seon
b101e92584
MIG 인스턴스 startup script가 실행하는 vm/legacy-api/apply.sh를 추가한다. VM SA의 메타데이터 토큰으로 Secret Manager(selfheal-db-password)에서 DB 비밀번호를 받아 env 파일(0600)에 DSN을 쓰고, 고정 태그 이미지(legacy-api:7186ef0)로 compose up. Alloy는 WP-15에서 추가한다.
23 lines
1.3 KiB
Bash
Executable File
23 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# legacy-api VM (GCP MIG instance). Idempotent: run at first boot by the startup script and again by `make vm-sync`.
|
|
# 1) DB password from Secret Manager via the VM service account (metadata token; no key files, design 6.11)
|
|
# 2) docker compose up with the pinned image tag
|
|
# Alloy (metrics/logs shipping) is added in WP-15.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
PROJECT="$(curl -sf -H 'Metadata-Flavor: Google' http://metadata.google.internal/computeMetadata/v1/project/project-id)"
|
|
command -v jq >/dev/null || { apt-get update -qq && apt-get install -y -qq jq >/dev/null; }
|
|
TOKEN="$(curl -sf -H 'Metadata-Flavor: Google' 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token' | jq -r .access_token)"
|
|
DB_PASSWORD="$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
|
|
"https://secretmanager.googleapis.com/v1/projects/${PROJECT}/secrets/selfheal-db-password/versions/latest:access" \
|
|
| jq -r .payload.data | base64 -d || true)"
|
|
unset TOKEN
|
|
ENV_FILE=/opt/selfheal/legacy-api.env
|
|
umask 077
|
|
{
|
|
printf 'DB_DSN=postgres://app:%s@10.20.0.20:5432/app?sslmode=disable\n' "${DB_PASSWORD}"
|
|
} > "$ENV_FILE"
|
|
unset DB_PASSWORD
|
|
docker compose --env-file "$ENV_FILE" -f compose.yaml up -d --pull always --remove-orphans
|
|
docker compose -f compose.yaml ps
|