Разработана первая версия приложений

2026-07-10 18:06:14 +03:00
parent aa8761d1b3
commit 8c7b4074c4
162 changed files with 12178 additions and 16 deletions
@@ -0,0 +1,24 @@
+#!/bin/sh
+set -eu
+
+if [ -z "${PG_BACKUP_DSN:-}" ]; then
+  echo "PG_BACKUP_DSN is required (managed PostgreSQL TLS DSN, supplied via secure environment)." >&2
+  exit 64
+fi
+case "$PG_BACKUP_DSN" in
+  *sslmode=verify-full*sslrootcert=*) ;;
+  *) echo "PG_BACKUP_DSN must enforce sslmode=verify-full and sslrootcert." >&2; exit 64 ;;
+esac
+
+output_dir=${1:-/opt/han-chat/backups}
+umask 077
+mkdir -p "$output_dir"
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+archive="$output_dir/han-chat-$stamp.dump"
+
+pg_dump --dbname="$PG_BACKUP_DSN" --format=custom --no-owner --no-privileges --file="$archive"
+pg_restore --list "$archive" >/dev/null
+sha256sum "$archive" > "$archive.sha256"
+chmod 600 "$archive" "$archive.sha256"
+echo "Logical backup verified: $archive"
+echo "This supplements, but does not replace, provider backup/PITR and restore rehearsal."
@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+if [ "${PITR_MARKER_CONFIRMED:-false}" != "true" ]; then
+  echo "Refusing migration: create provider PITR marker, then set PITR_MARKER_CONFIRMED=true" >&2
+  exit 64
+fi
+
+./scripts/validate-env "${ENV_FILE:-.env}"
+docker compose --env-file "${ENV_FILE:-.env}" config --quiet
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-api alembic current
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-bitrix-local alembic current
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-bitrix-sync alembic current
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-api
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-bitrix-local
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm migrate-bitrix-sync
+echo "Migrations completed; record revisions in release evidence."
@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+previous_env=${1:-}
+if [ -z "$previous_env" ] || [ ! -r "$previous_env" ]; then
+  echo "Usage: $0 /secure/path/previous-release.env" >&2
+  exit 64
+fi
+if [ "${SCHEMA_BACKWARD_COMPATIBLE_CONFIRMED:-false}" != "true" ]; then
+  echo "Refusing rollback: set SCHEMA_BACKWARD_COMPATIBLE_CONFIRMED=true after migration review." >&2
+  exit 64
+fi
+
+./scripts/validate-env "$previous_env"
+docker compose --env-file "$previous_env" config --quiet
+docker compose --env-file "$previous_env" up -d --remove-orphans
+docker compose --env-file "$previous_env" ps
+
+echo "Application images rolled back without Alembic downgrade."
+echo "Run deployment/scripts/smoke.sh with ENV_FILE=$previous_env and verify outbox/inbox idempotency."
@@ -0,0 +1,7 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+./scripts/validate-env "${ENV_FILE:-.env}"
+docker compose --env-file "${ENV_FILE:-.env}" --profile ops run --rm seed-settings
+echo "Seed and mandatory-settings validation completed."
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+ENV_FILE=${ENV_FILE:-.env}
+./scripts/validate-env "$ENV_FILE"
+set -a
+. "./$ENV_FILE"
+set +a
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+http_code=$(curl -sS -o /dev/null -w '%{http_code}' "http://${PUBLIC_HOST}/")
+[ "$http_code" = "308" ] || { echo "Expected HTTP 308, got $http_code" >&2; exit 1; }
+curl -fsS "${PUBLIC_WEB_URL}/api/v1/public/app-config" -o "$tmp/app-config.json"
+curl -fsS "${PUBLIC_WEB_URL}/api/v1/public/content" -o "$tmp/content.json"
+curl -fsS "${PUBLIC_WEB_URL}/auth/realms/${KEYCLOAK_REALM}/.well-known/openid-configuration" -o "$tmp/oidc.json"
+
+internal_code=$(curl -sS -o /dev/null -w '%{http_code}' "${PUBLIC_WEB_URL}/internal/safety/v1/messages/check")
+[ "$internal_code" = "404" ] || { echo "Public /internal returned $internal_code, expected 404" >&2; exit 1; }
+
+headers=$(curl -fsSI "${PUBLIC_WEB_URL}/")
+printf '%s' "$headers" | grep -qi '^x-content-type-options: nosniff'
+printf '%s' "$headers" | grep -qi '^x-request-id:'
+printf '%s' "$headers" | grep -qi '^content-security-policy:'
+
+openssl s_client -connect "${PUBLIC_HOST}:443" -servername "$PUBLIC_HOST" </dev/null 2>/dev/null \
+  | openssl x509 -noout -checkend 604800
+echo "Public edge smoke passed."
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+cd "$(dirname "$0")/../.."
+
+lock=/tmp/han-chat-cert-renew.lock
+exec 9>"$lock"
+flock -n 9 || { echo '{"event":"tls.renew.skipped","reason":"lock_busy"}'; exit 0; }
+
+docker compose --profile certbot run --rm certbot renew \
+  --webroot -w /var/www/certbot --quiet
+docker compose exec -T nginx nginx -t -c /tmp/nginx.conf
+docker compose exec -T nginx nginx -s reload
+echo "{\"event\":\"tls.renew.completed\",\"timestamp\":\"$(date -u +%FT%TZ)\"}"