feat(deploy): add production one-click deployment

2026-09-11 14:10:39 +08:00
parent 6eee55860f
commit a06d4f4199
5 changed files with 126 additions and 12 deletions
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+set -euo pipefail
+export LC_ALL=C
+
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+bundle_root=$(cd "$script_dir/../.." && pwd)
+env_file=
+allow_local_images=false
+
+usage() {
+    cat <<'EOF'
+Usage: deploy/docker/deploy.sh [env-file] [--allow-local-images]
+
+Use --allow-local-images only with a SHA256-verified production bundle whose
+application images were loaded from its images/ archive.
+EOF
+}
+
+while (($#)); do
+    case $1 in
+    --allow-local-images)
+        allow_local_images=true
+        shift
+        ;;
+    -h | --help)
+        usage
+        exit 0
+        ;;
+    -*)
+        echo "unknown option: $1" >&2
+        usage >&2
+        exit 2
+        ;;
+    *)
+        if [[ -n $env_file ]]; then
+            echo "only one env file may be specified" >&2
+            usage >&2
+            exit 2
+        fi
+        env_file=$1
+        shift
+        ;;
+    esac
+done
+
+env_file=${env_file:-$bundle_root/.env}
+if ! env_file=$(realpath -e -- "$env_file"); then
+    echo "environment file does not exist: $env_file" >&2
+    exit 1
+fi
+
+if [[ -f $bundle_root/SHA256SUMS ]]; then
+    (cd "$bundle_root" && sha256sum -c SHA256SUMS)
+elif [[ $allow_local_images == true ]]; then
+    echo "--allow-local-images requires a SHA256-verified production bundle" >&2
+    exit 1
+fi
+
+preflight_args=()
+if [[ $allow_local_images == true ]]; then
+    preflight_args+=(--allow-local-images)
+fi
+"$script_dir/preflight.sh" "${preflight_args[@]}" "$env_file"
+
+compose=(docker compose --env-file "$env_file" -f "$script_dir/docker-compose.prod.yml")
+"${compose[@]}" config --quiet
+"${compose[@]}" --profile ops run --rm migrate
+"${compose[@]}" up -d --wait
+
+echo "production deployment is ready"