`verification/TK-11380/deploy-disclosures.sh`

57 lines
#!/usr/bin/env bash
# Run on Kamatera. Narrow approved patch deployment; no data files overwritten.
set -euo pipefail
test "$(date -u +%s)" -lt 1789118350
case "${1:-}" in
 carmel)
  app=/root/public-projects/carmelwallpapers; process=carmelwallpapers; domain=carmelwallpapers.com; port=19961
  data=data/products.json
  files=(server.js public/about.html public/privacy.html public/robots.txt)
  ;;
 hospitality)
  app=/root/Projects/hospitalitydesignreps; process=hospitalitydesignreps; domain=hospitalitydesignreps.com; port=9927
  data=data/reps.json
  files=(server.js views/privacy.ejs views/about.ejs views/partials/head.ejs views/partials/foot.ejs)
  ;;
 *) exit 2 ;;
esac
patch="/tmp/TK-11380-$1-disclosures.patch"
cd "$app"
git apply --check "$patch"
if git ls-files | grep -qE '(^|/)\.env($|\.)'; then echo 'ABORT tracked env'; exit 1; fi
nginx -t > /tmp/TK-11380-disclosure-nginx.log 2>&1
backup="/root/backups/TK-11380-$1-disclosures-$(date -u +%Y%m%dT%H%M%SZ)"
mkdir -m 700 -p "$backup"
for file in "${files[@]}"; do
 if test -f "$file"; then mkdir -p "$backup/$(dirname "$file")"; cp -a "$file" "$backup/$file"; fi
done
sha256sum "$data" > "$backup/data.sha256"
git status --short > "$backup/worktree-before.txt"
git add -u
if ! git diff --cached --quiet; then
 git -c user.name='Steve Abrams' -c user.email=steve@designerwallcoverings.com commit -m "snapshot before approved $1 disclosures"
fi
git rev-parse HEAD > "$backup/snapshot-commit"
git apply "$patch"
node --check server.js
pm2 restart "$process" > "$backup/restart.log" 2>&1
for attempt in {1..20}; do
 if curl -fsS "http://127.0.0.1:$port/privacy" > "$backup/private-probe.html"; then break; fi
 sleep 1
done
for path in privacy about sitemap.xml robots.txt; do
 curl -fsS "https://$domain/$path" > "$backup/$path"
done
python3 - "$backup" <<'PY'
import pathlib,sys,xml.etree.ElementTree as ET
p=pathlib.Path(sys.argv[1]); root=ET.parse(p/'sitemap.xml').getroot()
assert root.tag=='{http://www.sitemaps.org/schemas/sitemap/0.9}urlset'
assert len(root)>60
assert 'My Ad Center' in (p/'privacy').read_text()
print('PUBLIC_DISCLOSURES_PASS',len(root))
PY
sha256sum -c "$backup/data.sha256"
git add -- "${files[@]}"
git -c user.name='Steve Abrams' -c user.email=steve@designerwallcoverings.com commit -m "Publish $1 privacy and crawl improvements"
printf 'DEPLOYED %s backup=%s commit=%s\n' "$domain" "$backup" "$(git rev-parse --short HEAD)"