AkurAI-Build / deploy/service-deploy.sh

Latest change a0c9d4ff8c1ee8397ccd5287465783b1f0f23d04 - deploy: path-activated root forge swap; CI job stages binary without sudo (OLI-279) by Ólafur Búi Ólafsson

#!/bin/sh
# Replace the live AkurAI-Build forge binary (system unit akurai-build).
#
# Live layout (see `systemctl cat akurai-build`):
#   binary  $HOME/.local/lib/akurai-build/akurai   (unit runs as the host user)
#   health  http://127.0.0.1:3210/api/health
#
# Steps: back up akurai -> akurai.prev, install target/release/akurai, restart,
# poll health up to 20s, restore akurai.prev and restart on failure.
#
# Self-restart: the forge unit sets NoNewPrivileges=true, so CI jobs cannot
# sudo. With --scheduled (as .akurai.yml does) the job only stages the binary
# and a request file in the data dir's deploy-staging/; the root-owned
# akurai-build-swap.path unit (deploy/systemd, installed once via
# deploy/systemd/install.sh) fires forge-swap.sh, which swaps, restarts, polls
# health and rolls back. Result: `journalctl -u akurai-build-swap`.
# Without --scheduled, run from a host shell to swap directly (needs sudo).
set -eu

host_home="${AKURAI_HOST_HOME:-$HOME}"
dest_dir="${AKURAI_BUILD_LIB:-$host_home/.local/lib/akurai-build}"
dest="$dest_dir/akurai"
unit=akurai-build
health=http://127.0.0.1:3210/api/health

swap() {
  src="$1"
  test -x "$src"
  test -x "$dest"
  sudo install -m 755 "$dest" "$dest.prev"
  sudo install -m 755 "$src" "$dest.new"
  sudo mv -f "$dest.new" "$dest"
  sudo systemctl restart "$unit"
  i=0
  while [ "$i" -lt 20 ]; do
    if curl -fsS -o /dev/null "$health"; then
      echo "akurai-build healthy"
      return 0
    fi
    i=$((i + 1))
    sleep 1
  done
  echo "akurai-build unhealthy after 20s; rolling back" >&2
  sudo install -m 755 "$dest.prev" "$dest"
  sudo systemctl restart "$unit"
  return 1
}

test -x target/release/akurai

if [ "${1:-}" = "--scheduled" ]; then
  stage_dir="${AKURAI_DEPLOY_STAGING:-${AKURAI_BUILD_DATA:-$host_home/.local/share/akurai-build}/deploy-staging}"
  mkdir -p "$stage_dir"
  install -m 755 target/release/akurai "$stage_dir/akurai"
  : > "$stage_dir/request"
  echo "forge swap requested; check: journalctl -u akurai-build-swap"
  exit 0
fi

swap target/release/akurai