Blame · Line-by-line history
auto-update.sh
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| f635e2f | 1 | #!/usr/bin/env bash |
| 2 | # | |
| 3 | # Fast auto-deploy for the standalone box. Installed as a ~60s systemd timer by | |
| 4 | # scripts/standalone-deploy.sh. Polls the deploy branch; when new commits land, | |
| 5 | # it pulls, rebuilds, and runs migrations. Push -> live in ~1-2 min, hands-off. | |
| 6 | # | |
| 7 | # Exits immediately (cheap) when there is nothing new, so a tight interval is fine. | |
| 3b77289 | 8 | # |
| 9 | # Rollback (2026-07-21): a bad deploy used to leave the box with the OLD | |
| 10 | # container already destroyed and the NEW one unhealthy -- a failed health | |
| 11 | # check just exited 1 with nothing serving traffic until a human noticed and | |
| 12 | # fixed it by hand. The previous image is now tagged before every build, and | |
| 13 | # a failed health check re-deploys it automatically instead of leaving a | |
| 14 | # broken container live. A SHA that fails is remembered (FAILED_MARKER) so a | |
| 15 | # persistently broken commit doesn't retry-and-fail every 60s forever -- it | |
| 16 | # waits for a newer commit (or a human clearing the marker) instead. | |
| f635e2f | 17 | set -euo pipefail |
| 18 | ||
| 19 | REPO_DIR="/opt/gluecron" | |
| 9de2807 | 20 | BRANCH="main" |
| f635e2f | 21 | COMPOSE="docker compose -f docker-compose.standalone.yml" |
| 3b77289 | 22 | IMAGE="gluecron-gluecron" |
| 23 | FAILED_MARKER="$REPO_DIR/.last-failed-deploy-sha" | |
| f635e2f | 24 | |
| 25 | cd "$REPO_DIR" | |
| 26 | git fetch origin "$BRANCH" --quiet | |
| 27 | ||
| 28 | local_sha=$(git rev-parse HEAD) | |
| 29 | remote_sha=$(git rev-parse "origin/$BRANCH") | |
| 30 | [ "$local_sha" = "$remote_sha" ] && exit 0 | |
| 31 | ||
| 3b77289 | 32 | if [ -f "$FAILED_MARKER" ] && [ "$(cat "$FAILED_MARKER")" = "$remote_sha" ]; then |
| 33 | # Already tried and rolled back from this exact commit -- don't loop. | |
| 34 | exit 0 | |
| 35 | fi | |
| 36 | ||
| f635e2f | 37 | echo "$(date -Is) deploying $local_sha -> $remote_sha" |
| 3b77289 | 38 | |
| 39 | # Preserve the last-known-good image BEFORE touching anything, so a bad | |
| 40 | # deploy can roll back to exactly what was running a moment ago. `|| true`: | |
| 41 | # the very first deploy on a fresh box has no prior image to tag. | |
| 42 | docker tag "$IMAGE:latest" "$IMAGE:last-good" 2>/dev/null || true | |
| 43 | prev_sha="$local_sha" | |
| 44 | ||
| f635e2f | 45 | git reset --hard "origin/$BRANCH" # untracked .env / backups are preserved |
| 46 | ||
| 8102dd4 | 47 | # Build provenance for the container. The image ships without a .git dir, so |
| 48 | # src/lib/build-info.ts can only report a real SHA if we hand it one via env. | |
| 49 | # Without this the footer renders "unknown · unknown", /api/version reports a | |
| 50 | # SHA that never changes (so the client auto-update banner can never fire), | |
| 51 | # and the PWA service-worker cache key never rotates between deploys. | |
| 52 | # docker-compose.standalone.yml interpolates these at `up` time. | |
| 53 | GIT_SHA="$(git rev-parse HEAD)" | |
| 54 | GIT_BRANCH="$BRANCH" | |
| 55 | BUILD_SHA="$GIT_SHA" | |
| 56 | export GIT_SHA GIT_BRANCH BUILD_SHA | |
| 57 | ||
| 30e70f3 | 58 | # NOTE: `|| true` is deliberate. On this Coolify co-tenant box the compose |
| 59 | # also defines a `caddy` service that tries to bind host :80/:443, which | |
| 60 | # Coolify's proxy already owns — so `up` reports a non-zero exit for caddy | |
| 61 | # even though the app (gluecron) started fine. Under `set -e` that would abort | |
| 62 | # the deploy BEFORE the coolify reattach + health gate below. We tolerate the | |
| 63 | # partial failure here and instead gate on the app's OWN health further down. | |
| 64 | $COMPOSE up -d --build || echo "$(date -Is) compose up returned non-zero (likely the co-tenant caddy port conflict) — continuing to app health gate" | |
| 5bac517 | 65 | |
| 66 | # Co-tenant ingress reattach (Coolify boxes only). | |
| 67 | # `docker compose up --build` recreates the gluecron container, which DROPS | |
| 68 | # any network attachment not declared in docker-compose.standalone.yml. On | |
| 69 | # this box the public ingress is Coolify's Traefik ("coolify-proxy"), which | |
| 70 | # reaches the app over the external "coolify" network via the file route | |
| 71 | # /traefik/dynamic/gluecron.yaml in the coolify-proxy container. Without this | |
| 72 | # reattach, every deploy 502s the site until someone reconnects by hand. | |
| 30e70f3 | 73 | # Idempotent: a no-op if already attached; skipped entirely on a dedicated VPS |
| 3b77289 | 74 | # that has no "coolify" network. Traefik's file provider watches with fsnotify |
| 75 | # (--providers.file.watch=true), so it notices the container is reachable | |
| 76 | # again within a second or two of the reconnect — no manual nudge needed. | |
| 5bac517 | 77 | if docker network inspect coolify >/dev/null 2>&1; then |
| 78 | docker network connect coolify gluecron-gluecron-1 2>/dev/null \ | |
| 79 | && echo "$(date -Is) reattached gluecron to coolify network" \ | |
| 80 | || echo "$(date -Is) coolify network already attached (ok)" | |
| 81 | fi | |
| 82 | ||
| f635e2f | 83 | $COMPOSE exec -T gluecron bun run db:migrate || true |
| 84 | docker image prune -f >/dev/null 2>&1 || true | |
| 85 | ||
| 30e70f3 | 86 | # App health gate — the real success signal (not caddy). Poll the container's |
| 3b77289 | 87 | # own /healthz; if the app itself never comes up, roll back instead of |
| 88 | # leaving a broken deploy live. | |
| 30e70f3 | 89 | healthy=0 |
| 90 | for _ in $(seq 1 20); do | |
| 91 | if docker exec gluecron-gluecron-1 wget -qO- --timeout=4 http://localhost:3000/healthz >/dev/null 2>&1; then | |
| 92 | healthy=1; break | |
| 93 | fi | |
| 94 | sleep 3 | |
| 95 | done | |
| 3b77289 | 96 | |
| 97 | if [ "$healthy" = "1" ]; then | |
| 98 | rm -f "$FAILED_MARKER" | |
| 99 | echo "$(date -Is) deploy complete: $remote_sha (app healthy)" | |
| 100 | exit 0 | |
| 101 | fi | |
| 102 | ||
| 103 | echo "$(date -Is) DEPLOY FAILED: app /healthz never came up for $remote_sha" >&2 | |
| 104 | docker logs --tail 80 gluecron-gluecron-1 >&2 || true | |
| 105 | ||
| 106 | if ! docker image inspect "$IMAGE:last-good" >/dev/null 2>&1; then | |
| 107 | echo "$(date -Is) no last-good image to roll back to (first deploy on this box?) — human intervention required" >&2 | |
| 108 | echo "$remote_sha" > "$FAILED_MARKER" | |
| 109 | exit 1 | |
| 110 | fi | |
| 111 | ||
| 112 | echo "$(date -Is) rolling back to $prev_sha" >&2 | |
| 113 | git reset --hard "$prev_sha" | |
| 114 | docker tag "$IMAGE:last-good" "$IMAGE:latest" | |
| 115 | $COMPOSE up -d --no-build || echo "$(date -Is) compose up (rollback) returned non-zero (likely the co-tenant caddy port conflict) — continuing to health gate" | |
| 116 | ||
| 117 | if docker network inspect coolify >/dev/null 2>&1; then | |
| 118 | docker network connect coolify gluecron-gluecron-1 2>/dev/null || true | |
| 119 | fi | |
| 120 | ||
| 121 | rb_healthy=0 | |
| 122 | for _ in $(seq 1 20); do | |
| 123 | if docker exec gluecron-gluecron-1 wget -qO- --timeout=4 http://localhost:3000/healthz >/dev/null 2>&1; then | |
| 124 | rb_healthy=1; break | |
| 125 | fi | |
| 126 | sleep 3 | |
| 127 | done | |
| 128 | ||
| 129 | echo "$remote_sha" > "$FAILED_MARKER" | |
| 130 | ||
| 131 | if [ "$rb_healthy" = "1" ]; then | |
| 132 | echo "$(date -Is) rollback to $prev_sha succeeded — app healthy again. $remote_sha will not be retried automatically; push a fix or clear $FAILED_MARKER to try again." >&2 | |
| 30e70f3 | 133 | exit 1 |
| 134 | fi | |
| 135 | ||
| 3b77289 | 136 | echo "$(date -Is) ROLLBACK ALSO FAILED — human intervention required NOW (site may be down)" >&2 |
| 137 | exit 1 |