1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
#!/bin/bash
if [ -z "${INFRA_LIB:-}" ]; then
. "$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/lib/common.sh"
fi
ingress_relay_defaults() {
INGRESS_RELAY_HOSTNAME="${INGRESS_RELAY_HOSTNAME:-xrpc.fedproxy.com}"
INGRESS_RELAY_SOCKET="${INGRESS_RELAY_SOCKET:-/opt/caddy/xrpc-relay-server.sock}"
INGRESS_RELAY_BASE="${INGRESS_RELAY_BASE:-/opt/xrpc-relay-go}"
INGRESS_RELAY_OUT_ROOT="${INGRESS_RELAY_OUT_ROOT:-$HOME/.tmp/xrpc-relay-deploy}"
INGRESS_RELAY_NO_AUTO_ROLLBACK="${INGRESS_RELAY_NO_AUTO_ROLLBACK:-}"
INGRESS_RELAY_UNIT=xrpc-relay-server.service
INGRESS_RELAY_DROPIN_DIR="/etc/systemd/system/$INGRESS_RELAY_UNIT.d"
INGRESS_RELAY_DROPIN="$INGRESS_RELAY_DROPIN_DIR/30-go.conf"
INGRESS_RELAY_BIN=socialweb-computer
}
ingress_relay_unit_state() {
local base sock
base="$(infra_q "$INGRESS_RELAY_BASE")"
sock="$(infra_q "$INGRESS_RELAY_SOCKET")"
infra_ro_root "systemctl show $INGRESS_RELAY_UNIT -p ActiveState -p SubState -p MainPID -p ExecMainStartTimestamp -p DropInPaths --no-pager
pid=\$(systemctl show $INGRESS_RELAY_UNIT -p MainPID --value)
if [ \"\$pid\" != 0 ]; then echo \"MainExe=\$(readlink /proc/\$pid/exe)\"; fi
echo \"Current=\$(readlink $base/current || true)\"
if [ -f $base/previous ]; then echo \"Previous=\$(cat $base/previous)\"; fi
if [ -S $sock ]; then echo \"Socket=\$(stat -c '%A %U:%G' $sock)\"; else echo Socket=missing; fi"
}
ingress_relay_wait_socket() {
infra_ro_root "for i in \$(seq 1 60); do [ -S $(infra_q "$INGRESS_RELAY_SOCKET") ] && exit 0; sleep 0.5; done; exit 1"
}
ingress_relay_socket_health() {
infra_ro_root "curl -sS --max-time 10 --unix-socket $(infra_q "$INGRESS_RELAY_SOCKET") -H $(infra_q "Host: $INGRESS_RELAY_HOSTNAME") -w ' %{http_code}' http://relay/xrpc/_health || true"
}
ingress_relay_report() {
infra_log "unit:"
ingress_relay_unit_state | infra_indent
infra_report_urls "https://$INGRESS_RELAY_HOSTNAME/xrpc/_health" "https://$INGRESS_RELAY_HOSTNAME/.well-known/did.json"
infra_log "last journal lines:"
infra_ro_root "journalctl -u $INGRESS_RELAY_UNIT -n 8 --no-pager -o cat | cut -c1-240" | infra_indent
}
ingress_relay_status() {
ingress_relay_defaults
ingress_relay_report
}
ingress_relay_rollback() {
local did
ingress_relay_defaults
infra_log "removing $INGRESS_RELAY_DROPIN and restarting $INGRESS_RELAY_UNIT on the deno relay of the lower drop-ins"
infra_rw_root "rm -f $(infra_q "$INGRESS_RELAY_DROPIN")"
infra_unit_restart "$INGRESS_RELAY_UNIT"
if [ "$INFRA_APPLY" != 1 ]; then
infra_log "dry-run: rollback printed; --rollback --apply runs it"
return 0
fi
if ! ingress_relay_wait_socket; then
infra_log "rollback: $INGRESS_RELAY_SOCKET did not come back"
ingress_relay_report
return 1
fi
did="$(infra_fetch "https://$INGRESS_RELAY_HOSTNAME/.well-known/did.json")"
ingress_relay_report
case "$did" in
200*) infra_log "rolled back: the deno relay serves https://$INGRESS_RELAY_HOSTNAME" ;;
*)
infra_log "rolled back, but https://$INGRESS_RELAY_HOSTNAME/.well-known/did.json answers $did"
return 1
;;
esac
}
ingress_relay_fail() {
infra_log "$1"
ingress_relay_report
if [ "$INGRESS_RELAY_NO_AUTO_ROLLBACK" = 1 ]; then
infra_log "INGRESS_RELAY_NO_AUTO_ROLLBACK=1: left as is; infra/ingress-relay/deploy.sh --rollback --apply restores the deno relay"
return 1
fi
ingress_relay_rollback || true
return 1
}
ingress_relay_deploy() {
local full_commit commit version out dest sha health did via_socket stamp
ingress_relay_defaults
full_commit="$(git -C "$INFRA_REPO" rev-parse HEAD)"
commit="${full_commit:0:12}"
version="$commit"
if [ -n "$(git -C "$INFRA_REPO" status --porcelain --untracked-files=no)" ]; then
version="$commit-dirty-$INFRA_TS"
fi
out="$INGRESS_RELAY_OUT_ROOT/$version"
stamp=github.com/johnandersen777/socialweb-computer-kcp/internal/buildstamp
infra_local_rw "build $INGRESS_RELAY_BIN $version for linux/amd64 (CGO_ENABLED=0)" \
env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go -C "$INFRA_REPO" build -trimpath -buildvcs=false \
-ldflags "-s -w -X $stamp.Version=$version -X $stamp.Commit=$full_commit" -o "$out/$INGRESS_RELAY_BIN" ./cmd/socialweb-computer
sha="<sha256 of $out/$INGRESS_RELAY_BIN>"
if [ "$INFRA_APPLY" = 1 ]; then
sha="$(infra_sha256 "$out/$INGRESS_RELAY_BIN")"
infra_log "built $out/$INGRESS_RELAY_BIN sha256 $sha ($(du -h "$out/$INGRESS_RELAY_BIN" | cut -f1))"
if [ "$(uname -s)/$(uname -m)" = "Linux/x86_64" ]; then
"$out/$INGRESS_RELAY_BIN" internal ingress-relay --help >/dev/null 2>&1 || infra_die "the built binary does not run internal ingress-relay --help"
fi
fi
dest="$INGRESS_RELAY_BASE/$version"
infra_upload "$out/$INGRESS_RELAY_BIN" "$dest/$INGRESS_RELAY_BIN" 0755 root
infra_ro_root "$(infra_q "$dest/$INGRESS_RELAY_BIN") internal ingress-relay --help >/dev/null 2>&1" || infra_die "the shipped binary does not run on $(infra_target)"
infra_log "pointing $INGRESS_RELAY_BASE/current at $version"
infra_rw_root "set -e
prev=\$(readlink $(infra_q "$INGRESS_RELAY_BASE/current") || true)
if [ -n \"\$prev\" ] && [ \"\$prev\" != $(infra_q "$version") ]; then printf '%s\n' \"\$prev\" > $(infra_q "$INGRESS_RELAY_BASE/previous"); fi
ln -sfn $(infra_q "$version") $(infra_q "$INGRESS_RELAY_BASE/current.new")
mv -T $(infra_q "$INGRESS_RELAY_BASE/current.new") $(infra_q "$INGRESS_RELAY_BASE/current")"
infra_file_install "$INGRESS_RELAY_DROPIN" 0644 "[Service]
Type=notify
NotifyAccess=main
WorkingDirectory=$INGRESS_RELAY_BASE
ExecStart=
ExecStart=$INGRESS_RELAY_BASE/current/$INGRESS_RELAY_BIN internal ingress-relay --unix-socket $INGRESS_RELAY_SOCKET --hostname $INGRESS_RELAY_HOSTNAME
TimeoutStopSec=20"
infra_log "restarting $INGRESS_RELAY_UNIT"
if ! infra_unit_restart "$INGRESS_RELAY_UNIT" || ! ingress_relay_wait_socket; then
ingress_relay_fail "$INGRESS_RELAY_UNIT did not come up on the Go relay"
return 1
fi
health="$(infra_fetch "https://$INGRESS_RELAY_HOSTNAME/xrpc/_health")"
did="$(infra_fetch "https://$INGRESS_RELAY_HOSTNAME/.well-known/did.json")"
via_socket="$(ingress_relay_socket_health)"
if [ "$INFRA_APPLY" != 1 ]; then
infra_log "dry-run: deploy printed; the check wants _health 200 with $commit and did.json 200, else it rolls back"
return 0
fi
ingress_relay_report
infra_log "via $INGRESS_RELAY_SOCKET: $via_socket"
case "$health" in
200*"$commit"*)
case "$did" in
200*)
infra_log "deployed: $version ($sha) serves https://$INGRESS_RELAY_HOSTNAME; rollback with infra/ingress-relay/deploy.sh --rollback --apply"
return 0
;;
esac
;;
esac
ingress_relay_fail "the health check failed: _health $health, did.json $did"
}
if [ "${BASH_SOURCE[0]}" = "$0" ]; then
set -euo pipefail
infra_component_main ingress-relay root@fedproxy.com "$HOME/.ssh/id_ed25519_no_password" "" "" "$@"
fi
