rollout.sh

#!/usr/bin/env bash

set -eou pipefail

GIT_BRANCH=${GIT_BRANCH:-main}

echo "Deploying git branch $GIT_BRANCH, docker tag $DOCKER_TAG"

source_env() {
    set -a
    # shellcheck source=/dev/null
    source .env
    set +a
}

send_slack_message() {
    escaped_message=$(echo "$@" | jq -Rsa .)
    curl -s -o /dev/null -XPOST "$SLACK_WEBHOOK" -d '{
      "blocks": [
        {
          "type": "section",
          "text": {
            "type": "mrkdwn",
            "text": '"$escaped_message"'
          }
        }
      ]
    }'
}

# send a failure message if this script errors for any reason
handle_error() {
    send_slack_message "🚨 Roll out failed 🚨"
    exit 1
}
trap 'handle_error' ERR

# update .env variables
# we don't want different service deployments to cause collisions
# or restarting docker daemon or the VM to reset a service to its main tag
# so maintain which docker tag was last deployed using .env
update_env() {
    VAR_NAME="$1"
    VALUE="$2"
    if grep -Eq "^${VAR_NAME}=" .env; then
        sed -i "s/^$VAR_NAME=.*/$VAR_NAME=$VALUE/" .env
    else
        echo "${VAR_NAME}=${VALUE}" | tee -a .env
    fi
}

docker_compose() {
    docker compose \
      -f docker-compose.yaml \
      -f "docker-compose.$HOSTNAME.yaml" \
      "$@"
}

create_secret_paths() {
  # Parse docker-compose files and create any missing secrets directories/files
  # This only handles volume mounts (e.g. volumes: [./secrets/foo/secret:/app/secret])
  # docker compose secrets are generated in ./create-secrets.sh
  # this script is to avoid starting a new service without the file on the host
  # which would create the secret file as a directory on the host
  # and is toilsome to cleanup

  docker_compose config --format json | \
    jq -r '.services[].volumes // [] | .[] | select(. != null) | .source | select(startswith("/opt/linderman/secrets/"))' | \
  while read -r SECRET; do
    if [ -f "$SECRET" ]; then
      continue
    fi

    DIR=$(dirname "$SECRET")
    if [ ! -d "$DIR" ]; then
      echo "Creating secrets directory: $DIR"
      mkdir -p "$DIR"
    fi

    echo "Creating empty secrets file: $SECRET"
    touch "$SECRET"
  done
}

cd /opt/linderman || exit 1

source_env

# TODO link right to PRs
send_slack_message "Rolling out <https://github.com/${GIT_REPO}/tree/${GIT_BRANCH}|${GIT_REPO#*/}:${DOCKER_TAG}> to \`${DOMAIN%%.*}\` :rocket: :shipit: :rocket:"

# specify which docker services to pull/restart based on the app/repo being deployed
DOCKER_SERVICES=("traefik" "rollout")
if [ "$GIT_REPO" = "lehigh-university-libraries/folio-offline-shelf-reading" ]; then
  update_env "SHELF_READING_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("shelf-reading")
elif [ "$GIT_REPO" = "lehigh-university-libraries/folio-shelving-order" ]; then
  update_env "SHELVING_ORDER_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("folio-shelving-order")
elif [ "$GIT_REPO" = "lehigh-university-libraries/ole-gate-count" ]; then
  update_env "OLE_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("gate-counts")
elif [ "$GIT_REPO" = "lehigh-university-libraries/folio-celus-report-link" ]; then
  update_env "CELUS_REPORT_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("folio-celus-report-link")
elif [ "$GIT_REPO" = "lehigh-university-libraries/folio-email-new-requests" ]; then
  update_env "EMAIL_NEW_REQUESTS_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("email-new-requests")
elif [ "$GIT_REPO" = "lehigh-university-libraries/triage-donations" ]; then
  update_env "TRIAGE_DONATIONS_TAG" "${DOCKER_TAG}"
  DOCKER_SERVICES=("triage-donations")
elif [ "$GIT_REPO" = "lehigh-university-libraries/linderman" ]; then
  git fetch origin
  git reset --hard
  git checkout "$GIT_BRANCH"
  git pull origin "$GIT_BRANCH"
else
  echo "Unknown repo: $GIT_REPO"
  exit 1
fi

# need to load .env again after we updated our .env file
source_env

./scripts/maintenance/create-secrets.sh

# Create any missing secrets directories and files from docker-compose volumes
create_secret_paths

docker_compose pull --quiet "${DOCKER_SERVICES[@]}"

# TODO if relevant, put app into read-only mode, we are about to restart any containers we pulled

docker_compose up \
  --remove-orphans \
  --wait \
  --pull missing \
  --quiet-pull \
  "${DOCKER_SERVICES[@]}" \
  -d

# TODO any app specific maintenance tasks

echo "ensuring all containers are online"
docker_compose up \
  --remove-orphans \
  --wait \
  --pull missing \
  --quiet-pull \
  "${DOCKER_SERVICES[@]}" \
  -d

send_slack_message "Roll out complete 🎉"

# TODO any app specific post deployment tasks