jared
40ceb43672
The chat.lotusguild.org nginx config (LXC 106) was edited directly on the box and never tracked — which is how its CSP drifted (kept a dead Sentry URL and blocked matrix.org logins). Snapshot it as cinny/nginx.conf (verbatim from prod, incl. the corrected connect-src that now allows matrix.org/*.matrix.org) and deploy it via lxc106-cinny.sh: back up the live file, swap, `nginx -t`, and reload only on success (auto-restore the backup if validation fails, so a bad config can't take the site down). TLS terminates at the NPM proxy, so this is a plain HTTP server block with no secrets. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
81 lines
3.0 KiB
Bash
81 lines
3.0 KiB
Bash
#!/bin/bash
|
|
# Auto-deploy script for LXC 106 (cinny)
|
|
# Handles: cinny/config.json, cinny/nginx.conf, cinny/upstream-check.sh,
|
|
# cinny/lotus-build.sh, deploy/hooks-lxc106.json,
|
|
# systemd/cinny-upstream-check.cron
|
|
# Triggered by: Gitea webhook on push to main
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="/opt/matrix-config"
|
|
LOG="/var/log/matrix-deploy.log"
|
|
CLONE_URL="https://code.lotusguild.org/LotusGuild/matrix.git"
|
|
|
|
exec >> "$LOG" 2>&1
|
|
echo "=== $(date) === LXC106 deploy triggered ==="
|
|
|
|
if [ ! -d "$REPO_DIR/.git" ]; then
|
|
git clone "$CLONE_URL" "$REPO_DIR"
|
|
CHANGED="cinny/config.json cinny/nginx.conf cinny/upstream-check.sh cinny/lotus-build.sh deploy/hooks-lxc106.json systemd/cinny-upstream-check.cron"
|
|
else
|
|
cd "$REPO_DIR"
|
|
git fetch --all
|
|
PREV=$(git rev-parse HEAD)
|
|
git reset --hard origin/main
|
|
NEW=$(git rev-parse HEAD)
|
|
CHANGED=$(git diff --name-only "$PREV" "$NEW")
|
|
echo "Changed files: $CHANGED"
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^cinny/config.json'; then
|
|
echo "Deploying cinny config.json..."
|
|
cp "$REPO_DIR/cinny/config.json" /var/www/html/config.json
|
|
echo "✓ config.json deployed"
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^cinny/nginx.conf'; then
|
|
echo "Deploying cinny nginx site config..."
|
|
# Back up the live config, swap in the repo copy, and validate before
|
|
# reloading. If `nginx -t` fails, restore the backup and skip the reload so
|
|
# a bad config can never take the site down.
|
|
BACKUP="/etc/nginx/sites-available/cinny.bak-$(date +%Y%m%d%H%M%S)"
|
|
cp /etc/nginx/sites-available/cinny "$BACKUP"
|
|
cp "$REPO_DIR/cinny/nginx.conf" /etc/nginx/sites-available/cinny
|
|
if nginx -t; then
|
|
systemctl reload nginx
|
|
echo "✓ nginx site config deployed + reloaded"
|
|
else
|
|
echo "✗ nginx -t FAILED — restoring previous config, skipping reload"
|
|
cp "$BACKUP" /etc/nginx/sites-available/cinny
|
|
fi
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^cinny/upstream-check.sh'; then
|
|
echo "Deploying upstream-check.sh..."
|
|
cp "$REPO_DIR/cinny/upstream-check.sh" /usr/local/bin/cinny-upstream-check.sh
|
|
chmod +x /usr/local/bin/cinny-upstream-check.sh
|
|
echo "✓ upstream-check.sh deployed"
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^cinny/lotus-build.sh'; then
|
|
echo "Deploying lotus-build.sh..."
|
|
cp "$REPO_DIR/cinny/lotus-build.sh" /usr/local/bin/cinny-build.sh
|
|
chmod +x /usr/local/bin/cinny-build.sh
|
|
echo "✓ lotus-build.sh deployed"
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^deploy/hooks-lxc106.json'; then
|
|
echo "Deploying hooks-lxc106.json..."
|
|
cp "$REPO_DIR/deploy/hooks-lxc106.json" /etc/webhook/hooks.json
|
|
systemctl restart webhook
|
|
echo "✓ hooks.json deployed, webhook restarted"
|
|
fi
|
|
|
|
if echo "$CHANGED" | grep -q '^systemd/cinny-upstream-check.cron'; then
|
|
echo "Deploying cinny-upstream-check.cron..."
|
|
cp "$REPO_DIR/systemd/cinny-upstream-check.cron" /etc/cron.d/cinny-upstream-check
|
|
chmod 644 /etc/cron.d/cinny-upstream-check
|
|
echo "✓ cron deployed"
|
|
fi
|
|
|
|
echo "=== $(date) === LXC106 deploy complete ==="
|