From ad90aad959973082f1801a19375cd68695a212c7 Mon Sep 17 00:00:00 2001 From: David Schroeder Date: Sat, 25 Jul 2026 16:11:08 -0500 Subject: [PATCH] update --- .env.example | 2 ++ docs/deployment.md | 24 ++++++++++++--- update.sh | 76 ++++++++++++++++++++++++++++------------------ 3 files changed, 69 insertions(+), 33 deletions(-) diff --git a/.env.example b/.env.example index f8e8007..af69ca4 100644 --- a/.env.example +++ b/.env.example @@ -1,4 +1,6 @@ TAPM_LISTEN_ADDR=127.0.0.1:8080 +TAPM_UPDATE_PEERS=10.10.1.122 +TAPM_UPDATE_SSH_USER=root TAPM_PUBLIC_URL=https://tapm.scity.us TAPM_DATABASE_DSN=tapm:change-me@tcp(127.0.0.1:3306)/tapm_broker?parseTime=true&charset=utf8mb4&collation=utf8mb4_unicode_ci&multiStatements=true&time_zone=%27%2B00%3A00%27 TAPM_GITEA_URL=https://git.scity.us diff --git a/docs/deployment.md b/docs/deployment.md index c730ede..1b4d7ff 100644 --- a/docs/deployment.md +++ b/docs/deployment.md @@ -123,10 +123,26 @@ For later updates, run the repository update helper from either webserver: ``` The helper updates and health-checks the local broker first, then connects as -`root` to the other broker (`10.10.1.121` or `10.10.1.122`) and performs the -same local-only check there. This provides a sequential rolling update from -either node. An unreachable peer is skipped with a warning; a reachable peer -whose update fails causes the command to fail. +`TAPM_UPDATE_SSH_USER` to each comma-separated host in `TAPM_UPDATE_PEERS` and +performs the same local-only check there. This provides a sequential rolling +update from any node. An unreachable peer is skipped with a warning; a reachable +peer whose update fails causes the command to fail. The SSH user defaults to +`root` when omitted. + +Configure each webserver's `.env` with its other broker: + +```dotenv +# Webserver-Node1 +TAPM_UPDATE_PEERS=10.10.1.122 +TAPM_UPDATE_SSH_USER=root + +# Webserver-Node2 +TAPM_UPDATE_PEERS=10.10.1.121 +TAPM_UPDATE_SSH_USER=root +``` + +Additional peers can be listed with commas. The updater reads only these named +settings and does not source `.env` as executable shell code. Each node fetches and compares its current tracked branch with its upstream. If both commits match, that node's Docker services are untouched. When an update diff --git a/update.sh b/update.sh index 9678499..c89d2e7 100755 --- a/update.sh +++ b/update.sh @@ -69,12 +69,30 @@ deploy_local_broker() { fail "broker did not become healthy within 150 seconds" } +read_env_setting() { + local key="$1" + local value + + value="$( + sed -n "s/^[[:space:]]*${key}[[:space:]]*=[[:space:]]*//p" .env | + tail -n 1 + )" + value="${value#"${value%%[![:space:]]*}"}" + value="${value%"${value##*[![:space:]]}"}" + value="${value#\"}" + value="${value%\"}" + value="${value#\'}" + value="${value%\'}" + printf '%s' "$value" +} + update_peer_broker() { - local listen_addr - local local_address - local peer_host="${TAPM_UPDATE_PEER_HOST:-}" - local ssh_user="${TAPM_UPDATE_SSH_USER:-root}" + local peer_list="${TAPM_UPDATE_PEERS:-}" + local ssh_user="${TAPM_UPDATE_SSH_USER:-}" local remote_update_path='/opt/idssys/ta-deployment-broker/update.sh' + local peer_host + local raw_peer + local -a peer_hosts local -a ssh_options=( -o BatchMode=yes -o ConnectTimeout=5 @@ -83,33 +101,33 @@ update_peer_broker() { ) [[ -f .env ]] || fail ".env was not found in ${SCRIPT_DIR}" - if [[ -z "$peer_host" ]]; then - listen_addr="$( - sed -n 's/^[[:space:]]*TAPM_LISTEN_ADDR[[:space:]]*=[[:space:]]*//p' .env | - tail -n 1 - )" - listen_addr="${listen_addr#\"}" - listen_addr="${listen_addr%\"}" - listen_addr="${listen_addr#\'}" - listen_addr="${listen_addr%\'}" - local_address="${listen_addr%:*}" - case "$local_address" in - 10.10.1.121) peer_host='10.10.1.122' ;; - 10.10.1.122) peer_host='10.10.1.121' ;; - *) fail "unable to determine peer from TAPM_LISTEN_ADDR=${listen_addr}" ;; - esac + if [[ -z "$peer_list" ]]; then + peer_list="$(read_env_setting TAPM_UPDATE_PEERS)" fi + [[ -n "$peer_list" ]] || + fail "TAPM_UPDATE_PEERS is not configured in .env" + if [[ -z "$ssh_user" ]]; then + ssh_user="$(read_env_setting TAPM_UPDATE_SSH_USER)" + fi + ssh_user="${ssh_user:-root}" - printf 'Checking peer broker at %s...\n' "$peer_host" - if ! ssh "${ssh_options[@]}" "${ssh_user}@${peer_host}" true; then - printf 'WARNING: peer %s is unavailable over SSH; its update was skipped.\n' "$peer_host" >&2 - return 0 - fi - if ! ssh "${ssh_options[@]}" "${ssh_user}@${peer_host}" \ - "TAPM_UPDATE_LOCAL_ONLY=1 ${remote_update_path} --local-only"; then - fail "peer ${peer_host} is reachable, but its broker update failed" - fi - printf 'Peer broker at %s completed successfully.\n' "$peer_host" + IFS=',' read -r -a peer_hosts <<< "$peer_list" + for raw_peer in "${peer_hosts[@]}"; do + peer_host="${raw_peer#"${raw_peer%%[![:space:]]*}"}" + peer_host="${peer_host%"${peer_host##*[![:space:]]}"}" + [[ -n "$peer_host" ]] || continue + + printf 'Checking peer broker at %s...\n' "$peer_host" + if ! ssh "${ssh_options[@]}" "${ssh_user}@${peer_host}" true; then + printf 'WARNING: peer %s is unavailable over SSH; its update was skipped.\n' "$peer_host" >&2 + continue + fi + if ! ssh "${ssh_options[@]}" "${ssh_user}@${peer_host}" \ + "TAPM_UPDATE_LOCAL_ONLY=1 ${remote_update_path} --local-only"; then + fail "peer ${peer_host} is reachable, but its broker update failed" + fi + printf 'Peer broker at %s completed successfully.\n' "$peer_host" + done } if ((POST_PULL == 0)); then