Add deployment hardening scripts

2026-07-10 18:44:13 -05:00
parent de9e473d3b
commit 9f58940b84
10 changed files with 478 additions and 16 deletions
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+BACKUP_DIR="${TSE_BACKUP_DIR:-$APP_DIR/storage/app/backups}"
+STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
+
+cd "$APP_DIR"
+mkdir -p "$BACKUP_DIR"
+
+env_value() {
+    local key="$1"
+    local fallback="${2:-}"
+    if [ -f .env ]; then
+        local line
+        line="$(grep -E "^${key}=" .env | tail -n 1 || true)"
+        if [ -n "$line" ]; then
+            local value="${line#*=}"
+            value="${value%\"}"
+            value="${value#\"}"
+            printf '%s' "$value"
+            return
+        fi
+    fi
+    printf '%s' "$fallback"
+}
+
+DB_CONNECTION="$(env_value DB_CONNECTION sqlite)"
+DB_DATABASE="$(env_value DB_DATABASE "$APP_DIR/database/database.sqlite")"
+DB_HOST="$(env_value DB_HOST 127.0.0.1)"
+DB_PORT="$(env_value DB_PORT 3306)"
+DB_USERNAME="$(env_value DB_USERNAME root)"
+DB_PASSWORD="$(env_value DB_PASSWORD '')"
+
+MANIFEST="$BACKUP_DIR/tse-backup-$STAMP.manifest.txt"
+{
+    echo "Technical Services Exchange backup"
+    echo "created_utc=$STAMP"
+    echo "app_dir=$APP_DIR"
+    echo "git_commit=$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
+    echo "db_connection=$DB_CONNECTION"
+} > "$MANIFEST"
+
+case "$DB_CONNECTION" in
+    sqlite)
+        if [ ! -f "$DB_DATABASE" ]; then
+            echo "SQLite database not found: $DB_DATABASE" >&2
+            exit 1
+        fi
+        DB_BACKUP="$BACKUP_DIR/database-$STAMP.sqlite"
+        cp "$DB_DATABASE" "$DB_BACKUP"
+        echo "database_backup=$DB_BACKUP" >> "$MANIFEST"
+        ;;
+    mysql|mariadb)
+        command -v mysqldump >/dev/null 2>&1 || { echo "mysqldump is required for $DB_CONNECTION backups" >&2; exit 1; }
+        DB_BACKUP="$BACKUP_DIR/database-$STAMP.sql.gz"
+        MYSQL_PWD="$DB_PASSWORD" mysqldump --single-transaction --quick --host="$DB_HOST" --port="$DB_PORT" --user="$DB_USERNAME" "$DB_DATABASE" | gzip > "$DB_BACKUP"
+        echo "database_backup=$DB_BACKUP" >> "$MANIFEST"
+        ;;
+    pgsql)
+        command -v pg_dump >/dev/null 2>&1 || { echo "pg_dump is required for pgsql backups" >&2; exit 1; }
+        DB_BACKUP="$BACKUP_DIR/database-$STAMP.sql.gz"
+        PGPASSWORD="$DB_PASSWORD" pg_dump --host="$DB_HOST" --port="${DB_PORT:-5432}" --username="$DB_USERNAME" "$DB_DATABASE" | gzip > "$DB_BACKUP"
+        echo "database_backup=$DB_BACKUP" >> "$MANIFEST"
+        ;;
+    *)
+        echo "Unsupported DB_CONNECTION for backup: $DB_CONNECTION" >&2
+        exit 1
+        ;;
+esac
+
+if [ "${TSE_BACKUP_STORAGE:-1}" = "1" ] && [ -d storage/app ]; then
+    STORAGE_BACKUP="$BACKUP_DIR/storage-app-$STAMP.tar.gz"
+    tar --exclude="$BACKUP_DIR" --exclude="storage/app/backups" -czf "$STORAGE_BACKUP" -C "$APP_DIR" storage/app
+    echo "storage_backup=$STORAGE_BACKUP" >> "$MANIFEST"
+fi
+
+echo "manifest=$MANIFEST"
+echo "Backup complete."
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+APP_DIR="${APP_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+
+cd "$APP_DIR"
+
+fail() {
+    echo "FAIL: $1" >&2
+    exit 1
+}
+
+pass() {
+    echo "OK: $1"
+}
+
+[ -f artisan ] || fail "artisan not found in $APP_DIR"
+[ -f .env ] || fail ".env is missing"
+[ -d storage ] || fail "storage directory is missing"
+[ -w storage ] || fail "storage directory is not writable"
+[ -d bootstrap/cache ] || fail "bootstrap/cache directory is missing"
+[ -w bootstrap/cache ] || fail "bootstrap/cache directory is not writable"
+
+php artisan about --only=environment >/dev/null || fail "Laravel cannot boot"
+pass "Laravel boots"
+
+php artisan migrate:status >/dev/null || fail "Database connection or migrations failed"
+pass "Database and migrations are reachable"
+
+php artisan route:list --path=api/v1 >/dev/null || fail "API routes are not available"
+pass "API routes are available"
+
+php artisan route:list --name=notifications >/dev/null || fail "Notification routes are not available"
+pass "Notification routes are available"
+
+if [ -L public/storage ] || [ -d public/storage ]; then
+    pass "public storage link exists"
+else
+    fail "public/storage link is missing; run php artisan storage:link"
+fi
+
+if [ -d public/build ]; then
+    pass "Vite build assets exist"
+else
+    fail "public/build is missing; run npm run build"
+fi
+
+echo "Health check complete."
@@ -5,6 +5,10 @@ APP_DIR="${APP_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"

 cd "$APP_DIR"

+if [ "${TSE_BACKUP_BEFORE_UPDATE:-0}" = "1" ]; then
+    bash scripts/backup.sh
+fi
+
 git pull --ff-only
 composer install --no-dev --prefer-dist --optimize-autoloader --no-interaction
 npm ci