74122b25cd
Was previously hardcoded to vault key "<project-dir-name>/<env>" with no marker-file lookup at all -- a real gap versus the design already written out in PROPOSAL-announce-and-agent.md §4, which this script never actually caught up to. Repo names, deploy directory names, and vault keys are three independent strings in practice (a repo can be named one thing, its deploy directory another, entirely by history/ accident) -- exactly the situation the npm-statuspage rollout hit. Resolution order: $dir/.keep-vault if present, else fall back to "<project>/<env>". `keep pull` is now fully best-effort -- missing vault, missing grant, or keep not installed at all is never fatal, matches the proposal's explicit requirement that a keep failure means "doesn't apply to this project (yet)," never "stop the deploy." Existing/hand-copied .env is left alone if the pull doesn't happen. Verified with stub keep/docker commands on PATH (no real server needed for this): a marker-file project with a deliberately mismatched vault key resolves and pulls correctly; a project with neither a marker nor a matching vault falls through cleanly to docker compose up -d without ever touching .env or failing the deploy. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
54 lines
1.9 KiB
Bash
Executable File
54 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pulls a project's env from keep (if it's bootstrapped onto keep), then
|
|
# brings its docker compose stack up.
|
|
#
|
|
# Usage:
|
|
# ./deploy.sh <project> [env]
|
|
#
|
|
# Expects a directory at $DEPLOY_ROOT/<project>/ containing a
|
|
# docker-compose.yml.
|
|
#
|
|
# The vault key is NOT assumed to match the deploy-directory name — repo
|
|
# names, deploy directory names, and vault keys are three independent
|
|
# strings in practice (a repo can be named one thing, its deploy
|
|
# directory another, entirely by history/accident). Resolution:
|
|
# 1. $dir/.keep-vault, if present — a one-time-per-project marker
|
|
# (`echo "<vault key>" > "$dir/.keep-vault"` when bootstrapping),
|
|
# one line, human-readable, cat-able to check what's configured.
|
|
# 2. Otherwise falls back to "<project>/<env>" — works when the vault
|
|
# key genuinely does match, and is also the graceful "not
|
|
# bootstrapped yet" case for a keep pull that's expected to fail.
|
|
#
|
|
# `keep pull` is always best-effort: a missing vault, a missing grant, or
|
|
# `keep` not being installed at all is never fatal here — it means "keep
|
|
# doesn't apply to this project (yet)," never "stop the deploy." Whatever
|
|
# .env already exists on disk (hand-copied, or from a previous keep pull)
|
|
# is what docker compose reads either way.
|
|
set -euo pipefail
|
|
|
|
project="${1:?usage: deploy.sh <project> [env]}"
|
|
env="${2:-production}"
|
|
root="${DEPLOY_ROOT:-/opt/docker}"
|
|
dir="$root/$project"
|
|
|
|
if [ ! -d "$dir" ]; then
|
|
echo "error: $dir does not exist" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f "$dir/.keep-vault" ]; then
|
|
vault="$(cat "$dir/.keep-vault")"
|
|
else
|
|
vault="$project/$env"
|
|
fi
|
|
|
|
if command -v keep >/dev/null 2>&1 && keep pull "$vault" --out "$dir/.env.new" 2>/dev/null; then
|
|
mv "$dir/.env.new" "$dir/.env"
|
|
echo " ✓ pulled $vault"
|
|
else
|
|
rm -f "$dir/.env.new"
|
|
echo " · keep pull skipped or failed for $vault (using existing .env, if any)"
|
|
fi
|
|
|
|
(cd "$dir" && docker compose up -d)
|