`verification/TK-11380/deploy-approved.sh`

53 lines
#!/usr/bin/env bash
# Run on Kamatera only. Approval recorded on TK-11380; expires 2026-09-11T09:19:10Z.
set -euo pipefail
test "$(date -u +%s)" -lt 1789118350
cd /root/public-projects/carmelwallpapers
test -f /tmp/TK-11380-carmel.patch
git apply --check /tmp/TK-11380-carmel.patch
nginx -t > /tmp/TK-11380-nginx-preflight.log 2>&1
if ss -lnt | grep -q ':19961 '; then echo 'ABORT: port19961 already occupied'; exit 1; fi
if grep -R -q '19961' /etc/nginx/sites-enabled /etc/nginx/conf.d; then echo 'ABORT: port19961 already referenced'; exit 1; fi
pm2 jlist | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{if(JSON.parse(s).some(p=>p.name==="carmelwallpapers"||String(p.pm2_env.PORT)==="19961")) process.exit(1)})'
if git ls-files | grep -qE '(^|/)\.env($|\.)'; then echo 'ABORT: tracked env file requires review'; exit 1; fi
backup="/root/backups/TK-11380-carmel-$(date -u +%Y%m%dT%H%M%SZ)"
mkdir -m 700 -p "$backup"
printf '%s\n' "$backup" > /tmp/TK-11380-carmel-backup-path
nginx_file=$(readlink -f /etc/nginx/sites-enabled/carmelwallpapers.com)
cp -a "$nginx_file" "$backup/nginx.conf"
cp -a server.js ecosystem.config.cjs site.config.json .deploy.conf "$backup/"
git status --short > "$backup/worktree-before.txt"
sha256sum data/products.json > "$backup/products.sha256"
git add -u
git add -- .deploy.conf ecosystem.config.cjs public/favicon.ico public/favicon.svg public/hero-pool.json
git -c user.name='Steve Abrams' -c user.email=steve@designerwallcoverings.com commit -m 'snapshot before approved Carmel routing repair'
git rev-parse HEAD > "$backup/snapshot-commit"
git apply /tmp/TK-11380-carmel.patch
node --check server.js
npm ci --omit=dev --ignore-scripts --no-audit --no-fund
pm2 start ecosystem.config.cjs --only carmelwallpapers --update-env
for attempt in {1..20}; do
  if curl -fsS http://127.0.0.1:19961/health > "$backup/health-after.json"; then break; fi
  sleep 1
done
node -e 'const a=require("assert/strict"),h=require(process.argv[1]);a.equal(h.ok,true);a.equal(h.site,"carmelwallpapers");a.ok(h.products>0)' "$backup/health-after.json"
curl -fsS http://127.0.0.1:19961/ > "$backup/home-after.html"
node -e 'const a=require("assert/strict"),s=require("fs").readFileSync(process.argv[1],"utf8");a.ok(s.includes("Carmel Wallpapers — Coastal California"));a.equal(s.split("adsbygoogle.js").length-1,1)' "$backup/home-after.html"
test "$(curl -fsS http://127.0.0.1:19961/ads.txt)" = 'google.com, pub-5278231299883833, DIRECT, f08c47fec0942fa0'
sha256sum -c "$backup/products.sha256"
python3 - "$nginx_file" <<'PY'
import pathlib,sys
p=pathlib.Path(sys.argv[1]); s=p.read_text()
old='proxy_pass http://localhost:9861;'
assert s.count(old)==1, 'Unexpected Carmel Nginx upstream; stop for review'
p.write_text(s.replace(old,'proxy_pass http://127.0.0.1:19961;'))
PY
if ! nginx -t > "$backup/nginx-after.log" 2>&1; then cp -a "$backup/nginx.conf" "$nginx_file"; echo 'Nginx validation failed; previous config restored'; exit 1; fi
if ! systemctl reload nginx; then cp -a "$backup/nginx.conf" "$nginx_file"; nginx -t && systemctl reload nginx; exit 1; fi
curl -fsS https://carmelwallpapers.com/health > "$backup/public-health.json"
node -e 'const a=require("assert/strict"),h=require(process.argv[1]);a.equal(h.site,"carmelwallpapers");a.ok(h.products>0)' "$backup/public-health.json"
pm2 save
git add -- server.js ecosystem.config.cjs site.config.json .deploy.conf
git -c user.name='Steve Abrams' -c user.email=steve@designerwallcoverings.com commit -m 'Restore Carmel storefront on dedicated localhost port'
printf 'DEPLOYED backup=%s commit=%s\n' "$backup" "$(git rev-parse --short HEAD)"