From 3a7358b6b5f17564f74856f12c5339766ca29910 Mon Sep 17 00:00:00 2001 From: zaragoza444 Date: Sun, 28 Jun 2026 17:29:29 -0700 Subject: [PATCH] fix: PVE LXC sync via sudo SSH and single build pass Use sudo ssh with ProxyJump=none from dev-bis-ali to Proxmox, build once before syncing all nine banking LXCs, and track deploy scripts as executable. Co-authored-by: Cursor --- .../ALI_GITEA_TWO_REPO_WORKFLOW.md | 6 ++ ...ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md | 4 +- .../deploy-omnl-banking-portal-pct.sh | 45 +++++++------- scripts/deployment/lib/omnl-pve-ssh.sh | 59 +++++++++++++++++++ .../deployment/setup-dev1-pve-ssh-access.sh | 32 ++++++++++ .../sync-ali-omnl-banking-portal-lxcs.sh | 25 ++++---- 6 files changed, 135 insertions(+), 36 deletions(-) mode change 100644 => 100755 scripts/deployment/deploy-omnl-banking-portal-pct.sh create mode 100755 scripts/deployment/lib/omnl-pve-ssh.sh create mode 100755 scripts/deployment/setup-dev1-pve-ssh-access.sh mode change 100644 => 100755 scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh diff --git a/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md index ea78528..ad95d0d 100644 --- a/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md +++ b/docs/04-configuration/ALI_GITEA_TWO_REPO_WORKFLOW.md @@ -47,6 +47,12 @@ Branch: **`main`** ## 5. Production banking LXCs (5820–5828) +First-time / after SSH config changes on dev-bis-ali: + +```bash +bash scripts/deployment/setup-dev1-pve-ssh-access.sh +``` + Operator sync from LAN (dev-bis-ali or Proxmox host with `pct`): ```bash diff --git a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md index b286fad..72a491e 100644 --- a/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md +++ b/docs/04-configuration/ALI_ZARDASHT_REMOTE_OPERATOR_ONBOARDING.md @@ -46,7 +46,9 @@ See [FORGE_CANONICAL_REGISTRY.md](./FORGE_CANONICAL_REGISTRY.md) and [ALI_GITEA_ ```bash curl -s -o /dev/null -w '%{http_code}\n' http://192.168.11.211:8545 # expect 405 -ssh root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' +ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' +# Or from dev-bis-ali when dev1 key is not on PVE: +sudo ssh -o ProxyJump=none root@192.168.11.13 'pct exec 5825 -- ls /srv/ali-portal' ``` ## Deploy OMNL to banking LXCs diff --git a/scripts/deployment/deploy-omnl-banking-portal-pct.sh b/scripts/deployment/deploy-omnl-banking-portal-pct.sh old mode 100644 new mode 100755 index a84b796..f76f67b --- a/scripts/deployment/deploy-omnl-banking-portal-pct.sh +++ b/scripts/deployment/deploy-omnl-banking-portal-pct.sh @@ -1,22 +1,13 @@ #!/usr/bin/env bash # Deploy OMNL banking portal into Proxmox LXC via pct. -# -# Topology: -# ~/home/projects/exchange/ (dev tree inside CT) -# /srv/ali-portal/ (production root inside banking LXC 5820–5828) -# -# Usage (from dev-bis-ali or Proxmox host): -# export OMNL_PCT_CTID=XXXX -# bash scripts/deployment/deploy-omnl-banking-portal-pct.sh -# -# Requires: root SSH to PVE host, pct, built repo at OMNL_BANK_ROOT - set -euo pipefail -PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}" -PVE_USER="${OMNL_PVE_USER:-root}" -CTID="${OMNL_PCT_CTID:-5825}" REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}" +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +# shellcheck source=lib/omnl-pve-ssh.sh +source "${SCRIPT_DIR}/lib/omnl-pve-ssh.sh" + +CTID="${OMNL_PCT_CTID:-5825}" PORTAL_ROOT="${OMNL_PORTAL_ROOT:-/srv/ali-portal}" PROJECT_SRC="${OMNL_PROJECT_SRC:-/home/projects/exchange}" STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz" @@ -24,18 +15,25 @@ STAGE="/tmp/omnl-banking-portal-$(date +%Y%m%d%H%M%S).tar.gz" log() { echo "[$(date -Iseconds)] $*"; } pct_exec() { - ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "pct exec ${CTID} -- $*" + omnl_pve_ssh "pct exec ${CTID} -- $*" } pve_exec() { - ssh -o BatchMode=yes "${PVE_USER}@${PVE_HOST}" "$*" + omnl_pve_ssh "$*" } -log "Building OMNL stack at $REPO_DIR..." -cd "$REPO_DIR" -bash scripts/deployment/deploy-omnl-bank-production.sh +omnl_pve_preflight -log "Staging bundle..." +if [[ "${OMNL_SKIP_BUILD:-0}" != "1" ]]; then + log "Building OMNL stack at $REPO_DIR..." + cd "$REPO_DIR" + bash scripts/deployment/deploy-omnl-bank-production.sh +else + log "Skipping build (OMNL_SKIP_BUILD=1) — using existing dist/ artifacts" + cd "$REPO_DIR" +fi + +log "Staging bundle for CT ${CTID}..." tar -czf "$STAGE" \ -C "$REPO_DIR" \ config \ @@ -53,8 +51,8 @@ tar -czf "$STAGE" \ services/dbis-exchange/package-lock.json \ scripts/deployment/start-omnl-banking-portal.sh -log "Push to PVE host $PVE_HOST..." -scp -o BatchMode=yes "$STAGE" "${PVE_USER}@${PVE_HOST}:/tmp/omnl-portal.tar.gz" +log "Push to PVE host ${OMNL_PVE_SSH_TARGET}..." +omnl_pve_scp "$STAGE" "${OMNL_PVE_SSH_TARGET}:/tmp/omnl-portal.tar.gz" rm -f "$STAGE" log "Install into CT $CTID at $PORTAL_ROOT..." @@ -67,5 +65,4 @@ pct_exec "chmod +x ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.s log "Start services inside CT..." pct_exec "bash ${PORTAL_ROOT}/scripts/deployment/start-omnl-banking-portal.sh" -log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${PVE_HOST})" -log "Point NPMplus / public DNS to ${PVE_HOST} frontend :3002" +log "Done — portal root: ${PORTAL_ROOT} (CT ${CTID} on ${OMNL_PVE_SSH_TARGET})" diff --git a/scripts/deployment/lib/omnl-pve-ssh.sh b/scripts/deployment/lib/omnl-pve-ssh.sh new file mode 100755 index 0000000..58fdd99 --- /dev/null +++ b/scripts/deployment/lib/omnl-pve-ssh.sh @@ -0,0 +1,59 @@ +#!/usr/bin/env bash +# Shared SSH/SCP helpers for Proxmox pct deploy from dev-bis-ali (LAN). +set -euo pipefail + +OMNL_PVE_HOST="${OMNL_PVE_HOST:-192.168.11.13}" +OMNL_PVE_USER="${OMNL_PVE_USER:-root}" +OMNL_PVE_SSH_HOST="${OMNL_PVE_SSH_HOST:-${OMNL_PVE_HOST}}" +OMNL_PVE_SSH_TARGET="${OMNL_PVE_USER}@${OMNL_PVE_SSH_HOST}" + +# Avoid cloudflared ProxyJump when using raw 192.168.11.x from dev-bis-ali. +OMNL_PVE_SSH_BASE_OPTS=( + -o BatchMode=yes + -o ConnectTimeout=20 + -o StrictHostKeyChecking=accept-new + -o ProxyJump=none +) + +OMNL_PVE_SSH_PREFIX=() + +omnl_pve_detect_sudo() { + if [[ -n "${OMNL_PVE_SSH_PREFIX[*]:-}" ]]; then + return 0 + fi + if [[ "${OMNL_PVE_USE_SUDO:-auto}" == "0" ]]; then + OMNL_PVE_SSH_PREFIX=() + return 0 + fi + if [[ "${OMNL_PVE_USE_SUDO:-auto}" == "1" ]]; then + OMNL_PVE_SSH_PREFIX=(sudo) + return 0 + fi + if ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" true 2>/dev/null; then + OMNL_PVE_SSH_PREFIX=() + elif sudo -n ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" true 2>/dev/null; then + OMNL_PVE_SSH_PREFIX=(sudo) + else + echo "Cannot SSH to ${OMNL_PVE_SSH_TARGET} (tried direct and sudo)." >&2 + echo "Fix: bash scripts/deployment/setup-dev1-pve-ssh-access.sh" >&2 + return 1 + fi +} + +omnl_pve_ssh() { + omnl_pve_detect_sudo + "${OMNL_PVE_SSH_PREFIX[@]}" ssh "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$OMNL_PVE_SSH_TARGET" "$@" +} + +omnl_pve_scp() { + omnl_pve_detect_sudo + "${OMNL_PVE_SSH_PREFIX[@]}" scp "${OMNL_PVE_SSH_BASE_OPTS[@]}" "$@" +} + +omnl_pve_preflight() { + omnl_pve_detect_sudo + omnl_pve_ssh "command -v pct >/dev/null && pct list >/dev/null" || { + echo "Proxmox pct unavailable on ${OMNL_PVE_SSH_TARGET}" >&2 + return 1 + } +} diff --git a/scripts/deployment/setup-dev1-pve-ssh-access.sh b/scripts/deployment/setup-dev1-pve-ssh-access.sh new file mode 100755 index 0000000..009964b --- /dev/null +++ b/scripts/deployment/setup-dev1-pve-ssh-access.sh @@ -0,0 +1,32 @@ +#!/usr/bin/env bash +# Ensure dev1@dev-bis-ali can reach Proxmox via sudo ssh (LAN, no cloudflared). +set -euo pipefail + +CONFIG="${HOME}/.ssh/config.d-ecosystem" +PUB="${HOME}/.ssh/id_ed25519.pub" + +log() { echo "[$(date -Iseconds)] $*"; } + +if [[ ! -f "$PUB" ]]; then + echo "Missing $PUB — generate or copy operator SSH key first." >&2 + exit 1 +fi + +if [[ -f "$CONFIG" ]] && grep -q 'Host 192.168.11\.\*' "$CONFIG"; then + log "Patching $CONFIG — disable ProxyJump for LAN 192.168.11.* (use pve-r630-* aliases from laptop via -J dev-bis)" + tmp="$(mktemp)" + awk ' + /^Host 192\.168\.11\.\*/ { inblock=1 } + inblock && /^[[:space:]]+ProxyJump dev-bis/ { sub(/ProxyJump dev-bis/, "ProxyJump none"); } + { print } + inblock && /^$/ { inblock=0 } + ' "$CONFIG" > "$tmp" + mv "$tmp" "$CONFIG" + chmod 600 "$CONFIG" +fi + +log "Testing Proxmox SSH (direct, then sudo)..." +# shellcheck source=lib/omnl-pve-ssh.sh +source "$(dirname "$0")/lib/omnl-pve-ssh.sh" +omnl_pve_preflight +log "Proxmox SSH OK via ${OMNL_PVE_SSH_PREFIX[*]:-direct} → ${OMNL_PVE_SSH_TARGET}" diff --git a/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh old mode 100644 new mode 100755 index b230598..27ba297 --- a/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh +++ b/scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh @@ -1,12 +1,5 @@ #!/usr/bin/env bash # Sync OMNL banking portal to all Ali banking LXCs (5820–5828) via Proxmox pct. -# -# Usage: -# bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh # dry-run -# bash scripts/deployment/sync-ali-omnl-banking-portal-lxcs.sh --apply # deploy all -# -# Requires: root SSH to OMNL_PVE_HOST (default 192.168.11.13), built repo at ~/smom-dbis-138 - set -euo pipefail REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}" @@ -17,26 +10,36 @@ if [[ "${1:-}" == "--apply" ]]; then APPLY=true fi -# Banking portal LXCs — one per public FQDN product surface CTIDS=(5820 5821 5822 5823 5824 5825 5826 5827 5828) log() { echo "[$(date -Iseconds)] $*"; } -if [[ ! -x "$DEPLOY_SCRIPT" ]]; then +if [[ ! -f "$DEPLOY_SCRIPT" ]]; then echo "Missing deploy script: $DEPLOY_SCRIPT" >&2 exit 1 fi +# shellcheck source=lib/omnl-pve-ssh.sh +source "${REPO_DIR}/scripts/deployment/lib/omnl-pve-ssh.sh" +omnl_pve_preflight + log "OMNL banking LXC sync — CTIDs: ${CTIDS[*]}" log "Mode: $(if $APPLY; then echo APPLY; else echo DRY-RUN; fi)" log "Repo: $REPO_DIR" +log "PVE: ${OMNL_PVE_SSH_TARGET} (sudo prefix: ${OMNL_PVE_SSH_PREFIX[*]:-none})" + +if $APPLY; then + log "Building stack once on dev..." + cd "$REPO_DIR" + bash scripts/deployment/deploy-omnl-bank-production.sh +fi for CTID in "${CTIDS[@]}"; do if $APPLY; then log "Deploying CT $CTID..." - OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT" + OMNL_SKIP_BUILD=1 OMNL_PCT_CTID="$CTID" OMNL_BANK_ROOT="$REPO_DIR" bash "$DEPLOY_SCRIPT" else - log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_HOST:-192.168.11.13})" + log "Would deploy CT $CTID → /srv/ali-portal (pct exec on ${OMNL_PVE_SSH_TARGET})" fi done