From 9a83d1c77280ec5112ed4bf3f2b9dee1b2174dfa Mon Sep 17 00:00:00 2001 From: Josh Date: Sat, 13 Sep 2025 11:16:40 +0000 Subject: [PATCH] syntax --- .woodpecker.yml | 160 ++++++++++++++++++++++++------------------------ 1 file changed, 80 insertions(+), 80 deletions(-) diff --git a/.woodpecker.yml b/.woodpecker.yml index 3276d9c..c1973c0 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -105,95 +105,95 @@ steps: depends_on: [security-scan] image: google/cloud-sdk:latest entrypoint: - - bash - - -c - - | + - bash + - -c + - | + set -euo pipefail + [[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; } + + mkdir -p ~/.ssh + + gcloud secrets versions access latest \ + --secret=PROD_SSH_KEY --project=aptivaai-dev \ + | base64 -d > ~/.ssh/id_ed25519 + chmod 600 ~/.ssh/id_ed25519 + + PROD_SSH_TARGET="$(gcloud secrets versions access latest --secret=PROD_SSH_TARGET --project=aptivaai-dev)" + IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)" + + echo "🔑 SSH prerequisites installed" + echo "🚀 Deploying tag $IMG_TAG to prod server $PROD_SSH_TARGET" + cat < ~/.ssh/id_ed25519 - chmod 600 ~/.ssh/id_ed25519 + # Pull runtime secrets (unchanged list) + JWT_SECRET="$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project="$PROJECT")"; export JWT_SECRET + OPENAI_API_KEY="$(gcloud secrets versions access latest --secret=OPENAI_API_KEY_$ENV --project="$PROJECT")"; export OPENAI_API_KEY + ONET_USERNAME="$(gcloud secrets versions access latest --secret=ONET_USERNAME_$ENV --project="$PROJECT")"; export ONET_USERNAME + ONET_PASSWORD="$(gcloud secrets versions access latest --secret=ONET_PASSWORD_$ENV --project="$PROJECT")"; export ONET_PASSWORD + STRIPE_SECRET_KEY="$(gcloud secrets versions access latest --secret=STRIPE_SECRET_KEY_$ENV --project="$PROJECT")"; export STRIPE_SECRET_KEY + STRIPE_PUBLISHABLE_KEY="$(gcloud secrets versions access latest --secret=STRIPE_PUBLISHABLE_KEY_$ENV --project="$PROJECT")"; export STRIPE_PUBLISHABLE_KEY + STRIPE_WH_SECRET="$(gcloud secrets versions access latest --secret=STRIPE_WH_SECRET_$ENV --project="$PROJECT")"; export STRIPE_WH_SECRET + STRIPE_PRICE_PREMIUM_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_MONTH + STRIPE_PRICE_PREMIUM_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_YEAR + STRIPE_PRICE_PRO_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_MONTH + STRIPE_PRICE_PRO_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_YEAR + DB_NAME="$(gcloud secrets versions access latest --secret=DB_NAME_$ENV --project="$PROJECT")"; export DB_NAME + DB_HOST="$(gcloud secrets versions access latest --secret=DB_HOST_$ENV --project="$PROJECT")"; export DB_HOST + DB_PORT="$(gcloud secrets versions access latest --secret=DB_PORT_$ENV --project="$PROJECT")"; export DB_PORT + DB_USER="$(gcloud secrets versions access latest --secret=DB_USER_$ENV --project="$PROJECT")"; export DB_USER + DB_PASSWORD="$(gcloud secrets versions access latest --secret=DB_PASSWORD_$ENV --project="$PROJECT")"; export DB_PASSWORD + DB_SSL_CA="$(gcloud secrets versions access latest --secret=DB_SSL_CA_$ENV --project="$PROJECT")"; export DB_SSL_CA + DB_SSL_CERT="$(gcloud secrets versions access latest --secret=DB_SSL_CERT_$ENV --project="$PROJECT")"; export DB_SSL_CERT + DB_SSL_KEY="$(gcloud secrets versions access latest --secret=DB_SSL_KEY_$ENV --project="$PROJECT")"; export DB_SSL_KEY + EMAIL_INDEX_SECRET="$(gcloud secrets versions access latest --secret=EMAIL_INDEX_SECRET_$ENV --project="$PROJECT")"; export EMAIL_INDEX_SECRET + TWILIO_ACCOUNT_SID="$(gcloud secrets versions access latest --secret=TWILIO_ACCOUNT_SID_$ENV --project="$PROJECT")"; export TWILIO_ACCOUNT_SID + TWILIO_AUTH_TOKEN="$(gcloud secrets versions access latest --secret=TWILIO_AUTH_TOKEN_$ENV --project="$PROJECT")"; export TWILIO_AUTH_TOKEN + TWILIO_MESSAGING_SERVICE_SID="$(gcloud secrets versions access latest --secret=TWILIO_MESSAGING_SERVICE_SID_$ENV --project="$PROJECT")"; export TWILIO_MESSAGING_SERVICE_SID + KMS_KEY_NAME="$(gcloud secrets versions access latest --secret=KMS_KEY_NAME_$ENV --project="$PROJECT")"; export KMS_KEY_NAME + DEK_PATH="$(gcloud secrets versions access latest --secret=DEK_PATH_$ENV --project="$PROJECT")"; export DEK_PATH + SUPPORT_SENDGRID_API_KEY="$(gcloud secrets versions access latest --secret=SUPPORT_SENDGRID_API_KEY_$ENV --project="$PROJECT")"; export SUPPORT_SENDGRID_API_KEY + GOOGLE_MAPS_API_KEY="$(gcloud secrets versions access latest --secret=GOOGLE_MAPS_API_KEY_$ENV --project="$PROJECT")"; export GOOGLE_MAPS_API_KEY + SERVER1_PORT="$(gcloud secrets versions access latest --secret=SERVER1_PORT_$ENV --project="$PROJECT")"; export SERVER1_PORT + SERVER2_PORT="$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project="$PROJECT")"; export SERVER2_PORT + SERVER3_PORT="$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project="$PROJECT")"; export SERVER3_PORT + ENV_NAME="$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project="$PROJECT")"; export ENV_NAME + CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT" 2>/dev/null || true)"; export CORS_ALLOWED_ORIGINS="${CORS_ALLOWED_ORIGINS:-}" + APTIVA_API_BASE="$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project="$PROJECT")"; export APTIVA_API_BASE + TOKEN_MAX_AGE_MS="$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project="$PROJECT")"; export TOKEN_MAX_AGE_MS + COOKIE_SECURE="$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project="$PROJECT")"; export COOKIE_SECURE + COOKIE_SAMESITE="$(gcloud secrets versions access latest --secret=COOKIE_SAMESITE_$ENV --project="$PROJECT")"; export COOKIE_SAMESITE + ACCESS_COOKIE_NAME="$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project="$PROJECT")"; export ACCESS_COOKIE_NAME + export FROM_SECRETS_MANAGER=true - PROD_SSH_TARGET="$(gcloud secrets versions access latest --secret=PROD_SSH_TARGET --project=aptivaai-dev)" - IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)" + cd /home/jcoakley_aptivaai_com - echo "🔑 SSH prerequisites installed" - echo "🚀 Deploying tag $IMG_TAG to prod server $PROD_SSH_TARGET" - - set -euo pipefail - IMG_TAG="${1:?IMG_TAG arg missing}" - export IMG_TAG + # Make Artifact Registry creds available to root (docker compose runs under sudo) + gcloud auth configure-docker us-central1-docker.pkg.dev -q + sudo gcloud auth configure-docker us-central1-docker.pkg.dev -q - PROJECT=aptivaai-prod - ENV=prod - export PROJECT ENV + sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ + docker compose pull - # Pull runtime secrets (unchanged list) - JWT_SECRET="$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project="$PROJECT")"; export JWT_SECRET - OPENAI_API_KEY="$(gcloud secrets versions access latest --secret=OPENAI_API_KEY_$ENV --project="$PROJECT")"; export OPENAI_API_KEY - ONET_USERNAME="$(gcloud secrets versions access latest --secret=ONET_USERNAME_$ENV --project="$PROJECT")"; export ONET_USERNAME - ONET_PASSWORD="$(gcloud secrets versions access latest --secret=ONET_PASSWORD_$ENV --project="$PROJECT")"; export ONET_PASSWORD - STRIPE_SECRET_KEY="$(gcloud secrets versions access latest --secret=STRIPE_SECRET_KEY_$ENV --project="$PROJECT")"; export STRIPE_SECRET_KEY - STRIPE_PUBLISHABLE_KEY="$(gcloud secrets versions access latest --secret=STRIPE_PUBLISHABLE_KEY_$ENV --project="$PROJECT")"; export STRIPE_PUBLISHABLE_KEY - STRIPE_WH_SECRET="$(gcloud secrets versions access latest --secret=STRIPE_WH_SECRET_$ENV --project="$PROJECT")"; export STRIPE_WH_SECRET - STRIPE_PRICE_PREMIUM_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_MONTH - STRIPE_PRICE_PREMIUM_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_YEAR - STRIPE_PRICE_PRO_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_MONTH - STRIPE_PRICE_PRO_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_YEAR - DB_NAME="$(gcloud secrets versions access latest --secret=DB_NAME_$ENV --project="$PROJECT")"; export DB_NAME - DB_HOST="$(gcloud secrets versions access latest --secret=DB_HOST_$ENV --project="$PROJECT")"; export DB_HOST - DB_PORT="$(gcloud secrets versions access latest --secret=DB_PORT_$ENV --project="$PROJECT")"; export DB_PORT - DB_USER="$(gcloud secrets versions access latest --secret=DB_USER_$ENV --project="$PROJECT")"; export DB_USER - DB_PASSWORD="$(gcloud secrets versions access latest --secret=DB_PASSWORD_$ENV --project="$PROJECT")"; export DB_PASSWORD - DB_SSL_CA="$(gcloud secrets versions access latest --secret=DB_SSL_CA_$ENV --project="$PROJECT")"; export DB_SSL_CA - DB_SSL_CERT="$(gcloud secrets versions access latest --secret=DB_SSL_CERT_$ENV --project="$PROJECT")"; export DB_SSL_CERT - DB_SSL_KEY="$(gcloud secrets versions access latest --secret=DB_SSL_KEY_$ENV --project="$PROJECT")"; export DB_SSL_KEY - EMAIL_INDEX_SECRET="$(gcloud secrets versions access latest --secret=EMAIL_INDEX_SECRET_$ENV --project="$PROJECT")"; export EMAIL_INDEX_SECRET - TWILIO_ACCOUNT_SID="$(gcloud secrets versions access latest --secret=TWILIO_ACCOUNT_SID_$ENV --project="$PROJECT")"; export TWILIO_ACCOUNT_SID - TWILIO_AUTH_TOKEN="$(gcloud secrets versions access latest --secret=TWILIO_AUTH_TOKEN_$ENV --project="$PROJECT")"; export TWILIO_AUTH_TOKEN - TWILIO_MESSAGING_SERVICE_SID="$(gcloud secrets versions access latest --secret=TWILIO_MESSAGING_SERVICE_SID_$ENV --project="$PROJECT")"; export TWILIO_MESSAGING_SERVICE_SID - KMS_KEY_NAME="$(gcloud secrets versions access latest --secret=KMS_KEY_NAME_$ENV --project="$PROJECT")"; export KMS_KEY_NAME - DEK_PATH="$(gcloud secrets versions access latest --secret=DEK_PATH_$ENV --project="$PROJECT")"; export DEK_PATH - SUPPORT_SENDGRID_API_KEY="$(gcloud secrets versions access latest --secret=SUPPORT_SENDGRID_API_KEY_$ENV --project="$PROJECT")"; export SUPPORT_SENDGRID_API_KEY - GOOGLE_MAPS_API_KEY="$(gcloud secrets versions access latest --secret=GOOGLE_MAPS_API_KEY_$ENV --project="$PROJECT")"; export GOOGLE_MAPS_API_KEY - SERVER1_PORT="$(gcloud secrets versions access latest --secret=SERVER1_PORT_$ENV --project="$PROJECT")"; export SERVER1_PORT - SERVER2_PORT="$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project="$PROJECT")"; export SERVER2_PORT - SERVER3_PORT="$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project="$PROJECT")"; export SERVER3_PORT - ENV_NAME="$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project="$PROJECT")"; export ENV_NAME - CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project="$PROJECT" 2>/dev/null || true)"; export CORS_ALLOWED_ORIGINS="${CORS_ALLOWED_ORIGINS:-}" - APTIVA_API_BASE="$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project="$PROJECT")"; export APTIVA_API_BASE - TOKEN_MAX_AGE_MS="$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project="$PROJECT")"; export TOKEN_MAX_AGE_MS - COOKIE_SECURE="$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project="$PROJECT")"; export COOKIE_SECURE - COOKIE_SAMESITE="$(gcloud secrets versions access latest --secret=COOKIE_SAMESITE_$ENV --project="$PROJECT")"; export COOKIE_SAMESITE - ACCESS_COOKIE_NAME="$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project="$PROJECT")"; export ACCESS_COOKIE_NAME - export FROM_SECRETS_MANAGER=true + sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ + docker compose up -d --force-recreate --remove-orphans - cd /home/jcoakley_aptivaai_com - - # Make Artifact Registry creds available to root (docker compose runs under sudo) - gcloud auth configure-docker us-central1-docker.pkg.dev -q - sudo gcloud auth configure-docker us-central1-docker.pkg.dev -q - - sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ - docker compose pull - - sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ - docker compose up -d --force-recreate --remove-orphans - - echo "✅ Prod stack refreshed with tag $IMG_TAG" - EOSSH + echo "✅ Prod stack refreshed with tag $IMG_TAG" + EOSSH secrets: - PROD_SSH_KEY