AkurAI-Platform / .akurai.yml

Latest change 33852c25bc10c730266ef5c691e0b22bf23cd1d1 - fix(platform): isolate payment edge routes (AKURAI-PLATFORM-15) by Ólafur Búi Ólafsson

version: 1
jobs:
  - name: verify
    executor: native
    branches: [master]
    run:
      - bun install --frozen-lockfile
      - bun run payment:check
      - bun run payment:test
      - python3 scripts/validate-page.py
      - bash -n scripts/check-live.sh
      - 'bash scripts/check-live.sh || echo "smoke: production not reachable from CI verify (expected)"'

  - name: package
    needs: [verify]
    executor: native
    branches: [master]
    run: |
      install -m 755 /home/olafurbui/.local/share/akurai-build/artifacts/362/1019/target/x86_64-unknown-linux-musl/release/akurai ./akurai-bin
      bun install --frozen-lockfile
      bun run payment:build
      tar czf akurai-platform-site.tar.gz frontend backend deployment
    artifacts:
      - akurai-bin
      - dist/akurai-platform-payments
      - akurai-platform-site.tar.gz

  - name: deploy
    needs: [package]
    executor: native
    environment: production
    approval: true
    branches: [master]
    run: |
      export HOME=/home/olafurbui
      export PATH=/home/olafurbui/.local/bin:/usr/bin:/bin
      FRAMEWORK_BIN=./akurai-bin
      PAYMENTS_BIN=dist/akurai-platform-payments
      test -x "$FRAMEWORK_BIN" || { echo "missing packaged framework binary" >&2; exit 1; }
      test -x "$PAYMENTS_BIN" || { echo "missing packaged payment binary" >&2; exit 1; }
      test -f akurai-platform-site.tar.gz || { echo "missing packaged site and edge configuration" >&2; exit 1; }

      echo "==> protected payment environment"
      akurai-ec2 ssh "sudo test -f /etc/akurai-platform-payments.env"
      akurai-ec2 ssh "sudo grep -Eq '^PAYMENTS_(TRUSTED_PROXY_SECRET|IDENTITY_SECRET|IDP_PUBLIC_KEY)=.+$' /etc/akurai-platform-payments.env"

      rm -rf .deploy-site
      mkdir .deploy-site
      tar xzf akurai-platform-site.tar.gz -C .deploy-site

      echo "==> framework and site"
      akurai-ec2 deploy-binary akurai-platform "$FRAMEWORK_BIN" 8098 .deploy-site

      echo "==> payment gateway"
      AKURAI_EXEC_START="{bin}" \
      AKURAI_ENV_FILE="/etc/akurai-platform-payments.env" \
      AKURAI_DATA_DIR="/var/lib/akurai-platform-payments" \
      AKURAI_HARDEN=1 \
        akurai-ec2 deploy-binary akurai-platform-payments "$PAYMENTS_BIN" 8198

      echo "==> independent service health"
      akurai-ec2 ssh "curl -fsS http://127.0.0.1:8098/api/health >/dev/null"
      payment_health="$(akurai-ec2 ssh "curl -fsS http://127.0.0.1:8198/api/payments/health")"
      PAYMENT_HEALTH="$payment_health" python3 -c 'import json, os; value=json.loads(os.environ["PAYMENT_HEALTH"]); assert value["ok"] is True and value["provider"] == "disabled" and value["paymentsEnabled"] is False'

      echo "==> public split edge cutover"
      akurai-ec2 ship .deploy-site/deployment/akurai-platform-proxy.conf /tmp/akurai-platform-proxy.conf
      akurai-ec2 ship .deploy-site/deployment/platform.olibuijr.com.conf /tmp/platform.olibuijr.com.conf
      akurai-ec2 ssh "sudo install -D -m 644 /tmp/akurai-platform-proxy.conf /etc/nginx/snippets/akurai-platform-proxy.conf && sudo install -m 644 /tmp/platform.olibuijr.com.conf /etc/nginx/sites-available/platform.olibuijr.com && sudo ln -sf /etc/nginx/sites-available/platform.olibuijr.com /etc/nginx/sites-enabled/platform.olibuijr.com && sudo nginx -t && sudo systemctl reload nginx"
      akurai-ec2 tls platform.olibuijr.com
      curl -fsS https://platform.olibuijr.com/api/health | python3 -c 'import json, sys; assert json.load(sys.stdin)["status"] == "ok"'
      curl -fsS https://platform.olibuijr.com/api/payments/health | python3 -c 'import json, sys; value=json.load(sys.stdin); assert value["ok"] is True and value["provider"] == "disabled" and value["paymentsEnabled"] is False'

      echo "==> cross-environment health sweep"
      akurai-health-sweep --self akurai-platform

      echo "==> public smoke check"
      bash scripts/check-live.sh