From e2ee9fea5b92209bb5a6f4e35e2372f6a27954ed Mon Sep 17 00:00:00 2001 From: Asger Geel Weirsoee Date: Sat, 3 Oct 2026 08:39:39 +0200 Subject: [PATCH] ci: udrul portalen med et v*-tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Portalen blev udrullet ved at kopiere filer ind i drift, og drift og git gled fra hinanden. Nu er appmappen i drift en git-checkout, og et v*-tag udruller via Gitea Actions: CD logger ind som deploy-brugeren og kører deploy/deploy.sh fra tagget. Scriptet afbryder hvis drift afviger fra git, installerer requirements kun når de er ændret, og ruller tilbage hvis /healthz ikke svarer efter genstart. Værtsadressen ligger i en repo-variabel. CI kompilerer Python, parser alle templates og tjekker deploy.sh. Claude-Session: https://claude.ai/code/session_012LCTmU2ewo8tnM1dByYAoG --- .gitea/workflows/cd.yml | 40 ++++++++++++++++++++++++++++++ .gitea/workflows/ci.yml | 31 +++++++++++++++++++++++ README.md | 12 +++++++++ deploy/deploy.sh | 55 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 138 insertions(+) create mode 100644 .gitea/workflows/cd.yml create mode 100644 .gitea/workflows/ci.yml create mode 100755 deploy/deploy.sh diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml new file mode 100644 index 0000000..ddc8a6e --- /dev/null +++ b/.gitea/workflows/cd.yml @@ -0,0 +1,40 @@ +name: CD +on: + push: + tags: ["v*"] + +concurrency: + group: deploy-prod + cancel-in-progress: false + +jobs: + deploy: + runs-on: ubuntu-latest + timeout-minutes: 15 + container: + image: python:3.11-bookworm + steps: + - name: Tooling (ssh client) + run: | + apt-get update -qq + apt-get install -y -qq --no-install-recommends openssh-client + + - name: Configure SSH + run: | + install -d -m700 ~/.ssh + printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_deploy + chmod 600 ~/.ssh/id_deploy + printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > ~/.ssh/known_hosts + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} + DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }} + + - name: Deploy ${{ github.ref_name }} + run: | + ssh -i ~/.ssh/id_deploy -o IdentitiesOnly=yes \ + "${DEPLOY_USER}@${DEPLOY_HOST}" \ + "cd \"\${PORTAL_DIR:-/opt/portal/app}\" && git fetch --tags --quiet && git show '${TAG}:deploy/deploy.sh' | bash -s -- '${TAG}'" + env: + DEPLOY_USER: ${{ vars.DEPLOY_USER }} + DEPLOY_HOST: ${{ vars.DEPLOY_HOST }} + TAG: ${{ github.ref_name }} diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..92929a9 --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,31 @@ +name: CI +on: + push: + branches: [master] + pull_request: + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + check: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v4 + - name: Tooling + run: apt-get update -qq && apt-get install -y -qq --no-install-recommends python3 python3-jinja2 + - name: Python compiles + run: python3 -m compileall -q . + - name: Templates parse + run: | + python3 - <<'PY' + import pathlib, jinja2 + env = jinja2.Environment(loader=jinja2.FileSystemLoader("templates")) + for p in sorted(pathlib.Path("templates").glob("*.html")): + env.parse(p.read_text()) + print("templates ok") + PY + - name: deploy.sh syntax + run: bash -n deploy/deploy.sh diff --git a/README.md b/README.md index b1a2485..cd35594 100644 --- a/README.md +++ b/README.md @@ -24,4 +24,16 @@ cp deploy/portal.service /etc/systemd/system/ systemctl enable --now portal ``` +## Udrulning + +Et `v*`-tag udruller: `.gitea/workflows/cd.yml` logger ind som deploy-brugeren +(repo-variablerne `DEPLOY_HOST`/`DEPLOY_USER`, secrets `DEPLOY_SSH_KEY`/`DEPLOY_KNOWN_HOSTS`) +og kører `deploy/deploy.sh` fra tagget. Appmappen i drift er en git-checkout; +afviger den fra git, afbrydes udrulningen, og svarer `/healthz` ikke efter +genstart, rulles der tilbage. Ret aldrig filer direkte i drift. + +```bash +git tag v1.2.3 && git push origin v1.2.3 +``` + Appen kører bag NPMplus (TLS + proxy) paa weircon.dk. Tilfoej nye admin-moduler i `ADMIN_MODULES` + en route + en template der extender `base.html`. diff --git a/deploy/deploy.sh b/deploy/deploy.sh new file mode 100755 index 0000000..89a8205 --- /dev/null +++ b/deploy/deploy.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# Portal-deploy: kører som deploy-brugeren, hvor portalen kører. +# Kaldes af CD med et git-tag: git show :deploy/deploy.sh | bash -s -- +# +# Appmappen er en git-checkout, ejet af deploy. Afviger den fra git (ændrede +# eller nye filer), afbrydes der: drift skal rettes i git, ikke overskrives. +# Svarer /healthz ikke efter genstart, rulles der tilbage til forrige commit. +set -euo pipefail + +APP_DIR=${PORTAL_DIR:-/opt/portal/app} +VENV=${PORTAL_VENV:-/opt/portal/venv} +HEALTH_URL=http://127.0.0.1:8000/healthz +TAG=${1:?brug: deploy.sh } + +cd "$APP_DIR" +git fetch --tags --quiet + +if [ -n "$(git status --porcelain)" ]; then + echo "afbrudt: appmappen afviger fra git:" + git status --short + exit 1 +fi +PREV=$(git rev-parse HEAD) + +checkout() { + local fra=$1 til=$2 + git checkout -q --detach "$til" + if ! git diff --quiet "$fra" "$til" -- requirements.txt; then + "$VENV/bin/pip" install -q -r requirements.txt + fi +} + +restart_and_check() { + sudo /usr/bin/systemctl restart portal + for i in $(seq 1 30); do + if curl -fsS -m 4 "$HEALTH_URL" >/dev/null 2>&1; then + echo "sund efter $((i * 2))s" + return 0 + fi + sleep 2 + done + echo "healthz svarede ikke" + return 1 +} + +checkout "$PREV" "$TAG" +if restart_and_check; then + echo "udrullet $TAG ($(git rev-parse --short HEAD))" + exit 0 +fi + +echo "ruller tilbage til $(git rev-parse --short "$PREV")" +checkout "$TAG" "$PREV" +restart_and_check || echo "ADVARSEL: heller ikke den forrige udgave svarer" +exit 1