105 lines
2.6 KiB
Bash
Executable File
105 lines
2.6 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
umask 077
|
|
|
|
ROOT=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
env_file=${1:-"$ROOT/.env"}
|
|
|
|
case "$env_file" in
|
|
/*) ;;
|
|
*) env_file="$ROOT/$env_file" ;;
|
|
esac
|
|
|
|
if [ ! -f "$env_file" ]; then
|
|
echo "Deployment environment does not exist: $env_file" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ "$(stat -c '%a' "$env_file")" != 600 ]; then
|
|
echo "Deployment environment must have mode 0600: $env_file" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ -n "$(git -C "$ROOT" status --porcelain --untracked-files=no)" ]; then
|
|
echo "Refusing to select a deployment revision from a dirty tracked checkout." >&2
|
|
exit 1
|
|
fi
|
|
|
|
read_env_value() {
|
|
key=$1
|
|
|
|
awk -v key="$key" '
|
|
index($0, key "=") == 1 {
|
|
print substr($0, length(key) + 2)
|
|
found = 1
|
|
exit
|
|
}
|
|
END { if (!found) exit 1 }
|
|
' "$env_file"
|
|
}
|
|
|
|
require_single_key() {
|
|
key=$1
|
|
count=$(awk -v key="$key" 'index($0, key "=") == 1 { count++ } END { print count + 0 }' "$env_file")
|
|
|
|
if [ "$count" -ne 1 ]; then
|
|
echo "$key must occur exactly once in $env_file." >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
deployment_env=$(read_env_value DEPLOYMENT_ENV)
|
|
domain=$(read_env_value PHX_HOST)
|
|
git_sha=$(git -C "$ROOT" rev-parse --short=12 HEAD)
|
|
|
|
case "$deployment_env" in
|
|
test)
|
|
required_keys='APP_IMAGE SOCKET_PROXY_IMAGE POSTGIS_IMAGE'
|
|
;;
|
|
production)
|
|
required_keys='APP_IMAGE SOCKET_PROXY_IMAGE POSTGIS_IMAGE CADDY_IMAGE'
|
|
;;
|
|
*)
|
|
echo "DEPLOYMENT_ENV must be test or production." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
for key in $required_keys; do
|
|
require_single_key "$key"
|
|
done
|
|
|
|
target_dir=$(dirname -- "$env_file")
|
|
tmp=$(mktemp "$target_dir/.deployment-revision.XXXXXX")
|
|
trap 'rm -f "$tmp"' EXIT HUP INT TERM
|
|
chmod 600 "$tmp"
|
|
|
|
DEPLOYMENT_ENV_VALUE=$deployment_env GIT_SHA_VALUE=$git_sha awk '
|
|
BEGIN {
|
|
prefix = ENVIRON["DEPLOYMENT_ENV_VALUE"]
|
|
sha = ENVIRON["GIT_SHA_VALUE"]
|
|
replacement["APP_IMAGE"] = "who-need-help:" prefix "-" sha
|
|
replacement["SOCKET_PROXY_IMAGE"] = "who-need-help:socket-proxy-" prefix "-" sha
|
|
replacement["POSTGIS_IMAGE"] = "who-need-help:postgis-" prefix "-" sha
|
|
if (prefix == "production") {
|
|
replacement["CADDY_IMAGE"] = "who-need-help:caddy-production-" sha
|
|
}
|
|
}
|
|
{
|
|
separator = index($0, "=")
|
|
key = separator > 1 ? substr($0, 1, separator - 1) : ""
|
|
print (key in replacement) ? key "=" replacement[key] : $0
|
|
}
|
|
' "$env_file" >"$tmp"
|
|
|
|
mv "$tmp" "$env_file"
|
|
chmod 600 "$env_file"
|
|
trap - EXIT HUP INT TERM
|
|
|
|
case "$deployment_env" in
|
|
test) "$ROOT/scripts/validate-test-env.sh" "$env_file" "$domain" ;;
|
|
production) "$ROOT/scripts/validate-production-env.sh" "$env_file" "$domain" ;;
|
|
esac
|
|
|
|
echo "Selected $deployment_env deployment revision $git_sha without rotating secrets."
|