AkurAI-Drive / backend/deploy.sh

Latest change 50b39439a0b58ad47208f3c1ee400b59d87c2fd7 - fix(ci): use EC2 host alias in Drive deployers by AkurAI Agent

#!/usr/bin/env bash
# Deploy rules of conduct:
# - Read AGENTS.md and canonical Notes/docs before changing or deploying.
# - Never print, commit, or copy secrets; use passvault/env files only.
# - Preserve env files, service users, user data, and databases; snapshot state before risky swaps.
# - Verify ports, DNS, TLS, and systemd unit names before changing routes or services.
# - Use managed services only (systemd/pm2); no nohup, background shells, or ad hoc daemons.
# - Run gates and health checks; if deploy fails, stop and roll back rather than improvising.
# - Keep deploy behavior unchanged unless the task explicitly asks for deploy logic changes.
set -euo pipefail


# Deploy akurai-drive-api to the AkurAI box (mail.olibuijr.com).
# Mirrors ~/Projects/akurai-idp/deploy.sh. The orchestrator runs this — not the
# build agent. Env vars live in /etc/akurai-drive-api.env (NOT managed here).
SSH_HOST="${AKURAI_MAIL_SSH:-akurai-ec2}"
DEPLOY_DIR="/opt/akurai-drive-api"
SERVICE="akurai-drive-api"
TARGET="x86_64-unknown-linux-musl"
PORT="${DRIVE_PORT:-8096}"

log()  { echo "[deploy] $*"; }
step() { echo; echo "── $* ──"; }
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
ROOT_DIR="$(cd -- "$SCRIPT_DIR/.." && pwd)"
BINARY_PATH="${DRIVE_API_BINARY:-}"
while (($#)); do
  case "$1" in
    --binary)
      BINARY_PATH="${2:?--binary requires a path}"
      shift 2
      ;;
    *)
      echo "usage: $0 [--binary PATH]" >&2
      exit 2
      ;;
  esac
done
if [[ -n "$BINARY_PATH" && "$BINARY_PATH" != /* ]]; then
  BINARY_PATH="$ROOT_DIR/$BINARY_PATH"
fi

if [[ -n "$BINARY_PATH" ]]; then
  BINARY="$BINARY_PATH"
else
  step "1/4  Build (musl static)"
  (cd "$SCRIPT_DIR" && CC_x86_64_unknown_linux_musl=musl-gcc cargo build --release --target "$TARGET")
  BINARY="$SCRIPT_DIR/target/$TARGET/release/akurai-drive-api"
fi
test -x "$BINARY"
log "Binary: $(du -sh "$BINARY" | cut -f1)"

step "2/4  Upload"
ssh "$SSH_HOST" "sudo mkdir -p $DEPLOY_DIR"
scp -q "$BINARY" "$SSH_HOST:/tmp/akurai-drive-api-bin"
ssh "$SSH_HOST" "sudo install -m 755 /tmp/akurai-drive-api-bin $DEPLOY_DIR/akurai-drive-api && rm /tmp/akurai-drive-api-bin"

step "3/4  Install service"
ssh "$SSH_HOST" "sudo bash -s" <<'INSTALL'
set -euo pipefail

# Ensure the service user exists.
id -u drive >/dev/null 2>&1 || useradd --system --no-create-home --shell /usr/sbin/nologin drive

cat > /etc/systemd/system/akurai-drive-api.service <<EOF
[Unit]
Description=AkurAI Drive API (Rust OIDC RP + S3 provisioning)
After=network.target

[Service]
Type=simple
ExecStart=/opt/akurai-drive-api/akurai-drive-api
WorkingDirectory=/opt/akurai-drive-api
EnvironmentFile=/etc/akurai-drive-api.env
Restart=always
RestartSec=3
User=drive
Group=drive

[Install]
WantedBy=multi-user.target
EOF

# Data dir for the SQLite DB (path comes from DRIVE_DB_PATH in the env file).
mkdir -p /data/akurai-drive
chown drive:drive /data/akurai-drive

systemctl daemon-reload
systemctl enable akurai-drive-api >/dev/null 2>&1 || true
systemctl restart akurai-drive-api
echo "  [done] service restarted"
INSTALL

step "4/4  Healthcheck"
sleep 2
if ssh "$SSH_HOST" "curl -fsS http://127.0.0.1:$PORT/healthz" | grep -q '"ok":true'; then
  log "Healthcheck passed"
else
  echo "ERROR: healthcheck failed"
  echo "Check: ssh $SSH_HOST 'sudo journalctl -u $SERVICE -n 50'"
  exit 1
fi

RSS=$(ssh "$SSH_HOST" "ps -C akurai-drive-api -o rss= 2>/dev/null | head -1 | tr -d ' '" 2>/dev/null || echo "?")
echo
echo "════════════════════════════════════════════════════"
echo "  AkurAI Drive API deployed (Rust, musl)"
echo "════════════════════════════════════════════════════"
echo "  Binary  : $(du -sh "$BINARY" | cut -f1)"
echo "  RSS     : ${RSS} KB"
echo "  Host    : $SSH_HOST"
echo "  Port    : 127.0.0.1:$PORT"
echo "  Public  : https://akurai-drive.olibuijr.com"
echo "════════════════════════════════════════════════════"