dnoulet/go-loose
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: testing build
Some checks failed
Build, test, publish, deploy / build-test (push) Has been cancelled
Details
Build, test, publish, deploy / integration-test (push) Has been cancelled
Details
Build, test, publish, deploy / publish (push) Has been cancelled
Details
Build, test, publish, deploy / deploy-prd (push) Has been cancelled
Details

Browse source
This commit is contained in:
Daniel Noulet 2026-10-10 18:58:32 +02:00
parent d3ee64282d
commit 8942383ff9
13 changed files with 353 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

28
.forgejo/scripts/deploy-prd.sh
View file

@ -23,6 +23,10 @@ secret_value() {
printf '%s' "$encoded" | base64 -d 2>/dev/null || true
}
kubectl get --raw=/readyz >/dev/null
if [[ "$RELEASE" == go-loose ]] && ! kubectl -n "$NAMESPACE" get secret go-loose-wildcard-tls >/dev/null 2>&1; then
echo "Required go-loose-wildcard-tls Secret is missing; provision the tenant wildcard certificate before bootstrap/deploy." >&2
exit 1
fi
kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
for attempt in {1..360}; do if kubectl -n "$NAMESPACE" create configmap "$LOCK_NAME" --from-literal=owner="${GITHUB_REPOSITORY:-local}:${GITHUB_RUN_ID:-$$}" >/dev/null 2>&1; then LOCK_ACQUIRED=true; break; fi; sleep 5; done
if [[ "$LOCK_ACQUIRED" != true ]]; then echo "Timed out waiting for another go-insane-prd deploy to release its lock." >&2; exit 1; fi
@ -69,18 +73,24 @@ if [[ "$RELEASE" != go-guess ]]; then HELM_ARGS+=(--set-string "image.repository
[[ ! -f "$CHART/values-prd.yaml" ]] || HELM_ARGS+=(--values "$CHART/values-prd.yaml")
case "$RELEASE" in
go-loose)
if ! kubectl -n "$NAMESPACE" get secret go-loose-runtime >/dev/null 2>&1; then
db_password="$(secret_value go-loose-postgresql postgres-password)"
if [[ -z "$db_password" ]] && kubectl -n "$NAMESPACE" get pvc -o name | grep -Eq 'go-loose.*postgresql|data-go-loose'; then echo "Existing go-loose database storage has no recoverable password secret; refusing to rotate its credentials." >&2; exit 1; fi
[[ -n "$db_password" ]] || db_password="$(openssl rand -hex 24)"
session_secret="$(secret_value go-loose-env GO_LOOSE_SESSION_SECRET)"
[[ -n "$session_secret" ]] || session_secret="$(openssl rand -hex 32)"
kubectl -n "$NAMESPACE" create secret generic go-loose-runtime --from-literal=postgresql-password="$db_password" --from-literal=session-secret="$session_secret"
fi
db_password="$(secret_value go-loose-runtime postgresql-password)"
[[ -n "$db_password" ]] || db_password="$(secret_value go-loose-postgresql postgres-password)"
[[ -n "$db_password" ]] || db_password="$(secret_value go-loose-postgresql password)"
if [[ -z "$db_password" ]] && kubectl -n "$NAMESPACE" get pvc -o name | grep -Eq 'go-loose.*postgresql|data-go-loose'; then
echo "Existing go-loose database storage has no recoverable password secret; refusing to rotate its credentials." >&2
exit 1
fi
[[ -n "$db_password" ]] || db_password="$(openssl rand -hex 24)"
session_secret="$(secret_value go-loose-runtime session-secret)"
[[ -n "$session_secret" ]] || session_secret="$(secret_value go-loose-env GO_LOOSE_SESSION_SECRET)"
[[ -n "$session_secret" ]] || session_secret="$(openssl rand -hex 32)"
database_url="postgres://goloose:${db_password}@go-loose-postgresql:5432/goloose?sslmode=disable"
HELM_ARGS+=(--set-string "postgresql.auth.password=${db_password}" --set-string "envSecrets.GO_LOOSE_DATABASE_URL=${database_url}" --set-string "envSecrets.GO_LOOSE_SESSION_SECRET=${session_secret}")
kubectl -n "$NAMESPACE" create secret generic go-loose-runtime \
--from-literal=postgresql-password="$db_password" \
--from-literal=postgres-password="$db_password" \
--from-literal=database-url="$database_url" \
--from-literal=session-secret="$session_secret" \
--dry-run=client -o yaml | kubectl apply -f -
;;
go-mad)
if ! kubectl -n "$NAMESPACE" get secret go-mad-runtime >/dev/null 2>&1; then