keep/scripts/deploy.sh

#!/usr/bin/env bash
# Pulls a project's env from keep (if it's bootstrapped onto keep), then
# brings its docker compose stack up.
#
# Usage:
#   ./deploy.sh <project> [env]
#
# Expects a directory at $DEPLOY_ROOT/<project>/ containing a
# docker-compose.yml.
#
# The vault key is NOT assumed to match the deploy-directory name — repo
# names, deploy directory names, and vault keys are three independent
# strings in practice (a repo can be named one thing, its deploy
# directory another, entirely by history/accident). Resolution:
#   1. $dir/.keep-vault, if present — a one-time-per-project marker
#      (`echo "<vault key>" > "$dir/.keep-vault"` when bootstrapping),
#      one line, human-readable, cat-able to check what's configured.
#   2. Otherwise falls back to "<project>/<env>" — works when the vault
#      key genuinely does match, and is also the graceful "not
#      bootstrapped yet" case for a keep pull that's expected to fail.
#
# `keep pull` is always best-effort: a missing vault, a missing grant, or
# `keep` not being installed at all is never fatal here — it means "keep
# doesn't apply to this project (yet)," never "stop the deploy." Whatever
# .env already exists on disk (hand-copied, or from a previous keep pull)
# is what docker compose reads either way.
set -euo pipefail

project="${1:?usage: deploy.sh <project> [env]}"
env="${2:-production}"
root="${DEPLOY_ROOT:-/opt/docker}"
dir="$root/$project"

if [ ! -d "$dir" ]; then
  echo "error: $dir does not exist" >&2
  exit 1
fi

if [ -f "$dir/.keep-vault" ]; then
  vault="$(cat "$dir/.keep-vault")"
else
  vault="$project/$env"
fi

if command -v keep >/dev/null 2>&1 && keep pull "$vault" --out "$dir/.env.new" 2>/dev/null; then
  mv "$dir/.env.new" "$dir/.env"
  echo "  ✓ pulled $vault"
else
  rm -f "$dir/.env.new"
  echo "  · keep pull skipped or failed for $vault (using existing .env, if any)"
fi

(cd "$dir" && docker compose up -d)