59099e1135
infra/vps/: orchestrate-generation.sh (reaper sweep + wp prautoblogger generate --sync over a held-open SSH session, lock-aware, bounded, structured logging, accept-new host-key) + install-orchestrator.sh + prab-generation.{service,timer}. Code only — install/enable is the gated cutover step. Companion to prautoblogger v0.22.1.
QA: APPROVE @ f3f579f (qa-reviews/peptide-e2e/2026-06-23-f3f579f.md). CEO greenlight 2026-06-22.
Agent-Session: prab-reliability-merge-20260622
80 lines
3.3 KiB
Bash
Executable File
80 lines
3.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# install-orchestrator.sh — One-time setup for the PRAB generation orchestrator on the VPS.
|
|
#
|
|
# Installs:
|
|
# 1. orchestrate-generation.sh -> /opt/prab-orchestrator/ (from this repo)
|
|
# 2. prab-generation.service -> /etc/systemd/system/
|
|
# 3. prab-generation.timer -> /etc/systemd/system/
|
|
#
|
|
# Does NOT enable or start the timer — that is an explicit post-QA cutover step.
|
|
# Does NOT write secrets — the SSH key at /root/.ssh/hostinger_prod_ed25519 must
|
|
# already be present (placed manually by the CTO from .env.credentials).
|
|
#
|
|
# Run as root on the KVM8 VPS (76.13.220.15):
|
|
# bash infra/vps/install-orchestrator.sh
|
|
#
|
|
# After install, validate with DRY_RUN=1 before enabling the timer:
|
|
# DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh
|
|
# systemctl enable --now prab-generation.timer # only after CEO greenlight
|
|
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
INSTALL_DIR="/opt/prab-orchestrator"
|
|
SYSTEMD_DIR="/etc/systemd/system"
|
|
ORCHESTRATE_SH="${SCRIPT_DIR}/orchestrate-generation.sh"
|
|
SERVICE_FILE="${SCRIPT_DIR}/prab-generation.service"
|
|
TIMER_FILE="${SCRIPT_DIR}/prab-generation.timer"
|
|
|
|
# Must be root.
|
|
if [[ "$(id -u)" -ne 0 ]]; then
|
|
echo "ERROR: install-orchestrator.sh must be run as root." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Validate source files exist.
|
|
for f in "${ORCHESTRATE_SH}" "${SERVICE_FILE}" "${TIMER_FILE}"; do
|
|
if [[ ! -f "$f" ]]; then
|
|
echo "ERROR: source file not found: $f" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
echo "Installing PRAB orchestrator to ${INSTALL_DIR}..."
|
|
mkdir -p "${INSTALL_DIR}"
|
|
install -m 0750 "${ORCHESTRATE_SH}" "${INSTALL_DIR}/orchestrate-generation.sh"
|
|
echo " OK: ${INSTALL_DIR}/orchestrate-generation.sh"
|
|
|
|
# Pre-seed known_hosts with Hostinger's host key so ssh(1) can verify
|
|
# the server identity without StrictHostKeyChecking=no.
|
|
# ssh-keyscan output is pinned here; re-run if Hostinger rotates its key.
|
|
KNOWN_HOSTS_FILE="${INSTALL_DIR}/known_hosts"
|
|
if [[ ! -f "${KNOWN_HOSTS_FILE}" ]]; then
|
|
echo "Pre-seeding known_hosts from Hostinger (${SSH_HOST:-145.223.107.228}:${SSH_PORT:-65002})..."
|
|
ssh-keyscan -p "${SSH_PORT:-65002}" "${SSH_HOST:-145.223.107.228}" \
|
|
> "${KNOWN_HOSTS_FILE}" 2>/dev/null \
|
|
&& chmod 0600 "${KNOWN_HOSTS_FILE}" \
|
|
&& echo " OK: ${KNOWN_HOSTS_FILE}" \
|
|
|| echo " WARN: ssh-keyscan failed — known_hosts not seeded; first SSH will add key via accept-new"
|
|
else
|
|
echo " OK: ${KNOWN_HOSTS_FILE} (already exists, not overwritten)"
|
|
fi
|
|
|
|
echo "Installing systemd units..."
|
|
install -m 0644 "${SERVICE_FILE}" "${SYSTEMD_DIR}/prab-generation.service"
|
|
install -m 0644 "${TIMER_FILE}" "${SYSTEMD_DIR}/prab-generation.timer"
|
|
echo " OK: ${SYSTEMD_DIR}/prab-generation.service"
|
|
echo " OK: ${SYSTEMD_DIR}/prab-generation.timer"
|
|
|
|
systemctl daemon-reload
|
|
echo " OK: systemctl daemon-reload"
|
|
|
|
echo ""
|
|
echo "Install complete. Timer is installed but NOT enabled."
|
|
echo "Next steps (post-QA + CEO greenlight only):"
|
|
echo " 1. Ensure SSH key exists: ls -la /root/.ssh/hostinger_prod_ed25519"
|
|
echo " 2. Validate with dry run: DRY_RUN=1 /opt/prab-orchestrator/orchestrate-generation.sh"
|
|
echo " 3. Run first real invocation: /opt/prab-orchestrator/orchestrate-generation.sh"
|
|
echo " 4. Enable timer: systemctl enable --now prab-generation.timer"
|
|
echo " 5. Confirm next run: systemctl list-timers prab-generation.timer"
|