scripts/server-image.sh

Ref: Size: 2.0 KiB History
#!/usr/bin/env bash
# Build and push the eitri-server production image (arm64 — the pod is
# pinned to the cluster's arm64 public-IP node; amd64 installs are served by
# the release tarballs, not this image).
#
# The image carries eitri-oidc as well as eitri-server. A plane with no
# external identity provider runs the bundled issuer from this same image, so
# the two can never be at different versions.
#
# Reads deploy.env (same file scripts/deploy.sh uses):
#   SERVER_IMAGE   registry/repo to push, e.g. registry.example/eitri-server (required)
#
# Expects `make web` to have run (internal/server/web/dist — the SPA is
# //go:embed'ed into the binary); the Makefile's server-image target orders it.
set -euo pipefail
cd "$(dirname "$0")/.."

ENV_FILE="${EITRI_DEPLOY_ENV:-$HOME/eitri-deploy/deploy.env}"
# shellcheck disable=SC1090
[ -f "$ENV_FILE" ] && . "$ENV_FILE"
: "${SERVER_IMAGE:?server-image: set SERVER_IMAGE in $ENV_FILE}"

VERSION="$(git describe --tags --always --dirty 2>/dev/null || echo dev)"
[ -f internal/server/web/dist/index.html ] || { echo "server-image: web dist missing — run make web" >&2; exit 1; }

LDFLAGS="-X github.com/a73x/eitri/internal/version.Version=$VERSION"
BUILD_DIR="$(mktemp -d)"
trap 'rm -rf "$BUILD_DIR"' EXIT
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "$LDFLAGS" \
  -o "$BUILD_DIR/eitri-server" ./cmd/eitri-server
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -trimpath -ldflags "$LDFLAGS" \
  -o "$BUILD_DIR/eitri-oidc" ./cmd/eitri-oidc
cp deploy/server/Dockerfile "$BUILD_DIR/"

docker build --platform linux/arm64 -t "$SERVER_IMAGE:$VERSION" "$BUILD_DIR"
# Between build and push on purpose: the gate is on what gets PUBLISHED, not on
# what someone happened to build locally.
./scripts/scan-image.sh "$SERVER_IMAGE:$VERSION"
docker push "$SERVER_IMAGE:$VERSION"
echo "server-image: pushed $SERVER_IMAGE:$VERSION — roll it out with kubectl -n eitri set image deployment/eitri-server eitri-server=$SERVER_IMAGE:$VERSION"