35 lines
1.7 KiB
Markdown
35 lines
1.7 KiB
Markdown
# Release bridge (host watcher) — DEV ONLY
|
|
|
|
The dashboard "Release" page (Deploy to Staging) cuts a beta by asking the **host** to do the git
|
|
work, so the container never holds git credentials — the same isolation as the WireGuard bridge.
|
|
|
|
- `clusev-release.sh serve-request` — reads `run/release-request.json` (the dashboard wrote it),
|
|
re-validates, bumps `config/clusev.php`, commits, tags `vX.Y.Z-betaN`, pushes to Gitea (token read
|
|
host-side from `/home/nexxo/.env.gitea`), and writes `run/release-result-<id>.json` for the
|
|
dashboard to poll. Roll back leaves no half-release if the push fails.
|
|
- `clusev-release-request.path` / `.service` — a systemd `.path` watcher that runs the handler when a
|
|
request file appears.
|
|
|
|
## Enable on the dev box
|
|
|
|
These units are installed **only** when `CLUSEV_RELEASE_CONTROLS=true` is in the project `.env`
|
|
(`install.sh` gates them). To enable manually:
|
|
|
|
```bash
|
|
cd /home/nexxo/clusev
|
|
sudo install -m 0644 docker/release/clusev-release-request.service /etc/systemd/system/
|
|
sudo install -m 0644 docker/release/clusev-release-request.path /etc/systemd/system/
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now clusev-release-request.path
|
|
```
|
|
|
|
The dev `docker-compose.yml` must bind-mount `./run` to the container's
|
|
`storage/app/restart-signal` (shared with the WireGuard/restart bridges) so the dashboard's request
|
|
lands where the watcher looks.
|
|
|
|
## Verify (manual gate)
|
|
|
|
This is the end-to-end gate (like the WireGuard runbook): with the watcher enabled and the flag on,
|
|
open `/release`, click a bump button, confirm, and check that `vX.Y.Z-betaN` lands on Gitea (and, via
|
|
the push-mirror, on GitHub-private). The handler never logs the Gitea token.
|