Deploy Foundry Core from main with Actions credentials

2026-11-05 00:18:53 +08:00
parent 8cbd83f0e5
commit 4e5832c14b
4 changed files with 199 additions and 1 deletions
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+umask 077
+cd /opt/endoleap-infra
+live=$1
+[[ "$live" =~ ^foundry-core-[a-f0-9]{12}$ ]]
+
+install -d -m 700 dev/foundry-edge
+edge=dev/foundry-edge
+route=$edge/foundry.yml
+previous=
+if [[ -f "$route" ]]; then
+  previous=$(sed -n 's@.*url: http://\(foundry-core-[a-f0-9]\{12\}\):8080.*@\1@p' "$route")
+fi
+backup=$(mktemp)
+if [[ -f "$route" ]]; then cp "$route" "$backup"; fi
+rollback() {
+  if [[ -s "$backup" ]]; then
+    cp "$backup" "$edge/.restore"
+    mv "$edge/.restore" "$route"
+  else
+    rm -f "$route"
+  fi
+  rm -f "$backup"
+}
+trap rollback EXIT
+
+touch "$edge/acme.json"
+chmod 600 "$edge/acme.json"
+cat > "$edge/.foundry.yml" <<YAML
+http:
+  routers:
+    foundry:
+      entryPoints: [websecure]
+      rule: Host(\`api.foundry.entroia.com\`)
+      middlewares: [foundry-limit]
+      service: foundry
+      tls:
+        certResolver: public
+  middlewares:
+    foundry-limit:
+      rateLimit:
+        average: 30
+        burst: 60
+  services:
+    foundry:
+      loadBalancer:
+        servers:
+          - url: http://$live:8080
+YAML
+mv "$edge/.foundry.yml" "$route"
+cat > foundry-edge.yml <<'YAML'
+services:
+  traefik:
+    command:
+      - --entrypoints.web.address=:8080
+      - --entrypoints.websecure.address=:8443
+      - --ping=true
+      - --ping.entrypoint=web
+      - --api.dashboard=false
+      - --providers.file.directory=/edge
+      - --certificatesresolvers.public.acme.storage=/edge/acme.json
+      - --certificatesresolvers.public.acme.tlschallenge=true
+    ports:
+      - "443:8443"
+    volumes:
+      - ./dev/foundry-edge:/edge
+YAML
+docker compose -p endoleap-dev --env-file dev/env -f compose.yml -f dev.yml -f foundry-edge.yml up -d --no-deps traefik
+
+curl --fail --silent --show-error --output /dev/null --max-time 6 \
+  --retry 15 --retry-delay 4 --retry-all-errors \
+  --resolve api.foundry.entroia.com:443:127.0.0.1 \
+  https://api.foundry.entroia.com/readyz
+
+trap - EXIT
+rm -f "$backup"
+if [[ "$previous" =~ ^foundry-core-[a-f0-9]{12}$ && "$previous" != "$live" ]]; then
+  docker stop "$previous" >/dev/null || printf 'Previous container needs manual cleanup.\n' >&2
+fi