diff --git a/deploy/rollout-131-healthcheck.sh b/deploy/rollout-131-healthcheck.sh old mode 100644 new mode 100755 index 2081717e..b66fe31a --- a/deploy/rollout-131-healthcheck.sh +++ b/deploy/rollout-131-healthcheck.sh @@ -4,6 +4,8 @@ # (curl gegen bekannte Ports). Aufruf: ./deploy/rollout-131-healthcheck.sh set -uo pipefail +ENV_DIR="${NEXARCH_ROLLOUT_ENV_DIR:-/etc/nexarch}" + check() { local name="$1" url="$2" local code @@ -15,6 +17,27 @@ check() { fi } +# Liest die tatsaechliche Listen-Adresse aus der echten Env-Datei statt einen +# Port zu raten -- kein Autodiscovery des Dienstes selbst, nur der schon +# konfigurierten Adresse, damit der Check nicht an falsch angenommenen Ports +# vorbeilaeuft (siehe Fund vom 2026-09-26: dms-app lief real auf 8096, nicht +# auf dem zuvor angenommenen 8600). +listen_addr() { + local file="$1" var="$2" default="$3" + local line + line="$(grep "^${var}=" "$file" 2>/dev/null || true)" + if [ -n "$line" ] && ! echo "$line" | grep -q '# TODO'; then + echo "${line#*=}" + else + echo "$default" + fi +} + +DMS_APP_ADDR=$(listen_addr "$ENV_DIR/dms-app.env" NEXARCH_DMS_APP_LISTEN_ADDR "127.0.0.1:8600") +DMS_WORKER_METRICS_ADDR=$(listen_addr "$ENV_DIR/dms-worker.env" NEXARCH_DMS_WORKER_METRICS_ADDR "127.0.0.1:8601") +DMS_KOSIT_ADDR=$(listen_addr "$ENV_DIR/dms-worker.env" NEXARCH_DMS_WORKER_KOSIT_ADDR "127.0.0.1:8610") +CONNECT_APP_ADDR=$(listen_addr "$ENV_DIR/connect-app.env" NEXARCH_CONNECT_APP_LISTEN_ADDR "127.0.0.1:9500") + echo "== Core (bereits laufend erwartet) ==" check "nexarch-core" "http://127.0.0.1:8080/healthz" check "account-api" "http://127.0.0.1:8099/healthz" @@ -23,16 +46,15 @@ check "kek-api" "http://127.0.0.1:8102/healthz" check "policy-api" "http://127.0.0.1:8093/healthz" echo "== DMS (Erstinstallation durch diesen Rollout) ==" -check "dms-app" "http://127.0.0.1:8600/healthz" -check "dms-worker-metrics" "http://127.0.0.1:8601/metrics" -check "dms-kosit-sidecar" "http://127.0.0.1:8610/healthz" +check "dms-app" "http://${DMS_APP_ADDR}/healthz" +check "dms-worker-metrics" "http://${DMS_WORKER_METRICS_ADDR}/metrics" +check "dms-kosit-sidecar" "http://${DMS_KOSIT_ADDR}/healthz" echo "== Connect (Erstinstallation durch diesen Rollout) ==" -check "connect-app" "http://127.0.0.1:9500/healthz" +check "connect-app" "http://${CONNECT_APP_ADDR}/healthz" echo -echo "Hinweis: Ports/Pfade aus deploy/ports.tsv bzw. den jeweiligen" -echo "BETRIEB-UMGEBUNGSVARIABLEN.md-Dokumenten je Modul; falls ein Dienst auf" -echo "einer anderen Adresse laeuft als hier angenommen, dieses Skript" -echo "entsprechend anpassen (kein Autodiscovery, um keine falsche Sicherheit" -echo "vorzutaeuschen)." +echo "Hinweis: Adressen werden aus den echten Env-Dateien gelesen" +echo "(NEXARCH_*_LISTEN_ADDR); ohne gesetzten Wert greift der Platzhalter aus" +echo "deploy/ports.tsv. Kein Autodiscovery des Dienstes selbst, um keine" +echo "falsche Sicherheit vorzutaeuschen." diff --git a/deploy/rollout-131-selfheal.sh b/deploy/rollout-131-selfheal.sh index ab70faf0..34b519b2 100755 --- a/deploy/rollout-131-selfheal.sh +++ b/deploy/rollout-131-selfheal.sh @@ -136,6 +136,59 @@ while [ "$attempt" -lt "$MAX_ATTEMPTS" ]; do chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" "$DMS_STORAGE_DIR" "$DMS_STAGING_DIR" 2>/dev/null || true fi + log "== Binaries pruefen (nachbauen falls sie fehlen) ==" + for triple in "$DMS_INSTALL_DIR/bin/dms-app:$REPO_DIR/dms:./cmd/app" \ + "$DMS_INSTALL_DIR/bin/dms-worker:$REPO_DIR/dms:./cmd/worker" \ + "$CONNECT_INSTALL_DIR/bin/connect-app:$REPO_DIR/connect:./cmd/connect-app"; do + bin="${triple%%:*}"; rest="${triple#*:}"; moddir="${rest%%:*}"; pkg="${rest#*:}" + if [ ! -x "$bin" ]; then + if [ -f "$moddir/go.mod" ]; then + if ( cd "$moddir" && go build -o "$bin" "$pkg" ) 2>/tmp/rollout-selfheal-buildbin.log; then + log "repariert: ${bin} nachgebaut (aus ${moddir}, ${pkg})." + fixed_this_round=1 + else + blockers+=("Binary ${bin} fehlt und konnte nicht gebaut werden -- siehe /tmp/rollout-selfheal-buildbin.log") + tail -20 /tmp/rollout-selfheal-buildbin.log >&2 || true + fi + else + blockers+=("Binary ${bin} fehlt, Modulverzeichnis ${moddir} nicht gefunden.") + fi + fi + done + if id nexarch >/dev/null 2>&1; then + chown -R nexarch:nexarch "$DMS_INSTALL_DIR" "$CONNECT_INSTALL_DIR" 2>/dev/null || true + fi + + log "== dms-worker.env pruefen (aus dms-app.env ableiten falls sie fehlt) ==" + if [ ! -f "$DMS_ENV" ]; then + blockers+=("dms-app.env fehlt, dms-worker.env kann noch nicht abgeleitet werden.") + elif [ ! -f "$ENV_DIR/dms-worker.env" ]; then + for v in NEXARCH_DMS_APP_TENANT_DSN NEXARCH_DMS_APP_TENANT_SLUG \ + NEXARCH_DMS_APP_STORAGE_DIR NEXARCH_DMS_APP_STORAGE_SIGNING_SECRET \ + NEXARCH_DMS_APP_STORAGE_PUBLIC_BASE_URL NEXARCH_DMS_APP_USAGE_ENDPOINT_URL \ + NEXARCH_DMS_APP_USAGE_CLIENT_ID NEXARCH_DMS_APP_USAGE_CLIENT_SECRET \ + NEXARCH_DMS_APP_KEK_ENDPOINT_URL NEXARCH_DMS_APP_KEK_CLIENT_ID \ + NEXARCH_DMS_APP_KEK_CLIENT_SECRET NEXARCH_DMS_APP_RETENTION_BASE_URL; do + line="$(grep "^${v}=" "$DMS_ENV" 2>/dev/null || true)" + if [ -n "$line" ] && ! echo "$line" | grep -q '# TODO'; then + worker_name="NEXARCH_DMS_WORKER_${v#NEXARCH_DMS_APP_}" + worker_value="${line#*=}" + echo "${worker_name}=${worker_value}" >> "$ENV_DIR/dms-worker.env" + fi + done + { + echo "NEXARCH_DMS_WORKER_METRICS_ADDR=127.0.0.1:8601" + echo "NEXARCH_DMS_WORKER_KOSIT_ADDR=127.0.0.1:8610" + echo "NEXARCH_DMS_WORKER_CONCURRENCY=2" + } >> "$ENV_DIR/dms-worker.env" + chmod 600 "$ENV_DIR/dms-worker.env" + if id nexarch >/dev/null 2>&1; then + chown nexarch:nexarch "$ENV_DIR/dms-worker.env" + fi + log "repariert: ${ENV_DIR}/dms-worker.env angelegt (Werte aus dms-app.env uebernommen)." + fixed_this_round=1 + fi + log "== systemd-Unit-Dateien pruefen (nur Datei-Kopie, kein systemctl) ==" for unit in nexarch-connect-app nexarch-dms-app nexarch-dms-worker; do tmpl="$SCRIPT_DIR/systemd/${unit}.service.tmpl"