smom-dbis-138/scripts/deployment/deploy-omnl-bank-production.sh

#!/usr/bin/env bash
# OMNL Bank — production deploy on server (128-chain, Office 24)
set -euo pipefail

REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
BRANCH="${OMNL_BANK_BRANCH:-main}"
LOG_DIR="${OMNL_BANK_LOG_DIR:-$HOME/omnl-bank/logs}"
ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"

log() { echo "[$(date -Iseconds)] $*"; }

mkdir -p "$LOG_DIR"

if [ ! -d "$REPO_DIR/.git" ]; then
  log "Cloning smom-dbis-138..."
  git clone "https://gitea.d-bis.org/d-bis/smom-dbis-138.git" "$REPO_DIR"
fi

cd "$REPO_DIR"
log "Pull latest ($BRANCH)..."
git fetch origin
git checkout "$BRANCH"
git pull --ff-only origin "$BRANCH"

log "Generate 128-chain registry..."
node scripts/generate-omnl-128-chains.mjs

export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
export DBIS_EXCHANGE_CONFIG="${DBIS_EXCHANGE_CONFIG:-$REPO_DIR/config/dbis-exchange.production.v1.json}"
export OMNL_SUPPORTED_CHAINS_CONFIG="${OMNL_SUPPORTED_CHAINS_CONFIG:-$REPO_DIR/config/omnl-supported-chains.v1.json}"
export OMNL_M2_TOKEN_REGISTRY="${OMNL_M2_TOKEN_REGISTRY:-$REPO_DIR/config/omnl-m2-token-registry.v1.json}"

if [ -f "$ENV_FILE" ]; then
  if grep -q $'\r' "$ENV_FILE" 2>/dev/null; then
    log "Normalizing CRLF line endings in $ENV_FILE"
    tr -d '\r' <"$ENV_FILE" >"${ENV_FILE}.lf" && mv "${ENV_FILE}.lf" "$ENV_FILE"
    chmod 600 "$ENV_FILE"
  fi
  set -a
  set +u
  # shellcheck disable=SC1090
  source "$ENV_FILE"
  set -u
  set +a
fi

if [[ -f "$ENV_FILE" ]] && ! grep -q '^OMNL_SUPER_ADMIN_OFFICE24_KEY=' "$ENV_FILE" 2>/dev/null; then
  log "Generating four super-admin API keys..."
  bash "$REPO_DIR/scripts/deployment/seed-omnl-super-admin-keys.sh"
  set -a
  set +u
  # shellcheck disable=SC1090
  source "$ENV_FILE"
  set -u
  set +a
fi

if [[ -f "$ENV_FILE" ]]; then
  # omdnl.org LXCs (5820–5824) reuse super-admin keys from d-bis.org twins (5826–5828 / 5825).
  declare -A PORTAL_AUTH_SOURCE=(
    [5820]=5826 [5821]=5827 [5822]=5827 [5823]=5828 [5824]=5825
    [5825]=5825 [5826]=5826 [5827]=5827 [5828]=5828
  )
  for CTID in 5820 5821 5822 5823 5824 5825 5826 5827 5828; do
    AUTH_SRC="${PORTAL_AUTH_SOURCE[$CTID]}"
    bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" \
      "$CTID" "$REPO_DIR/deploy/nginx/omnl-portal-auth-${CTID}.conf.inc" "$AUTH_SRC" || true
  done
  bash "$REPO_DIR/scripts/deployment/generate-portal-nginx-auth-snippet.sh" \
    5827 "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" 5827 || true
  if [[ -f "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" ]]; then
    sudo cp "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" /etc/nginx/omnl-portal-auth-current.conf.inc 2>/dev/null || \
      cp "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" "$REPO_DIR/deploy/nginx/omnl-portal-auth-current.conf.inc" 2>/dev/null || true
    sudo nginx -t 2>/dev/null && sudo systemctl reload nginx 2>/dev/null || true
  fi
fi

build_pkg() {
  local dir="$1"
  log "Building $dir..."
  cd "$REPO_DIR/$dir"
  npm install --no-fund --no-audit
  npm run build
}

for dir in packages/integration-foundation packages/settlement-core \
  services/token-aggregation services/settlement-middleware services/dbis-exchange; do
  build_pkg "$dir"
done

log "Building frontend..."
cd "$REPO_DIR/frontend-dapp"
export VITE_TOKEN_AGGREGATION_URL="${VITE_TOKEN_AGGREGATION_URL:-/api/v1}"
export VITE_SETTLEMENT_MIDDLEWARE_URL="${VITE_SETTLEMENT_MIDDLEWARE_URL:-/settlement}"
export VITE_DBIS_EXCHANGE_URL="${VITE_DBIS_EXCHANGE_URL:-/exchange}"
# Never embed operator API keys in production frontend — nginx injects server-side.
unset VITE_OMNL_API_KEY
if command -v pnpm >/dev/null 2>&1; then
  pnpm install --frozen-lockfile 2>/dev/null || pnpm install
  pnpm run build
else
  npm install
  npm run build
fi

start_svc() {
  local name="$1"
  local dir="$2"
  local port="$3"
  local cmd="$4"
  log "Starting $name on :$port"
  cd "$REPO_DIR/$dir"
  pkill -f "smom-dbis-138/$dir" 2>/dev/null || true
  fuser -k "${port}/tcp" 2>/dev/null || true
  sleep 1
  nohup env \
    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
    DBIS_EXCHANGE_CONFIG="$DBIS_EXCHANGE_CONFIG" \
    OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
    OMNL_M2_TOKEN_REGISTRY="$OMNL_M2_TOKEN_REGISTRY" \
    OMNL_API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_SECURE_KEY:-}}" \
    OMNL_SUPER_ADMIN_OFFICE24_KEY="${OMNL_SUPER_ADMIN_OFFICE24_KEY:-}" \
    OMNL_SUPER_ADMIN_EXCHANGE_KEY="${OMNL_SUPER_ADMIN_EXCHANGE_KEY:-}" \
    OMNL_SUPER_ADMIN_SECURE_KEY="${OMNL_SUPER_ADMIN_SECURE_KEY:-}" \
    OMNL_SUPER_ADMIN_FOREX_KEY="${OMNL_SUPER_ADMIN_FOREX_KEY:-}" \
    OMNL_PORTAL_INTERNAL_SECRET="${OMNL_PORTAL_INTERNAL_SECRET:-}" \
    OMNL_CUSTOMER_API_KEYS="${OMNL_CUSTOMER_API_KEYS:-}" \
    OMNL_CUSTOMER_SECURITY_PRODUCTION="${OMNL_CUSTOMER_SECURITY_PRODUCTION:-1}" \
    OMNL_BANK_ROOT="$REPO_DIR" \
    OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-${FINERACT_BASE_URL:-}}" \
    OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-${FINERACT_TENANT:-omnl}}" \
    OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
    OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
    OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
    OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}" \
    DATABASE_URL="${DATABASE_URL:-}" \
    SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-1}" \
    SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE="${SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
    OMNL_ALLOW_CHAIN_MINT_EXECUTE="${OMNL_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
    TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}" \
    HYBX_MIFOS_FINERACT_SIDECAR_URL="${HYBX_MIFOS_FINERACT_SIDECAR_URL:-}" \
    SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-}" \
    RPC_URL_138="${RPC_URL_138:-${CHAIN_138_RPC_URL:-}}" \
    CHAIN_138_RPC_URL="${CHAIN_138_RPC_URL:-${RPC_URL_138:-}}" \
    OMNL_MINT_OPERATOR_PRIVATE_KEY="${OMNL_MINT_OPERATOR_PRIVATE_KEY:-}" \
    bash -c "$cmd" >"$LOG_DIR/$name.log" 2>&1 &
  echo $! >"$LOG_DIR/$name.pid"
}

start_svc token-aggregation services/token-aggregation 3000 "npm run start"
sleep 2
start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
sleep 2
start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
sleep 2

FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
pkill -f "serve -s.*$FRONTEND_PORT" 2>/dev/null || true
cd "$REPO_DIR/frontend-dapp"
nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"$LOG_DIR/frontend.log" 2>&1 &
echo $! >"$LOG_DIR/frontend.pid"

sleep 5
log "Health checks..."
curl -sf "http://127.0.0.1:3011/api/v1/settlement/health" | head -c 200 || true
echo
curl -sf "http://127.0.0.1:3011/api/v1/settlement/money-supply/public" | head -c 400 || true
echo
curl -sf "http://127.0.0.1:3012/api/v1/exchange/health" | head -c 200 || true
echo
curl -sf -o /dev/null -w "frontend=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/central-bank"

if [[ -n "${DATABASE_URL:-}" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]]; then
  log "Seeding super-admin control-panel users..."
  node "$REPO_DIR/scripts/deployment/seed-omnl-super-admin-users.mjs" --stop-services >"$LOG_DIR/super-admin-seed.log" 2>&1 || log "WARN: super-admin seed failed — see $LOG_DIR/super-admin-seed.log"
  start_svc token-aggregation services/token-aggregation 3000 "npm run start"
  sleep 2
  start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
  sleep 2
  start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
  sleep 2
fi

log "OMNL Bank deploy complete"
log "  Central Bank: http://127.0.0.1:$FRONTEND_PORT/central-bank"
log "  Office 24:    http://127.0.0.1:$FRONTEND_PORT/office-24"
log "  DBIS Trade:   http://127.0.0.1:$FRONTEND_PORT/trade"
log "  128 chains:   http://127.0.0.1:3011/api/v1/settlement/chains"