Copilot rewrite of sudo docker run

.woodpecker.yml

@@ -38,7 +38,7 @@ steps:
 
         mkdir -p ~/.ssh
 
-        # known_hosts + key
+        # ── Inject known-hosts and SSH key ───────────────────────────────
         gcloud secrets versions access latest \
           --secret=STAGING_KNOWN_HOSTS --project=aptivaai-dev \
           | base64 -d > ~/.ssh/known_hosts
@@ -49,75 +49,98 @@ steps:
           | base64 -d > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
 
-        # --- Run a real bash on the remote and feed it a literal script
+        echo "🔑 SSH prerequisites installed"
+
+        # ── SSH into staging and deploy ──────────────────────────────────
         ssh -o StrictHostKeyChecking=yes \
             -i ~/.ssh/id_ed25519 \
             jcoakley@10.128.0.12 \
-            bash -seuo pipefail <<'REMOTE'
+            'set -euo pipefail; \
-
+             PROJECT=aptivaai-dev; \
-        set -Eeuo pipefail
+             ENV=staging; \
-
+             IMG_TAG=$(gcloud secrets versions access latest --secret=IMG_TAG --project=$PROJECT); \
-        PROJECT=aptivaai-dev
+             export IMG_TAG; \
-        ENV=staging
+             JWT_SECRET=$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project=$PROJECT); \
-        REG=us-central1-docker.pkg.dev/${PROJECT}/aptiva-repo
+             export JWT_SECRET; \
-        DEK_VOL=aptiva_dek_staging   # adjust if your staging volume has a different name
+             OPENAI_API_KEY=$(gcloud secrets versions access latest --secret=OPENAI_API_KEY_$ENV --project=$PROJECT); \
-
+             export OPENAI_API_KEY; \
-        # helper: fetch a secret value for this ENV
+             ONET_USERNAME=$(gcloud secrets versions access latest --secret=ONET_USERNAME_$ENV --project=$PROJECT); \
-        get() { gcloud secrets versions access latest --secret="${1}_${ENV}" --project="${PROJECT}"; }
+             export ONET_USERNAME; \
-
+             ONET_PASSWORD=$(gcloud secrets versions access latest --secret=ONET_PASSWORD_$ENV --project=$PROJECT); \
-        # read the image tag (no suffix)
+             export ONET_PASSWORD; \
-        IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project="${PROJECT}")"
+             STRIPE_SECRET_KEY=$(gcloud secrets versions access latest --secret=STRIPE_SECRET_KEY_$ENV --project=$PROJECT); \
-        export IMG_TAG FROM_SECRETS_MANAGER=true PROJECT ENV_NAME="${ENV}"
+             export STRIPE_SECRET_KEY; \
-
+             STRIPE_PUBLISHABLE_KEY=$(gcloud secrets versions access latest --secret=STRIPE_PUBLISHABLE_KEY_$ENV --project=$PROJECT); \
-        # export all env the compose needs
+             export STRIPE_PUBLISHABLE_KEY; \
-        export JWT_SECRET="$(get JWT_SECRET)"
+             STRIPE_WH_SECRET=$(gcloud secrets versions access latest --secret=STRIPE_WH_SECRET_$ENV --project=$PROJECT); \
-        export OPENAI_API_KEY="$(get OPENAI_API_KEY)"
+             export STRIPE_WH_SECRET; \
-        export ONET_USERNAME="$(get ONET_USERNAME)"
+             STRIPE_PRICE_PREMIUM_MONTH=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_MONTH_$ENV --project=$PROJECT); \
-        export ONET_PASSWORD="$(get ONET_PASSWORD)"
+             export STRIPE_PRICE_PREMIUM_MONTH; \
-        export STRIPE_SECRET_KEY="$(get STRIPE_SECRET_KEY)"
+             STRIPE_PRICE_PREMIUM_YEAR=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_YEAR_$ENV --project=$PROJECT); \
-        export STRIPE_PUBLISHABLE_KEY="$(get STRIPE_PUBLISHABLE_KEY)"
+             export STRIPE_PRICE_PREMIUM_YEAR; \
-        export STRIPE_WH_SECRET="$(get STRIPE_WH_SECRET)"
+             STRIPE_PRICE_PRO_MONTH=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_MONTH_$ENV --project=$PROJECT); \
-        export STRIPE_PRICE_PREMIUM_MONTH="$(get STRIPE_PRICE_PREMIUM_MONTH)"
+             export STRIPE_PRICE_PRO_MONTH; \
-        export STRIPE_PRICE_PREMIUM_YEAR="$(get STRIPE_PRICE_PREMIUM_YEAR)"
+             STRIPE_PRICE_PRO_YEAR=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_YEAR_$ENV --project=$PROJECT); \
-        export STRIPE_PRICE_PRO_MONTH="$(get STRIPE_PRICE_PRO_MONTH)"
+             export STRIPE_PRICE_PRO_YEAR; \
-        export STRIPE_PRICE_PRO_YEAR="$(get STRIPE_PRICE_PRO_YEAR)"
+             DB_NAME=$(gcloud secrets versions access latest --secret=DB_NAME_$ENV --project=$PROJECT); \
-        export DB_NAME="$(get DB_NAME)"
+             export DB_NAME; \
-        export DB_HOST="$(get DB_HOST)"
+             DB_HOST=$(gcloud secrets versions access latest --secret=DB_HOST_$ENV --project=$PROJECT); \
-        export DB_PORT="$(get DB_PORT)"
+             export DB_HOST; \
-        export DB_USER="$(get DB_USER)"
+             DB_PORT=$(gcloud secrets versions access latest --secret=DB_PORT_$ENV --project=$PROJECT); \
-        export DB_PASSWORD="$(get DB_PASSWORD)"
+             export DB_PORT; \
-        export DB_SSL_CA="$(get DB_SSL_CA)"
+             DB_USER=$(gcloud secrets versions access latest --secret=DB_USER_$ENV --project=$PROJECT); \
-        export DB_SSL_CERT="$(get DB_SSL_CERT)"
+             export DB_USER; \
-        export DB_SSL_KEY="$(get DB_SSL_KEY)"
+             DB_PASSWORD=$(gcloud secrets versions access latest --secret=DB_PASSWORD_$ENV --project=$PROJECT); \
-        export TWILIO_ACCOUNT_SID="$(get TWILIO_ACCOUNT_SID)"
+             export DB_PASSWORD; \
-        export TWILIO_AUTH_TOKEN="$(get TWILIO_AUTH_TOKEN)"
+             DB_SSL_CA=$(gcloud secrets versions access latest --secret=DB_SSL_CA_$ENV --project=$PROJECT); \
-        export TWILIO_MESSAGING_SERVICE_SID="$(get TWILIO_MESSAGING_SERVICE_SID)"
+             export DB_SSL_CA; \
-        export KMS_KEY_NAME="$(get KMS_KEY_NAME)"
+             DB_SSL_CERT=$(gcloud secrets versions access latest --secret=DB_SSL_CERT_$ENV --project=$PROJECT); \
-        export DEK_PATH="$(get DEK_PATH)"
+             export DB_SSL_CERT; \
-
+             DB_SSL_KEY=$(gcloud secrets versions access latest --secret=DB_SSL_KEY_$ENV --project=$PROJECT); \
-        cd /home/jcoakley/aptiva-staging-app
+             export DB_SSL_KEY; \
-
+             TWILIO_ACCOUNT_SID=$(gcloud secrets versions access latest --secret=TWILIO_ACCOUNT_SID_$ENV --project=$PROJECT); \
-        # Optional safety net: if WRAPPED_DEK_staging has no versions, escrow the current EDEK
+             export TWILIO_ACCOUNT_SID; \
-        if ! gcloud secrets describe "WRAPPED_DEK_${ENV}" --project="${PROJECT}" >/dev/null 2>&1; then
+             TWILIO_AUTH_TOKEN=$(gcloud secrets versions access latest --secret=TWILIO_AUTH_TOKEN_$ENV --project=$PROJECT); \
-          gcloud secrets create "WRAPPED_DEK_${ENV}" --replication-policy=automatic --project="${PROJECT}"
+             export TWILIO_AUTH_TOKEN; \
-        fi
+             TWILIO_MESSAGING_SERVICE_SID=$(gcloud secrets versions access latest --secret=TWILIO_MESSAGING_SERVICE_SID_$ENV --project=$PROJECT); \
-        if ! gcloud secrets versions list "WRAPPED_DEK_${ENV}" --project="${PROJECT}" --format='value(name)' | grep -q .; then
+             export TWILIO_MESSAGING_SERVICE_SID; \
-          # read dek.enc out of the staging volume and push to Secret Manager
+             KMS_KEY_NAME=$(gcloud secrets versions access latest --secret=KMS_KEY_NAME_$ENV --project=$PROJECT); \
-          docker run --rm -v "${DEK_VOL}:/run/secrets" busybox \
+             export KMS_KEY_NAME; \
-            cat "${DEK_PATH}" \
+             DEK_PATH=$(gcloud secrets versions access latest --secret=DEK_PATH_$ENV --project=$PROJECT); \
-          | gcloud secrets versions add "WRAPPED_DEK_${ENV}" --data-file=- --project="${PROJECT}"
+             export DEK_PATH; \
-          echo "Escrowed EDEK to Secret Manager as WRAPPED_DEK_${ENV}"
+             export FROM_SECRETS_MANAGER=true; \
-        fi
+             \
-
+             # ── NEW: sync dev DEK into staging volume (uses Secret Manager) ── \
-        # Pull & restart with all env preserved
+             if gcloud secrets describe WRAPPED_DEK_dev --project=$PROJECT >/dev/null 2>&1; then \
-        PRESERVE="IMG_TAG,FROM_SECRETS_MANAGER,ENV_NAME,PROJECT,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH"
+               echo \"🔁 Syncing dev DEK into staging volume\"; \
-
+               gcloud secrets versions access latest --secret=WRAPPED_DEK_dev --project=$PROJECT > /tmp/dev_dek.enc; \
-        sudo --preserve-env="${PRESERVE}" docker compose pull
+               if [ -s /tmp/dev_dek.enc ]; then \
-        sudo --preserve-env="${PRESERVE}" docker compose up -d --force-recreate --remove-orphans
+                 docker volume ls -q | grep -qx aptiva_dek_staging || docker volume create aptiva_dek_staging >/dev/null; \
-
+                sudo docker run --rm -v aptiva_dek_staging:/v -v /tmp:/host busybox sh <<'EOF'
-        echo "✅ Staging stack refreshed with tag ${IMG_TAG}"
+                  set -e
-        REMOTE
+                  mkdir -p /v/staging
+                  cp -f /host/dev_dek.enc /v/staging/dek.enc
+                  chown 1000:1000 /v/staging/dek.enc
+                  chmod 400 /v/staging/dek.enc
+                  rm -f /v/staging/dek.fpr
+                  echo -n "staging dek.enc bytes: "; wc -c </v/staging/dek.enc
+                  ls -l /v/staging
+                  EOF
 
+                 \"; \
+               else \
+                 echo \"⚠️ WRAPPED_DEK_dev returned empty; skipping copy\"; \
+               fi; \
+             else \
+               echo \"ℹ️ WRAPPED_DEK_dev not found; leaving existing staging DEK alone\"; \
+             fi; \
+             \
+             cd /home/jcoakley/aptiva-staging-app; \
+             sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH \
+               docker compose pull; \
+             sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH \
+               docker compose up -d --force-recreate --remove-orphans; \
+             echo \"✅ Staging stack refreshed with tag $IMG_TAG\"'
 
 
     secrets: