1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
#!/bin/bash
if [ -z "${INFRA_LIB:-}" ]; then
. "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/lib/common.sh"
fi
did_key_associator_defaults() {
DID_KEY_ASSOCIATOR_REPO="${DID_KEY_ASSOCIATOR_REPO:-$HOME/src/kcp/did-key-associator}"
DID_KEY_ASSOCIATOR_MODE="${DID_KEY_ASSOCIATOR_MODE:-full}"
DID_KEY_ASSOCIATOR_DOMAIN=qr.fedfork.com
DID_KEY_ASSOCIATOR_UNIT=qr-fedfork-backend.service
DID_KEY_ASSOCIATOR_BACKUPS=/root/qr-backup
}
did_key_associator_args() {
DID_KEY_ASSOCIATOR_ARGS=()
case "$DID_KEY_ASSOCIATOR_MODE" in
full) ;;
static) DID_KEY_ASSOCIATOR_ARGS+=(--static-only) ;;
*) infra_die "DID_KEY_ASSOCIATOR_MODE is full or static, not $DID_KEY_ASSOCIATOR_MODE" ;;
esac
}
did_key_associator_status() {
did_key_associator_defaults
infra_unit_state "$DID_KEY_ASSOCIATOR_UNIT" caddy.service
infra_ro_root "echo \"backend sha256: \$(sha256sum /opt/qr-fedfork/qr-fedfork-backend | cut -d' ' -f1)\"; echo \"latest backups: \$(ls -1t $DID_KEY_ASSOCIATOR_BACKUPS 2>/dev/null | head -3 | tr '\n' ' ')\""
infra_report_urls "https://$DID_KEY_ASSOCIATOR_DOMAIN/" "https://$DID_KEY_ASSOCIATOR_DOMAIN/xrpc/com.fedfork.atprotoOauthQR"
}
did_key_associator_deploy() {
local script
did_key_associator_defaults
did_key_associator_args
script="$DID_KEY_ASSOCIATOR_REPO/scripts/deploy.sh"
if [ "$INFRA_APPLY" != 1 ]; then
infra_log "[dry-run] local: SSH_TARGET=$SSH_TARGET SSH_KEY=${SSH_KEY:-<ssh config>} $script ${DID_KEY_ASSOCIATOR_ARGS[*]}"
infra_log "it builds the static site and the backend, backs up to $DID_KEY_ASSOCIATOR_BACKUPS/<ts>, uploads, validates caddy and restores on a failure"
if [ "${DID_KEY_ASSOCIATOR_DEEP_DRY_RUN:-}" = 1 ]; then
SSH_TARGET="$SSH_TARGET" SSH_KEY="${SSH_KEY:-}" "$script" "${DID_KEY_ASSOCIATOR_ARGS[@]}" --dry-run
else
infra_log "DID_KEY_ASSOCIATOR_DEEP_DRY_RUN=1 runs its own --dry-run (a local build, no upload)"
fi
return 0
fi
[ -f "$script" ] || infra_die "no $script; set DID_KEY_ASSOCIATOR_REPO"
[ -z "${SSH_PORT:-}" ] || infra_die "$script takes no SSH_PORT"
SSH_TARGET="$SSH_TARGET" SSH_KEY="${SSH_KEY:-}" bash "$script" "${DID_KEY_ASSOCIATOR_ARGS[@]}"
infra_health_wait "https://$DID_KEY_ASSOCIATOR_DOMAIN/" 200 15 2
infra_health_wait "https://$DID_KEY_ASSOCIATOR_DOMAIN/xrpc/com.fedfork.atprotoOauthQR" 401 15 2
}
did_key_associator_rollback() {
local pick
did_key_associator_defaults
if [ -n "${DID_KEY_ASSOCIATOR_BACKUP_TS:-}" ]; then
pick="$(infra_q "$DID_KEY_ASSOCIATOR_BACKUPS/$DID_KEY_ASSOCIATOR_BACKUP_TS")"
else
pick="\$(ls -1dt $DID_KEY_ASSOCIATOR_BACKUPS/*/ | head -1)"
fi
infra_rw_root "set -e
b=$pick
[ -f \"\$b/restore.sh\" ] || { echo \"no restore.sh in \$b\" >&2; exit 1; }
echo \"restoring from \$b\"
bash \"\$b/restore.sh\""
infra_health_wait "https://$DID_KEY_ASSOCIATOR_DOMAIN/" 200 15 2
}
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
set -euo pipefail
infra_component_main did-key-associator root@qr.fedfork.com "$HOME/.ssh/id_ed25519_no_password" "" "" "$@"
fi
