582 lines
25 KiB
Python
582 lines
25 KiB
Python
|
#!/usr/bin/env python3
|
||
|
|
"""
|
||
|
|
Deploy automation: update a running stack to a newly published image.
|
||
|
|
|
||
|
|
Builds a Docker image from the project directory, tags it with an incremented
|
||
|
|
version and `latest`, pushes it to the Forgejo Docker registry, then updates the
|
||
|
|
configured Portainer stack to that image and verifies the container is running
|
||
|
|
and healthy.
|
||
|
|
|
||
|
|
## This is the only copy
|
||
|
|
|
||
|
|
It used to exist twice — here and in the `privacyllc-deploy` skill — and the two
|
||
|
|
drifted apart until neither was a subset of the other (#209). The skill copy had
|
||
|
|
the credential resolution and the two safety refusals below; this one had the
|
||
|
|
environment-driven configuration. A defect fixed in one stayed live in the
|
||
|
|
other, behind a closed issue, because nothing said which was authoritative.
|
||
|
|
|
||
|
|
The skill's copy is now a symlink to this file. Anything project-specific must
|
||
|
|
therefore arrive through the environment, never as a literal: a script copied
|
||
|
|
from another project must not silently point a deploy at that project's stack —
|
||
|
|
or, just as quietly, bake that project's canonical origin into somebody else's
|
||
|
|
image.
|
||
|
|
|
||
|
|
Credentials:
|
||
|
|
- Forgejo registry token: ~/.openclaw/docker-registry.env
|
||
|
|
- Portainer API key: PORTAINER_API_KEY, or the credential file the operator
|
||
|
|
keeps Portainer keys in — which is the file named after Portainer, not the
|
||
|
|
one named after whichever project you are deploying. Looking in the wrong
|
||
|
|
one is what made every deploy on the source project manual for weeks (#137):
|
||
|
|
the key was on the machine the whole time, and the error said it was
|
||
|
|
missing.
|
||
|
|
|
||
|
|
Usage:
|
||
|
|
export PORTAINER_API_URL="https://192.168.1.11:9443/api"
|
||
|
|
python3 deploy.py [--project-dir PATH] [--portainer-stack-id ID]
|
||
|
|
[--dry-run] [--build-only] [--skip-push] [--skip-portainer]
|
||
|
|
"""
|
||
|
|
|
||
|
|
import argparse
|
||
|
|
import json
|
||
|
|
import os
|
||
|
|
import re
|
||
|
|
import subprocess
|
||
|
|
import sys
|
||
|
|
import traceback
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
import urllib3
|
||
|
|
|
||
|
|
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||
|
|
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
# Everything about a particular deployment lives here, and nowhere else.
|
||
|
|
#
|
||
|
|
# Set these before the first run. They are read from the environment so a
|
||
|
|
# checkout carries no deployment's identity — the same reason `release.sh` takes
|
||
|
|
# its image from RELEASE_IMAGE rather than hard-coding one: a script copied from
|
||
|
|
# another project must not silently point a deploy at that project's stack.
|
||
|
|
#
|
||
|
|
# DEPLOY_PROJECT_DIR the repository to build from
|
||
|
|
# DEPLOY_IMAGE fully-qualified image name, no tag
|
||
|
|
# DEPLOY_STACK_ID the Portainer stack that runs it
|
||
|
|
# DEPLOY_CONTAINER the container name, for the post-deploy check
|
||
|
|
# DEPLOY_SITE_URL public origin, baked into the image at build time
|
||
|
|
# DEPLOY_LABEL what to call this thing in output (cosmetic)
|
||
|
|
# PORTAINER_API_URL e.g. https://portainer.example.com:9443/api
|
||
|
|
# ---------------------------------------------------------------------------
|
||
|
|
PROJECT_DIR_DEFAULT = os.environ.get("DEPLOY_PROJECT_DIR", os.getcwd())
|
||
|
|
FORGEJO_IMAGE = os.environ.get("DEPLOY_IMAGE", "")
|
||
|
|
FORGEJO_REGISTRY = FORGEJO_IMAGE.split("/")[0] if FORGEJO_IMAGE else ""
|
||
|
|
PORTAINER_STACK_ID_DEFAULT = int(os.environ.get("DEPLOY_STACK_ID", "0") or 0)
|
||
|
|
CONTAINER_NAME = os.environ.get("DEPLOY_CONTAINER", "")
|
||
|
|
|
||
|
|
# The canonical origin is frozen into the image at build time — every canonical
|
||
|
|
# URL, the sitemap and robots.txt — and cannot be corrected without another
|
||
|
|
# build. Both copies of this script hard-coded one project's origin, so
|
||
|
|
# deploying any other project from it would have baked the wrong one in and
|
||
|
|
# nothing would have failed. Required, rather than defaulted, for that reason.
|
||
|
|
SITE_URL = os.environ.get("DEPLOY_SITE_URL", "")
|
||
|
|
|
||
|
|
# Cosmetic only: what the [DONE] line calls this. Nothing branches on it.
|
||
|
|
DEPLOY_LABEL = os.environ.get("DEPLOY_LABEL", "site")
|
||
|
|
|
||
|
|
|
||
|
|
def load_env_file(path: Path) -> dict:
|
||
|
|
"""Read KEY=VALUE lines, ignoring blank lines and comments."""
|
||
|
|
values = {}
|
||
|
|
if not path.exists():
|
||
|
|
return values
|
||
|
|
for line in path.read_text().splitlines():
|
||
|
|
line = line.strip()
|
||
|
|
if not line or line.startswith("#"):
|
||
|
|
continue
|
||
|
|
if "=" in line:
|
||
|
|
key, value = line.split("=", 1)
|
||
|
|
values[key.strip()] = value.strip()
|
||
|
|
return values
|
||
|
|
|
||
|
|
|
||
|
|
def load_privacyllc_credentials() -> dict:
|
||
|
|
"""Load the privacyllc credential file (KEY=VALUE format)."""
|
||
|
|
path = Path.home() / ".openclaw" / "credentials" / "privacyllc.md"
|
||
|
|
return load_env_file(path)
|
||
|
|
|
||
|
|
|
||
|
|
def load_registry_credentials() -> dict:
|
||
|
|
"""Load the docker registry credential file."""
|
||
|
|
path = Path.home() / ".openclaw" / "docker-registry.env"
|
||
|
|
return load_env_file(path)
|
||
|
|
|
||
|
|
|
||
|
|
def get_git_version(project_dir: Path) -> str:
|
||
|
|
"""Derive the next release version from the latest release commit message.
|
||
|
|
|
||
|
|
Release commits are of the form `chore(release): vX.Y.Z`. Returns the next
|
||
|
|
patch increment (vX.Y.Z+1).
|
||
|
|
"""
|
||
|
|
result = subprocess.run(
|
||
|
|
["git", "log", "--oneline", "--grep=chore(release): v", "-1"],
|
||
|
|
cwd=project_dir,
|
||
|
|
capture_output=True,
|
||
|
|
text=True,
|
||
|
|
check=True,
|
||
|
|
)
|
||
|
|
line = result.stdout.strip()
|
||
|
|
if not line:
|
||
|
|
raise RuntimeError("No release commit found; cannot auto-increment version")
|
||
|
|
match = re.search(r"v(\d+)\.(\d+)\.(\d+)", line)
|
||
|
|
if not match:
|
||
|
|
raise RuntimeError(f"Could not parse version from commit: {line}")
|
||
|
|
major, minor, patch = map(int, match.groups())
|
||
|
|
return f"v{major}.{minor}.{patch + 1}"
|
||
|
|
|
||
|
|
|
||
|
|
def run(cmd: list[str], cwd: Path | None = None, env: dict | None = None) -> subprocess.CompletedProcess:
|
||
|
|
"""Run a shell command and return the result."""
|
||
|
|
merged_env = os.environ.copy()
|
||
|
|
if env:
|
||
|
|
merged_env.update(env)
|
||
|
|
print(f"[RUN] {' '.join(cmd)}")
|
||
|
|
return subprocess.run(cmd, cwd=cwd, env=merged_env, text=True, capture_output=True)
|
||
|
|
|
||
|
|
|
||
|
|
def build_image(project_dir: Path, version: str, dry_run: bool) -> None:
|
||
|
|
"""Build the Docker image with the incremented version tag."""
|
||
|
|
full_tag = f"{FORGEJO_IMAGE}:{version}"
|
||
|
|
latest_tag = f"{FORGEJO_IMAGE}:latest"
|
||
|
|
|
||
|
|
if dry_run:
|
||
|
|
# Checked here too, so --dry-run reports a missing origin instead of
|
||
|
|
# printing a confident "would build" for an image that would be wrong.
|
||
|
|
_require_site_url()
|
||
|
|
print(f"[DRY-RUN] would build image {full_tag} and {latest_tag}")
|
||
|
|
return
|
||
|
|
|
||
|
|
_require_site_url()
|
||
|
|
|
||
|
|
# Clean build to avoid stale Next.js output layers.
|
||
|
|
print("[BUILD] Cleaning previous build artifacts...")
|
||
|
|
run(["rm", "-rf", ".next"], cwd=project_dir)
|
||
|
|
|
||
|
|
print(f"[BUILD] Building {full_tag}...")
|
||
|
|
build_result = run(
|
||
|
|
[
|
||
|
|
"docker",
|
||
|
|
"build",
|
||
|
|
"--no-cache",
|
||
|
|
"--build-arg",
|
||
|
|
f"NEXT_PUBLIC_SITE_URL={SITE_URL}",
|
||
|
|
# The Dockerfile declares ARG APP_VERSION and bakes it into
|
||
|
|
# ENV APP_VERSION and org.opencontainers.image.version. Omitting it
|
||
|
|
# here built images with an EMPTY version label, which is not
|
||
|
|
# cosmetic: buildVersion() then returns null so the admin screen
|
||
|
|
# reports no running build, and release.sh's deployed_version()
|
||
|
|
# reads that same label to decide which published tag a prune may
|
||
|
|
# not delete — an empty label makes prune fail-safe but blind.
|
||
|
|
#
|
||
|
|
# A published tag is immutable here (release.sh refuses to move
|
||
|
|
# one), so an image pushed without the label could never be
|
||
|
|
# corrected, only abandoned at the cost of a burned version number.
|
||
|
|
#
|
||
|
|
# release.sh has always passed this and additionally verifies the
|
||
|
|
# baked value with printenv before it will push. This is the same
|
||
|
|
# build arg; the verification is not duplicated because this script
|
||
|
|
# deploys an existing version rather than cutting one.
|
||
|
|
"--build-arg",
|
||
|
|
f"APP_VERSION={version}",
|
||
|
|
"-t",
|
||
|
|
full_tag,
|
||
|
|
"-t",
|
||
|
|
latest_tag,
|
||
|
|
".",
|
||
|
|
],
|
||
|
|
cwd=project_dir,
|
||
|
|
)
|
||
|
|
if build_result.returncode != 0:
|
||
|
|
print(build_result.stderr)
|
||
|
|
raise RuntimeError("Docker build failed")
|
||
|
|
print(build_result.stdout)
|
||
|
|
|
||
|
|
|
||
|
|
def push_image(version: str, dry_run: bool, skip: bool) -> None:
|
||
|
|
"""Push the version and latest tags to the Forgejo registry."""
|
||
|
|
if skip:
|
||
|
|
print("[SKIP] image push disabled by --skip-push")
|
||
|
|
return
|
||
|
|
|
||
|
|
full_tag = f"{FORGEJO_IMAGE}:{version}"
|
||
|
|
latest_tag = f"{FORGEJO_IMAGE}:latest"
|
||
|
|
|
||
|
|
if dry_run:
|
||
|
|
print(f"[DRY-RUN] would push {full_tag} and {latest_tag}")
|
||
|
|
return
|
||
|
|
|
||
|
|
creds = load_registry_credentials()
|
||
|
|
registry = creds.get("FORGEJO_REGISTRY", FORGEJO_REGISTRY)
|
||
|
|
user = creds.get("FORGEJO_REGISTRY_USER", "null")
|
||
|
|
token = creds.get("FORGEJO_REGISTRY_TOKEN")
|
||
|
|
if not token:
|
||
|
|
raise RuntimeError("FORGEJO_REGISTRY_TOKEN not found in ~/.openclaw/docker-registry.env")
|
||
|
|
|
||
|
|
print("[PUSH] Logging in to Forgejo registry...")
|
||
|
|
login = run(
|
||
|
|
["docker", "login", registry, "-u", user, "--password-stdin"],
|
||
|
|
env={"DOCKER_CONFIG": os.environ.get("DOCKER_CONFIG", "")},
|
||
|
|
)
|
||
|
|
if login.returncode != 0:
|
||
|
|
# docker login --password-stdin reads from stdin; pass token via input
|
||
|
|
login = subprocess.run(
|
||
|
|
["docker", "login", registry, "-u", user, "--password-stdin"],
|
||
|
|
input=token,
|
||
|
|
text=True,
|
||
|
|
capture_output=True,
|
||
|
|
)
|
||
|
|
if login.returncode != 0:
|
||
|
|
print(login.stderr)
|
||
|
|
raise RuntimeError("Docker login failed")
|
||
|
|
|
||
|
|
for tag in (full_tag, latest_tag):
|
||
|
|
print(f"[PUSH] Pushing {tag}...")
|
||
|
|
push = run(["docker", "push", tag])
|
||
|
|
if push.returncode != 0:
|
||
|
|
print(push.stderr)
|
||
|
|
raise RuntimeError(f"Docker push failed for {tag}")
|
||
|
|
print(push.stdout)
|
||
|
|
|
||
|
|
print("[PUSH] Logging out from Forgejo registry...")
|
||
|
|
run(["docker", "logout", registry])
|
||
|
|
|
||
|
|
|
||
|
|
def load_portainer_key(host: str = "nebula") -> str | None:
|
||
|
|
"""Read one host's Portainer API key out of the credential file.
|
||
|
|
|
||
|
|
The key lives here, not in privacyllc.md. Looking only in the latter is
|
||
|
|
what made every deploy manual for weeks: the credential was on the machine
|
||
|
|
the whole time, in the file named after the service it belongs to, while
|
||
|
|
the error said it was "not available".
|
||
|
|
|
||
|
|
Parsed rather than run through `load_env_file`, for two reasons. The file
|
||
|
|
is prose with markdown headings, not KEY=VALUE. And it documents the
|
||
|
|
variable by example — a literal `PORTAINER_API_KEY=<the-key>` line — which
|
||
|
|
a KEY=VALUE reader would happily return as the string "<the-key>", giving a
|
||
|
|
401 that looks like a revoked key rather than a parse mistake.
|
||
|
|
|
||
|
|
It also holds more than one host. Sections are `### Portainer (nebula)` and
|
||
|
|
`### Portainer (exodus)`; this takes the key under the one asked for, so a
|
||
|
|
deploy cannot authenticate against the wrong machine.
|
||
|
|
"""
|
||
|
|
path = Path.home() / ".openclaw" / "credentials" / "portainer.md"
|
||
|
|
if not path.exists():
|
||
|
|
return None
|
||
|
|
|
||
|
|
section = None
|
||
|
|
for line in path.read_text(encoding="utf-8").splitlines():
|
||
|
|
heading = re.match(r"^#{1,6}\s*Portainer\s*\(([^)]+)\)", line.strip())
|
||
|
|
if heading:
|
||
|
|
section = heading.group(1).strip().lower()
|
||
|
|
continue
|
||
|
|
if section != host.lower():
|
||
|
|
continue
|
||
|
|
found = re.search(r"`(ptr_[A-Za-z0-9+/=_-]+)`", line)
|
||
|
|
if found:
|
||
|
|
return found.group(1)
|
||
|
|
|
||
|
|
return None
|
||
|
|
|
||
|
|
|
||
|
|
def portainer_headers() -> dict:
|
||
|
|
"""Return request headers with the Portainer API key.
|
||
|
|
|
||
|
|
Four places, in the order somebody would expect them to win: an explicit
|
||
|
|
environment variable, then either credential file. Both env spellings are
|
||
|
|
honoured because the error message below names both, and promising a
|
||
|
|
variable the code never reads is how this failed silently — exporting
|
||
|
|
PORTAINER_API_KEY, the name portainer.md itself documents, did nothing.
|
||
|
|
"""
|
||
|
|
token = (
|
||
|
|
os.environ.get("PORTAINER_API_KEY")
|
||
|
|
or os.environ.get("PORTAINER_API_TOKEN")
|
||
|
|
or load_portainer_key()
|
||
|
|
or load_privacyllc_credentials().get("PORTAINER_API_KEY")
|
||
|
|
)
|
||
|
|
if not token:
|
||
|
|
raise RuntimeError(
|
||
|
|
"PORTAINER_API_KEY/PORTAINER_API_TOKEN not available. Looked in the "
|
||
|
|
"environment, ~/.openclaw/credentials/portainer.md and "
|
||
|
|
"~/.openclaw/credentials/privacyllc.md."
|
||
|
|
)
|
||
|
|
return {"X-API-Key": token, "Content-Type": "application/json"}
|
||
|
|
|
||
|
|
|
||
|
|
def portainer_api_url() -> str:
|
||
|
|
"""Return the Portainer API base URL from environment or default."""
|
||
|
|
url = os.environ.get("PORTAINER_API_URL", "https://192.168.1.11:9443/api")
|
||
|
|
return url.rstrip("/")
|
||
|
|
|
||
|
|
|
||
|
|
def update_portainer_stack(version: str, stack_id: int, dry_run: bool, skip: bool) -> None:
|
||
|
|
"""Update the Portainer stack image line and trigger a redeploy."""
|
||
|
|
if skip:
|
||
|
|
print("[SKIP] Portainer update disabled by --skip-portainer")
|
||
|
|
return
|
||
|
|
|
||
|
|
base_url = portainer_api_url()
|
||
|
|
headers = portainer_headers()
|
||
|
|
|
||
|
|
# Fetch current stack file.
|
||
|
|
file_url = f"{base_url}/stacks/{stack_id}/file"
|
||
|
|
import requests
|
||
|
|
|
||
|
|
file_resp = requests.get(file_url, headers=headers, verify=False, timeout=30)
|
||
|
|
file_resp.raise_for_status()
|
||
|
|
compose_text = file_resp.json().get("StackFileContent", "")
|
||
|
|
if not compose_text:
|
||
|
|
raise RuntimeError("Portainer stack file content is empty")
|
||
|
|
|
||
|
|
# Replace the image line's tag, keeping the line's indentation.
|
||
|
|
#
|
||
|
|
# The previous pattern matched `^\s*image:` — indentation included — and
|
||
|
|
# replaced the whole match with an unindented line. The image line landed at
|
||
|
|
# column 0, the YAML stopped parsing ("mapping values are not allowed in
|
||
|
|
# this context"), and Portainer answered 500 before its compose engine ever
|
||
|
|
# ran — which is why its log carried no entry for the failed update while a
|
||
|
|
# hand-edit through the UI, indentation intact, deployed fine. Reproduced
|
||
|
|
# locally against the real stack file and confirmed with
|
||
|
|
# `docker compose config` before this was written.
|
||
|
|
#
|
||
|
|
# `[ \t]*` rather than `\s*`, because `\s` matches newlines and could crawl
|
||
|
|
# up through blank lines above the target.
|
||
|
|
image_line = re.compile(
|
||
|
|
r"^([ \t]*)image:[ \t]*" + re.escape(FORGEJO_IMAGE) + r":(\S+)[ \t]*$",
|
||
|
|
flags=re.MULTILINE,
|
||
|
|
)
|
||
|
|
found = image_line.search(compose_text)
|
||
|
|
if not found:
|
||
|
|
raise RuntimeError(
|
||
|
|
f"Could not find image line for {FORGEJO_IMAGE} in Portainer stack file"
|
||
|
|
)
|
||
|
|
if found.group(2) == version:
|
||
|
|
# Distinguished from "not found": redeploying the version already pinned
|
||
|
|
# is a no-op somebody may have meant, not a malformed stack file.
|
||
|
|
print(f"[PORTAINER] stack already pins {version}; sending it unchanged")
|
||
|
|
|
||
|
|
updated_compose = image_line.sub(
|
||
|
|
lambda m: f"{m.group(1)}image: {FORGEJO_IMAGE}:{version}",
|
||
|
|
compose_text,
|
||
|
|
)
|
||
|
|
|
||
|
|
# The whole point of the last failure: prove the result still parses as
|
||
|
|
# YAML before it goes anywhere near the stack. `docker compose config`
|
||
|
|
# validates against the real schema; if the binary is missing the check is
|
||
|
|
# skipped with a warning rather than silently passed.
|
||
|
|
import shutil, subprocess, tempfile
|
||
|
|
if shutil.which("docker"):
|
||
|
|
with tempfile.NamedTemporaryFile("w", suffix=".yml", delete=False) as handle:
|
||
|
|
handle.write(updated_compose)
|
||
|
|
probe_path = handle.name
|
||
|
|
# --no-interpolate: the stack's variables live in Portainer's Env, not
|
||
|
|
# in this shell, and `${TURNSTILE_SECRET:?}`-style references would fail
|
||
|
|
# interpolation here while being perfectly valid there. Structure is
|
||
|
|
# what the last failure corrupted and structure is checked either way —
|
||
|
|
# the de-indented file still fails this exact command.
|
||
|
|
probe = subprocess.run(
|
||
|
|
["docker", "compose", "-f", probe_path, "config", "--no-interpolate", "-q"],
|
||
|
|
capture_output=True, text=True, timeout=60,
|
||
|
|
)
|
||
|
|
Path(probe_path).unlink(missing_ok=True)
|
||
|
|
if probe.returncode != 0:
|
||
|
|
raise RuntimeError(
|
||
|
|
"The transformed compose does not validate; refusing to send it to "
|
||
|
|
f"Portainer. docker compose says: {probe.stderr.strip()[:300]}"
|
||
|
|
)
|
||
|
|
else:
|
||
|
|
print("[WARN] docker not on PATH here; skipping compose validation of the transformed file")
|
||
|
|
|
||
|
|
# Fetch stack metadata to get endpoint ID.
|
||
|
|
stack_url = f"{base_url}/stacks/{stack_id}"
|
||
|
|
stack_resp = requests.get(stack_url, headers=headers, verify=False, timeout=30)
|
||
|
|
stack_resp.raise_for_status()
|
||
|
|
stack_data = stack_resp.json()
|
||
|
|
endpoint_id = stack_data.get("EndpointId")
|
||
|
|
if not endpoint_id:
|
||
|
|
raise RuntimeError("Portainer stack response missing EndpointId")
|
||
|
|
|
||
|
|
if dry_run:
|
||
|
|
print(f"[DRY-RUN] would update Portainer stack {stack_id} on endpoint {endpoint_id}")
|
||
|
|
print(updated_compose)
|
||
|
|
return
|
||
|
|
|
||
|
|
# Update the stack via Portainer API. Preserve existing env vars to avoid
|
||
|
|
# wiping secrets (POSTGRES_PASSWORD, OIDC_CLIENT_SECRET, etc.).
|
||
|
|
#
|
||
|
|
# A stack update REPLACES the definition, so whatever is not sent back is
|
||
|
|
# gone. This is a round trip of what the GET returned, never a rebuild.
|
||
|
|
env_vars = stack_data.get("Env") or []
|
||
|
|
|
||
|
|
# An empty list is not a stack without variables; it is far more likely a
|
||
|
|
# read that did not return them — a Portainer version that moved the field,
|
||
|
|
# a partial response, a token whose scope quietly narrowed. Sending it would
|
||
|
|
# blank every secret the stack holds, and one of them cannot be recovered by
|
||
|
|
# re-entering it: without CONTACT_ENCRYPTION_KEY every contact message,
|
||
|
|
# brainstorming note, document and business detail is permanently
|
||
|
|
# unreadable. `preflightRestore` refuses a restore for this same reason.
|
||
|
|
#
|
||
|
|
# So "I could not read them" and "there are none" are kept apart, which is
|
||
|
|
# the distinction this deployment refuses to collapse anywhere else. The
|
||
|
|
# escape hatch exists for a stack that genuinely has none, and it has to be
|
||
|
|
# asked for by name rather than being what happens by default.
|
||
|
|
if not env_vars and not os.environ.get("DEPLOY_ALLOW_EMPTY_ENV"):
|
||
|
|
raise RuntimeError(
|
||
|
|
f"Portainer stack {stack_id} returned no environment variables. Refusing to "
|
||
|
|
"update, because sending an empty list would erase every variable the stack "
|
||
|
|
"holds — including CONTACT_ENCRYPTION_KEY, which cannot be recovered by "
|
||
|
|
"typing it again. Check the stack in Portainer. If it genuinely has none, "
|
||
|
|
"re-run with DEPLOY_ALLOW_EMPTY_ENV=1."
|
||
|
|
)
|
||
|
|
|
||
|
|
payload_env = [{"name": e.get("name"), "value": e.get("value")} for e in env_vars]
|
||
|
|
|
||
|
|
# Names only. The values are secrets and this prints to a terminal and a log.
|
||
|
|
print(f"[PORTAINER] carrying {len(payload_env)} env vars: "
|
||
|
|
f"{' '.join(sorted(e['name'] for e in payload_env if e.get('name')))}")
|
||
|
|
update_url = f"{base_url}/stacks/{stack_id}?endpointId={endpoint_id}"
|
||
|
|
payload = {"stackFileContent": updated_compose, "env": payload_env, "prune": False}
|
||
|
|
update_resp = requests.put(update_url, headers=headers, json=payload, verify=False, timeout=120)
|
||
|
|
if update_resp.status_code >= 400:
|
||
|
|
# The body is where Portainer puts the reason, and discarding it is what
|
||
|
|
# turned the indentation bug into a day of guesswork. Truncated, and it
|
||
|
|
# carries Portainer's own message rather than anything from the stack's
|
||
|
|
# environment.
|
||
|
|
raise RuntimeError(
|
||
|
|
f"Portainer answered {update_resp.status_code} updating stack {stack_id}: "
|
||
|
|
f"{update_resp.text[:500]}"
|
||
|
|
)
|
||
|
|
print(f"[PORTAINER] Stack {stack_id} updated to {FORGEJO_IMAGE}:{version}")
|
||
|
|
|
||
|
|
|
||
|
|
def verify_container(endpoint_id: int, dry_run: bool) -> dict:
|
||
|
|
"""Check that the container is running and healthy via Portainer."""
|
||
|
|
if dry_run:
|
||
|
|
print(f"[DRY-RUN] would verify container {CONTAINER_NAME} on endpoint {endpoint_id}")
|
||
|
|
return {"State": "DryRun"}
|
||
|
|
|
||
|
|
base_url = portainer_api_url()
|
||
|
|
headers = portainer_headers()
|
||
|
|
import requests
|
||
|
|
|
||
|
|
url = f"{base_url}/endpoints/{endpoint_id}/docker/containers/json"
|
||
|
|
resp = requests.get(url, headers=headers, verify=False, timeout=30)
|
||
|
|
resp.raise_for_status()
|
||
|
|
containers = resp.json()
|
||
|
|
|
||
|
|
for container in containers:
|
||
|
|
names = container.get("Names", [])
|
||
|
|
if any(name.lstrip("/") == CONTAINER_NAME for name in names):
|
||
|
|
state = container.get("State", "")
|
||
|
|
status = container.get("Status", "")
|
||
|
|
print(f"[VERIFY] {CONTAINER_NAME}: state={state}, status={status}")
|
||
|
|
if state != "running":
|
||
|
|
raise RuntimeError(f"Container {CONTAINER_NAME} is not running (state={state})")
|
||
|
|
if "healthy" not in status.lower() and "(unhealthy)" in status.lower():
|
||
|
|
raise RuntimeError(f"Container {CONTAINER_NAME} is unhealthy: {status}")
|
||
|
|
return container
|
||
|
|
|
||
|
|
raise RuntimeError(f"Container {CONTAINER_NAME} not found on endpoint {endpoint_id}")
|
||
|
|
|
||
|
|
|
||
|
|
def _require_config() -> None:
|
||
|
|
"""Refuse a half-configured run.
|
||
|
|
|
||
|
|
The failure this prevents is quiet and expensive: an unset image name makes
|
||
|
|
every tag `":v1.2.3"`, and an unset stack id makes the update target stack
|
||
|
|
0. Neither raises anything obviously about configuration, and one of them
|
||
|
|
could update somebody else's stack.
|
||
|
|
|
||
|
|
DEPLOY_SITE_URL is required for the same class of reason but a worse
|
||
|
|
outcome: it is frozen into the image at build time, so an empty or wrong
|
||
|
|
value cannot be corrected without another build, and nothing fails at
|
||
|
|
deploy time to tell you. Only checked when a build will actually happen —
|
||
|
|
--skip-* runs that never build have no origin to bake.
|
||
|
|
"""
|
||
|
|
missing = [
|
||
|
|
name
|
||
|
|
for name, value in (
|
||
|
|
("DEPLOY_IMAGE", FORGEJO_IMAGE),
|
||
|
|
("DEPLOY_STACK_ID", PORTAINER_STACK_ID_DEFAULT),
|
||
|
|
("DEPLOY_CONTAINER", CONTAINER_NAME),
|
||
|
|
)
|
||
|
|
if not value
|
||
|
|
]
|
||
|
|
|
||
|
|
if missing:
|
||
|
|
raise SystemExit(
|
||
|
|
"[ERROR] not configured: " + ", ".join(missing) + "\n"
|
||
|
|
" See the header of this file; a deploy script that guesses "
|
||
|
|
"its target is one that deploys to the wrong place."
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def _require_site_url() -> None:
|
||
|
|
"""Refuse to build without the origin that will be frozen into the image."""
|
||
|
|
if not SITE_URL:
|
||
|
|
raise SystemExit(
|
||
|
|
"[ERROR] not configured: DEPLOY_SITE_URL\n"
|
||
|
|
" It is baked into every canonical URL, the sitemap and "
|
||
|
|
"robots.txt at build time and cannot be corrected afterwards "
|
||
|
|
"without another build."
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def main() -> int:
|
||
|
|
parser = argparse.ArgumentParser(description="Deploy a stack to a newly built image")
|
||
|
|
parser.add_argument("--project-dir", default=PROJECT_DIR_DEFAULT, help="Path to the project to build")
|
||
|
|
parser.add_argument("--portainer-stack-id", type=int, default=PORTAINER_STACK_ID_DEFAULT, help="Portainer stack ID")
|
||
|
|
parser.add_argument("--dry-run", action="store_true", help="Print actions without executing")
|
||
|
|
parser.add_argument("--build-only", action="store_true", help="Build only; do not push or update Portainer")
|
||
|
|
parser.add_argument("--skip-push", action="store_true", help="Skip pushing image to registry")
|
||
|
|
parser.add_argument("--skip-portainer", action="store_true", help="Skip Portainer stack update")
|
||
|
|
parser.add_argument("--version", help="Override the auto-incremented version tag")
|
||
|
|
args = parser.parse_args()
|
||
|
|
_require_config()
|
||
|
|
|
||
|
|
project_dir = Path(args.project_dir).expanduser().resolve()
|
||
|
|
|
||
|
|
try:
|
||
|
|
version = args.version or get_git_version(project_dir)
|
||
|
|
print(f"[DEPLOY] Target version: {version}")
|
||
|
|
|
||
|
|
build_image(project_dir, version, args.dry_run)
|
||
|
|
|
||
|
|
if args.build_only:
|
||
|
|
print("[DONE] Build-only requested; stopping after build.")
|
||
|
|
return 0
|
||
|
|
|
||
|
|
push_image(version, args.dry_run, args.skip_push)
|
||
|
|
update_portainer_stack(version, args.portainer_stack_id, args.dry_run, args.skip_portainer)
|
||
|
|
|
||
|
|
if not args.skip_portainer:
|
||
|
|
# Re-fetch endpoint ID for verification if we did not update Portainer.
|
||
|
|
import requests
|
||
|
|
|
||
|
|
base_url = portainer_api_url()
|
||
|
|
headers = portainer_headers()
|
||
|
|
stack_resp = requests.get(
|
||
|
|
f"{base_url}/stacks/{args.portainer_stack_id}", headers=headers, verify=False, timeout=30
|
||
|
|
)
|
||
|
|
stack_resp.raise_for_status()
|
||
|
|
endpoint_id = stack_resp.json().get("EndpointId")
|
||
|
|
verify_container(endpoint_id, args.dry_run)
|
||
|
|
|
||
|
|
print(f"[DONE] {DEPLOY_LABEL} deployed as {FORGEJO_IMAGE}:{version}")
|
||
|
|
return 0
|
||
|
|
except Exception as exc:
|
||
|
|
print(f"[ERROR] {exc}")
|
||
|
|
if os.environ.get("DEPLOY_DEBUG"):
|
||
|
|
traceback.print_exc()
|
||
|
|
return 1
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
sys.exit(main())
|