protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
32 lines
2.2 KiB
Bash
32 lines
2.2 KiB
Bash
# Resolve maintained stable aliases to exact numeric tags and digests.
|
|
get() { curl -fsS --connect-timeout 10 --max-time 60 "$1"; }
|
|
image() (
|
|
repo=$1; alias=$2
|
|
digest=$(get "https://hub.docker.com/v2/repositories/$repo/tags/$alias" | jq -er '.digest | select(test("^sha256:[a-f0-9]{64}$"))') || exit 1
|
|
tag=$(get "https://hub.docker.com/v2/repositories/$repo/tags?page_size=100" | jq -er --arg digest "$digest" '
|
|
[.results[] | select(.digest==$digest) | .name | select(test("^[0-9]+\\.[0-9]+(\\.[0-9]+)?(-alpine)?$"))]
|
|
| sort_by(split("-")[0] | split(".") | map(tonumber)) | last // error("No stable numeric tag matches digest")') || exit 1
|
|
printf '%s:%s@%s\n' "$repo" "$tag" "$digest"
|
|
)
|
|
images() (
|
|
go=$(get 'https://go.dev/dl/?mode=json' | jq -er '.[0] | select(.stable) | .version | select(test("^go[0-9]+\\.[0-9]+\\.[0-9]+$"))') || exit 1
|
|
for spec in VAULT_IMAGE:hashicorp/vault:latest MONGO_IMAGE:library/mongo:latest NATS_IMAGE:library/nats:latest CADDY_IMAGE:library/caddy:alpine "GO_IMAGE:library/golang:${go#go}-alpine" UBUNTU_IMAGE:library/ubuntu:latest; do
|
|
key=${spec%%:*}; rest=${spec#*:}; repo=${rest%:*}; alias=${rest##*:}
|
|
ref=$(image "$repo" "$alias") || exit 1
|
|
printf '%s=%s\n' "$key" "$ref" >> "$WORK/images.env"
|
|
done
|
|
commit=$(get https://api.github.com/repos/flutter/flutter/commits/stable | jq -er '.sha | select(test("^[a-f0-9]{40}$"))') || exit 1
|
|
git ls-remote --tags https://github.com/flutter/flutter.git > "$WORK/flutter-tags" || exit 1
|
|
tag=$(jq -Rrs --arg commit "$commit" '[split("\n")[] | split("\t") | select(.[0]==$commit) | .[1] | sub("^refs/tags/";"") | select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))] | sort_by(split(".")|map(tonumber)) | last // error("Flutter stable has no stable release tag")' "$WORK/flutter-tags") || exit 1
|
|
printf 'FLUTTER_VERSION=%s\nFLUTTER_COMMIT=%s\n' "$tag" "$commit" >> "$WORK/images.env"
|
|
cat "$WORK/images.env" | write "$STATE/images.env"
|
|
cat "$STATE/images.env"
|
|
)
|
|
# Production pins: one resolution for every node of a cluster, so all of them
|
|
# run the same build. Written outside .local/dev; copied to the servers.
|
|
prod_images() (
|
|
ref=$(image hashicorp/vault latest) || exit 1
|
|
printf 'VAULT_IMAGE=%s\n' "$ref" | write "$PWD/.local/prod/images.env"
|
|
cat "$PWD/.local/prod/images.env"
|
|
)
|