up

venue/deploy.sh

@@ -2,12 +2,43 @@
 set -euo pipefail
 
 cd -- "$(dirname -- "${BASH_SOURCE[0]}")"
+if [[ $# -ne 0 ]]; then
+    echo 'Используйте make venue' >&2
+    exit 1
+fi
+compose=(docker compose -f docker-compose.yml -f docker-compose.https.yml)
+
+command -v openssl >/dev/null
+certificate=certificates/fullchain.pem
+key=certificates/privkey.pem
+if [[ ! -s "$certificate" || ! -s "$key" ]]; then
+    echo 'HTTPS: нужны venue/certificates/fullchain.pem и privkey.pem.' >&2
+    exit 1
+fi
+if ! openssl x509 -in "$certificate" -checkend 0 -noout >/dev/null 2>&1; then
+    echo 'HTTPS: сертификат повреждён или истёк.' >&2
+    exit 1
+fi
+if ! certificate_public=$(openssl x509 -in "$certificate" -pubkey -noout 2>/dev/null) ||
+   ! key_public=$(openssl pkey -in "$key" -pubout -passin pass: 2>/dev/null) ||
+   [[ "$certificate_public" != "$key_public" ]]; then
+    echo 'HTTPS: ключ повреждён, зашифрован или не соответствует сертификату.' >&2
+    exit 1
+fi
+for domain in evening-detective.crabs-games.art evening-detective-api.crabs-games.art; do
+    if ! openssl verify -purpose sslserver -verify_hostname "$domain" \
+        -untrusted "$certificate" "$certificate" >/dev/null 2>&1; then
+        echo "HTTPS: сертификат не доверен, недействителен или не покрывает $domain." >&2
+        exit 1
+    fi
+done
+
 if [[ ! -f .env ]]; then
     command -v openssl >/dev/null
     (
         umask 077
         cat > .env <<EOF
-APP_BASE_URL=http://localhost:8088
+APP_BASE_URL=https://evening-detective.crabs-games.art
 VENUE_BIND_IP=127.0.0.1
 VENUE_PORT=8088
 POSTGRES_USER=evening_detective
@@ -26,36 +57,32 @@ EOF
     )
 fi
 
-prepare=false
-case "${1:-}" in
-    --build) prepare=true ;;
-    '') ;;
-    *) echo 'Используйте make venue или make venue-update' >&2; exit 1 ;;
-esac
-for image in evening-detective-venue-app:1 postgres:15 rustfs/rustfs:latest byjg/static-httpserver:latest nginx:alpine; do
-    if ! docker image inspect "$image" >/dev/null 2>&1; then prepare=true; fi
-done
 for artifact in backend/evening_detective_server backend/goose backend/dev-user.sql frontend/dist/index.html; do
-    if [[ ! -f "$artifact" ]]; then prepare=true; fi
+    if [[ ! -f "$artifact" ]]; then
+        echo "Нет venue/$artifact. Сначала выполните make prod-build." >&2
+        exit 1
+    fi
 done
-if [[ ! -d migrations ]]; then prepare=true; fi
-if [[ "$prepare" == true ]]; then
-    echo 'Подготовка площадки: потребуется интернет.'
-    if ! docker image inspect my-go-builder >/dev/null 2>&1; then
-        make -C ../evening_detective_server build-builder
-    fi
-    if [[ ! -d ../evening_detective_frontend/node_modules ]]; then
-        npm --prefix ../evening_detective_frontend ci
-    fi
-    make -C .. build
-    docker compose pull postgres_evening_detective_server rustfs_evening_detective_server evening_detective_frontend proxy
-    docker pull alpine:3.22
-    docker compose build --pull=false
+if [[ ! -d migrations ]] || ! compgen -G 'migrations/*.sql' >/dev/null; then
+    echo 'Нет миграций venue. Сначала выполните make prod-build.' >&2
+    exit 1
 fi
+
+for service_image in postgres_evening_detective_server=postgres:15 rustfs_evening_detective_server=rustfs/rustfs:latest evening_detective_frontend=byjg/static-httpserver:latest proxy=nginx:alpine; do
+    if ! docker image inspect "${service_image#*=}" >/dev/null 2>&1; then
+        "${compose[@]}" pull "${service_image%%=*}"
+    fi
+done
+if ! docker image inspect alpine:3.22 >/dev/null 2>&1; then
+    docker pull alpine:3.22
+fi
+"${compose[@]}" build --pull=false
 for volume in evening-detective-local_postgres_data evening-detective-local_rustfs_data; do
     docker volume create "$volume" >/dev/null
 done
-docker compose up -d --no-build --pull never
-docker compose --profile setup run --rm bootstrap
-docker compose ps
-echo 'Площадка запущена. Адрес и данные входа находятся в venue/.env.'
+"${compose[@]}" up -d --force-recreate --no-build --pull never
+"${compose[@]}" --profile setup run --rm bootstrap
+"${compose[@]}" exec -T proxy nginx -t
+"${compose[@]}" exec -T proxy nginx -s reload
+echo 'Площадка: https://evening-detective.crabs-games.art; данные входа — venue/.env.'
+"${compose[@]}" ps