inference-bot
44f040c27f
The agent host's cloud firewall only admits inbound SSH, so the registered Gitea webhook cannot reach the receiver. docs-deploy-poll.service polls Gitea every 60s over outbound HTTPS and deploys whenever main moves; the webhook stays wired for the moment a port is opened in the Infomaniak panel. Both serialise on the same deploy lock.
67 lines
2.3 KiB
Bash
Executable File
67 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Poll Gitea for new commits on main and deploy the docs site when it moves.
|
|
#
|
|
# Why polling: the agent host's cloud firewall only admits inbound SSH, so a
|
|
# Gitea webhook cannot reach the receiver (publishing/webhook-receiver.py) —
|
|
# every port is silently dropped. Outbound to git.inference.coop works, so the
|
|
# agent host polls instead: a push to main is picked up within ~a minute and
|
|
# deployed with no human action. When the operator opens a TCP port to the
|
|
# agent host in the Infomaniak panel, the webhook takes over (its unit is
|
|
# already installed); until then this watcher is the automation.
|
|
#
|
|
# Runs on the agent host as a systemd service (docs-deploy-poll.service).
|
|
# Deploy steps are serialised with the same lock the webhook receiver uses, so
|
|
# the two mechanisms can never deploy concurrently.
|
|
|
|
set -uo pipefail
|
|
|
|
REPO_DIR="${DOCS_REPO_DIR:-/home/ubuntu/repos/docs}"
|
|
ENV_FILE="${DOCS_ENV_FILE:-/home/ubuntu/.hermes/.env}"
|
|
LOG_FILE="${DOCS_DEPLOY_LOG:-/home/ubuntu/docs-deploy.log}"
|
|
LOCK_FILE="${DOCS_DEPLOY_LOCK:-/home/ubuntu/.docs-deploy.lock}"
|
|
INTERVAL="${DOCS_POLL_INTERVAL:-60}"
|
|
|
|
cd "$REPO_DIR"
|
|
|
|
log() { echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) [poll] $*" | tee -a "$LOG_FILE" >&2; }
|
|
|
|
# The Cloudron token travels by environment only; it is read from the env file
|
|
# and never echoed.
|
|
CLOUDRON_TOKEN="$(sed -n 's/^CLOUDRON_TOKEN=//p' "$ENV_FILE" | head -1 | tr -d '"' | tr -d "'")"
|
|
export CLOUDRON_TOKEN
|
|
if [ -z "$CLOUDRON_TOKEN" ]; then
|
|
log "FATAL: CLOUDRON_TOKEN not found in $ENV_FILE"
|
|
exit 1
|
|
fi
|
|
|
|
log "watcher started: polling $REPO_DIR every ${INTERVAL}s"
|
|
|
|
while true; do
|
|
if ! git fetch --quiet origin main 2>>"$LOG_FILE"; then
|
|
log "git fetch failed; will retry"
|
|
sleep "$INTERVAL"
|
|
continue
|
|
fi
|
|
|
|
LOCAL="$(git rev-parse HEAD 2>/dev/null || echo none)"
|
|
REMOTE="$(git rev-parse origin/main 2>/dev/null || echo none)"
|
|
|
|
if [ "$LOCAL" != "$REMOTE" ]; then
|
|
log "main moved: $LOCAL -> $REMOTE; deploying"
|
|
# flock -n shares the receiver's lock: one deploy at a time, ever.
|
|
if flock -n "$LOCK_FILE" bash -c '
|
|
set -e
|
|
cd "$1"
|
|
git pull --ff-only origin main
|
|
bash publishing/build.sh
|
|
bash publishing/deploy.sh
|
|
' _ "$REPO_DIR" >>"$LOG_FILE" 2>&1; then
|
|
log "deploy finished for $REMOTE"
|
|
else
|
|
log "deploy FAILED for $REMOTE (see log above)"
|
|
fi
|
|
fi
|
|
|
|
sleep "$INTERVAL"
|
|
done
|