mirror of
https://github.com/jjbrunton/Sauci.git
synced 2026-10-31 18:19:43 +00:00
jjbrunton
006761d3b0
Replace the Supabase application data plane with the Node/PostgreSQL API, migrate mobile, admin, web, and MCP callers, add controlled cutover tooling, and define hardened Dokploy infrastructure.
50 lines
2.7 KiB
Bash
Executable File
50 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
compose_file="$repo_root/infra/backend/compose.production.yaml"
|
|
project_name="sauci-deploy-verify-$$"
|
|
|
|
# Deliberately fixed disposable values: this check must never consume deployment
|
|
# secrets or connect to an externally configured database.
|
|
export POSTGRES_PASSWORD='sauci-container-test-only'
|
|
export DATABASE_URL='postgresql://sauci:sauci-container-test-only@postgres:5432/sauci'
|
|
export SUPABASE_AUTH_URL='https://example.supabase.co'
|
|
export SUPABASE_AUTH_AUDIENCE='authenticated'
|
|
export SUPABASE_AUTH_SERVICE_ROLE_KEY='container-test-auth-admin-only'
|
|
export ADMIN_API_SERVICE_TOKEN='container-test-admin-service-token-123456789'
|
|
export ADMIN_API_SERVICE_USER_ID='00000000-0000-4000-8000-000000000002'
|
|
export REVENUECAT_API_KEY='container-test-revenuecat-only'
|
|
export REVENUECAT_WEBHOOK_SECRET='container-test-webhook-only'
|
|
export MEDIA_SIGNING_SECRET='sauci-media-container-test-only-secret'
|
|
export MEDIA_PUBLIC_BASE_URL='https://api.sauci.test'
|
|
export CLASSIFIER_ENABLED='false'
|
|
|
|
cleanup() {
|
|
docker compose -p "$project_name" -f "$compose_file" down --volumes --remove-orphans >/dev/null 2>&1 || true
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
docker compose -p "$project_name" -f "$compose_file" config >/dev/null
|
|
docker compose -p "$project_name" -f "$compose_file" up -d --build --wait
|
|
|
|
docker compose -p "$project_name" -f "$compose_file" exec -T api node -e \
|
|
"Promise.all(['/health/live','/health/ready','/v1/me'].map(async p=>[p,(await fetch('http://127.0.0.1:3003'+p)).status])).then(results=>{const expected=[200,200,401];if(results.some((result,index)=>result[1]!==expected[index])){console.error(results);process.exit(1)};console.log(results)})"
|
|
|
|
docker compose -p "$project_name" -f "$compose_file" run --rm migrate
|
|
docker compose -p "$project_name" -f "$compose_file" exec -T api sh -c 'test "$(id -u)" != 0'
|
|
docker compose -p "$project_name" -f "$compose_file" exec -T worker sh -c 'test "$(id -u)" != 0'
|
|
docker compose -p "$project_name" -f "$compose_file" exec -T api sh -c 'touch /data/media/write-check && rm /data/media/write-check'
|
|
|
|
if docker compose -p "$project_name" -f "$compose_file" exec -T api sh -c 'touch /app/should-not-write'; then
|
|
echo 'API filesystem unexpectedly allowed writes' >&2
|
|
exit 1
|
|
fi
|
|
|
|
docker compose -p "$project_name" -f "$compose_file" stop api
|
|
docker compose -p "$project_name" -f "$compose_file" logs --no-color api | grep -q 'Received SIGTERM; shutting down'
|
|
docker compose -p "$project_name" -f "$compose_file" stop worker
|
|
docker compose -p "$project_name" -f "$compose_file" logs --no-color worker | grep -q 'stopping operations worker'
|
|
|
|
echo 'Production container verification passed'
|