+NATS

ci/prod/scripts/bootstrap/network.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+set -euo pipefail
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && set -x
+trap 'echo "[bootstrap-shared-network] error at line $LINENO" >&2' ERR
+
+: "${SSH_USER:?missing SSH_USER}"
+: "${SSH_HOST:?missing SSH_HOST}"
+
+REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+DOCKER_SHARED_NETWORK="${DOCKER_SHARED_NETWORK:-sendico-net}"
+
+SSH_OPTS=(
+  -i /root/.ssh/id_rsa
+  -o StrictHostKeyChecking=no
+  -o UserKnownHostsFile=/dev/null
+  -o LogLevel=ERROR
+  -q
+)
+if [[ "${DEBUG_DEPLOY:-0}" = "1" ]]; then
+  SSH_OPTS=("${SSH_OPTS[@]/-q/}" -vv)
+fi
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
+  DOCKER_SHARED_NETWORK="$DOCKER_SHARED_NETWORK" bash -s <<'EOSSH'
+set -euo pipefail
+docker network inspect "$DOCKER_SHARED_NETWORK" >/dev/null 2>&1 || \
+  docker network create "$DOCKER_SHARED_NETWORK"
+EOSSH

ci/prod/scripts/deploy/db.sh

@@ -49,12 +49,11 @@ ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
 set -euo pipefail
 cd "${REMOTE_DIR}/compose"
 set -a; . ../env/.env.runtime; set +a
-
 # Run with ephemeral AppRole env (scoped only to these commands)
 VAULT_ROLE_ID="${VAULT_ROLE_ID}" VAULT_SECRET_ID="${VAULT_SECRET_ID}" docker compose -f db.yml pull --quiet 2>/dev/null || \
 VAULT_ROLE_ID="${VAULT_ROLE_ID}" VAULT_SECRET_ID="${VAULT_SECRET_ID}" docker compose -f db.yml pull
 
-VAULT_ROLE_ID="${VAULT_ROLE_ID}" VAULT_SECRET_ID="${VAULT_SECRET_ID}" docker compose -f db.yml up -d --remove-orphans --force-recreate
+VAULT_ROLE_ID="${VAULT_ROLE_ID}" VAULT_SECRET_ID="${VAULT_SECRET_ID}" docker compose -f db.yml up -d --remove-orphans
 
 docker compose -f db.yml ps
 date -Is > .last_deploy

ci/prod/scripts/deploy/nats.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && set -x
+trap 'echo "[deploy-nats] error at line $LINENO" >&2' ERR
+
+: "${REMOTE_BASE:?missing REMOTE_BASE}"
+: "${NATS_DIR:?missing NATS_DIR}"
+: "${SSH_USER:?missing SSH_USER}"
+: "${SSH_HOST:?missing SSH_HOST}"
+: "${NATS_USER:?missing NATS_USER}"
+: "${NATS_PASSWORD:?missing NATS_PASSWORD}"
+
+REMOTE_DIR="${REMOTE_BASE%/}/${NATS_DIR}"
+REMOTE_TARGET="${SSH_USER}@${SSH_HOST}"
+
+SSH_OPTS=(
+  -i /root/.ssh/id_rsa
+  -o StrictHostKeyChecking=no
+  -o UserKnownHostsFile=/dev/null
+  -o LogLevel=ERROR
+  -q
+)
+if [[ "${DEBUG_DEPLOY:-0}" = "1" ]]; then
+  SSH_OPTS=("${SSH_OPTS[@]/-q/}" -vv)
+fi
+
+RSYNC_FLAGS=(-az --delete)
+[[ "${DEBUG_DEPLOY:-0}" = "1" ]] && RSYNC_FLAGS=(-avz --delete)
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" "mkdir -p ${REMOTE_DIR}/{compose,env}"
+
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/compose/    "$REMOTE_TARGET:${REMOTE_DIR}/compose/"
+rsync "${RSYNC_FLAGS[@]}" -e "ssh ${SSH_OPTS[*]}" ci/prod/.env.runtime "$REMOTE_TARGET:${REMOTE_DIR}/env/.env.runtime"
+
+ssh "${SSH_OPTS[@]}" "$REMOTE_TARGET" \
+  REMOTE_DIR="$REMOTE_DIR" \
+  NATS_USER="$NATS_USER" \
+  NATS_PASSWORD="$NATS_PASSWORD" \
+  bash -s <<'EOSSH'
+set -euo pipefail
+cd "${REMOTE_DIR}/compose"
+set -a; . ../env/.env.runtime; set +a
+: "${NATS_USER:?missing NATS_USER}"
+: "${NATS_PASSWORD:?missing NATS_PASSWORD}"
+export NATS_USER NATS_PASSWORD
+
+docker compose -f nats.yml pull --quiet 2>/dev/null || docker compose -f nats.yml pull
+docker compose -f nats.yml up -d --remove-orphans
+
+docker compose -f nats.yml ps
+date -Is > .last_deploy
+logger -t deploy-nats "nats deployed at $(date -Is) in ${REMOTE_DIR}"
+EOSSH