From f6a75455332d0c6ecf7fce078469260dd92aa2e8 Mon Sep 17 00:00:00 2001 From: Dan Crosby Date: Thu, 15 Jan 2026 09:28:46 -0800 Subject: [PATCH] Fully separate auth and eagle deployments (#5370) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Exclude auth paths from docker_build.yml triggers so eagle builds don't trigger when only auth code changes - Remove `docker compose up -d auth` from docker_build.yml - auth is deployed exclusively by auth_build.yml now - Delete unused deploy/update-env.sh and deploy/env.template This prevents docker_build.yml from reverting auth to stale images when it runs after auth_build.yml. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.5 --- .github/workflows/docker_build.yml | 13 +++--- deploy/env.template | 40 ------------------ deploy/update-env.sh | 65 ------------------------------ 3 files changed, 8 insertions(+), 110 deletions(-) delete mode 100644 deploy/env.template delete mode 100644 deploy/update-env.sh diff --git a/.github/workflows/docker_build.yml b/.github/workflows/docker_build.yml index 835cf0f3d0..cd63f7e507 100644 --- a/.github/workflows/docker_build.yml +++ b/.github/workflows/docker_build.yml @@ -5,9 +5,15 @@ on: branches: [ "main" ] paths: # Note: C++ changes trigger shardok_arm64_build.yml instead + # Note: Auth changes trigger auth_build.yml instead - 'src/main/go/**' + - '!src/main/go/net/eagle0/authservice/**' + - '!src/main/go/net/eagle0/authcli/**' - 'src/main/scala/**' - 'src/main/protobuf/**' + - '!src/main/protobuf/net/eagle0/eagle/api/auth.proto' + - '!src/main/protobuf/net/eagle0/eagle/api/admin/**' + - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto' - 'src/main/resources/**' - 'ci/BUILD.bazel' - 'MODULE.bazel' @@ -198,7 +204,7 @@ jobs: # Create directory structure on remote ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << 'SETUP_DIRS' set -e - mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx /opt/eagle0/deploy + mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx rm -f /opt/eagle0/scripts/bin/warmup SETUP_DIRS @@ -207,7 +213,6 @@ jobs: scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/ scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/ scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/ - scp -i ~/.ssh/deploy_key deploy/env.template deploy/update-env.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/deploy/ - name: Deploy to production droplet run: | @@ -282,14 +287,12 @@ jobs: # Deploy Eagle with blue-green (handles eagle, nginx, admin, jfr-sidecar) # Note: Shardok runs on Hetzner, deployed separately via shardok_arm64_build.yml + # Note: Auth is deployed separately via auth_build.yml - do NOT touch auth here chmod +x /opt/eagle0/scripts/*.sh [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://') /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}" - # Ensure auth is running - docker compose -f docker-compose.prod.yml up -d auth - # Verify sleep 10 docker compose -f docker-compose.prod.yml ps diff --git a/deploy/env.template b/deploy/env.template deleted file mode 100644 index eb63736bcd..0000000000 --- a/deploy/env.template +++ /dev/null @@ -1,40 +0,0 @@ -# Environment template for production deployment -# This file defines all env vars used by docker-compose.prod.yml -# Workflows should update their specific vars without overwriting others - -# Container images (managed by respective build workflows) -# Note: Shardok runs on Hetzner, deployed via shardok_arm64_build.yml -EAGLE_IMAGE=registry.digitalocean.com/eagle0/eagle-server:latest -ADMIN_IMAGE=registry.digitalocean.com/eagle0/admin-server:latest -JFR_SIDECAR_IMAGE=registry.digitalocean.com/eagle0/jfr-sidecar:latest -AUTH_IMAGE=registry.digitalocean.com/eagle0/auth-server:latest - -# OpenAI / LLM -OPENAI_API_KEY= -GPT_MODEL_NAME=gpt-4o - -# DigitalOcean Spaces (S3-compatible storage) -EAGLE_ENABLE_S3=false -DO_SPACES_ACCESS_KEY= -DO_SPACES_SECRET_KEY= - -# JWT authentication -JWT_PRIVATE_KEY= - -# OAuth providers -DISCORD_CLIENT_ID= -DISCORD_CLIENT_SECRET= -GOOGLE_CLIENT_ID= -GOOGLE_CLIENT_SECRET= - -# Shardok connection (Hetzner ARM64 server) -SHARDOK_ADDRESS= -SHARDOK_AUTH_TOKEN= - -# Monitoring -SENTRY_DSN= - -# Email (Fastmail JMAP) -FASTMAIL_API_TOKEN= -FASTMAIL_FROM_EMAIL= -FASTMAIL_FROM_NAME= diff --git a/deploy/update-env.sh b/deploy/update-env.sh deleted file mode 100644 index dd0cc93cd5..0000000000 --- a/deploy/update-env.sh +++ /dev/null @@ -1,65 +0,0 @@ -#!/bin/bash -# Update .env file without losing other variables -# Usage: ./update-env.sh KEY1=value1 KEY2=value2 ... -# -# This script: -# 1. Creates .env from template if it doesn't exist -# 2. Updates only the specified KEY=value pairs -# 3. Preserves all other existing values - -set -e - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -ENV_FILE="${ENV_FILE:-/opt/eagle0/.env}" -TEMPLATE_FILE="${TEMPLATE_FILE:-$SCRIPT_DIR/env.template}" - -# Create .env from template if it doesn't exist -if [ ! -f "$ENV_FILE" ]; then - if [ -f "$TEMPLATE_FILE" ]; then - echo "Creating .env from template..." - grep -v '^#' "$TEMPLATE_FILE" | grep -v '^$' > "$ENV_FILE" - else - echo "Creating empty .env..." - touch "$ENV_FILE" - fi - chmod 600 "$ENV_FILE" -fi - -# Process each KEY=VALUE argument -for arg in "$@"; do - # Skip empty args - [ -z "$arg" ] && continue - - # Parse KEY=VALUE - KEY="${arg%%=*}" - VALUE="${arg#*=}" - - # Skip if no key - [ -z "$KEY" ] && continue - - # Skip setting empty values (keeps existing value) - if [ -z "$VALUE" ]; then - echo "Skipping $KEY (empty value)" - continue - fi - - # Remove existing line for this key and add new one - # Use single quotes to avoid issues with special characters in values - # (JSON strings, base64 with /, etc.) - # Escape any single quotes in the value by replacing ' with '\'' - ESCAPED_VALUE="${VALUE//\'/\'\\\'\'}" - - if grep -q "^${KEY}=" "$ENV_FILE" 2>/dev/null; then - # Key exists, remove old line and add new one (sed with special chars is fragile) - grep -v "^${KEY}=" "$ENV_FILE" > "$ENV_FILE.tmp" && mv "$ENV_FILE.tmp" "$ENV_FILE" - echo "${KEY}='${ESCAPED_VALUE}'" >> "$ENV_FILE" - echo "Updated $KEY" - else - # Key doesn't exist, add it - echo "${KEY}='${ESCAPED_VALUE}'" >> "$ENV_FILE" - echo "Added $KEY" - fi -done - -chmod 600 "$ENV_FILE" -echo "Done updating $ENV_FILE"