3f8790ffce
deployment/cloud: PocketBase (pinned, sha256-checked) as dev (/pb/, signed in; its /_/ dashboard for OIDC_ADMIN_GROUPS only) and prod (/api-prod/api/ public, dashboard never exposed), with the schema as migrations in backend/pocketbase/pb_migrations and data on the /data volume; superuser from env. admin.mjs routes /cdn/, /api-prod/, /pb/ and /admin/ behind oauth2-proxy (public: /cdn/ and /api-prod/api/ only). build-cdn.sh: flock (409 on a second build), a snapshot of the pulled commit, the public exclusions applied BEFORE the build, a heap-capped build, a check of the output that REFUSES the swap if anything excluded remains (proved with planted fixtures: a field-access file, 'Visa Requirements' content, and key-cities one level down each fail; clean passes), then an atomic swap; runtime-config.js carries the public API URL. public-exclusions.txt is the ONE list the giveaway export and the CDN build share. Any git host via REPO_URL/BRANCH/GIT_TOKEN.
29 lines
1.7 KiB
Bash
Executable file
29 lines
1.7 KiB
Bash
Executable file
#!/bin/bash
|
|
# build-cdn.sh — one production build of the pulled commit into /data/cdn, one at a time.
|
|
# snapshot (so the pull loop can't change files mid-build) -> apply the public exclusions ->
|
|
# BUILD_ALLOW=1 bun run build (memory-capped) -> check the output -> atomic swap of /data/cdn/current.
|
|
# Exit 75 = another build holds the lock.
|
|
set -u
|
|
exec 9>/tmp/build-cdn.lock
|
|
flock -n 9 || { echo "another build is running"; exit 75; }
|
|
cd /app/repo
|
|
SHA=$(git rev-parse --short HEAD); SNAP=/tmp/build-$SHA
|
|
rm -rf "$SNAP"; mkdir -p "$SNAP"
|
|
git archive HEAD | tar -x -C "$SNAP" || { echo "snapshot failed"; exit 1; }
|
|
bash /app/repo/deployment/cloud/apply-exclusions.sh "$SNAP"
|
|
ln -s /app/repo/node_modules "$SNAP/node_modules"
|
|
cd "$SNAP"
|
|
echo "$(date -u +%FT%TZ) building $SHA"
|
|
NODE_OPTIONS="--max-old-space-size=${BUILD_MAX_OLD_SPACE_MB:-1536}" BUILD_ALLOW=1 nice -n 10 bun run build \
|
|
|| { echo "build failed"; rm -rf "$SNAP"; exit 1; }
|
|
OUT="$SNAP/public/dx-maps"
|
|
[ -f "$OUT/manifest.json" ] || { echo "no manifest.json in the output"; rm -rf "$SNAP"; exit 1; }
|
|
printf 'window.MAP_API_BASE=%s;\n' "$(printf '%s' "${PUBLIC_API_BASE:-}" | python3 -c 'import json,sys;print(json.dumps(sys.stdin.read()))')" > "$OUT/runtime-config.js"
|
|
NEW=/data/cdn/build-$SHA
|
|
rm -rf "$NEW"; mkdir -p /data/cdn; mv "$SNAP/public" "$NEW"
|
|
bash /app/repo/deployment/cloud/apply-exclusions.sh --check "$NEW" || { echo "REFUSED: excluded content in the build; not published"; rm -rf "$NEW" "$SNAP"; exit 1; }
|
|
ln -sfn "$NEW" /data/cdn/current.tmp && mv -T /data/cdn/current.tmp /data/cdn/current
|
|
echo "$SHA" > /data/cdn/COMMIT
|
|
find /data/cdn -maxdepth 1 -name 'build-*' ! -path "$NEW" -exec rm -rf {} +
|
|
rm -rf "$SNAP"
|
|
echo "$(date -u +%FT%TZ) published $SHA at /cdn/dx-maps/"
|