
|
|
echo "Pull the live file into deploy/nginx/ first, then re-add your changes." >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
$SSH "$DEST" "mkdir -p $APP_DIR"
|
|
rsync -avz "$ROOT/deploy/report-service.py" "$DEST:$APP_DIR/"
|
|
rsync -avz "$ROOT/deploy/wadamesh-reports.service" "$DEST:/etc/systemd/system/wadamesh-reports.service"
|
|
# The live name carries the .conf suffix and is what sites-enabled points at.
|
|
# Getting this wrong writes a file nginx never reads, and the /report/ proxy
|
|
# silently does not exist.
|
|
rsync -avz "$ROOT/deploy/nginx/firmware.wadamesh.com.conf" \
|
|
"$DEST:/etc/nginx/sites-available/firmware.wadamesh.com.conf"
|
|
|
|
$SSH "$DEST" bash -s <<EOF
|
|
set -e
|
|
# No venv: this box's python3.14 has no ensurepip, so venv cannot bootstrap pip.
|
|
# flask and requests come from apt and are already in use by the tile service.
|
|
if ! /usr/bin/python3 -c 'import flask, requests' 2>/dev/null; then
|
|
echo "installing flask and requests from apt"
|
|
apt-get update -qq && apt-get install -y -qq python3-flask python3-requests
|
|
fi
|
|
systemctl daemon-reload
|
|
systemctl enable --now wadamesh-reports
|
|
systemctl restart wadamesh-reports
|
|
sleep 1
|
|
nginx -t && systemctl reload nginx
|
|
systemctl is-active wadamesh-reports
|
|
EOF
|
|
|
|
echo
|
|
echo "deployed. checking the live endpoint:"
|
|
curl -fsS "http://firmware.wadamesh.com/report/health" && echo
|
|
echo
|
|
echo 'publishes:false is the expected state: the matrix lives at wadamesh.com/beta'
|
|
echo 'and no GitHub token exists for it. See the header if that ever changes.'
|