chore: add cloud deployment templates

scripts/deploy/bin/deploy.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+CONFIG_FILE="${CONFIG_FILE:-/etc/tiku-saas/deploy.env}"
+
+if [[ ! -r "$CONFIG_FILE" ]]; then
+  echo "Missing deploy config: $CONFIG_FILE" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "$CONFIG_FILE"
+
+: "${GIT_REPO:?GIT_REPO is required}"
+: "${GIT_BRANCH:=main}"
+: "${APP_ROOT:=/opt/tiku-saas}"
+: "${REPO_DIR:=$APP_ROOT/repo}"
+: "${WWW_ROOT:=/srv/tiku-saas/www}"
+: "${RUNTIME_CONFIG_DIR:=/etc/tiku-saas/runtime-config}"
+: "${RUN_SECURITY_CHECKS:=true}"
+: "${RUN_LAUNCH_GATE:=true}"
+: "${RESTART_SERVICES:=true}"
+
+LOCK_FILE="${LOCK_FILE:-/tmp/tiku-saas-deploy.lock}"
+mkdir -p "$APP_ROOT" "$WWW_ROOT/student" "$WWW_ROOT/tenant-admin" "$WWW_ROOT/platform-admin"
+
+exec 9>"$LOCK_FILE"
+if ! flock -n 9; then
+  echo "Another deployment is already running." >&2
+  exit 1
+fi
+
+log() {
+  printf '[%s] %s\n' "$(date '+%Y-%m-%d %H:%M:%S')" "$*"
+}
+
+cleanup() {
+  if [[ -n "${ASKPASS_FILE:-}" && -f "$ASKPASS_FILE" ]]; then
+    rm -f "$ASKPASS_FILE"
+  fi
+}
+trap cleanup EXIT
+
+prepare_git_auth() {
+  if [[ -n "${GIT_SSH_COMMAND:-}" ]]; then
+    export GIT_SSH_COMMAND
+    return
+  fi
+
+  if [[ -z "${GIT_USERNAME:-}" || -z "${GITEA_TOKEN:-}" ]]; then
+    return
+  fi
+
+  ASKPASS_FILE="$(mktemp)"
+  chmod 700 "$ASKPASS_FILE"
+  cat > "$ASKPASS_FILE" <<'ASKPASS'
+#!/usr/bin/env bash
+case "$1" in
+  *Username*) printf '%s\n' "$GIT_USERNAME" ;;
+  *Password*) printf '%s\n' "$GITEA_TOKEN" ;;
+  *) printf '\n' ;;
+esac
+ASKPASS
+  export GIT_ASKPASS="$ASKPASS_FILE"
+  export GIT_TERMINAL_PROMPT=0
+}
+
+prepare_git_auth
+
+if [[ ! -d "$REPO_DIR/.git" ]]; then
+  log "Cloning repository..."
+  git clone --branch "$GIT_BRANCH" "$GIT_REPO" "$REPO_DIR"
+fi
+
+cd "$REPO_DIR"
+
+log "Fetching $GIT_BRANCH..."
+git fetch origin "$GIT_BRANCH" --prune
+git checkout "$GIT_BRANCH"
+
+if ! git diff --quiet || ! git diff --cached --quiet; then
+  echo "Repository has local changes. Refusing to deploy until the server checkout is clean." >&2
+  exit 1
+fi
+
+git merge --ff-only "origin/$GIT_BRANCH"
+
+CURRENT_SHA="$(git rev-parse --short=12 HEAD)"
+log "Deploying commit $CURRENT_SHA"
+
+log "Installing dependencies with npm ci..."
+npm ci
+
+if [[ "$RUN_SECURITY_CHECKS" == "true" ]]; then
+  log "Running repository security scan..."
+  npm run security:repo
+fi
+
+if [[ "$RUN_LAUNCH_GATE" == "true" ]]; then
+  log "Running production launch gate test..."
+  node scripts/production-launch-gate-test.js
+fi
+
+log "Building API and worker..."
+npm run build:api
+npm run build:worker
+
+log "Building H5 portals..."
+npm run build:taro:h5:student
+npm run build:taro:h5:tenant
+npm run build:taro:h5:platform
+
+log "Publishing H5 static assets..."
+rsync -a --delete apps/taro/dist/h5-student/ "$WWW_ROOT/student/"
+rsync -a --delete apps/taro/dist/h5-tenant-admin/ "$WWW_ROOT/tenant-admin/"
+rsync -a --delete apps/taro/dist/h5-platform-admin/ "$WWW_ROOT/platform-admin/"
+
+install_runtime_config() {
+  local source_file="$1"
+  local target_dir="$2"
+  if [[ ! -r "$source_file" ]]; then
+    echo "Missing runtime config: $source_file" >&2
+    exit 1
+  fi
+  install -m 0644 "$source_file" "$target_dir/runtime-config.json"
+}
+
+log "Installing H5 runtime config files..."
+install_runtime_config "$RUNTIME_CONFIG_DIR/h5-student.runtime-config.json" "$WWW_ROOT/student"
+install_runtime_config "$RUNTIME_CONFIG_DIR/h5-tenant-admin.runtime-config.json" "$WWW_ROOT/tenant-admin"
+install_runtime_config "$RUNTIME_CONFIG_DIR/h5-platform-admin.runtime-config.json" "$WWW_ROOT/platform-admin"
+
+if [[ "$RESTART_SERVICES" == "true" ]]; then
+  log "Restarting systemd services..."
+  systemctl restart tiku-api.service
+  systemctl restart tiku-worker.service
+  systemctl --no-pager --full status tiku-api.service tiku-worker.service >/dev/null
+fi
+
+log "Deployment finished: $CURRENT_SHA"