[OCaml] High Intensity Training Online
refactor Drop legacy-layout repairs from setup.sh
setup.sh now covers only the nominal path. Remove the database moves from shared/ and /srv/hito, the recursive chown/chmod repairs, the removal of obsolete sudoers rules, and the unit .bak copies. deploy and reset no longer re-create the runtime user or data/; that is the job of install alone.
deploy/setup.sh
@@ -2,24 +2,21 @@
2
2
#
3
3
# hito deployment setup. One root script, three subcommands.
4
4
#
5
Removed:
# sudo bash setup.sh install One-time host setup: take git ownership of
6
Removed:
# /srv/hito, create the hito runtime user and
5
Added:
# sudo bash setup.sh install One-time host setup: create the git-owned
6
Added:
# /srv/hito layout, the hito runtime user and
7
7
# its data/ directory, build the shared switch as
8
8
# git, install the hook, the scoped sudoers rule,
9
9
# and the systemd unit from hito.service beside
10
10
# this script. Idempotent. Creates no release;
11
11
# the first push (or 'deploy') does.
12
Removed:
# sudo bash setup.sh deploy Ensure the hito user and data/ (moving a
13
Removed:
# database left in shared/), reinstall
14
Removed:
# hito.service if it changed, build
12
Added:
# sudo bash setup.sh deploy Reinstall hito.service if it changed, build
15
13
# master as a fresh release on the shared
16
14
# switch, and flip current. Health-checks and
17
15
# rolls back on failure. Use to go live without a
18
16
# push, or right after 'install'.
19
Removed:
# sudo bash setup.sh reset Wipe /srv/hito to the clean layout, preserving
20
Removed:
# only the database, then rebuild the switch as
21
Removed:
# git and 'deploy'. Destructive: all else,
22
Removed:
# including the old switch, is removed.
17
Added:
# sudo bash setup.sh reset Wipe /srv/hito except data/, then rebuild the
18
Added:
# switch as git and 'deploy'. Destructive: all
19
Added:
# else, including the switch, is removed.
23
20
#
24
21
# Two-account model. The git user owns the bare repo and /srv/hito (except
25
22
# data/), builds every release, and may run one privileged command,
@@ -45,7 +42,6 @@
45
42
readonly RELEASES="${SRV}/releases"
46
43
readonly DATA="${SRV}/data"
47
44
readonly DB="${DATA}/hito.sqlite"
48
Removed:
readonly LEGACY_DB="${SHARED}/hito.sqlite"
49
45
readonly SWITCH="${SHARED}/_opam"
50
46
readonly OCAML_COMPILER="ocaml-base-compiler.5.5.0"
51
47
readonly HEALTH_URL="http://127.0.0.1:8080/login"
@@ -101,26 +97,10 @@
101
97
echo " created system user ${RUN_USER}"
102
98
}
103
99
104
Removed:
# Create data/, owned by the runtime user and private to it. If the database
105
Removed:
# still sits in shared/ (the single-account layout), stop the service and move
106
Removed:
# it, with its SQLite -wal and -shm files, so that no write is lost.
100
Added:
# Create data/, owned by the runtime user and private to it. The service
101
Added:
# creates the database inside it under UMask=0077.
107
102
ensure_data() {
108
103
install -d -o "${RUN_USER}" -g "${RUN_GROUP}" -m 0700 "${DATA}"
109
Removed:
if [[ -f "${LEGACY_DB}" && ! -e "${DB}" ]]; then
110
Removed:
echo " moving ${LEGACY_DB} -> ${DB} (service stopped)"
111
Removed:
systemctl stop hito || true
112
Removed:
local f
113
Removed:
for f in "${LEGACY_DB}" "${LEGACY_DB}-wal" "${LEGACY_DB}-shm"; do
114
Removed:
if [[ -e "${f}" ]]; then
115
Removed:
mv "${f}" "${DATA}/"
116
Removed:
fi
117
Removed:
done
118
Removed:
elif [[ -f "${LEGACY_DB}" ]]; then
119
Removed:
echo "FATAL: database in both ${LEGACY_DB} and ${DB}; resolve by hand" >&2
120
Removed:
exit 1
121
Removed:
fi
122
Removed:
chown -R "${RUN_USER}:${RUN_GROUP}" "${DATA}"
123
Removed:
chmod -R u=rwX,go= "${DATA}"
124
104
}
125
105
126
106
install_sudoers() {
@@ -130,13 +110,10 @@
130
110
SUDO
131
111
chmod 0440 "${SUDOERS}"
132
112
visudo -c -f "${SUDOERS}" >/dev/null && echo " sudoers valid"
133
Removed:
# Remove obsolete rules from the earlier multi-account design, if present.
134
Removed:
rm -f /etc/sudoers.d/hito-git-deploy
135
Removed:
rm -f /usr/local/libexec/hito-deploy
136
113
}
137
114
138
115
# Install the unit shipped beside this script. The repo copy is the source of
139
Removed:
# truth. A changed installed copy is backed up, then replaced.
116
Added:
# truth; git history keeps earlier versions.
140
117
install_unit() {
141
118
local src="${HERE}/hito.service"
142
119
if cmp -s "${src}" "${UNIT}"; then
@@ -144,13 +121,10 @@
144
121
return 0
145
122
fi
146
123
systemd-analyze verify "${src}"
147
Removed:
if [[ -f "${UNIT}" ]]; then
148
Removed:
cp -a "${UNIT}" "${UNIT}.bak.$(date +%s)"
149
Removed:
fi
150
124
install -o root -g root -m 0644 "${src}" "${UNIT}"
151
125
systemctl daemon-reload
152
126
systemctl enable hito >/dev/null 2>&1
153
Removed:
echo " installed ${UNIT} (previous copy kept alongside)"
127
Added:
echo " installed ${UNIT}"
154
128
}
155
129
156
130
health_ok() {
@@ -241,17 +215,9 @@
241
215
}
242
216
243
217
cmd_install() {
244
Removed:
echo "== shared and releases directories =="
245
Removed:
mkdir -p "${RELEASES}" "${SHARED}"
246
Removed:
# Adopt a pre-existing in-place DB exactly once.
247
Removed:
# Adopt a pre-existing in-place DB exactly once; ensure_data moves it on.
248
Removed:
if [[ -f "${SRV}/hito.sqlite" && ! -e "${LEGACY_DB}" && ! -e "${DB}" ]]; then
249
Removed:
mv "${SRV}/hito.sqlite" "${LEGACY_DB}"
250
Removed:
echo " adopted existing hito.sqlite -> ${LEGACY_DB}"
251
Removed:
fi
252
Removed:
echo "== take ${SVC_USER} ownership of ${SRV} =="
253
Removed:
find "${SRV}" -path "${DATA}" -prune -o \
254
Removed:
-exec chown -h "${SVC_USER}:${SVC_GROUP}" {} +
218
Added:
echo "== ${SVC_USER}-owned layout =="
219
Added:
install -d -o "${SVC_USER}" -g "${SVC_GROUP}" -m 0755 \
220
Added:
"${SRV}" "${SHARED}" "${RELEASES}"
255
221
echo "== runtime user and data =="
256
222
ensure_run_user
257
223
ensure_data
@@ -272,30 +238,22 @@
272
238
echo "FATAL: no shared switch; run 'install' first" >&2
273
239
exit 1
274
240
fi
275
Removed:
echo "== runtime user and data =="
276
Removed:
ensure_run_user
277
Removed:
ensure_data
278
241
echo "== systemd unit =="; install_unit
279
242
echo "== deploy master =="; build_and_flip
280
243
}
281
244
282
245
cmd_reset() {
283
Removed:
if [[ ! -f "${DB}" && ! -f "${LEGACY_DB}" ]]; then
284
Removed:
echo "FATAL: no database at ${DB} or ${LEGACY_DB}; aborting before wipe" >&2
246
Added:
if [[ ! -f "${DB}" ]]; then
247
Added:
echo "FATAL: no database at ${DB}; aborting before wipe" >&2
285
248
exit 1
286
249
fi
287
250
local stash
288
251
echo "== stop service =="; systemctl stop hito || true
289
Removed:
echo "== runtime user and data =="
290
Removed:
ensure_run_user
291
Removed:
ensure_data
292
252
echo "== stash the data directory =="
293
253
stash="$(mktemp -d /root/hito-reset-stash.XXXXXX)"
294
254
cp -a "${DATA}/." "${stash}/" # safety copy, never removed by us
295
255
echo " DB backup at ${stash}/hito.sqlite"
296
256
echo "== wipe /srv/hito contents except data/ =="
297
Removed:
# The old switch is intentionally not preserved: it was built under a
298
Removed:
# different opam root and owner. reset rebuilds it fresh as ${SVC_USER}.
299
257
find "${SRV}" -mindepth 1 -maxdepth 1 ! -path "${DATA}" -exec rm -rf {} +
300
258
echo "== rebuild skeleton, ${SVC_USER}-owned =="
301
259
mkdir -p "${SHARED}" "${RELEASES}"