GarminHealthLab/deploy/push.sh

#!/bin/sh
# RETIRED 2026-09-12: production moved off the NAS to the Oracle box — see
# deploy/push_oracle.sh. The NAS's garmin_health_lab database has been
# DROPPED and its S99garmin.sh boot entry removed; this script now has
# nothing live to deploy to. Kept for reference (the tar-over-ssh dance for
# a password-only host may be useful again) — do not run it expecting it to
# reach a running service.
#
# --- original header below ---
#
# Push this working tree to the NAS and restart it.
#
# The NAS only accepts password auth, so one ssh master connection is opened
# up front and every later step rides on it: you type the password once, not
# five times. (macOS's bundled rsync 2.6.9 cannot carry a password through
# -e at all — hence tar over ssh.)
#
#   ./deploy/push.sh [user@host] [port]
#
# The password is never stored here — ssh asks for it on your terminal. To
# stop being asked at all, run `ssh-copy-id -p 2222 ericwyuan@192.168.50.64`
# once; after that this script runs unattended.
#
# Never touches .env, .venv or the database on the far side.
set -e

# DHCP-assigned and has already changed once (192.168.50.64 -> .65 on the
# 2026-09-06 reboot) — this default will go stale again after the NAS's next
# reboot unless a DHCP reservation is set for it on the router. Until then,
# pass the current IP explicitly: `./deploy/push.sh ericwyuan@<ip>`.
HOST="${1:-ericwyuan@192.168.50.65}"
PORT="${2:-2222}"
# Needed for the sudo restart below. Prompted for rather than stored, and only
# used over the already-authenticated ssh master connection.
PASS="${NAS_PASSWORD:-}"
REPO="$(cd "$(dirname "$0")/.." && pwd)"
CTL="$(mktemp -u /tmp/garmin-deploy-XXXXXX)"

sh_() { ssh -S "$CTL" -o BatchMode=yes "$HOST" "$@"; }

cleanup() { ssh -S "$CTL" -O exit "$HOST" 2>/dev/null || true; }
trap cleanup EXIT

echo "==> connecting to $HOST:$PORT (password prompt follows, once)"
ssh -M -S "$CTL" -fN -p "$PORT" -o ControlPersist=300 "$HOST"

if [ -z "$PASS" ]; then
  # Same password as the ssh login; asked for separately because ssh consumed
  # the first one itself and sudo on the far side needs it on stdin.
  printf 'sudo password for %s (needed to restart the root-owned service): ' "$HOST" >&2
  stty -echo 2>/dev/null; read PASS; stty echo 2>/dev/null; echo >&2
fi

# The app dir has moved before; find it rather than assume it.
APP=$(sh_ 'for d in ~/apps/garmin-health-lab /volume1/web/garmin-health-lab; do
             [ -d "$d/backend" ] && { echo "$d"; break; }; done')
[ -n "$APP" ] || { echo "cannot find the app dir on $HOST" >&2; exit 1; }
echo "==> app dir: $APP"

# STATIC_DIR is ./static relative to backend/, which is where start.sh cds to.
STATIC="$APP/backend/static"
# `cmd && VAR=x` would trip `set -e` when cmd fails, so spell it out.
if sh_ "[ -f '$APP/static/index.html' ]" 2>/dev/null; then
  STATIC="$APP/static"
fi
echo "==> static dir: $STATIC"

# macOS bsdtar writes com.apple.provenance xattrs and ._ resource forks that
# the NAS's tar cannot read; it warns once per file and copies nothing useful.
TAR="tar czf - --no-xattrs"
export COPYFILE_DISABLE=1

echo "==> backend"
$TAR --exclude .venv --exclude .env --exclude __pycache__ \
    --exclude '*.db' --exclude tests --exclude .pytest_cache \
    -C "$REPO/backend" . | sh_ "tar xzf - -C '$APP/backend'"

# The restart below runs the NAS's own copies of stop.sh / start.sh, so they
# have to travel with the code — otherwise a fix to them lands in git, the
# deploy reports success, and the far side keeps running the old ones. That is
# exactly how the broken pgrep guards survived a deploy that was meant to fix
# them.
echo "==> deploy scripts"
$TAR -C "$REPO/deploy" . | sh_ "tar xzf - -C '$APP/deploy'"
# tar carries whatever bit the local file has, and it silently had none:
# S99garmin.sh lost +x at some point before this repo existed, every deploy
# since then re-clobbered the NAS's copy back to non-executable, and nothing
# noticed until a 2026-09-06 reboot left the service down for two days —
# DSM's rc.d runner does not execute a script it cannot execute, and does not
# warn either. Asserted here so a future loss of the bit fails the deploy
# instead of failing silently at the next reboot.
sh_ "chmod +x '$APP/deploy/S99garmin.sh' '$APP/deploy/start.sh' '$APP/deploy/stop.sh'"
if ! sh_ "[ -x '$APP/deploy/S99garmin.sh' ]"; then
  echo "S99garmin.sh is not executable after chmod — the boot script will not run on the next reboot" >&2
  exit 1
fi

echo "==> static (cleared first, so stale JS chunks do not pile up)"
if [ ! -f "$REPO/client/build/index.html" ]; then
  echo "client/build is missing — run 'npm run build' first" >&2
  exit 1
fi
sh_ "rm -rf '$STATIC' && mkdir -p '$STATIC'"
$TAR -C "$REPO/client/build" . | sh_ "tar xzf - -C '$STATIC'"

# The service is started at boot as root (DSM Task Scheduler -> S99garmin.sh),
# so logs/error.log and logs/access.log are root-owned. Restarting as
# ericwyuan therefore fails instantly — gunicorn cannot open its own error log
# — and this went unnoticed for a whole deploy: stop.sh could not kill a root
# process either, so the OLD master kept serving :8124, start.sh's health
# check saw a 200 and reported "started", and the new code was never loaded.
# Hence sudo, matching how the service actually runs.
SUDO="echo '$PASS' | sudo -S"
echo "==> restart (sudo: the service runs as root, started at boot)"
# DSM has no pgrep, and an unprivileged `ps` cannot see a root-owned process
# — either one silently returns nothing, which would make the pid comparison
# below always "pass" and put the check right back where it started.
pids_() {
  sh_ "echo '$PASS' | sudo -S ps -eo pid,args 2>/dev/null \
       | grep '$APP/backend/.venv/bin/gunicorn' | grep -v grep \
       | awk '{print \$1}' | sort -n | tr '\n' ','"
}
BEFORE=$(pids_ || true)
sh_ "cd '$APP' && $SUDO sh deploy/stop.sh >/dev/null 2>&1; sleep 3; $SUDO sh deploy/start.sh" \
  || { echo "restart failed" >&2; exit 1; }

echo "==> health"
sh_ "curl -sf -m 5 -o /dev/null -w 'local api: %{http_code}\n' \
     http://127.0.0.1:8124/api/health/status" || echo "local api: unreachable"

# A 200 alone proves nothing: it is exactly what a surviving old master
# returns. The master pid must have changed for the new code to be loaded.
AFTER=$(pids_ || true)
if [ -z "$AFTER" ]; then
  echo "cannot see any gunicorn process - the pid check could not run." >&2
  echo "Verify by hand before trusting this deploy." >&2
  exit 1
fi
if [ "$BEFORE" = "$AFTER" ]; then
  echo "the gunicorn pids did not change ($AFTER) - the old process is still" >&2
  echo "serving and your changes are NOT live. Check $APP/logs/error.log." >&2
  exit 1
fi
echo "==> gunicorn restarted: $BEFORE -> $AFTER"
echo "done. The public URL takes a few seconds longer (frp reconnecting)."