fix: all 3 containers on internal network, NO host networking
This commit is contained in:
parent
11bcd78a13
commit
8d2ffb503a
1 changed files with 22 additions and 48 deletions
70
deploy.sh
70
deploy.sh
|
|
@ -6,7 +6,6 @@ REPO_DIR="/opt/NextWks"
|
|||
TARGET_DIR="/opt/nextworkspace"
|
||||
BACKUP_DIR="/opt/backup"
|
||||
NETWORK_NAME="nextwks-net"
|
||||
BINARY_NAME="nextworkspace"
|
||||
HEALTH_CHECK_RETRIES=10
|
||||
HEALTH_CHECK_INTERVAL=2
|
||||
|
||||
|
|
@ -26,34 +25,29 @@ else echo "[MODE] Smart update (target exists)"; fi
|
|||
|
||||
# --- Pull + build ---
|
||||
cd "$REPO_DIR"
|
||||
echo "[1/6] Pulling latest code..."
|
||||
echo "[1/5] Pulling latest code..."
|
||||
git pull 2>/dev/null || true
|
||||
|
||||
echo "[2/6] Building binary (static)..."
|
||||
echo "[2/5] Building binary (static)..."
|
||||
export PATH=$PATH:/usr/local/go/bin
|
||||
CGO_ENABLED=0 go build -o nextworkspace .
|
||||
|
||||
# --- Greenfield ---
|
||||
if [ "$GREENFIELD" = true ]; then
|
||||
echo "[3/6] Full teardown..."
|
||||
# Stop systemd service if still running
|
||||
echo "[3/5] Full teardown..."
|
||||
systemctl stop nextworkspace 2>/dev/null || true
|
||||
systemctl disable nextworkspace 2>/dev/null || true
|
||||
rm -f /etc/systemd/system/nextworkspace.service
|
||||
systemctl daemon-reload
|
||||
# Remove containers (both root and master user)
|
||||
podman rm -f caddy authelia launcher 2>/dev/null || true
|
||||
sudo -u master podman rm -f caddy authelia launcher 2>/dev/null || true
|
||||
# Remove old network
|
||||
podman network rm nextwks-net 2>/dev/null || true
|
||||
sudo -u master podman network rm nextwks-net 2>/dev/null || true
|
||||
podman network rm "$NETWORK_NAME" 2>/dev/null || true
|
||||
|
||||
if [ -d "$TARGET_DIR" ]; then
|
||||
chattr -R -i "$TARGET_DIR" 2>/dev/null || true
|
||||
rm -rf "$TARGET_DIR"
|
||||
fi
|
||||
|
||||
echo "[4/6] Building directories..."
|
||||
echo "[4/5] Building directories..."
|
||||
mkdir -p "$TARGET_DIR/config/caddy"
|
||||
mkdir -p "$TARGET_DIR/config/authelia"
|
||||
mkdir -p "$TARGET_DIR/data/caddy"
|
||||
|
|
@ -61,11 +55,10 @@ if [ "$GREENFIELD" = true ]; then
|
|||
mkdir -p "$TARGET_DIR/compose"
|
||||
mkdir -p "$TARGET_DIR/www"
|
||||
mkdir -p "$TARGET_DIR/config/nextworkspace"
|
||||
mkdir -p "$TARGET_DIR/logs/caddy"
|
||||
mkdir -p "$TARGET_DIR/logs"
|
||||
chown -R master:master "$TARGET_DIR/data/caddy" 2>/dev/null || true
|
||||
chown -R master:master "$TARGET_DIR/logs/caddy" 2>/dev/null || true
|
||||
chown -R master:master "$TARGET_DIR/logs" 2>/dev/null || true
|
||||
|
||||
# Copy .env from backup
|
||||
if [ -f "$BACKUP_DIR/.env" ]; then
|
||||
cp "$BACKUP_DIR/.env" "$TARGET_DIR/.env"
|
||||
chmod 600 "$TARGET_DIR/.env"
|
||||
|
|
@ -75,66 +68,48 @@ if [ "$GREENFIELD" = true ]; then
|
|||
sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
|
||||
"$SCRIPT_DIR/config/caddy/Caddyfile" > "$TARGET_DIR/config/caddy/Caddyfile"
|
||||
|
||||
# Generate Authelia config (minimal — deploy.sh fills secrets)
|
||||
# Generate Authelia config
|
||||
JWT_SECRET="${JWT_SECRET:-$(openssl rand -hex 32)}"
|
||||
SESSION_SECRET="${SESSION_SECRET:-$(openssl rand -hex 32)}"
|
||||
sed -e "s|{DOMAIN}|$DOMAIN|g" \
|
||||
-e "s|{JWT_SECRET}|$JWT_SECRET|g" \
|
||||
sed -e "s|{DOMAIN}|$DOMAIN|g" -e "s|{JWT_SECRET}|$JWT_SECRET|g" \
|
||||
-e "s|{SESSION_SECRET}|$SESSION_SECRET|g" \
|
||||
-e "s|{SMTP_HOST}|${SMTP_HOST:-smtp.openxchange.eu}|g" \
|
||||
-e "s|{SMTP_PORT}|${SMTP_PORT:-587}|g" \
|
||||
-e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" \
|
||||
-e "s|{SMTP_PASS}|$SMTP_PASS|g" \
|
||||
-e "s|{SMTP_USER}|${SMTP_USER:-post@nextwks.eu}|g" -e "s|{SMTP_PASS}|$SMTP_PASS|g" \
|
||||
"$SCRIPT_DIR/config/authelia/configuration.yml" > "$TARGET_DIR/config/authelia/configuration.yml"
|
||||
|
||||
# Generate users database
|
||||
ADMIN_PASSWORD_HASH="${ADMIN_PASSWORD_HASH:-}"
|
||||
if [ -z "$ADMIN_PASSWORD_HASH" ] && [ -n "${ADMIN_PASSWORD:-}" ] && [ -f "$SCRIPT_DIR/tools/hash-password/main.go" ]; then
|
||||
ADMIN_PASSWORD_HASH=$(cd "$SCRIPT_DIR" && go run ./tools/hash-password/ "$ADMIN_PASSWORD" 2>/dev/null || echo "")
|
||||
fi
|
||||
sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" \
|
||||
-e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
|
||||
sed -e "s|{ADMIN_PASSWORD_HASH}|$ADMIN_PASSWORD_HASH|g" -e "s|{TLS_EMAIL}|${TLS_EMAIL:-admin@$DOMAIN}|g" \
|
||||
"$SCRIPT_DIR/config/authelia/users_database.yml" > "$TARGET_DIR/config/authelia/users_database.yml"
|
||||
|
||||
# Copy compose files + binary
|
||||
# Copy files
|
||||
cp "$SCRIPT_DIR/compose/caddy.yaml" "$TARGET_DIR/compose/caddy.yaml"
|
||||
cp "$SCRIPT_DIR/compose/authelia.yaml" "$TARGET_DIR/compose/authelia.yaml"
|
||||
cp "$SCRIPT_DIR/compose/launcher.yaml" "$TARGET_DIR/compose/launcher.yaml"
|
||||
cp "$BINARY_NAME" "$TARGET_DIR/$BINARY_NAME"
|
||||
if [ -f "$REPO_DIR/VERSION" ]; then
|
||||
cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"
|
||||
fi
|
||||
|
||||
# Copy landing page
|
||||
if [ -d "$SCRIPT_DIR/config/www" ]; then
|
||||
cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"
|
||||
fi
|
||||
|
||||
# Copy launcher config
|
||||
cp nextworkspace "$TARGET_DIR/nextworkspace"
|
||||
if [ -f "$REPO_DIR/VERSION" ]; then cp "$REPO_DIR/VERSION" "$TARGET_DIR/VERSION"; fi
|
||||
if [ -d "$SCRIPT_DIR/config/www" ]; then cp -r "$SCRIPT_DIR/config/www"/* "$TARGET_DIR/www/"; fi
|
||||
cp -r "$SCRIPT_DIR/config/nextworkspace"/* "$TARGET_DIR/config/nextworkspace/" 2>/dev/null || true
|
||||
|
||||
# Create podman network (no subnet — auto-assign)
|
||||
echo "[5/6] Creating podman network..."
|
||||
podman network create "$NETWORK_NAME" 2>&1 || echo "[WARN] Network create failed (may already exist)"
|
||||
|
||||
# Deploy all containers
|
||||
echo "[6/6] Deploying containers..."
|
||||
# Podman network + deploy all 3 containers
|
||||
echo "[5/5] Deploying containers on $NETWORK_NAME..."
|
||||
podman network create "$NETWORK_NAME" 2>/dev/null || true
|
||||
podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || echo "[WARN] Launcher deploy had issues"
|
||||
podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || echo "[WARN] Authelia deploy had issues"
|
||||
podman-compose -f "$TARGET_DIR/compose/caddy.yaml" up -d 2>&1 || echo "[WARN] Caddy deploy had issues"
|
||||
|
||||
# Extract Authelia secret
|
||||
sleep 3
|
||||
AUTHELIA_SECRET=$(grep -oP 'session_secret: \K.*' "$TARGET_DIR/config/authelia/configuration.yml" 2>/dev/null || echo "")
|
||||
if [ -n "$AUTHELIA_SECRET" ]; then
|
||||
if ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
|
||||
echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
|
||||
fi
|
||||
if [ -n "$AUTHELIA_SECRET" ] && ! grep -q "AUTHELIA_SECRET" "$BACKUP_DIR/.env" 2>/dev/null; then
|
||||
echo "AUTHELIA_SECRET=$AUTHELIA_SECRET" >> "$BACKUP_DIR/.env"
|
||||
fi
|
||||
|
||||
# --- Smart update ---
|
||||
else
|
||||
echo "[3/6] Redeploying containers..."
|
||||
echo "[3/5] Redeploying containers..."
|
||||
podman-compose -f "$TARGET_DIR/compose/launcher.yaml" up -d 2>&1 || true
|
||||
podman-compose -f "$TARGET_DIR/compose/authelia.yaml" up -d 2>&1 || true
|
||||
podman-compose -f "$TARGET_DIR/compose/caddy.yaml" restart 2>&1 || true
|
||||
|
|
@ -143,8 +118,7 @@ fi
|
|||
# --- Health check ---
|
||||
echo "[*] Running health check..."
|
||||
for i in $(seq 1 $HEALTH_CHECK_RETRIES); do
|
||||
HEALTH=$(podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || \
|
||||
sudo -u master podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || echo "")
|
||||
HEALTH=$(podman exec launcher wget -qO- http://127.0.0.1:9000/health 2>/dev/null || echo "")
|
||||
if [ "$HEALTH" = "OK" ]; then
|
||||
echo "[OK] NextWorkspace launcher is healthy"
|
||||
exit 0
|
||||
|
|
|
|||
Loading…
Reference in a new issue