fix(ops OPS53): deploy — compose run consome o stdin do bash -s (migrate com </dev/null); build via --network host + proxy socat (BuildKit recusa rede bridge custom)
All checks were successful
Agent PR Ready + auto-merge / ready-automerge (pull_request) Has been skipped
CI (PR) / scope (pull_request) Successful in 45s
CI (PR) / docs-guards (pull_request) Successful in 7s
CI (PR) / lint (pull_request) Successful in 57s
CI (PR) / plans-only-closes (pull_request) Successful in 10s
CI (PR) / format (pull_request) Successful in 1m10s
CI (PR) / knip (pull_request) Successful in 40s
CI (PR) / typecheck (pull_request) Successful in 49s
CI (PR) / cycles (pull_request) Successful in 46s
CI (PR) / unit (pull_request) Successful in 1m15s
CI (PR) / build (pull_request) Has been skipped
CI (PR) / e2e (1) (pull_request) Has been skipped
CI (PR) / e2e (2) (pull_request) Has been skipped
CI (PR) / int (pull_request) Successful in 2m31s
CI (PR) / checks (pull_request) Successful in 1s
All checks were successful
Agent PR Ready + auto-merge / ready-automerge (pull_request) Has been skipped
CI (PR) / scope (pull_request) Successful in 45s
CI (PR) / docs-guards (pull_request) Successful in 7s
CI (PR) / lint (pull_request) Successful in 57s
CI (PR) / plans-only-closes (pull_request) Successful in 10s
CI (PR) / format (pull_request) Successful in 1m10s
CI (PR) / knip (pull_request) Successful in 40s
CI (PR) / typecheck (pull_request) Successful in 49s
CI (PR) / cycles (pull_request) Successful in 46s
CI (PR) / unit (pull_request) Successful in 1m15s
CI (PR) / build (pull_request) Has been skipped
CI (PR) / e2e (1) (pull_request) Has been skipped
CI (PR) / e2e (2) (pull_request) Has been skipped
CI (PR) / int (pull_request) Successful in 2m31s
CI (PR) / checks (pull_request) Successful in 1s
Primeiro deploy real validado manualmente (0aec0d50): build+push+migrate+rollout+healthcheck+smoke verdes.
This commit is contained in:
Francisco Solla
parent
b5ae7497df
commit
e46c2e7092
2 changed files with 39 additions and 13 deletions
|
|
@ -12,10 +12,12 @@ com a suite verde publica o site em `jorgesolla1313.com.br` — sem passo manual
|
|||
`ssh homeserver "bash -s -- <sha>" < scripts/deploy-homeserver.sh`.
|
||||
4. O script, no **homeserver**: guarda de HEAD (`main` remoto == SHA do job,
|
||||
senão skip) → `flock` (serializa) → build da imagem standalone + migrator
|
||||
(BuildKit, secrets do `~/stack/teqo-1313.env`, rede `stack_default`) →
|
||||
(BuildKit, secrets do `~/stack/teqo-1313.env`, `--network host` com proxy
|
||||
socat `teqo-1313-build-proxy` na `stack_default` para o build alcançar o
|
||||
`postgres` — o proxy é criado idempotentemente pelo script) →
|
||||
push em `localhost:5000` → swap dos tags de imagem no
|
||||
`~/stack/docker-compose.yml` (backup antes) → **migrations**
|
||||
(`docker compose --profile maintenance run --rm teqo-1313-migrate`) →
|
||||
(`docker compose --profile maintenance run --rm teqo-1313-migrate </dev/null`) →
|
||||
`docker compose up -d teqo-1313` → healthcheck → smoke (`/`,
|
||||
`/campanha/login`, `/admin`, barreira 307, WebAuthn login-options,
|
||||
`api/revalidate` com o secret real).
|
||||
|
|
@ -59,14 +61,16 @@ roda após build+push ok; rollout só após migrate ok).
|
|||
|
||||
## Falhas conhecidas
|
||||
|
||||
| Sintoma | Causa | Tratamento |
|
||||
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| Job verde sem deploy ("stale run") | Push mais novo venceu; o deploy antigo saiu da fila | Nada a fazer — o run do SHA novo deploya |
|
||||
| Todo job docker quebra com `exec: "node": executable file not found in $PATH` | `runner.envs.PATH` do `~/.forgejo-runner/config.yaml` (workstation) com paths só de host (nvm/bun) — o container perde o node do toolcache (`/opt/acttoolcache`) | Corrigir o PATH no config (toolcache primeiro — ver comentário no próprio arquivo) + `systemctl --user restart forgejo-runner` (incidente 2026-08-17) |
|
||||
| Build OOM no homeserver | Laptop 8c/16GB com o stack ativo (~12GB livres medidos) | Re-dispatch; se recorrente, item futuro: build na workstation com túnel |
|
||||
| `checkout@v5` falha no job `host` | Label host do act_runner | Fallback: baixar o script direto do Forgejo (`curl -s https://git.solla.dev/fsolla/teqo/raw/branch/main/scripts/deploy-homeserver.sh`) |
|
||||
| Migrate falha | Drift/erro de schema | Job vermelho; site segue no container antigo; corrigir e re-mergear |
|
||||
| Smoke falha pós-up | Regressão de runtime | Rollback automático (restore + `up -d`) + job vermelho; investigar |
|
||||
| Sintoma | Causa | Tratamento |
|
||||
| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| Job verde sem deploy ("stale run") | Push mais novo venceu; o deploy antigo saiu da fila | Nada a fazer — o run do SHA novo deploya |
|
||||
| Todo job docker quebra com `exec: "node": executable file not found in $PATH` | `runner.envs.PATH` do `~/.forgejo-runner/config.yaml` (workstation) com paths só de host (nvm/bun) — o container perde o node do toolcache (`/opt/acttoolcache`); edição do config exige o toolcache primeiro (ver comentário no próprio config) | Corrigir o PATH no config (toolcache primeiro — ver comentário no próprio arquivo) + `systemctl --user restart forgejo-runner` (incidente 2026-08-17) |
|
||||
| Deploy para logo após o migrate ("Done." e nada mais, EXIT=0) | `docker compose run` anexa stdin por padrão — o container consome o resto do script que vai no pipe do `bash -s`; o bash chega a EOF e termina sem rodar o rollout | O script já usa `< /dev/null` no `run --rm` do migrate (não remover); sintoma visto 2026-08-17 no primeiro deploy |
|
||||
| Build falha: `network mode "stack_default" not supported by buildkit` | BuildKit (drivers docker e docker-container) recusa rede bridge custom no `--network` | O script builda com `--network host` + proxy socat `teqo-1313-build-proxy` (na `stack_default`, publicado em 127.0.0.1:5433, criado idempotentemente com `restart: unless-stopped`) + `DATABASE_URL` reescrita para o loopback |
|
||||
| Build OOM no homeserver | Laptop 8c/16GB com o stack ativo (~12GB livres medidos) | Re-dispatch; se recorrente, item futuro: build na workstation com túnel |
|
||||
| `checkout@v5` falha no job `host` | Label host do act_runner | Fallback: baixar o script direto do Forgejo (`curl -s https://git.solla.dev/fsolla/teqo/raw/branch/main/scripts/deploy-homeserver.sh`) |
|
||||
| Migrate falha | Drift/erro de schema | Job vermelho; site segue no container antigo; corrigir e re-mergear |
|
||||
| Smoke falha pós-up | Regressão de runtime | Rollback automático (restore + `up -d`) + job vermelho; investigar |
|
||||
|
||||
## Segurança (decisão deliberada)
|
||||
|
||||
|
|
|
|||
|
|
@ -84,11 +84,30 @@ echo "$REGISTRY_PASSWORD" | docker login localhost:5000 --username "$REGISTRY_US
|
|||
|
||||
# --- build --------------------------------------------------------------
|
||||
|
||||
# BuildKit rejects a custom bridge network on `--network`, so the build runs
|
||||
# with `--network host`; the prod DB (only reachable inside stack_default) is
|
||||
# proxied to the host loopback by a one-off socat container on the compose
|
||||
# network, and DATABASE_URL is rewritten to that endpoint. The proxy is
|
||||
# idempotent and survives reboots (restart: unless-stopped).
|
||||
ensure_db_proxy() {
|
||||
if ! docker inspect teqo-1313-build-proxy >/dev/null 2>&1; then
|
||||
docker run -d --name teqo-1313-build-proxy \
|
||||
--network stack_default \
|
||||
--restart unless-stopped \
|
||||
-p 127.0.0.1:5433:5433 \
|
||||
alpine/socat TCP-LISTEN:5433,fork TCP:postgres:5432 >/dev/null
|
||||
fi
|
||||
}
|
||||
|
||||
build_image() {
|
||||
local target="$1" image="$2"
|
||||
say "building $target ($image)"
|
||||
DOCKER_BUILDKIT=1 docker build \
|
||||
--network stack_default \
|
||||
ensure_db_proxy
|
||||
# The build's DATABASE_URL points at the loopback proxy; the outer env
|
||||
# keeps the original value and nothing is echoed.
|
||||
local build_db_url="${DATABASE_URL/@postgres:5432/@127.0.0.1:5433}"
|
||||
DATABASE_URL="$build_db_url" DOCKER_BUILDKIT=1 docker build \
|
||||
--network host \
|
||||
--build-arg "NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL" \
|
||||
--secret "id=database_url,env=DATABASE_URL" \
|
||||
--secret "id=payload_secret,env=PAYLOAD_SECRET" \
|
||||
|
|
@ -134,7 +153,10 @@ trap 'rollback "unexpected failure"' ERR
|
|||
|
||||
cd "$STACK_DIR"
|
||||
say "applying pending migrations (maintenance service teqo-1313-migrate)"
|
||||
docker compose --profile maintenance run --rm teqo-1313-migrate || rollback "migrations failed"
|
||||
# `< /dev/null`: `compose run` attaches stdin by default; the container would
|
||||
# consume the rest of the script piped into `bash -s` (bash then hits EOF and
|
||||
# exits right after the migrate step, skipping the rollout).
|
||||
docker compose --profile maintenance run --rm teqo-1313-migrate </dev/null || rollback "migrations failed"
|
||||
|
||||
# --- rollout ------------------------------------------------------------
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue