Bot hosting: releases are self-contained CI bundles, and the bot serves its own web UI
The image no longer installs the bot's dependencies: its CI builds one tar.gz holding the app plus a
vendor/ directory of prebuilt wheels, and PYTHONPATH=/app/vendor makes the code import them. A new
dependency therefore needs no image rebuild and the server contacts no package index.
- deployBotBundle.sh: install / --latest / --status / --rollback, verifies every file against BUILD.json
and keeps the previous release beside the live one.
- compose: mount ${BOT_APP_DIR:-/srv/bot/app} at /app, set DB_BACKEND, DATA_DIR, WEB_ALLOWED_GROUPS,
WEB_SERVE_UI and PYTHONPATH. bot/app placeholder untracked; install.sh creates /srv/bot/app.
- The placeholder requirements would have crashed the bot on import (no sqlglot), which is why the
image now ships none of them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
111
deployBotBundle.sh
Executable file
111
deployBotBundle.sh
Executable file
@@ -0,0 +1,111 @@
|
||||
#!/bin/bash
|
||||
# Install a Vanguard Bot release bundle into the place the discord-bot container expects it.
|
||||
#
|
||||
# The bundle comes from the bot repo's CI (workflow "ci", job "bundle", artifact "vanguard-bot-bundle"):
|
||||
# one tar.gz holding main.py, app/, website/, version.json, BUILD.json and vendor/ — the bot's own
|
||||
# dependencies. Nothing is installed here and the server needs no package index.
|
||||
#
|
||||
# ./deployBotBundle.sh vanguard-bot-bundle.tar.gz install that file
|
||||
# ./deployBotBundle.sh --latest download the newest main build from Gitea first
|
||||
# ./deployBotBundle.sh --rollback put the previous bundle back
|
||||
# ./deployBotBundle.sh --status what is installed right now
|
||||
#
|
||||
# --latest needs a Gitea token with read access to the repo, in .env as BOT_REPO_TOKEN (or $BOT_REPO_TOKEN).
|
||||
# Layout: $BOT_DIR/app = live (mounted at /app) $BOT_DIR/previous = the one before $BOT_DIR/.incoming = staging
|
||||
set -euo pipefail
|
||||
cd "$(dirname "$0")"
|
||||
BOT_DIR="${BOT_DIR:-/srv/bot}"
|
||||
REPO="${BOT_REPO:-VanguardOrg/VanguardBot}"
|
||||
BRANCH="${BOT_BRANCH:-main}"
|
||||
fromenv() { [[ -f .env ]] && grep -E "^$1=" .env | head -1 | cut -d= -f2- || true; }
|
||||
GIT_HOST="$(fromenv GIT_HOST)"
|
||||
BOT_HOST="$(fromenv BOT_HOST)"
|
||||
BOT_REPO_TOKEN="${BOT_REPO_TOKEN:-$(fromenv BOT_REPO_TOKEN)}"
|
||||
|
||||
say() { printf '\n== %s\n' "$*"; }
|
||||
die() { echo "error: $*" >&2; exit 1; }
|
||||
|
||||
summary() { # summary <bundle-root>
|
||||
python3 - "$1" <<'PY'
|
||||
import json,sys,pathlib
|
||||
root=pathlib.Path(sys.argv[1]); build=root/'BUILD.json'
|
||||
if not build.is_file(): print(' (no BUILD.json — not a CI bundle)'); sys.exit(0)
|
||||
d=json.loads(build.read_text())
|
||||
print(f" version {d.get('version')} commit {(d.get('commit') or '?')[:8]} built {d.get('built_at')} {d.get('python')} ({d.get('abi')})")
|
||||
print(f" {len(d.get('files',{}))} files, {len(d.get('packages',[]))} packages: {', '.join(d.get('packages',[])[:6])}…")
|
||||
PY
|
||||
}
|
||||
|
||||
case "${1:-}" in
|
||||
--status)
|
||||
say "installed at $BOT_DIR/app"; summary "$BOT_DIR/app"
|
||||
if [[ -d $BOT_DIR/previous ]]; then say "previous"; summary "$BOT_DIR/previous"; fi
|
||||
say "container"; docker ps --filter name=discord-bot --format ' {{.Names}} {{.Status}}'
|
||||
exit 0 ;;
|
||||
--rollback)
|
||||
[[ -d $BOT_DIR/previous ]] || die "no previous bundle in $BOT_DIR/previous"
|
||||
say "rolling back"; summary "$BOT_DIR/previous"
|
||||
docker stop discord-bot >/dev/null
|
||||
rm -rf "$BOT_DIR/.rollback" && mv "$BOT_DIR/app" "$BOT_DIR/.rollback" && mv "$BOT_DIR/previous" "$BOT_DIR/app" && mv "$BOT_DIR/.rollback" "$BOT_DIR/previous"
|
||||
docker start discord-bot >/dev/null; sleep 8; docker logs --tail 12 discord-bot; exit 0 ;;
|
||||
--latest)
|
||||
[[ -n ${BOT_REPO_TOKEN:-} ]] || die "set BOT_REPO_TOKEN in .env (Gitea token with read access to $REPO)"
|
||||
[[ -n $GIT_HOST ]] || die "GIT_HOST not found in .env"
|
||||
TARBALL=$(mktemp /tmp/vanguard-bot-bundle.XXXXXX.tar.gz)
|
||||
say "newest '$BRANCH' bundle from https://$GIT_HOST/$REPO"
|
||||
URL=$(curl -fsS -H "Authorization: token $BOT_REPO_TOKEN" \
|
||||
"https://$GIT_HOST/api/v1/repos/$REPO/actions/artifacts?name=vanguard-bot-bundle" |
|
||||
python3 -c "
|
||||
import json,sys
|
||||
items=json.load(sys.stdin).get('artifacts') or []
|
||||
ok=[a for a in items if not a.get('expired')]
|
||||
if not ok: sys.exit('no unexpired vanguard-bot-bundle artifact — check the ci workflow ran')
|
||||
print(sorted(ok,key=lambda a:a.get('created_at',''))[-1]['archive_download_url'])")
|
||||
curl -fsSL -H "Authorization: token $BOT_REPO_TOKEN" -o "$TARBALL.zip" "$URL"
|
||||
# Gitea serves artifacts as a zip holding the tar.gz
|
||||
if python3 -c "import zipfile,sys; sys.exit(0 if zipfile.is_zipfile(sys.argv[1]) else 1)" "$TARBALL.zip"; then
|
||||
python3 - "$TARBALL.zip" "$TARBALL" <<'PY'
|
||||
import sys,zipfile
|
||||
with zipfile.ZipFile(sys.argv[1]) as z:
|
||||
name=[n for n in z.namelist() if n.endswith('.tar.gz')] or z.namelist()
|
||||
open(sys.argv[2],'wb').write(z.read(name[0]))
|
||||
PY
|
||||
else mv "$TARBALL.zip" "$TARBALL"; fi
|
||||
rm -f "$TARBALL.zip" ;;
|
||||
"" | -h | --help) sed -n '2,20p' "$0"; exit 2 ;;
|
||||
*) TARBALL="$1"; [[ -f $TARBALL ]] || die "no such file: $TARBALL" ;;
|
||||
esac
|
||||
|
||||
say "staging $TARBALL"
|
||||
rm -rf "$BOT_DIR/.incoming"; mkdir -p "$BOT_DIR/.incoming"
|
||||
tar -xzf "$TARBALL" -C "$BOT_DIR/.incoming"
|
||||
for required in main.py app/main.py app/config.py website/static/home.html vendor; do
|
||||
[[ -e "$BOT_DIR/.incoming/$required" ]] || die "bundle is missing $required — is this the CI artifact?"
|
||||
done
|
||||
summary "$BOT_DIR/.incoming"
|
||||
python3 - "$BOT_DIR/.incoming" <<'PY'
|
||||
import hashlib,json,pathlib,sys
|
||||
root=pathlib.Path(sys.argv[1]); d=json.loads((root/'BUILD.json').read_text())
|
||||
bad=[name for name,digest in d.get('files',{}).items()
|
||||
if name!='BUILD.json' and hashlib.sha256((root/name).read_bytes()).hexdigest()!=digest]
|
||||
sys.exit(f" {len(bad)} file(s) do not match BUILD.json: {bad[:3]}" if bad else 0)
|
||||
PY
|
||||
echo " checksums match BUILD.json"
|
||||
|
||||
say "swapping in and restarting discord-bot"
|
||||
docker stop discord-bot >/dev/null 2>&1 || true
|
||||
rm -rf "$BOT_DIR/previous"
|
||||
if [[ -d $BOT_DIR/app ]]; then mv "$BOT_DIR/app" "$BOT_DIR/previous"; fi
|
||||
mv "$BOT_DIR/.incoming" "$BOT_DIR/app"
|
||||
chown -R 1000:1000 "$BOT_DIR/app" 2>/dev/null || sudo chown -R 1000:1000 "$BOT_DIR/app"
|
||||
docker compose up -d discord-bot >/dev/null
|
||||
sleep 10
|
||||
|
||||
say "result"
|
||||
docker ps --filter name=discord-bot --format ' {{.Names}} {{.Status}}'
|
||||
code=$(curl -s -o /dev/null -w '%{http_code}' -H 'X-Authentik-Username: deploy-check' -H 'X-Authentik-Groups: admins' http://127.0.0.1:8000/health || true)
|
||||
echo " /health -> ${code:-no answer} (200 = serving; 401/403 = running but the identity headers were refused)"
|
||||
docker logs --tail 15 discord-bot 2>&1 | sed 's/^/ /'
|
||||
echo
|
||||
echo " web UI: https://${BOT_HOST:-BOT_HOST-not-set}/ (Caddy + Authentik; needs the bot-users group)"
|
||||
echo " rollback: ./deployBotBundle.sh --rollback"
|
||||
Reference in New Issue
Block a user