privacy-in-design/gitea-migration
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f82c98513fa6dbb74c0ed6ec9f125d8bcf5ad620
gitea-migration/phase8_cutover.sh
S 9494645b3a fix: resolve 10 bugs across scripts 
- manage_runner.sh: fix RUNNER_DEFAULT_IMAGE clobbering by renaming
  per-runner var to RUNNER_SECTION_IMAGE; .env fallback now works
- manage_runner.sh: render native runner config.yaml before registration
  so act_runner can read it during --config flag
- manage_runner.sh: add SSH credential validation for remote hosts
  (fail early with clear error instead of cryptic SSH failure)
- phase1/phase2: add UNRAID_DB_IP/FEDORA_DB_IP to conditional
  require_vars when DB_TYPE != sqlite3
- cleanup.sh: only clear manifest when all actions for host succeeded;
  failed actions are preserved for retry
- phase8_cutover.sh: strip empty environment: block from Caddy
  docker-compose when TLS_MODE=existing
- phase5_migrate_pipelines.sh, phase5_teardown.sh, phase9_teardown.sh:
  wrap cd+git in subshells so working directory is always restored
- phase3_post_check.sh: handle both string and numeric runner status
  from Gitea API (offline vs 2)
- configure_env.sh: fix TOTAL_PROMPTS base count (63->64) and move
  DB/repo count adjustments before their prompts are shown

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-01 13:21:30 -05:00

291 lines
11 KiB
Bash
Executable File
Raw Blame History

#!/usr/bin/env bash
set -euo pipefail
# =============================================================================
# phase8_cutover.sh — HTTPS via Caddy + Mark GitHub repos as mirrors
# Depends on: All prior phases complete, macvlan network created on Unraid
# This is the "go live" script — after this, Gitea is the primary git host.
#
# Caddy handles TLS automatically. TLS_MODE from .env controls how:
# "cloudflare" → DNS-01 via Cloudflare API (wildcard cert)
# "existing" → user provides cert/key paths
#
# After HTTPS is live, GitHub repos are marked as offsite mirrors.
# =============================================================================
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
source "${SCRIPT_DIR}/lib/common.sh"
load_env
require_vars UNRAID_IP UNRAID_SSH_USER UNRAID_GITEA_IP UNRAID_CADDY_IP \
GITEA_INTERNAL_URL GITEA_DOMAIN GITEA_ADMIN_TOKEN \
GITEA_ORG_NAME TLS_MODE CADDY_DOMAIN CADDY_DATA_PATH \
GITHUB_USERNAME GITHUB_TOKEN \
REPO_NAMES
if [[ "$TLS_MODE" == "cloudflare" ]]; then
require_vars CLOUDFLARE_API_TOKEN
elif [[ "$TLS_MODE" == "existing" ]]; then
require_vars SSL_CERT_PATH SSL_KEY_PATH
else
log_error "Invalid TLS_MODE='${TLS_MODE}' — must be 'cloudflare' or 'existing'"
exit 1
fi
phase_header 8 "Cutover (HTTPS via Caddy + Mark GitHub Mirrors)"
read -ra REPOS <<< "$REPO_NAMES"
PHASE8_STATE_DIR="$(_project_root)/.manifests"
PHASE8_STATE_FILE="${PHASE8_STATE_DIR}/phase8_github_repo_state.json"
# ---------------------------------------------------------------------------
# Helper: persist original GitHub repo settings for teardown symmetry
# ---------------------------------------------------------------------------
init_phase8_state_store() {
mkdir -p "$PHASE8_STATE_DIR"
if [[ ! -f "$PHASE8_STATE_FILE" ]]; then
printf '{}\n' > "$PHASE8_STATE_FILE"
fi
}
fetch_github_pages_state() {
local repo="$1"
local tmpfile http_code
local pages_enabled=false
local pages_cname=""
local pages_source_branch=""
local pages_source_path="/"
tmpfile=$(mktemp)
http_code=$(curl -s \
-H "Authorization: token ${GITHUB_TOKEN}" \
-H "Accept: application/json" \
-o "$tmpfile" \
-w "%{http_code}" \
"https://api.github.com/repos/${GITHUB_USERNAME}/${repo}/pages" || echo "000")
if [[ "$http_code" == "200" ]]; then
pages_enabled=true
pages_cname=$(jq -r '.cname // ""' "$tmpfile")
pages_source_branch=$(jq -r '.source.branch // ""' "$tmpfile")
pages_source_path=$(jq -r '.source.path // "/"' "$tmpfile")
fi
rm -f "$tmpfile"
jq -n \
--argjson pages_enabled "$pages_enabled" \
--arg pages_cname "$pages_cname" \
--arg pages_source_branch "$pages_source_branch" \
--arg pages_source_path "$pages_source_path" \
'{
pages_enabled: $pages_enabled,
pages_cname: $pages_cname,
pages_source_branch: $pages_source_branch,
pages_source_path: $pages_source_path
}'
}
snapshot_repo_state() {
local repo="$1"
local repo_data="$2"
init_phase8_state_store
if jq -e --arg repo "$repo" 'has($repo)' "$PHASE8_STATE_FILE" >/dev/null 2>&1; then
log_info "State snapshot already exists for ${repo} — preserving original values"
return 0
fi
local current_desc current_homepage current_has_wiki current_has_projects
local pages_state tmpfile
current_desc=$(printf '%s' "$repo_data" | jq -r '.description // ""')
current_homepage=$(printf '%s' "$repo_data" | jq -r '.homepage // ""')
current_has_wiki=$(printf '%s' "$repo_data" | jq -r '.has_wiki // false')
current_has_projects=$(printf '%s' "$repo_data" | jq -r '.has_projects // false')
pages_state=$(fetch_github_pages_state "$repo")
tmpfile=$(mktemp)
jq \
--arg repo "$repo" \
--arg description "$current_desc" \
--arg homepage "$current_homepage" \
--argjson has_wiki "$current_has_wiki" \
--argjson has_projects "$current_has_projects" \
--argjson pages "$pages_state" \
'.[$repo] = {
description: $description,
homepage: $homepage,
has_wiki: $has_wiki,
has_projects: $has_projects
} + $pages' \
"$PHASE8_STATE_FILE" > "$tmpfile"
mv "$tmpfile" "$PHASE8_STATE_FILE"
log_info "Saved pre-cutover GitHub settings for ${repo}"
}
# ---------------------------------------------------------------------------
# Step 1: Create Caddy data directories
# ---------------------------------------------------------------------------
log_step 1 "Creating Caddy data directories on Unraid..."
if ssh_exec UNRAID "test -d '${CADDY_DATA_PATH}/data'"; then
log_info "Caddy data directory already exists — skipping"
else
ssh_exec UNRAID "mkdir -p '${CADDY_DATA_PATH}/data' '${CADDY_DATA_PATH}/config'"
log_success "Caddy data directories created"
fi
# ---------------------------------------------------------------------------
# Step 2: Render + deploy Caddyfile
# ---------------------------------------------------------------------------
log_step 2 "Deploying Caddyfile..."
if ssh_exec UNRAID "test -f '${CADDY_DATA_PATH}/Caddyfile'" 2>/dev/null; then
log_info "Caddyfile already exists — skipping"
else
TMPFILE=$(mktemp)
GITEA_CONTAINER_IP="${UNRAID_GITEA_IP}"
export GITEA_CONTAINER_IP GITEA_DOMAIN CADDY_DOMAIN
# Build TLS block based on TLS_MODE
if [[ "$TLS_MODE" == "cloudflare" ]]; then
TLS_BLOCK=" tls {
dns cloudflare {env.CF_API_TOKEN}
}"
else
TLS_BLOCK=" tls ${SSL_CERT_PATH} ${SSL_KEY_PATH}"
fi
export TLS_BLOCK
render_template "${SCRIPT_DIR}/templates/Caddyfile.tpl" "$TMPFILE" \
"\${CADDY_DOMAIN} \${GITEA_DOMAIN} \${TLS_BLOCK} \${GITEA_CONTAINER_IP}"
scp_to UNRAID "$TMPFILE" "${CADDY_DATA_PATH}/Caddyfile"
rm -f "$TMPFILE"
log_success "Caddyfile deployed"
fi
# ---------------------------------------------------------------------------
# Step 3: Render + deploy Caddy docker-compose
# ---------------------------------------------------------------------------
log_step 3 "Deploying Caddy docker-compose..."
if ssh_exec UNRAID "test -f '${CADDY_DATA_PATH}/docker-compose.yml'" 2>/dev/null; then
log_info "Caddy docker-compose.yml already exists — skipping"
else
TMPFILE=$(mktemp)
CADDY_CONTAINER_IP="${UNRAID_CADDY_IP}"
export CADDY_CONTAINER_IP CADDY_DATA_PATH
if [[ "$TLS_MODE" == "cloudflare" ]]; then
CADDY_ENV_VARS=" - CF_API_TOKEN=${CLOUDFLARE_API_TOKEN}"
CADDY_EXTRA_VOLUMES=""
else
CADDY_ENV_VARS=""
# Mount cert/key files into the container
CADDY_EXTRA_VOLUMES=" - ${SSL_CERT_PATH}:${SSL_CERT_PATH}:ro
- ${SSL_KEY_PATH}:${SSL_KEY_PATH}:ro"
fi
export CADDY_ENV_VARS CADDY_EXTRA_VOLUMES
render_template "${SCRIPT_DIR}/templates/docker-compose-caddy.yml.tpl" "$TMPFILE" \
"\${CADDY_DATA_PATH} \${CADDY_CONTAINER_IP} \${CADDY_ENV_VARS} \${CADDY_EXTRA_VOLUMES}"
# Strip empty YAML blocks left when optional vars are blank
if [[ -z "$CADDY_ENV_VARS" ]]; then
sed -i.bak '/^[[:space:]]*environment:$/d' "$TMPFILE"
rm -f "${TMPFILE}.bak"
fi
if [[ -z "$CADDY_EXTRA_VOLUMES" ]]; then
# Remove trailing blank lines after the volumes block
sed -i.bak -e :a -e '/^\n*$/{$d;N;ba' -e '}' "$TMPFILE"
rm -f "${TMPFILE}.bak"
fi
scp_to UNRAID "$TMPFILE" "${CADDY_DATA_PATH}/docker-compose.yml"
rm -f "$TMPFILE"
log_success "Caddy docker-compose.yml deployed"
fi
# ---------------------------------------------------------------------------
# Step 4: Start Caddy container
# ---------------------------------------------------------------------------
log_step 4 "Starting Caddy container..."
CONTAINER_STATUS=$(ssh_exec UNRAID "docker ps --filter name=caddy --format '{{.Status}}'" 2>/dev/null || true)
if [[ "$CONTAINER_STATUS" == *"Up"* ]]; then
log_info "Caddy container already running — skipping"
else
ssh_exec UNRAID "cd '${CADDY_DATA_PATH}' && docker compose up -d 2>/dev/null || docker-compose up -d"
log_success "Caddy container started"
fi
# ---------------------------------------------------------------------------
# Step 5: Wait for HTTPS to work
# Caddy auto-obtains certs — poll until HTTPS responds.
# ---------------------------------------------------------------------------
log_step 5 "Waiting for HTTPS (Caddy auto-provisions cert)..."
wait_for_http "https://${GITEA_DOMAIN}/api/v1/version" 120
log_success "HTTPS verified — https://${GITEA_DOMAIN} works"
# ---------------------------------------------------------------------------
# Step 6: Mark GitHub repos as offsite backup only
# Updates description + homepage to indicate Gitea is primary.
# Disables wiki and Pages to avoid unnecessary resource usage.
# Does NOT archive — archived repos reject pushes, which would break
# the push mirrors configured in Phase 6.
# Persists original mutable settings to a local state file for teardown.
# GitHub Actions already disabled in Phase 6 Step D.
# ---------------------------------------------------------------------------
log_step 6 "Marking GitHub repos as offsite backup..."
init_phase8_state_store
GITHUB_REPO_UPDATE_FAILURES=0
for repo in "${REPOS[@]}"; do
# Fetch repo metadata (single API call)
REPO_DATA=$(github_api GET "/repos/${GITHUB_USERNAME}/${repo}" 2>/dev/null || echo "{}")
CURRENT_DESC=$(printf '%s' "$REPO_DATA" | jq -r '.description // ""')
# Skip if already marked
if [[ "$CURRENT_DESC" == "[MIRROR]"* ]]; then
if ! jq -e --arg repo "$repo" 'has($repo)' "$PHASE8_STATE_FILE" >/dev/null 2>&1; then
log_warn "GitHub repo ${repo} already marked as mirror but no local state snapshot exists"
log_warn " → Teardown may not fully restore pre-cutover settings for this repo"
fi
log_info "GitHub repo ${repo} already marked as mirror — skipping"
continue
fi
# Snapshot current mutable state so teardown can restore exactly.
snapshot_repo_state "$repo" "$REPO_DATA"
# Build new description preserving original
NEW_DESC="[MIRROR] Offsite backup — primary at https://${GITEA_DOMAIN}/${GITEA_ORG_NAME}/${repo}"
if [[ -n "$CURRENT_DESC" ]]; then
NEW_DESC="${NEW_DESC} — was: ${CURRENT_DESC}"
fi
# Update description + homepage, disable wiki and projects
UPDATE_PAYLOAD=$(jq -n \
--arg description "$NEW_DESC" \
--arg homepage "https://${GITEA_DOMAIN}/${GITEA_ORG_NAME}/${repo}" \
'{description: $description, homepage: $homepage, has_wiki: false, has_projects: false}')
if github_api PATCH "/repos/${GITHUB_USERNAME}/${repo}" "$UPDATE_PAYLOAD" >/dev/null 2>&1; then
log_success "Marked GitHub repo as mirror: ${repo}"
else
log_error "Failed to update GitHub repo: ${repo}"
GITHUB_REPO_UPDATE_FAILURES=$((GITHUB_REPO_UPDATE_FAILURES + 1))
fi
# Disable GitHub Pages if enabled (Pages can incur bandwidth costs)
github_api DELETE "/repos/${GITHUB_USERNAME}/${repo}/pages" >/dev/null 2>&1 || true
done
# ---------------------------------------------------------------------------
# Summary
# ---------------------------------------------------------------------------
printf '\n'
if [[ "$GITHUB_REPO_UPDATE_FAILURES" -gt 0 ]]; then
log_error "Phase 8 failed: ${GITHUB_REPO_UPDATE_FAILURES} GitHub repo update(s) failed"
exit 1
fi
log_success "Phase 8 complete — Gitea is live at https://${GITEA_DOMAIN}"
log_info "GitHub repos marked as offsite backup. Push mirrors remain active."
Reference in New Issue View Git Blame Copy Permalink