diff --git a/.woodpecker.yml b/.woodpecker.yml index 6d40cf5..58911b4 100644 --- a/.woodpecker.yml +++ b/.woodpecker.yml @@ -112,95 +112,87 @@ steps: [[ "${PROMOTE:-}" == "prod" ]] || { echo "⏭ Skipping (PROMOTE=$PROMOTE)"; exit 0; } mkdir -p ~/.ssh - - # Pull SSH materials for PROD from aptivaai-dev SM (same pattern as staging) - gcloud secrets versions access latest \ --secret=PROD_SSH_KEY --project=aptivaai-dev \ | base64 -d > ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519 - PROD_SSH_TARGET="$(gcloud secrets versions access latest --secret=PROD_SSH_TARGET --project=aptivaai-dev)" - # single source of truth for deploy as well - IMG_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)" - + # Source of truth: dev tag + DEV_TAG="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)" + [ -n "$DEV_TAG" ] || { echo "❌ dev IMG_TAG empty"; exit 2; } + echo "🚀 Deploying tag: $DEV_TAG" - echo "🔑 SSH prerequisites installed" + # Pipe a script to the VM; pass DEV_TAG as $1 + cat <<'EOSSH' | ssh -T \ + -o ProxyCommand="gcloud compute start-iap-tunnel aptiva-prod-vm 22 \ + --project=aptivaai-prod --zone=us-central1-a \ + --listen-on-stdin --verbosity=error" \ + -o StrictHostKeyChecking=accept-new \ + -i ~/.ssh/id_ed25519 \ + "$PROD_SSH_TARGET" bash -s -- "$DEV_TAG" + set -euo pipefail + IMG_TAG="${1:?missing tag}"; export IMG_TAG + PROJECT=aptivaai-prod + ENV=prod + export PROJECT ENV - # ── SSH into PROD and deploy (NO DEK SYNC) ──────────────────────── - IMG_TAG_DEV="$(gcloud secrets versions access latest --secret=IMG_TAG --project=aptivaai-dev)" - [ -n "$IMG_TAG_DEV" ] || { echo "❌ dev IMG_TAG empty"; exit 2; } - ssh -o ProxyCommand="gcloud compute start-iap-tunnel aptiva-prod-vm 22 \ - --project=aptivaai-prod --zone=us-central1-a \ - --listen-on-stdin --verbosity=error" \ - -o StrictHostKeyChecking=accept-new -i ~/.ssh/id_ed25519 \ - "$PROD_SSH_TARGET" bash -s \ - set -euo pipefail; \ - PROJECT=aptivaai-prod; \ - export PROJECT; \ - ENV=prod; \ + # Pull runtime secrets (unchanged list) + JWT_SECRET="$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project="$PROJECT")"; export JWT_SECRET + OPENAI_API_KEY="$(gcloud secrets versions access latest --secret=OPENAI_API_KEY_$ENV --project="$PROJECT")"; export OPENAI_API_KEY + ONET_USERNAME="$(gcloud secrets versions access latest --secret=ONET_USERNAME_$ENV --project="$PROJECT")"; export ONET_USERNAME + ONET_PASSWORD="$(gcloud secrets versions access latest --secret=ONET_PASSWORD_$ENV --project="$PROJECT")"; export ONET_PASSWORD + STRIPE_SECRET_KEY="$(gcloud secrets versions access latest --secret=STRIPE_SECRET_KEY_$ENV --project="$PROJECT")"; export STRIPE_SECRET_KEY + STRIPE_PUBLISHABLE_KEY="$(gcloud secrets versions access latest --secret=STRIPE_PUBLISHABLE_KEY_$ENV --project="$PROJECT")"; export STRIPE_PUBLISHABLE_KEY + STRIPE_WH_SECRET="$(gcloud secrets versions access latest --secret=STRIPE_WH_SECRET_$ENV --project="$PROJECT")"; export STRIPE_WH_SECRET + STRIPE_PRICE_PREMIUM_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_MONTH + STRIPE_PRICE_PREMIUM_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PREMIUM_YEAR + STRIPE_PRICE_PRO_MONTH="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_MONTH_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_MONTH + STRIPE_PRICE_PRO_YEAR="$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_YEAR_$ENV --project="$PROJECT")"; export STRIPE_PRICE_PRO_YEAR + DB_NAME="$(gcloud secrets versions access latest --secret=DB_NAME_$ENV --project="$PROJECT")"; export DB_NAME + DB_HOST="$(gcloud secrets versions access latest --secret=DB_HOST_$ENV --project="$PROJECT")"; export DB_HOST + DB_PORT="$(gcloud secrets versions access latest --secret=DB_PORT_$ENV --project="$PROJECT")"; export DB_PORT + DB_USER="$(gcloud secrets versions access latest --secret=DB_USER_$ENV --project="$PROJECT")"; export DB_USER + DB_PASSWORD="$(gcloud secrets versions access latest --secret=DB_PASSWORD_$ENV --project="$PROJECT")"; export DB_PASSWORD + DB_SSL_CA="$(gcloud secrets versions access latest --secret=DB_SSL_CA_$ENV --project="$PROJECT")"; export DB_SSL_CA + DB_SSL_CERT="$(gcloud secrets versions access latest --secret=DB_SSL_CERT_$ENV --project="$PROJECT")"; export DB_SSL_CERT + DB_SSL_KEY="$(gcloud secrets versions access latest --secret=DB_SSL_KEY_$ENV --project="$PROJECT")"; export DB_SSL_KEY + EMAIL_INDEX_SECRET="$(gcloud secrets versions access latest --secret=EMAIL_INDEX_SECRET_$ENV --project="$PROJECT")"; export EMAIL_INDEX_SECRET + TWILIO_ACCOUNT_SID="$(gcloud secrets versions access latest --secret=TWILIO_ACCOUNT_SID_$ENV --project="$PROJECT")"; export TWILIO_ACCOUNT_SID + TWILIO_AUTH_TOKEN="$(gcloud secrets versions access latest --secret=TWILIO_AUTH_TOKEN_$ENV --project="$PROJECT")"; export TWILIO_AUTH_TOKEN + TWILIO_MESSAGING_SERVICE_SID="$(gcloud secrets versions access latest --secret=TWILIO_MESSAGING_SERVICE_SID_$ENV --project="$PROJECT")"; export TWILIO_MESSAGING_SERVICE_SID + KMS_KEY_NAME="$(gcloud secrets versions access latest --secret=KMS_KEY_NAME_$ENV --project="$PROJECT")"; export KMS_KEY_NAME + DEK_PATH="$(gcloud secrets versions access latest --secret=DEK_PATH_$ENV --project="$PROJECT")"; export DEK_PATH + SUPPORT_SENDGRID_API_KEY="$(gcloud secrets versions access latest --secret=SUPPORT_SENDGRID_API_KEY_$ENV --project="$PROJECT")"; export SUPPORT_SENDGRID_API_KEY + GOOGLE_MAPS_API_KEY="$(gcloud secrets versions access latest --secret=GOOGLE_MAPS_API_KEY_$ENV --project="$PROJECT")"; export GOOGLE_MAPS_API_KEY + SERVER1_PORT="$(gcloud secrets versions access latest --secret=SERVER1_PORT_$ENV --project="$PROJECT")"; export SERVER1_PORT + SERVER2_PORT="$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project="$PROJECT")"; export SERVER2_PORT + SERVER3_PORT="$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project="$PROJECT")"; export SERVER3_PORT + ENV_NAME="$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project="$PROJECT")"; export ENV_NAME + CORS_ALLOWED_ORIGINS="$(gcloud secrets versions access latest --secret=CORDS_ALLOWED_ORIGINS_$ENV --project="$PROJECT" 2>/dev/null || true)"; export CORS_ALLOWED_ORIGINS="${CORS_ALLOWED_ORIGINS:-}" + APTIVA_API_BASE="$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project="$PROJECT")"; export APTIVA_API_BASE + TOKEN_MAX_AGE_MS="$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project="$PROJECT")"; export TOKEN_MAX_AGE_MS + COOKIE_SECURE="$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project="$PROJECT")"; export COOKIE_SECURE + COOKIE_SAMESITE="$(gcloud secrets versions access latest --secret=COOKIE_SAMESITE_$ENV --project="$PROJECT")"; export COOKIE_SAMESITE + ACCESS_COOKIE_NAME="$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project="$PROJECT")"; export ACCESS_COOKIE_NAME + export FROM_SECRETS_MANAGER=true - # dev tag injected from CI at script-generation time - IMG_TAG_DEV="$IMG_TAG_DEV" - echo "🔖 Using DEV IMG_TAG=\$IMG_TAG_DEV" + APP_DIR="/home/jcoakley_aptivaai_com" + cd "$APP_DIR" - # read prod tag on the VM and enforce parity - IMG_TAG_PROD="$(gcloud secrets versions access latest --secret=IMG_TAG --project="\$PROJECT")" - [ "\$IMG_TAG_PROD" = "\$IMG_TAG_DEV" ] || { echo "❌ Tag mismatch on VM: dev=\$IMG_TAG_DEV prod=\$IMG_TAG_PROD"; exit 1; } - IMG_TAG="\$IMG_TAG_DEV"; export IMG_TAG - echo "✅ Tag parity ok (\$IMG_TAG)" + # Make Artifact Registry creds available to root (docker compose runs under sudo) + gcloud auth configure-docker us-central1-docker.pkg.dev -q + sudo gcloud auth configure-docker us-central1-docker.pkg.dev -q + + sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ + docker compose pull + + sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET \ + docker compose up -d --force-recreate --remove-orphans + + echo "✅ Prod stack refreshed with tag $IMG_TAG" + EOSSH - # Pull all runtime secrets from aptivaai-prod - JWT_SECRET=$(gcloud secrets versions access latest --secret=JWT_SECRET_$ENV --project=$PROJECT); export JWT_SECRET; \ - OPENAI_API_KEY=$(gcloud secrets versions access latest --secret=OPENAI_API_KEY_$ENV --project=$PROJECT); export OPENAI_API_KEY; \ - ONET_USERNAME=$(gcloud secrets versions access latest --secret=ONET_USERNAME_$ENV --project=$PROJECT); export ONET_USERNAME; \ - ONET_PASSWORD=$(gcloud secrets versions access latest --secret=ONET_PASSWORD_$ENV --project=$PROJECT); export ONET_PASSWORD; \ - STRIPE_SECRET_KEY=$(gcloud secrets versions access latest --secret=STRIPE_SECRET_KEY_$ENV --project=$PROJECT); export STRIPE_SECRET_KEY; \ - STRIPE_PUBLISHABLE_KEY=$(gcloud secrets versions access latest --secret=STRIPE_PUBLISHABLE_KEY_$ENV --project=$PROJECT); export STRIPE_PUBLISHABLE_KEY; \ - STRIPE_WH_SECRET=$(gcloud secrets versions access latest --secret=STRIPE_WH_SECRET_$ENV --project=$PROJECT); export STRIPE_WH_SECRET; \ - STRIPE_PRICE_PREMIUM_MONTH=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_MONTH_$ENV --project=$PROJECT); export STRIPE_PRICE_PREMIUM_MONTH; \ - STRIPE_PRICE_PREMIUM_YEAR=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PREMIUM_YEAR_$ENV --project=$PROJECT); export STRIPE_PRICE_PREMIUM_YEAR; \ - STRIPE_PRICE_PRO_MONTH=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_MONTH_$ENV --project=$PROJECT); export STRIPE_PRICE_PRO_MONTH; \ - STRIPE_PRICE_PRO_YEAR=$(gcloud secrets versions access latest --secret=STRIPE_PRICE_PRO_YEAR_$ENV --project=$PROJECT); export STRIPE_PRICE_PRO_YEAR; \ - DB_NAME=$(gcloud secrets versions access latest --secret=DB_NAME_$ENV --project=$PROJECT); export DB_NAME; \ - DB_HOST=$(gcloud secrets versions access latest --secret=DB_HOST_$ENV --project=$PROJECT); export DB_HOST; \ - DB_PORT=$(gcloud secrets versions access latest --secret=DB_PORT_$ENV --project=$PROJECT); export DB_PORT; \ - DB_USER=$(gcloud secrets versions access latest --secret=DB_USER_$ENV --project=$PROJECT); export DB_USER; \ - DB_PASSWORD=$(gcloud secrets versions access latest --secret=DB_PASSWORD_$ENV --project=$PROJECT); export DB_PASSWORD; \ - DB_SSL_CA=$(gcloud secrets versions access latest --secret=DB_SSL_CA_$ENV --project=$PROJECT); export DB_SSL_CA; \ - DB_SSL_CERT=$(gcloud secrets versions access latest --secret=DB_SSL_CERT_$ENV --project=$PROJECT); export DB_SSL_CERT; \ - DB_SSL_KEY=$(gcloud secrets versions access latest --secret=DB_SSL_KEY_$ENV --project=$PROJECT); export DB_SSL_KEY; \ - EMAIL_INDEX_SECRET=$(gcloud secrets versions access latest --secret=EMAIL_INDEX_SECRET_$ENV --project=$PROJECT); export EMAIL_INDEX_SECRET; \ - TWILIO_ACCOUNT_SID=$(gcloud secrets versions access latest --secret=TWILIO_ACCOUNT_SID_$ENV --project=$PROJECT); export TWILIO_ACCOUNT_SID; \ - TWILIO_AUTH_TOKEN=$(gcloud secrets versions access latest --secret=TWILIO_AUTH_TOKEN_$ENV --project=$PROJECT); export TWILIO_AUTH_TOKEN; \ - TWILIO_MESSAGING_SERVICE_SID=$(gcloud secrets versions access latest --secret=TWILIO_MESSAGING_SERVICE_SID_$ENV --project=$PROJECT); export TWILIO_MESSAGING_SERVICE_SID; \ - KMS_KEY_NAME=$(gcloud secrets versions access latest --secret=KMS_KEY_NAME_$ENV --project=$PROJECT); export KMS_KEY_NAME; \ - DEK_PATH=$(gcloud secrets versions access latest --secret=DEK_PATH_$ENV --project=$PROJECT); export DEK_PATH; \ - SUPPORT_SENDGRID_API_KEY=$(gcloud secrets versions access latest --secret=SUPPORT_SENDGRID_API_KEY_$ENV --project=$PROJECT); export SUPPORT_SENDGRID_API_KEY; \ - GOOGLE_MAPS_API_KEY=$(gcloud secrets versions access latest --secret=GOOGLE_MAPS_API_KEY_$ENV --project=$PROJECT); export GOOGLE_MAPS_API_KEY; \ - SERVER1_PORT=$(gcloud secrets versions access latest --secret=SERVER1_PORT_$ENV --project=$PROJECT); export SERVER1_PORT; \ - SERVER2_PORT=$(gcloud secrets versions access latest --secret=SERVER2_PORT_$ENV --project=$PROJECT); export SERVER2_PORT; \ - SERVER3_PORT=$(gcloud secrets versions access latest --secret=SERVER3_PORT_$ENV --project=$PROJECT); export SERVER3_PORT; \ - ENV_NAME=$(gcloud secrets versions access latest --secret=ENV_NAME_$ENV --project=$PROJECT); export ENV_NAME; \ - CORS_ALLOWED_ORIGINS=$(gcloud secrets versions access latest --secret=CORS_ALLOWED_ORIGINS_$ENV --project=$PROJECT); export CORS_ALLOWED_ORIGINS; \ - APTIVA_API_BASE=$(gcloud secrets versions access latest --secret=APTIVA_API_BASE_$ENV --project=$PROJECT); export APTIVA_API_BASE; \ - TOKEN_MAX_AGE_MS=$(gcloud secrets versions access latest --secret=TOKEN_MAX_AGE_MS_$ENV --project=$PROJECT); export TOKEN_MAX_AGE_MS; \ - COOKIE_SECURE=$(gcloud secrets versions access latest --secret=COOKIE_SECURE_$ENV --project=$PROJECT); export COOKIE_SECURE; \ - COOKIE_SAMESITE=$(gcloud secrets versions access latest --secret=COOKIE_SAMESITE_$ENV --project=$PROJECT); export COOKIE_SAMESITE; \ - ACCESS_COOKIE_NAME=$(gcloud secrets versions access latest --secret=ACCESS_COOKIE_NAME_$ENV --project=$PROJECT); export ACCESS_COOKIE_NAME; \ - export FROM_SECRETS_MANAGER=true; \ - \ - APP_DIR="/home/jcoakley_aptivaai_com"; \ - cd "$APP_DIR"; \ - gcloud auth configure-docker us-central1-docker.pkg.dev -q; \ - sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET,PROJECT \ - sudo -n bash -lc 'TOKEN=$(gcloud auth print-access-token); \ - echo "$TOKEN" | docker login -u oauth2accesstoken --password-stdin https://us-central1-docker.pkg.dev' - docker compose pull; \ - sudo --preserve-env=IMG_TAG,FROM_SECRETS_MANAGER,JWT_SECRET,OPENAI_API_KEY,ONET_USERNAME,ONET_PASSWORD,STRIPE_SECRET_KEY,STRIPE_PUBLISHABLE_KEY,STRIPE_WH_SECRET,STRIPE_PRICE_PREMIUM_MONTH,STRIPE_PRICE_PREMIUM_YEAR,STRIPE_PRICE_PRO_MONTH,STRIPE_PRICE_PRO_YEAR,DB_NAME,DB_HOST,DB_PORT,DB_USER,DB_PASSWORD,DB_SSL_CA,DB_SSL_CERT,DB_SSL_KEY,TWILIO_ACCOUNT_SID,TWILIO_AUTH_TOKEN,TWILIO_MESSAGING_SERVICE_SID,KMS_KEY_NAME,DEK_PATH,SUPPORT_SENDGRID_API_KEY,GOOGLE_MAPS_API_KEY,SERVER1_PORT,SERVER2_PORT,SERVER3_PORT,CORS_ALLOWED_ORIGINS,ENV_NAME,APTIVA_API_BASE,PROJECT,TOKEN_MAX_AGE_MS,COOKIE_SECURE,COOKIE_SAMESITE,ACCESS_COOKIE_NAME,EMAIL_INDEX_SECRET,PROJECT \ - docker compose up -d --force-recreate --remove-orphans; \ - echo "✅ Prod stack refreshed with tag $IMG_TAG" secrets: - PROD_SSH_KEY