31 lines
1.2 KiB
Bash
31 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Invoked by server.js after a verified webhook push to master.
|
|
#
|
|
# This checkout is deploy-only: it exists purely so this script can update
|
|
# it. Never edit files directly in /opt/audit-endpoint - `git reset --hard`
|
|
# below throws away anything that isn't committed upstream.
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="${REPO_DIR:-/opt/audit-endpoint}"
|
|
|
|
cd "$REPO_DIR"
|
|
git fetch --quiet origin master
|
|
git reset --hard origin/master
|
|
|
|
cd "$REPO_DIR/backend"
|
|
npm install --omit=dev --no-audit --no-fund
|
|
|
|
# Restarting audit-endpoint needs root; the audit-webhook service runs as an
|
|
# unprivileged user, so this relies on the narrow sudoers grant from
|
|
# backend/deploy/audit-deploy-sudoers (restart of this exact unit only).
|
|
sudo /usr/bin/systemctl restart audit-endpoint
|
|
|
|
echo "Deployed $(git -C "$REPO_DIR" rev-parse --short HEAD)"
|
|
|
|
# Deliberately not restarting audit-webhook itself here: a process cannot
|
|
# cleanly restart its own systemd unit mid-script (systemd would SIGTERM this
|
|
# script's parent while it is still running). Changes to backend/webhook/
|
|
# take effect on the next manual `sudo systemctl restart audit-webhook` -
|
|
# see DEPLOYMENT.md. That code changes far less often than the audit
|
|
# endpoint's own logic, so this is a fair trade for the simplicity.
|