han-app/support&notes/deploy_stories/260904_1.md

Логирование операций

1. env: editor /etc/han/vm1.env изменение Release_Version

• две переменные: HOST_NAME=prodhanapp.ihan.ru \devhanapp \ TELEMETRYGEN_IMAGE=ghcr.io/open-telemetry/opentelemetry-collector-contrib/telemetrygen@sha256:9461e2c7213219467e5f775ea8652d15c990afb4d1ca94e62344f2025a7587d1

2. Обновить образы:

API_BACKEND_IMAGE=cr.selcloud.ru/han-images/han-api-backend@sha256:5ec8336ce56de41880398f68a2174530ba4dde9cd8ae6151c42f1631ab29bc35 SMS_SERVICE_IMAGE=cr.selcloud.ru/han-images/sms-service@sha256:404685c45b7391a78f95c014ce8fdff64a84ccd7ae5b280e7a65b524c109d898 BITRIX_LOCAL_APP_IMAGE=cr.selcloud.ru/han-images/bitrix-local-app@sha256:442889dc20e76f2a16d093adb4ae3ae38508535bafda82654755d1da50693183 NGINX_IMAGE=cr.selcloud.ru/han-images/nginx@sha256:2cd7d32967b400c15bb6aaa18e97e99d429b2b6f2bfd54b965fc7d42a91a228e

3. Скопировать проект:

$Release = "1.0.1"
tar --exclude=backend/.env `
  --exclude='backend/**/__pycache__' `
  --exclude='backend/**/.pytest_cache' `
  --exclude='backend/**/.ruff_cache' `
  -czf "vm1-backend-$Release.tar.gz" `
  -C C:/Users/MI/Documents/Assistent/HAN_chat_specification/VM1_app/codebase backend
Get-FileHash "vm1-backend-$Release.tar.gz" -Algorithm SHA256
scp "vm1-backend-$Release.tar.gz" prodVM1Deploy:/var/lib/han-deploy/incoming/

RELEASE='1.0.1' EXPECTED_SHA256='900C7AF2AEC061CFA112F82F8511A8A21F43EDB356EA3EF8C3205F49B6F1DF8F' ARCHIVE="/var/lib/han-deploy/incoming/vm1-backend-${RELEASE}.tar.gz" printf '%s %s/n' "$EXPECTED_SHA256" "$ARCHIVE" | sha256sum --check - tar -tvzf "$ARCHIVE" if tar -tzf "ARCHIVE" | grep -Eq '(^/|(^|/)\.\.(/|)|^backend/.env$)'; then echo 'unsafe path or .env' >&2; exit 1 fi if tar -tzf "ARCHIVE" | grep -Ev '^backend(/|)' | grep -q .; then echo 'archive has files outside backend' >&2; exit 1 fi if tar -tvzf "$ARCHIVE" | awk '$1 ~ /^[lh]/ {found=1} END {exit !found}'; then echo 'symlink/hardlink is forbidden' >&2; exit 1 fi

TARGET="/opt/han-chat/releases/${RELEASE}" test ! -e "$TARGET" install -d -m 0755 -o root -g root "$TARGET" tar --extract --gzip --file "$ARCHIVE" --directory "$TARGET"
--no-same-owner --no-same-permissions test -f "$TARGET/backend/docker-compose.yml" chmod 0755
"$TARGET/backend/deployment/scripts/setup-vm.sh"
"$TARGET/backend/deployment/preflight.sh"
"$TARGET/backend/deployment/scripts/tls-deploy-hook.sh"
"$TARGET/backend/deployment/secrets/han-compose"
"$TARGET/backend/deployment/secrets/han-secrets" test -x "$TARGET/backend/deployment/scripts/setup-vm.sh" test -x "$TARGET/backend/deployment/preflight.sh" test -x "$TARGET/backend/deployment/scripts/tls-deploy-hook.sh" test -x "$TARGET/backend/deployment/secrets/han-compose" test -x "$TARGET/backend/deployment/secrets/han-secrets" if find "$TARGET/backend" -type l -print -quit | grep -q .; then exit 1; fi chown -R root:root "$TARGET" chmod -R go-w "$TARGET" ln -s "releases/${RELEASE}" /opt/han-chat/.current-new mv -Tf /opt/han-chat/.current-new /opt/han-chat/current

cd /opt/han-chat/current/backend/ sudo apt update sudo apt install -y dos2unix find . -type f (
-name '.sh' -o -name '.py' -o -name '.service' -o -name '.sudoers' -o -name 'han-compose' -o -name 'han-secrets' -o -name 'han-message-safety-mode' -o -name '.yml' -o -name '.conf*' -o -name 'preflight.sh' -o -name '.yaml' -o -name '.md' -o -name '.toml' -o -name 'Dockerfile' -o -name '.acl*' -o -name '.tsx' -o -name '.ts' -o -name '.java' -o -name '.js' -o -name '.ps1' -o -name '.xml' -o -name '.dockerignore' -o -name '.env*' -o -name '.css' -o -name '.ftl' -o -name '.TAG' -o -name 'validate-env' -o -name '.properties' -o -name '*org.keycloak.Factory' -o -name '.html'
) -exec dos2unix {} + find -type f -exec file {} ; | grep -i 'CRLF'

sudo apt remove -y dos2unix sudo apt purge -y dos2unix

/usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-api alembic current /usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-bitrix-local alembic current

/usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-api /usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-bitrix-local

Проверка применения миграции /usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-bitrix-local alembic current /usr/local/sbin/han-vm1-compose --profile ops run --rm migrate-bitrix-local alembic heads

scp C:/Users/MI/.ssh/prodDeploy.pub C:/Users/MI/.ssh/prodAdmin.pub ` prodVM1Deploy:/var/lib/han-deploy/incoming/

install -m 0600 -o root -g root /var/lib/han-deploy/incoming/prodDeploy.pub /root/bootstrap/deploy.pub install -m 0600 -o root -g root /var/lib/han-deploy/incoming/prodAdmin.pub /root/bootstrap/admin.pub

rm -f /var/lib/han-deploy/incoming/prodDeploy.pub /var/lib/han-deploy/incoming/prodAdmin.pub

cd /opt/han-chat/current/backend

export OTEL_HOST_COLLECTOR_VERSION='0.117.0' export OTEL_HOST_COLLECTOR_SHA256='90710c909a30fc3b89dd0e389c13f9e57ebbb87d6a0dc51fdde0bf03499a5f25' DEPLOY_AUTHORIZED_KEY_FILE=/root/bootstrap/deploy.pub
ADMIN_AUTHORIZED_KEY_FILE=/root/bootstrap/admin.pub
HARDEN_SSH=true SKIP_APT_UPGRADE=true
/opt/han-chat/current/backend/deployment/scripts/setup-vm.sh

export OTEL_REMOTE_ENDPOINT="$(awk -F= '$1=="OTEL_REMOTE_ENDPOINT"{print substr($0,index($0,"=")+1)}' /etc/han/vm1.env)" export OTEL_REMOTE_TLS_INSECURE="$(awk -F= '$1=="OTEL_REMOTE_TLS_INSECURE"{print substr($0,index($0,"=")+1)}' /etc/han/vm1.env)" export HOST_NAME="$(awk -F= '$1=="HOST_NAME"{print substr($0,index($0,"=")+1)}' /etc/han/vm1.env)" export APP_ENV="$(awk -F= '$1=="APP_ENV"{print substr($0,index($0,"=")+1)}' /etc/han/vm1.env)" export RELEASE_VERSION="$(awk -F= '$1=="RELEASE_VERSION"{print substr($0,index($0,"=")+1)}' /etc/han/vm1.env)" printf '%s\n' "$OTEL_REMOTE_ENDPOINT" /usr/local/bin/otelcol-contrib validate
--config=/opt/han-chat/current/backend/deployment/observability/otel-host-collector.yaml

chmod 0755 /opt/han-chat/current/backend/scripts/validate-env /opt/han-chat/current/backend/deployment/preflight.sh

systemctl restart han-stack@production.service если ошибка journalctl -u han-stack@production.service --no-pager -n 80 --output=cat

!!! (образы могут устареть в будущем)

docker pull cr.selcloud.ru/han-images/nginx@sha256:2cd7d32967b400c15bb6aaa18e97e99d429b2b6f2bfd54b965fc7d42a91a228e docker pull cr.selcloud.ru/han-images/sms-service@sha256:404685c45b7391a78f95c014ce8fdff64a84ccd7ae5b280e7a65b524c109d898

systemctl start han-host-otel-collector@production.service rm -f /root/bootstrap/deploy.pub /root/bootstrap/admin.pub

Canary test: chmod 0755 /opt/han-chat/current/backend/deployment/scripts/verify-observability.sh CONFIG_FILE=/etc/han/vm1.env ./deployment/scripts/verify-observability.sh