@@ -47,33 +47,38 @@ deployInit
4747 => ThunkPtr
4848 -> FilePath
4949 -> FilePath
50− -> FilePath
5150 -> [String] -- ^ hostnames
5251 -> String -- ^ route
5352 -> String -- ^ admin email
5453 -> Bool -- ^ enable https
5554 -> m ()
56−deployInit thunkPtr configDir deployDir sshKeyPath hostnames route adminEmail enableHttps = do
57− (hasConfigDir, localKey) <- withSpinner ("Preparing " <> T.pack deployDir) $ do
58− hasConfigDir <- liftIO $ do
59− createDirectoryIfMissing True deployDir
60− doesDirectoryExist configDir
55+deployInit thunkPtr deployDir sshKeyPath hostnames route adminEmail enableHttps = do
56+ localKey <- withSpinner ("Preparing " <> T.pack deployDir) $ do
6157 localKey <- liftIO (doesFileExist sshKeyPath) >>= \case
6258 False -> failWith $ T.pack $ "ob deploy init: file does not exist: " <> sshKeyPath
6359 True -> pure $ deployDir </> "ssh_key"
6460 callProcessAndLogOutput (Notice, Error) $
6561 proc "cp" [sshKeyPath, localKey]
6662 liftIO $ setFileMode localKey $ ownerReadMode .|. ownerWriteMode
67− return $ (hasConfigDir, localKey)
63+ return localKey
6864 withSpinner "Validating configuration" $ do
6965 void $ getHostFromRoute enableHttps route -- make sure that hostname is present
7066 forM_ hostnames $ \hostname -> do
7167 putLog Notice $ "Verifying host keys (" <> T.pack hostname <> ")"
7268 -- Note: we can't use a spinner here as this function will prompt the user.
7369 verifyHostKey (deployDir </> "backend_known_hosts") localKey hostname
74− when hasConfigDir $ withSpinner "Importing project configuration" $ do
70+ --IMPORTANT: We cannot copy config directory from the development project to
71+ --the deployment directory. If we do, it's very likely someone will
72+ --accidentally create a production deployment that uses development
73+ --credentials to connect to some resources. This could result in, e.g.,
74+ --production data backed up to a dev environment.
75+ withSpinner "Creating project configuration directories" $ do
7576 callProcessAndLogOutput (Notice, Error) $
76− proc "cp" [ "-r" , "-T" , configDir , deployDir </> "config"]
77+ proc "mkdir" [ "-p"
78+ , deployDir </> "config" </> "backend"
79+ , deployDir </> "config" </> "common"
80+ , deployDir </> "config" </> "frontend"
81+ ]
7782 withSpinner "Writing deployment configuration" $ do
7883 writeDeployConfig deployDir "backend_hosts" $ unlines hostnames
7984 writeDeployConfig deployDir "enable_https" $ show enableHttps
@@ -131,7 +136,7 @@ deployPush deployPath getNixBuilders = do
131136 withSpinner "Uploading closures" $ ifor_ buildOutputByHost $ \host outputPath -> do
132137 callProcess'
133138 (Map.fromList [("NIX_SSHOPTS", unwords sshOpts)])
134− "nix-copy-closure" ["-v", "--to", "root@" <> host, "--gzip", outputPath]
139+ "nix-copy-closure" ["-v", "--to", "--use-substitutes", "root@" <> host, "--gzip", outputPath]
135140 withSpinner "Uploading config" $ ifor_ buildOutputByHost $ \host _ -> do
136141 callProcessAndLogOutput (Notice, Warning) $
137142 proc "rsync"