wangjia
def3bb34b8
Deploy Server / deploy-server (push) Successful in 4m33s
Deploy Site / deploy-site (push) Successful in 2m19s
Deploy Client / build-windows (push) Successful in 1m39s
Deploy Client / build-android (push) Successful in 3m49s
Deploy Client / build-macos (push) Failing after 1m47s
Deploy Client / build-ios (push) Failing after 16m18s
Deploy Client / release-deploy (push) Successful in 1m39s
现网 server.env 漂移成 ADDR=:8080(全网卡),ufw 又放行 8080 → 控制面 API 明文 裸奔公网(http://<IP>:8080),绕过 cloudflared/CF 的 TLS 层。两处硬化: - main.go:ADDR 未设时默认由 :8080 改 127.0.0.1:8080(防御纵深;跨主机监听须显式设 ADDR) - deploy-server.sh:部署重启前幂等把 ADDR=:8080 纠回 127.0.0.1:8080(备份原文件)+ 撤 ufw allow 8080/tcp。收口随 server-v* 发版自动落地,不再手改线上。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEVUXAbFT6bF1Qw27RHWoD
84 lines
4.4 KiB
Bash
84 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# deploy-server.sh <tag> — deploy the pangolin control-plane binaries
|
|
# (pangolin-server / pangolin-agent / pangolin-migrate / pangolin-nodectl) to
|
|
# pangolin1, in the exact manual sequence used for F3/F4: stop → wal
|
|
# checkpoint → backup db → migrate (rollback db + restart old binary on
|
|
# failure) → swap binaries → start → healthcheck. Assumes compile-backend.sh
|
|
# has already produced
|
|
# server/out/{pangolin-server,pangolin-agent,pangolin-migrate,pangolin-nodectl}.
|
|
#
|
|
# Usage: scripts/ci/deploy-server.sh <tag> (e.g. server-v1.2.3)
|
|
# Requires env: DEPLOY_SSH_KEY (see lib-ssh.sh).
|
|
set -euo pipefail
|
|
|
|
# shellcheck source=scripts/ci/lib-ssh.sh
|
|
. scripts/ci/lib-ssh.sh
|
|
|
|
DB=/var/lib/pangolin/pangolin.db
|
|
BIN=/usr/local/bin
|
|
TAG="${1:?usage: deploy-server.sh <tag>}"
|
|
|
|
# Refuse anything that isn't a strict server-vX.Y.Z[-suffix] tag before it can
|
|
# reach the remote heredoc / backup paths below (command-injection guard).
|
|
# An anchored regex is used instead of a `case` glob: a trailing `*` in a
|
|
# case pattern matches ANY trailing characters (including shell metachars
|
|
# like `; rm -rf /`), which would defeat the point of this check.
|
|
if ! [[ "$TAG" =~ ^server-v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
|
|
echo "deploy-server: refusing unexpected tag '$TAG'" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# setup_ssh registers the EXIT cleanup trap itself (before writing the key),
|
|
# so a mid-setup failure still cleans up — see lib-ssh.sh. It exports
|
|
# SSH_KEY_FILE / DEPLOY_PORT / SSH_KNOWN_HOSTS_FILE / DEPLOY_HOST used below
|
|
# to build SCP (mirroring the SSH/RSYNC_SSH command-string convention).
|
|
setup_ssh
|
|
SCP="scp -i ${SSH_KEY_FILE} -P ${DEPLOY_PORT} -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=${SSH_KNOWN_HOSTS_FILE}"
|
|
|
|
echo "==> deploy-server: tag=${TAG} host=${DEPLOY_HOST}"
|
|
echo "==> deploy-server: uploading binaries to ${DEPLOY_HOST}:/tmp/"
|
|
$SCP server/out/pangolin-server server/out/pangolin-agent server/out/pangolin-migrate server/out/pangolin-nodectl "root@${DEPLOY_HOST}:/tmp/"
|
|
|
|
$SSH "root@${DEPLOY_HOST}" "bash -s" <<REMOTE
|
|
set -euo pipefail
|
|
systemctl stop pangolin-server
|
|
runuser -u pangolin -- sqlite3 "$DB" 'PRAGMA wal_checkpoint(TRUNCATE);'
|
|
cp -p "$DB" "$DB.bak-pre-$TAG"
|
|
if ! runuser -u pangolin -- env DB_DRIVER=sqlite DB_DSN=$DB /tmp/pangolin-migrate up; then
|
|
echo "!! migrate 失败,回滚"; cp -p "$DB.bak-pre-$TAG" "$DB"; systemctl start pangolin-server; exit 1
|
|
fi
|
|
cp -p "$BIN/pangolin-server" "$BIN/pangolin-server.bak-$TAG" || true
|
|
install -m755 /tmp/pangolin-server "$BIN/pangolin-server"
|
|
install -m755 /tmp/pangolin-agent "$BIN/pangolin-agent"
|
|
install -m755 /tmp/pangolin-migrate "$BIN/pangolin-migrate"
|
|
install -m755 /tmp/pangolin-nodectl "$BIN/pangolin-nodectl"
|
|
# ── 控制面收口(幂等):HTTP API 只绑 loopback,经 cloudflared 隧道对外,关公网 8080 ──
|
|
# 现网 server.env 曾漂移成 ADDR=:8080(全网卡明文暴露 http://<公网IP>:8080,绕过 CF/TLS)。
|
|
# 这里在重启前把它纠回 127.0.0.1:8080 并撤掉 ufw 放行,随本次部署自动生效——不再手改线上。
|
|
# 幂等:仅当精确匹配公网形态 ADDR=:8080 才改;已收口则跳过。备份原文件。
|
|
if grep -qxF 'ADDR=:8080' /etc/pangolin/server.env; then
|
|
cp -p /etc/pangolin/server.env "/etc/pangolin/server.env.bak-addr-$TAG"
|
|
sed -i 's/^ADDR=:8080\$/ADDR=127.0.0.1:8080/' /etc/pangolin/server.env
|
|
echo "==> deploy-server: ADDR 收口 :8080 -> 127.0.0.1:8080"
|
|
fi
|
|
if command -v ufw >/dev/null 2>&1; then
|
|
ufw delete allow 8080/tcp >/dev/null 2>&1 || true
|
|
fi
|
|
systemctl start pangolin-server
|
|
systemctl is-active pangolin-server
|
|
REMOTE
|
|
|
|
# 8080 现仅 loopback(经 cloudflared 隧道对外)。
|
|
# 本地 /healthz 是本次二进制部署成败的**权威闸**:新 server 起来即通过。
|
|
$SSH "root@${DEPLOY_HOST}" 'curl -fsS -m 10 --retry 5 --retry-connrefused http://127.0.0.1:8080/healthz >/dev/null && echo "healthz(local) OK"'
|
|
# 隧道 /healthz 是端到端冒烟(最贴近真实客户端路径),但**非致命**:它依赖 cloudflared/CF 边缘,
|
|
# 与「本次二进制是否健康」是两回事——CF 边缘抖动或隧道尚未 provision 不应判整次部署失败
|
|
# (本地闸已证明 server 健康)。失败只告警,不 exit。
|
|
if curl -fsS -m 10 --retry 3 "https://api.yanmeiai.com/healthz" >/dev/null; then
|
|
echo "healthz(tunnel) OK"
|
|
else
|
|
echo "==> deploy-server: 警告 —— 隧道 https://api.yanmeiai.com/healthz 不通(CF 边缘抖动/隧道未就绪?);本地 healthz 已通过,不阻断部署。" >&2
|
|
fi
|
|
|
|
echo "==> deploy-server: done"
|