zwitschi
5d81f617f0
- deploy.sh: clean-tree guard + git fetch && git pull --ff-only + optional dep reinstall + app.db --migrate + restart. - restart-service.sh: supervisor-agnostic restart (systemd or fallback), waits for an in-flight scan. - check_runtime_git.sh: proves no scan writes git-tracked runtime data. - ids.service: systemd unit template. - tests/test_deployment.py: stdlib unittest invariant tests for the deployment runtime-isolation guarantee.
54 lines
2.0 KiB
Bash
54 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# D005 — supervisor-agnostic restart shim.
|
|
#
|
|
# Restarts the intrusion-detection service after a deploy, preferring systemd
|
|
# (Linux), with a fallback message for other environments (Windows dev).
|
|
#
|
|
# It first waits for any in-flight background scan to finish so a checkout
|
|
# change never interleaves with a live scan (belt-and-suspenders; the runtime
|
|
# isolation guarantee already means scans only write gitignored files).
|
|
#
|
|
# Usage:
|
|
# deploy/restart-service.sh [production]
|
|
# ENV=production deploy/restart-service.sh
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
ENV="${1:-${ENV:-production}}"
|
|
UNIT="ids@${ENV}.service"
|
|
|
|
# Wait for an in-flight scan to finish (~0..120s). We probe the web UI status
|
|
# endpoint if it is reachable; a failure to reach it just means no web UI is up.
|
|
web_host="${WEB_HOST:-127.0.0.1}"
|
|
web_port="${WEB_PORT:-54666}"
|
|
status_url="http://${web_host}:${web_port}/api/scan/status"
|
|
for _ in $(seq 1 60); do
|
|
running=$(curl -fsS --max-time 2 "$status_url" 2>/dev/null \
|
|
| python3 -c 'import sys,json;print(json.load(sys.stdin).get("running",False))' 2>/dev/null \
|
|
|| echo false)
|
|
[[ "$running" == "false" ]] && break
|
|
echo " waiting for running scan to finish..."
|
|
sleep 2
|
|
done
|
|
|
|
if command -v systemctl >/dev/null 2>&1; then
|
|
# Installed unit is <unit>.service.template; the enabled name includes env.
|
|
if systemctl list-unit-files "${UNIT}" >/dev/null 2>&1; then
|
|
echo "== systemctl restart ${UNIT} =="
|
|
systemctl restart "${UNIT}"
|
|
systemctl --no-pager status "${UNIT}" --lines=0 || true
|
|
elif systemctl list-unit-files "ids.service" >/dev/null 2>&1; then
|
|
echo "== systemctl restart ids.service =="
|
|
systemctl restart ids.service
|
|
systemctl --no-pager status ids.service --lines=0 || true
|
|
else
|
|
echo "No ids systemd unit found; restart manually." >&2
|
|
exit 2
|
|
fi
|
|
else
|
|
echo "No systemd available (Windows dev?). Restart the app manually." >&2
|
|
echo " python app.py # in a terminal, or via your dev runner" >&2
|
|
exit 2
|
|
fi
|