boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
clusev/docker/release
History
boban d502756b66 fix(release): genuine rollback-path test + install/gitignore hardening (review) 
- serve-request.test.sh: the push-fail case pointed origin at a dead https remote,
  so _precheck's fetch failed first and the rollback path in _do_stage was never
  reached (assertions passed trivially). Use a fetch-OK / push-rejecting remote
  (pre-receive exit 1) so the commit+tag are created and _rollback genuinely runs;
  also assert the tree is restored clean.
- clusev-release.sh: |\| true on the version extraction (defensive under pipefail).
- install.sh: make the release-unit install best-effort (if/then/warn) like the WG
  block so a systemctl failure cannot abort the installer.
- .gitignore: ignore runtime run/ contents, keep the dir via run/.gitkeep.
- docker/release/README.md: dev-watcher runbook (the manual end-to-end gate).
- ReleaseBridgeTest: assert a rejected target writes no request file.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 		2026-06-23 00:16:22 +02:00
..
README.md fix(release): genuine rollback-path test + install/gitignore hardening (review) 2026-06-23 00:16:22 +02:00
clusev-release-request.path feat(release): systemd watcher units + dev run-mount + flag-gated install 2026-06-22 23:28:27 +02:00
clusev-release-request.service feat(release): systemd watcher units + dev run-mount + flag-gated install 2026-06-22 23:28:27 +02:00
clusev-release.sh fix(release): genuine rollback-path test + install/gitignore hardening (review) 2026-06-23 00:16:22 +02:00
serve-request.test.sh fix(release): genuine rollback-path test + install/gitignore hardening (review) 2026-06-23 00:16:22 +02:00

README.md

Release bridge (host watcher) — DEV ONLY

The dashboard "Release" page (Deploy to Staging) cuts a beta by asking the host to do the git work, so the container never holds git credentials — the same isolation as the WireGuard bridge.

  • clusev-release.sh serve-request — reads run/release-request.json (the dashboard wrote it), re-validates, bumps config/clusev.php, commits, tags vX.Y.Z-betaN, pushes to Gitea (token read host-side from /home/nexxo/.env.gitea), and writes run/release-result-<id>.json for the dashboard to poll. Roll back leaves no half-release if the push fails.
  • clusev-release-request.path / .service — a systemd .path watcher that runs the handler when a request file appears.

Enable on the dev box

These units are installed only when CLUSEV_RELEASE_CONTROLS=true is in the project .env (install.sh gates them). To enable manually:

cd /home/nexxo/clusev
sudo install -m 0644 docker/release/clusev-release-request.service /etc/systemd/system/
sudo install -m 0644 docker/release/clusev-release-request.path    /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now clusev-release-request.path

The dev docker-compose.yml must bind-mount ./run to the container's storage/app/restart-signal (shared with the WireGuard/restart bridges) so the dashboard's request lands where the watcher looks.

Verify (manual gate)

This is the end-to-end gate (like the WireGuard runbook): with the watcher enabled and the flag on, open /release, click a bump button, confirm, and check that vX.Y.Z-betaN lands on Gitea (and, via the push-mirror, on GitHub-private). The handler never logs the Gitea token.