Brandyn / Techy
223458550a
The image no longer installs the bot's dependencies: its CI builds one tar.gz holding the app plus a
vendor/ directory of prebuilt wheels, and PYTHONPATH=/app/vendor makes the code import them. A new
dependency therefore needs no image rebuild and the server contacts no package index.
- deployBotBundle.sh: install / --latest / --status / --rollback, verifies every file against BUILD.json
and keeps the previous release beside the live one.
- compose: mount ${BOT_APP_DIR:-/srv/bot/app} at /app, set DB_BACKEND, DATA_DIR, WEB_ALLOWED_GROUPS,
WEB_SERVE_UI and PYTHONPATH. bot/app placeholder untracked; install.sh creates /srv/bot/app.
- The placeholder requirements would have crashed the bot on import (no sqlglot), which is why the
image now ships none of them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
112 lines
5.7 KiB
Bash
Executable File
112 lines
5.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install a Vanguard Bot release bundle into the place the discord-bot container expects it.
|
|
#
|
|
# The bundle comes from the bot repo's CI (workflow "ci", job "bundle", artifact "vanguard-bot-bundle"):
|
|
# one tar.gz holding main.py, app/, website/, version.json, BUILD.json and vendor/ — the bot's own
|
|
# dependencies. Nothing is installed here and the server needs no package index.
|
|
#
|
|
# ./deployBotBundle.sh vanguard-bot-bundle.tar.gz install that file
|
|
# ./deployBotBundle.sh --latest download the newest main build from Gitea first
|
|
# ./deployBotBundle.sh --rollback put the previous bundle back
|
|
# ./deployBotBundle.sh --status what is installed right now
|
|
#
|
|
# --latest needs a Gitea token with read access to the repo, in .env as BOT_REPO_TOKEN (or $BOT_REPO_TOKEN).
|
|
# Layout: $BOT_DIR/app = live (mounted at /app) $BOT_DIR/previous = the one before $BOT_DIR/.incoming = staging
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
BOT_DIR="${BOT_DIR:-/srv/bot}"
|
|
REPO="${BOT_REPO:-VanguardOrg/VanguardBot}"
|
|
BRANCH="${BOT_BRANCH:-main}"
|
|
fromenv() { [[ -f .env ]] && grep -E "^$1=" .env | head -1 | cut -d= -f2- || true; }
|
|
GIT_HOST="$(fromenv GIT_HOST)"
|
|
BOT_HOST="$(fromenv BOT_HOST)"
|
|
BOT_REPO_TOKEN="${BOT_REPO_TOKEN:-$(fromenv BOT_REPO_TOKEN)}"
|
|
|
|
say() { printf '\n== %s\n' "$*"; }
|
|
die() { echo "error: $*" >&2; exit 1; }
|
|
|
|
summary() { # summary <bundle-root>
|
|
python3 - "$1" <<'PY'
|
|
import json,sys,pathlib
|
|
root=pathlib.Path(sys.argv[1]); build=root/'BUILD.json'
|
|
if not build.is_file(): print(' (no BUILD.json — not a CI bundle)'); sys.exit(0)
|
|
d=json.loads(build.read_text())
|
|
print(f" version {d.get('version')} commit {(d.get('commit') or '?')[:8]} built {d.get('built_at')} {d.get('python')} ({d.get('abi')})")
|
|
print(f" {len(d.get('files',{}))} files, {len(d.get('packages',[]))} packages: {', '.join(d.get('packages',[])[:6])}…")
|
|
PY
|
|
}
|
|
|
|
case "${1:-}" in
|
|
--status)
|
|
say "installed at $BOT_DIR/app"; summary "$BOT_DIR/app"
|
|
if [[ -d $BOT_DIR/previous ]]; then say "previous"; summary "$BOT_DIR/previous"; fi
|
|
say "container"; docker ps --filter name=discord-bot --format ' {{.Names}} {{.Status}}'
|
|
exit 0 ;;
|
|
--rollback)
|
|
[[ -d $BOT_DIR/previous ]] || die "no previous bundle in $BOT_DIR/previous"
|
|
say "rolling back"; summary "$BOT_DIR/previous"
|
|
docker stop discord-bot >/dev/null
|
|
rm -rf "$BOT_DIR/.rollback" && mv "$BOT_DIR/app" "$BOT_DIR/.rollback" && mv "$BOT_DIR/previous" "$BOT_DIR/app" && mv "$BOT_DIR/.rollback" "$BOT_DIR/previous"
|
|
docker start discord-bot >/dev/null; sleep 8; docker logs --tail 12 discord-bot; exit 0 ;;
|
|
--latest)
|
|
[[ -n ${BOT_REPO_TOKEN:-} ]] || die "set BOT_REPO_TOKEN in .env (Gitea token with read access to $REPO)"
|
|
[[ -n $GIT_HOST ]] || die "GIT_HOST not found in .env"
|
|
TARBALL=$(mktemp /tmp/vanguard-bot-bundle.XXXXXX.tar.gz)
|
|
say "newest '$BRANCH' bundle from https://$GIT_HOST/$REPO"
|
|
URL=$(curl -fsS -H "Authorization: token $BOT_REPO_TOKEN" \
|
|
"https://$GIT_HOST/api/v1/repos/$REPO/actions/artifacts?name=vanguard-bot-bundle" |
|
|
python3 -c "
|
|
import json,sys
|
|
items=json.load(sys.stdin).get('artifacts') or []
|
|
ok=[a for a in items if not a.get('expired')]
|
|
if not ok: sys.exit('no unexpired vanguard-bot-bundle artifact — check the ci workflow ran')
|
|
print(sorted(ok,key=lambda a:a.get('created_at',''))[-1]['archive_download_url'])")
|
|
curl -fsSL -H "Authorization: token $BOT_REPO_TOKEN" -o "$TARBALL.zip" "$URL"
|
|
# Gitea serves artifacts as a zip holding the tar.gz
|
|
if python3 -c "import zipfile,sys; sys.exit(0 if zipfile.is_zipfile(sys.argv[1]) else 1)" "$TARBALL.zip"; then
|
|
python3 - "$TARBALL.zip" "$TARBALL" <<'PY'
|
|
import sys,zipfile
|
|
with zipfile.ZipFile(sys.argv[1]) as z:
|
|
name=[n for n in z.namelist() if n.endswith('.tar.gz')] or z.namelist()
|
|
open(sys.argv[2],'wb').write(z.read(name[0]))
|
|
PY
|
|
else mv "$TARBALL.zip" "$TARBALL"; fi
|
|
rm -f "$TARBALL.zip" ;;
|
|
"" | -h | --help) sed -n '2,20p' "$0"; exit 2 ;;
|
|
*) TARBALL="$1"; [[ -f $TARBALL ]] || die "no such file: $TARBALL" ;;
|
|
esac
|
|
|
|
say "staging $TARBALL"
|
|
rm -rf "$BOT_DIR/.incoming"; mkdir -p "$BOT_DIR/.incoming"
|
|
tar -xzf "$TARBALL" -C "$BOT_DIR/.incoming"
|
|
for required in main.py app/main.py app/config.py website/static/home.html vendor; do
|
|
[[ -e "$BOT_DIR/.incoming/$required" ]] || die "bundle is missing $required — is this the CI artifact?"
|
|
done
|
|
summary "$BOT_DIR/.incoming"
|
|
python3 - "$BOT_DIR/.incoming" <<'PY'
|
|
import hashlib,json,pathlib,sys
|
|
root=pathlib.Path(sys.argv[1]); d=json.loads((root/'BUILD.json').read_text())
|
|
bad=[name for name,digest in d.get('files',{}).items()
|
|
if name!='BUILD.json' and hashlib.sha256((root/name).read_bytes()).hexdigest()!=digest]
|
|
sys.exit(f" {len(bad)} file(s) do not match BUILD.json: {bad[:3]}" if bad else 0)
|
|
PY
|
|
echo " checksums match BUILD.json"
|
|
|
|
say "swapping in and restarting discord-bot"
|
|
docker stop discord-bot >/dev/null 2>&1 || true
|
|
rm -rf "$BOT_DIR/previous"
|
|
if [[ -d $BOT_DIR/app ]]; then mv "$BOT_DIR/app" "$BOT_DIR/previous"; fi
|
|
mv "$BOT_DIR/.incoming" "$BOT_DIR/app"
|
|
chown -R 1000:1000 "$BOT_DIR/app" 2>/dev/null || sudo chown -R 1000:1000 "$BOT_DIR/app"
|
|
docker compose up -d discord-bot >/dev/null
|
|
sleep 10
|
|
|
|
say "result"
|
|
docker ps --filter name=discord-bot --format ' {{.Names}} {{.Status}}'
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -H 'X-Authentik-Username: deploy-check' -H 'X-Authentik-Groups: admins' http://127.0.0.1:8000/health || true)
|
|
echo " /health -> ${code:-no answer} (200 = serving; 401/403 = running but the identity headers were refused)"
|
|
docker logs --tail 15 discord-bot 2>&1 | sed 's/^/ /'
|
|
echo
|
|
echo " web UI: https://${BOT_HOST:-BOT_HOST-not-set}/ (Caddy + Authentik; needs the bot-users group)"
|
|
echo " rollback: ./deployBotBundle.sh --rollback"
|