dev cicd + tron + docs

2026-01-30 16:58:02 +01:00
parent 51f5b0804a
commit c1596296d1
52 changed files with 3695 additions and 0 deletions
--- a/ci/prod/.env.runtime
+++ b/ci/prod/.env.runtime
@@ -90,6 +90,13 @@ FEES_SERVICE_NAME=sendico_billing_fees
 FEES_GRPC_PORT=50060
 FEES_METRICS_PORT=9402

+# Billing documents stack
+DOCUMENTS_DIR=billing_documents
+DOCUMENTS_COMPOSE_PROJECT=sendico-billing-documents
+DOCUMENTS_SERVICE_NAME=sendico_billing_documents
+DOCUMENTS_GRPC_PORT=50061
+DOCUMENTS_METRICS_PORT=9409
+
 # Billing fees Mongo settings
 FEES_MONGO_HOST=sendico_db1
 FEES_MONGO_PORT=27017
--- a/ci/prod/compose/billing_documents.dockerfile
+++ b/ci/prod/compose/billing_documents.dockerfile
@@ -0,0 +1,40 @@
+# syntax=docker/dockerfile:1.7
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+FROM golang:alpine AS build
+ARG APP_VERSION=dev
+ARG GIT_REV=unknown
+ARG BUILD_BRANCH=unknown
+ARG BUILD_DATE=unknown
+ARG BUILD_USER=ci
+ENV GO111MODULE=on
+ENV PATH="/go/bin:${PATH}"
+WORKDIR /src
+COPY . .
+RUN apk add --no-cache bash git build-base protoc protobuf-dev \
+ && go install google.golang.org/protobuf/cmd/protoc-gen-go@latest \
+ && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
+ && bash ci/scripts/proto/generate.sh
+WORKDIR /src/api/billing/documents
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags "\
+      -s -w \
+      -X github.com/tech/sendico/billing/documents/internal/appversion.Version=${APP_VERSION} \
+      -X github.com/tech/sendico/billing/documents/internal/appversion.Revision=${GIT_REV} \
+      -X github.com/tech/sendico/billing/documents/internal/appversion.Branch=${BUILD_BRANCH} \
+      -X github.com/tech/sendico/billing/documents/internal/appversion.BuildUser=${BUILD_USER} \
+      -X github.com/tech/sendico/billing/documents/internal/appversion.BuildDate=${BUILD_DATE}" \
+    -o /out/billing-documents .
+
+FROM alpine:latest AS runtime
+RUN apk add --no-cache ca-certificates tzdata wget
+WORKDIR /app
+COPY api/billing/documents/config.yml /app/config.yml
+COPY --from=build /out/billing-documents /app/billing-documents
+EXPOSE 50061 9409
+ENTRYPOINT ["/app/billing-documents"]
+CMD ["--config.file", "/app/config.yml"]
--- a/ci/prod/compose/billing_documents.yml
+++ b/ci/prod/compose/billing_documents.yml
@@ -0,0 +1,39 @@
+# Compose v2 - Billing documents
+
+x-common-env: &common-env
+  env_file:
+    - ../env/.env.runtime
+    - ../env/.env.version
+
+networks:
+  sendico-net:
+    external: true
+    name: sendico-net
+
+services:
+  sendico_billing_documents:
+    <<: *common-env
+    container_name: sendico-billing-documents
+    restart: unless-stopped
+    image: ${REGISTRY_URL}/billing/documents:${APP_V}
+    pull_policy: always
+    environment:
+      DOCUMENTS_GRPC_PORT: ${DOCUMENTS_GRPC_PORT}
+      DOCUMENTS_METRICS_PORT: ${DOCUMENTS_METRICS_PORT}
+      NATS_URL: ${NATS_URL}
+      NATS_HOST: ${NATS_HOST}
+      NATS_PORT: ${NATS_PORT}
+      NATS_USER: ${NATS_USER}
+      NATS_PASSWORD: ${NATS_PASSWORD}
+    command: ["--config.file", "/app/config.yml"]
+    ports:
+      - "0.0.0.0:${DOCUMENTS_GRPC_PORT}:50061"
+      - "0.0.0.0:${DOCUMENTS_METRICS_PORT}:${DOCUMENTS_METRICS_PORT}"
+    healthcheck:
+      test: ["CMD-SHELL","wget -qO- http://localhost:${DOCUMENTS_METRICS_PORT}/health | grep -q '\"status\":\"ok\"'"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+    networks:
+      - sendico-net
--- a/ci/prod/compose/tron_gateway.dockerfile
+++ b/ci/prod/compose/tron_gateway.dockerfile
@@ -0,0 +1,43 @@
+# syntax=docker/dockerfile:1.7
+
+ARG TARGETOS=linux
+ARG TARGETARCH=amd64
+
+FROM golang:alpine AS build
+ARG APP_VERSION=dev
+ARG GIT_REV=unknown
+ARG BUILD_BRANCH=unknown
+ARG BUILD_DATE=unknown
+ARG BUILD_USER=ci
+ENV GO111MODULE=on
+ENV PATH="/go/bin:${PATH}"
+WORKDIR /src
+COPY . .
+RUN apk add --no-cache bash git build-base protoc protobuf-dev \
+ && go install google.golang.org/protobuf/cmd/protoc-gen-go@latest \
+ && go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest \
+ && bash ci/scripts/proto/generate.sh
+WORKDIR /src/api/gateway/tron
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
+    go build -trimpath -ldflags "\
+      -s -w \
+      -X github.com/tech/sendico/gateway/tron/internal/appversion.Version=${APP_VERSION} \
+      -X github.com/tech/sendico/gateway/tron/internal/appversion.Revision=${GIT_REV} \
+      -X github.com/tech/sendico/gateway/tron/internal/appversion.Branch=${BUILD_BRANCH} \
+      -X github.com/tech/sendico/gateway/tron/internal/appversion.BuildUser=${BUILD_USER} \
+      -X github.com/tech/sendico/gateway/tron/internal/appversion.BuildDate=${BUILD_DATE}" \
+    -o /out/tron-gateway .
+
+FROM alpine:latest AS runtime
+RUN apk add --no-cache ca-certificates tzdata wget
+WORKDIR /app
+COPY api/gateway/tron/config.yml /app/config.yml
+COPY api/gateway/tron/env /app/env
+COPY api/gateway/tron/entrypoint.sh /app/entrypoint.sh
+COPY --from=build /out/tron-gateway /app/tron-gateway
+RUN chmod +x /app/entrypoint.sh
+EXPOSE 50071 9407
+ENTRYPOINT ["/app/entrypoint.sh"]
+CMD ["/app/tron-gateway","--config.file","/app/config.yml"]
--- a/ci/prod/compose/vault-agent/tron-gateway.hcl
+++ b/ci/prod/compose/vault-agent/tron-gateway.hcl
@@ -0,0 +1,20 @@
+vault {
+  address = "https://vault.sendico.io"
+}
+
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path    = "/run/vault/role_id"
+      secret_id_file_path  = "/run/vault/secret_id"
+    }
+  }
+
+  sink "file" {
+    config = {
+      path = "/run/vault/token"
+      mode = 0600
+    }
+  }
+}
--- a/ci/prod/scripts/deploy/billing_documents.sh
+++ b/ci/prod/scripts/deploy/billing_documents.sh
@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+set -euo pipefail
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && set -x
+trap 'echo "[deploy-billing-documents] error at line $LINENO" >&2' ERR
+
+: "${REMOTE_BASE:?missing REMOTE_BASE}"
+: "${SSH_USER:?missing SSH_USER}"
+: "${SSH_HOST:?missing SSH_HOST}"
+: "${DOCUMENTS_DIR:?missing DOCUMENTS_DIR}"
+: "${DOCUMENTS_COMPOSE_PROJECT:?missing DOCUMENTS_COMPOSE_PROJECT}"
+: "${DOCUMENTS_SERVICE_NAME:?missing DOCUMENTS_SERVICE_NAME}"
+
+REMOTE_DIR="${REMOTE_BASE%/}/${DOCUMENTS_DIR}"
+REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+COMPOSE_FILE="billing_documents.yml"
+SERVICE_NAMES="${DOCUMENTS_SERVICE_NAME}"
+
+REQUIRED_SECRETS=(
+  NATS_USER
+  NATS_PASSWORD
+  NATS_URL
+)
+
+for var in "${REQUIRED_SECRETS[@]}"; do
+  if [[ -z "${!var:-}" ]]; then
+    echo "missing required secret env: ${var}" >&2
+    exit 65
+  fi
+done
+
+if [[ ! -s .env.version ]]; then
+  echo ".env.version is missing; run version step first" >&2
+  exit 66
+fi
+
+b64enc() {
+  printf '%s' "$1" | base64 | tr -d '\n'
+}
+
+NATS_USER_B64="$(b64enc "${NATS_USER}")"
+NATS_PASSWORD_B64="$(b64enc "${NATS_PASSWORD}")"
+NATS_URL_B64="$(b64enc "${NATS_URL}")"
+
+SSH_OPTS=(
+  -i /root/.ssh/id_rsa
+  -o StrictHostKeyChecking=no
+  -o UserKnownHostsFile=/dev/null
+  -o LogLevel=ERROR
+  -q
+)
+if [[ "${DEBUG_DEPLOY:-0}" = "1" ]]; then
+  SSH_OPTS=("${SSH_OPTS[@]/-q/}" -vv)
+fi
+
+RSYNC_FLAGS=(-az --delete)
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && RSYNC_FLAGS=(-avz --delete)
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
+
+SERVICES_LINE="${SERVICE_NAMES}"
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
+  REMOTE_DIR="$REMOTE_DIR" \
+  COMPOSE_FILE="$COMPOSE_FILE" \
+  COMPOSE_PROJECT="$DOCUMENTS_COMPOSE_PROJECT" \
+  SERVICES_LINE="$SERVICES_LINE" \
+  NATS_USER_B64="$NATS_USER_B64" \
+  NATS_PASSWORD_B64="$NATS_PASSWORD_B64" \
+  NATS_URL_B64="$NATS_URL_B64" \
+  bash -s <<'EOSSH'
+set -euo pipefail
+cd "${REMOTE_DIR}/compose"
+set -a
+. ../env/.env.runtime
+load_kv_file() {
+  local file="$1"
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ''|\#*) continue ;;
+    esac
+    if printf '%s' "$line" | grep -Eq '^[[:alpha:]_][[:alnum:]_]*='; then
+      local key="${line%%=*}"
+      local value="${line#*=}"
+      key="$(printf '%s' "$key" | tr -d '[:space:]')"
+      value="${value#"${value%%[![:space:]]*}"}"
+      value="${value%"${value##*[![:space:]]}"}"
+      if [[ -n "$key" ]]; then
+        export "$key=$value"
+      fi
+    fi
+  done <"$file"
+}
+load_kv_file ../env/.env.version
+set +a
+
+if base64 -d >/dev/null 2>&1 <<<'AA=='; then
+  BASE64_DECODE_FLAG='-d'
+else
+  BASE64_DECODE_FLAG='--decode'
+fi
+
+decode_b64() {
+  val="$1"
+  if [[ -z "$val" ]]; then
+    printf ''
+    return
+  fi
+  printf '%s' "$val" | base64 "${BASE64_DECODE_FLAG}"
+}
+
+NATS_USER="$(decode_b64 "$NATS_USER_B64")"
+NATS_PASSWORD="$(decode_b64 "$NATS_PASSWORD_B64")"
+NATS_URL="$(decode_b64 "$NATS_URL_B64")"
+
+export NATS_USER NATS_PASSWORD NATS_URL
+COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
+export COMPOSE_PROJECT_NAME
+read -r -a SERVICES <<<"${SERVICES_LINE}"
+
+pull_cmd=(docker compose -f "$COMPOSE_FILE" pull)
+up_cmd=(docker compose -f "$COMPOSE_FILE" up -d --remove-orphans)
+ps_cmd=(docker compose -f "$COMPOSE_FILE" ps)
+if [[ "${#SERVICES[@]}" -gt 0 ]]; then
+  pull_cmd+=("${SERVICES[@]}")
+  up_cmd+=("${SERVICES[@]}")
+  ps_cmd+=("${SERVICES[@]}")
+fi
+
+"${pull_cmd[@]}"
+"${up_cmd[@]}"
+"${ps_cmd[@]}"
+
+date -Is > .last_deploy
+logger -t "deploy-${COMPOSE_PROJECT_NAME}" "${COMPOSE_PROJECT_NAME} deployed at $(date -Is) in ${REMOTE_DIR}"
+EOSSH
--- a/ci/prod/scripts/deploy/tron_gateway.sh
+++ b/ci/prod/scripts/deploy/tron_gateway.sh
@@ -0,0 +1,175 @@
+#!/usr/bin/env bash
+set -euo pipefail
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && set -x
+trap 'echo "[deploy-tron-gateway] error at line $LINENO" >&2' ERR
+
+: "${REMOTE_BASE:?missing REMOTE_BASE}"
+: "${SSH_USER:?missing SSH_USER}"
+: "${SSH_HOST:?missing SSH_HOST}"
+: "${TRON_GATEWAY_DIR:?missing TRON_GATEWAY_DIR}"
+: "${TRON_GATEWAY_COMPOSE_PROJECT:?missing TRON_GATEWAY_COMPOSE_PROJECT}"
+: "${TRON_GATEWAY_SERVICE_NAME:?missing TRON_GATEWAY_SERVICE_NAME}"
+
+REMOTE_DIR="${REMOTE_BASE%/}/${TRON_GATEWAY_DIR}"
+REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+COMPOSE_FILE="tron_gateway.yml"
+SERVICE_NAMES="${TRON_GATEWAY_SERVICE_NAME}"
+
+REQUIRED_SECRETS=(
+  TRON_GATEWAY_MONGO_USER
+  TRON_GATEWAY_MONGO_PASSWORD
+  TRON_GATEWAY_RPC_URL
+  TRON_GATEWAY_SERVICE_WALLET_KEY
+  TRON_GATEWAY_SERVICE_WALLET_ADDRESS
+  TRON_GATEWAY_VAULT_ROLE_ID
+  TRON_GATEWAY_VAULT_SECRET_ID
+  NATS_USER
+  NATS_PASSWORD
+  NATS_URL
+)
+
+for var in "${REQUIRED_SECRETS[@]}"; do
+  if [[ -z "${!var:-}" ]]; then
+    echo "missing required secret env: ${var}" >&2
+    exit 65
+  fi
+done
+
+if [[ ! -s .env.version ]]; then
+  echo ".env.version is missing; run version step first" >&2
+  exit 66
+fi
+
+b64enc() {
+  printf '%s' "$1" | base64 | tr -d '\n'
+}
+
+TRON_GATEWAY_MONGO_USER_B64="$(b64enc "${TRON_GATEWAY_MONGO_USER}")"
+TRON_GATEWAY_MONGO_PASSWORD_B64="$(b64enc "${TRON_GATEWAY_MONGO_PASSWORD}")"
+TRON_GATEWAY_RPC_URL_B64="$(b64enc "${TRON_GATEWAY_RPC_URL}")"
+TRON_GATEWAY_GRPC_URL_B64="$(b64enc "${TRON_GATEWAY_GRPC_URL:-}")"
+TRON_GATEWAY_SERVICE_WALLET_KEY_B64="$(b64enc "${TRON_GATEWAY_SERVICE_WALLET_KEY}")"
+TRON_GATEWAY_SERVICE_WALLET_ADDRESS_B64="$(b64enc "${TRON_GATEWAY_SERVICE_WALLET_ADDRESS}")"
+TRON_GATEWAY_VAULT_ROLE_ID_B64="$(b64enc "${TRON_GATEWAY_VAULT_ROLE_ID}")"
+TRON_GATEWAY_VAULT_SECRET_ID_B64="$(b64enc "${TRON_GATEWAY_VAULT_SECRET_ID}")"
+NATS_USER_B64="$(b64enc "${NATS_USER}")"
+NATS_PASSWORD_B64="$(b64enc "${NATS_PASSWORD}")"
+NATS_URL_B64="$(b64enc "${NATS_URL}")"
+
+SSH_OPTS=(
+  -i /root/.ssh/id_rsa
+  -o StrictHostKeyChecking=no
+  -o UserKnownHostsFile=/dev/null
+  -o LogLevel=ERROR
+  -q
+)
+if [[ "${DEBUG_DEPLOY:-0}" = "1" ]]; then
+  SSH_OPTS=("${SSH_OPTS[@]/-q/}" -vv)
+fi
+
+RSYNC_FLAGS=(-az --delete)
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && RSYNC_FLAGS=(-avz --delete)
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/compose/secrets ${REMOTE_DIR}/env"
+
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/ "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" .env.version         "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.version"
+
+SERVICES_LINE="${SERVICE_NAMES}"
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
+  REMOTE_DIR="$REMOTE_DIR" \
+  COMPOSE_FILE="$COMPOSE_FILE" \
+  COMPOSE_PROJECT="$TRON_GATEWAY_COMPOSE_PROJECT" \
+  SERVICES_LINE="$SERVICES_LINE" \
+  TRON_GATEWAY_MONGO_USER_B64="$TRON_GATEWAY_MONGO_USER_B64" \
+  TRON_GATEWAY_MONGO_PASSWORD_B64="$TRON_GATEWAY_MONGO_PASSWORD_B64" \
+  TRON_GATEWAY_RPC_URL_B64="$TRON_GATEWAY_RPC_URL_B64" \
+  TRON_GATEWAY_GRPC_URL_B64="$TRON_GATEWAY_GRPC_URL_B64" \
+  TRON_GATEWAY_SERVICE_WALLET_KEY_B64="$TRON_GATEWAY_SERVICE_WALLET_KEY_B64" \
+  TRON_GATEWAY_SERVICE_WALLET_ADDRESS_B64="$TRON_GATEWAY_SERVICE_WALLET_ADDRESS_B64" \
+  TRON_GATEWAY_VAULT_ROLE_ID_B64="$TRON_GATEWAY_VAULT_ROLE_ID_B64" \
+  TRON_GATEWAY_VAULT_SECRET_ID_B64="$TRON_GATEWAY_VAULT_SECRET_ID_B64" \
+  NATS_USER_B64="$NATS_USER_B64" \
+  NATS_PASSWORD_B64="$NATS_PASSWORD_B64" \
+  NATS_URL_B64="$NATS_URL_B64" \
+  bash -s <<'EOSSH'
+set -euo pipefail
+cd "${REMOTE_DIR}/compose"
+set -a
+. ../env/.env.runtime
+load_kv_file() {
+  local file="$1"
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ''|\#*) continue ;;
+    esac
+    if printf '%s' "$line" | grep -Eq '^[[:alpha:]_][[:alnum:]_]*='; then
+      local key="${line%%=*}"
+      local value="${line#*=}"
+      key="$(printf '%s' "$key" | tr -d '[:space:]')"
+      value="${value#"${value%%[![:space:]]*}"}"
+      value="${value%"${value##*[![:space:]]}"}"
+      if [[ -n "$key" ]]; then
+        export "$key=$value"
+      fi
+    fi
+  done <"$file"
+}
+load_kv_file ../env/.env.version
+set +a
+
+if base64 -d >/dev/null 2>&1 <<<'AA=='; then
+  BASE64_DECODE_FLAG='-d'
+else
+  BASE64_DECODE_FLAG='--decode'
+fi
+
+decode_b64() {
+  val="$1"
+  if [[ -z "$val" ]]; then
+    printf ''
+    return
+  fi
+  printf '%s' "$val" | base64 "${BASE64_DECODE_FLAG}"
+}
+
+TRON_GATEWAY_MONGO_USER="$(decode_b64 "$TRON_GATEWAY_MONGO_USER_B64")"
+TRON_GATEWAY_MONGO_PASSWORD="$(decode_b64 "$TRON_GATEWAY_MONGO_PASSWORD_B64")"
+TRON_GATEWAY_RPC_URL="$(decode_b64 "$TRON_GATEWAY_RPC_URL_B64")"
+TRON_GATEWAY_GRPC_URL="$(decode_b64 "$TRON_GATEWAY_GRPC_URL_B64")"
+TRON_GATEWAY_SERVICE_WALLET_KEY="$(decode_b64 "$TRON_GATEWAY_SERVICE_WALLET_KEY_B64")"
+TRON_GATEWAY_SERVICE_WALLET_ADDRESS="$(decode_b64 "$TRON_GATEWAY_SERVICE_WALLET_ADDRESS_B64")"
+TRON_GATEWAY_VAULT_ROLE_ID="$(decode_b64 "$TRON_GATEWAY_VAULT_ROLE_ID_B64")"
+TRON_GATEWAY_VAULT_SECRET_ID="$(decode_b64 "$TRON_GATEWAY_VAULT_SECRET_ID_B64")"
+NATS_USER="$(decode_b64 "$NATS_USER_B64")"
+NATS_PASSWORD="$(decode_b64 "$NATS_PASSWORD_B64")"
+NATS_URL="$(decode_b64 "$NATS_URL_B64")"
+
+export TRON_GATEWAY_MONGO_USER TRON_GATEWAY_MONGO_PASSWORD
+export TRON_GATEWAY_RPC_URL TRON_GATEWAY_GRPC_URL
+export TRON_GATEWAY_SERVICE_WALLET_KEY TRON_GATEWAY_SERVICE_WALLET_ADDRESS
+export TRON_GATEWAY_VAULT_ROLE_ID TRON_GATEWAY_VAULT_SECRET_ID
+export NATS_USER NATS_PASSWORD NATS_URL
+
+COMPOSE_PROJECT_NAME="$COMPOSE_PROJECT"
+export COMPOSE_PROJECT_NAME
+read -r -a SERVICES <<<"${SERVICES_LINE}"
+
+pull_cmd=(docker compose -f "$COMPOSE_FILE" pull)
+up_cmd=(docker compose -f "$COMPOSE_FILE" up -d --remove-orphans)
+ps_cmd=(docker compose -f "$COMPOSE_FILE" ps)
+if [[ "${#SERVICES[@]}" -gt 0 ]]; then
+  pull_cmd+=("${SERVICES[@]}")
+  up_cmd+=("${SERVICES[@]}")
+  ps_cmd+=("${SERVICES[@]}")
+fi
+
+"${pull_cmd[@]}"
+"${up_cmd[@]}"
+"${ps_cmd[@]}"
+
+date -Is > .last_deploy
+logger -t "deploy-${COMPOSE_PROJECT_NAME}" "${COMPOSE_PROJECT_NAME} deployed at $(date -Is) in ${REMOTE_DIR}"
+EOSSH