fix(ci): make deploy SSH commands non-interactive and fail fast

Reviewed-on: http://gitea.lan:3000/robbond/pleskSaas/pulls/52

Dockerfile

@@ -7,6 +7,13 @@ RUN npm ci
 FROM node:20-bookworm-slim AS builder
 WORKDIR /app
 
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ARG BUILD_CACHE_BUSTER
+ENV NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
+ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
+ENV BUILD_CACHE_BUSTER=${BUILD_CACHE_BUSTER}
+
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
 RUN npm run build

Jenkinsfile

@@ -1,6 +1,7 @@
 pipeline {
   // Build + deploy stages require Docker CLI/daemon access on the Jenkins node.
   // Ensure this label maps to an agent with Docker installed and usable.
+  //update
   agent any
 
   environment {
@@ -11,7 +12,7 @@ pipeline {
     APP_HOST = "${env.APP_HOST ?: '192.168.68.89'}"
     APP_USER = "${env.APP_USER ?: 'deploy'}"
     DEPLOY_PATH = "${env.DEPLOY_PATH ?: '/opt/plesk-agency-portal'}"
-    APP_BASE_URL = "${env.APP_BASE_URL ?: 'https://portal.rdbcloud.co.uk}"
+    APP_BASE_URL = "${env.APP_BASE_URL ?: 'http://192.168.68.89:3000'}"
 
   }
 
@@ -62,13 +63,23 @@ pipeline {
 
     stage('Build application') {
       steps {
+        withCredentials([
+          string(credentialsId: 'supabase-public-url', variable: 'NEXT_PUBLIC_SUPABASE_URL'),
+          string(credentialsId: 'supabase-public-anon-key', variable: 'NEXT_PUBLIC_SUPABASE_ANON_KEY')
+        ]) {
           sh 'npm run build'
         }
       }
+    }
 
     stage('Build Docker image') {
       steps {
-        sh 'docker build -t ${IMAGE_LATEST} -t ${IMAGE_BUILD} .'
+        withCredentials([
+          string(credentialsId: 'supabase-public-url', variable: 'NEXT_PUBLIC_SUPABASE_URL'),
+          string(credentialsId: 'supabase-public-anon-key', variable: 'NEXT_PUBLIC_SUPABASE_ANON_KEY')
+        ]) {
+          sh 'docker build --build-arg NEXT_PUBLIC_SUPABASE_URL="$NEXT_PUBLIC_SUPABASE_URL" --build-arg NEXT_PUBLIC_SUPABASE_ANON_KEY="$NEXT_PUBLIC_SUPABASE_ANON_KEY" --build-arg BUILD_CACHE_BUSTER="${BUILD_NUMBER}" -t ${IMAGE_LATEST} -t ${IMAGE_BUILD} .'
+        }
       }
     }
 
@@ -79,34 +90,62 @@ stage('Deploy') {
       keyFileVariable: 'SSH_KEY'
     )]) {
       sh '''
-    bash -eo pipefail << 'EOF'
-    set -euo pipefail
+bash <<EOF
+set -euxo pipefail
 
-    ssh -i "$SSH_KEY" "$APP_USER@$APP_HOST" "mkdir -p $DEPLOY_PATH/scripts"
+SSH_OPTS="-i ${SSH_KEY} -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
 
-    rsync -az \
-      -e "ssh -i $SSH_KEY" \
+echo "Testing remote SSH connectivity"
+ssh ${SSH_OPTS} "${APP_USER}@${APP_HOST}" "whoami && hostname && pwd"
+
+echo "Deploying image tag: ${IMAGE_BUILD}"
+docker image inspect "${IMAGE_BUILD}" --format='{{.Id}} {{.RepoTags}}'
+
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "mkdir -p $DEPLOY_PATH/scripts"
+
+rsync -az \
+  -e "ssh ${SSH_OPTS}" \
   docker-compose.prod.yml \
   "$APP_USER@$APP_HOST:$DEPLOY_PATH/"
 
-    rsync -az \
-      -e "ssh -i $SSH_KEY" \
+rsync -az \
+  -e "ssh ${SSH_OPTS}" \
   scripts/ \
   "$APP_USER@$APP_HOST:$DEPLOY_PATH/scripts/"
 
-    docker save ${IMAGE_LATEST} ${IMAGE_BUILD} \
-      | ssh -i "$SSH_KEY" "$APP_USER@$APP_HOST" 'docker load'
+IMAGE_TAR="plesk-agency-portal-build.tar"
+echo "Creating image archive: ${IMAGE_TAR}"
+docker save -o "${IMAGE_TAR}" "${IMAGE_BUILD}"
+ls -lh "${IMAGE_TAR}"
+sha256sum "${IMAGE_TAR}"
 
-    ssh -i "$SSH_KEY" "$APP_USER@$APP_HOST" \
+echo "Copying image archive to remote host via scp"
+scp ${SSH_OPTS} "${IMAGE_TAR}" "$APP_USER@$APP_HOST:$DEPLOY_PATH/"
+
+echo "Verifying image archive exists on remote host"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "ls -lh $DEPLOY_PATH/plesk-agency-portal-build.tar"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "sha256sum $DEPLOY_PATH/plesk-agency-portal-build.tar"
+
+echo "Loading image archive on remote host"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "docker load -i $DEPLOY_PATH/plesk-agency-portal-build.tar"
+
+echo "Verifying exact image tag is available on remote host"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "docker image inspect ${IMAGE_BUILD} --format='{{.Id}} {{.RepoTags}}'"
+
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" \
   "cd $DEPLOY_PATH && chmod +x ./scripts/deploy-prod.sh ./scripts/smoke-check.sh ./scripts/rollback-prod.sh"
 
-    ssh -i "$SSH_KEY" "$APP_USER@$APP_HOST" \
-      "cd $DEPLOY_PATH && ./scripts/deploy-prod.sh"
-    EOF
+echo "Running remote deploy script with exact image tag"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" \
+  "cd $DEPLOY_PATH && APP_IMAGE='${IMAGE_BUILD}' ./scripts/deploy-prod.sh"
+
+echo "Printing final running container image metadata"
+ssh ${SSH_OPTS} "$APP_USER@$APP_HOST" "docker inspect plesk-agency-portal --format='{{.Image}} {{.Created}}'"
+EOF
       '''
     }
   }
-    }
+}
 
     stage('Smoke check') {
       steps {

docker-compose.prod.yml

@@ -2,9 +2,6 @@ services:
   web:
     container_name: plesk-agency-portal
     image: ${APP_IMAGE:-plesk-agency-portal:latest}
-    build:
-      context: .
-      dockerfile: Dockerfile
     restart: unless-stopped
     env_file:
       - .env

scripts/deploy-prod.sh

@@ -4,27 +4,21 @@ set -euo pipefail
 
 DEPLOY_PATH="${DEPLOY_PATH:-/opt/plesk-agency-portal}"
 APP_IMAGE="${APP_IMAGE:-plesk-agency-portal:latest}"
-SOURCE_PATH="${SOURCE_PATH:-${DEPLOY_PATH}}"
 
 mkdir -p "${DEPLOY_PATH}"
 
-for file in docker-compose.prod.yml deploy-prod.sh smoke-check.sh rollback-prod.sh; do
-  if [ -f "${SOURCE_PATH}/${file}" ]; then
-    cp "${SOURCE_PATH}/${file}" "${DEPLOY_PATH}/${file}"
-  fi
-done
-
-chmod +x "${DEPLOY_PATH}/deploy-prod.sh" \
-  "${DEPLOY_PATH}/smoke-check.sh" \
-  "${DEPLOY_PATH}/rollback-prod.sh" 2>/dev/null || true
-
 if [ ! -f "${DEPLOY_PATH}/docker-compose.prod.yml" ]; then
   echo "Missing docker-compose.prod.yml in ${DEPLOY_PATH}" >&2
   exit 1
 fi
 
+if [ ! -f "${DEPLOY_PATH}/.env" ]; then
+  echo "Missing .env in ${DEPLOY_PATH}" >&2
+  exit 1
+fi
+
 cd "${DEPLOY_PATH}"
 
-APP_IMAGE="${APP_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-build
+APP_IMAGE="${APP_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-build --force-recreate
 
-docker compose -f docker-compose.prod.yml ps
+APP_IMAGE="${APP_IMAGE}" docker compose -f docker-compose.prod.yml ps

scripts/rollback-prod.sh

@@ -21,10 +21,20 @@ if [ ! -f "${DEPLOY_PATH}/docker-compose.prod.yml" ]; then
   exit 1
 fi
 
+if [ ! -f "${DEPLOY_PATH}/.env" ]; then
+  echo "Missing .env in ${DEPLOY_PATH}" >&2
+  exit 1
+fi
+
+if [ ! -f "${DEPLOY_PATH}/scripts/smoke-check.sh" ]; then
+  echo "Missing scripts/smoke-check.sh in ${DEPLOY_PATH}" >&2
+  exit 1
+fi
+
 cd "${DEPLOY_PATH}"
 
-APP_IMAGE="${PREVIOUS_IMAGE_TAG}" docker compose -f docker-compose.prod.yml up -d --no-build
+APP_IMAGE="${PREVIOUS_IMAGE_TAG}" docker compose -f docker-compose.prod.yml up -d --no-build --force-recreate
 
-"${DEPLOY_PATH}/smoke-check.sh" "${APP_BASE_URL}"
+"${DEPLOY_PATH}/scripts/smoke-check.sh" "${APP_BASE_URL}"
 
 docker compose -f docker-compose.prod.yml ps

scripts/smoke-check.sh

@@ -11,17 +11,26 @@ fi
 
 URL="${BASE_URL%/}/api/health"
 TMP_FILE="$(mktemp)"
+MAX_ATTEMPTS=20
+SLEEP_SECONDS=3
 
 trap 'rm -f "${TMP_FILE}"' EXIT
 
-HTTP_CODE=$(curl -sS -o "${TMP_FILE}" -w "%{http_code}" "${URL}")
+for attempt in $(seq 1 "${MAX_ATTEMPTS}"); do
+  HTTP_CODE=$(curl -sS -o "${TMP_FILE}" -w "%{http_code}" "${URL}" || echo "000")
 
-if [ "${HTTP_CODE}" != "200" ]; then
-  echo "Smoke check failed: ${URL} returned ${HTTP_CODE}" >&2
-  cat "${TMP_FILE}" >&2 || true
-  exit 1
-fi
+  if [ "${HTTP_CODE}" = "200" ]; then
+    if node -e "const fs=require('fs');const d=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));if(d?.ok!==true||typeof d?.service!=='string'){process.exit(1)}" "${TMP_FILE}"; then
+      echo "Smoke check passed: ${URL} (attempt ${attempt}/${MAX_ATTEMPTS})"
+      exit 0
+    fi
+  fi
 
-node -e "const fs=require('fs');const d=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));if(d?.ok!==true||typeof d?.service!=='string'){process.exit(1)}" "${TMP_FILE}"
+  if [ "${attempt}" -lt "${MAX_ATTEMPTS}" ]; then
+    sleep "${SLEEP_SECONDS}"
+  fi
+done
 
-echo "Smoke check passed: ${URL}"
+echo "Smoke check failed after ${MAX_ATTEMPTS} attempts: ${URL}" >&2
+cat "${TMP_FILE}" >&2 || true
+exit 1