Begin Wyrm from the game kit

deploy/deploy.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Build locally, push the static site and the game server to the droplet,
+# and restart the server. Usage: deploy/deploy.sh <droplet-ip-or-host>
+set -euo pipefail
+HOST="${1:?usage: deploy.sh <droplet-ip-or-host>}"
+
+# The family list is the kit's; a game deploys with the kit's latest copy when the kit is beside it.
+KIT_FAMILY="$(dirname "$0")/../../game-kit/family.json"
+[ -f "$KIT_FAMILY" ] && cp "$KIT_FAMILY" static/family.json
+
+npm run check
+npm run check:server
+npm test
+npm run build
+
+# Every production ledger must replay identically with the engine about to ship.
+deploy/verify-ledgers.sh "$HOST"
+
+# Old hashed chunks stay a week: a page loaded before this deploy can still
+# fetch the module it was built against instead of failing mid-game.
+rsync -az --delete --filter='P _app/immutable/*' \
+  build/ "root@$HOST:/opt/wyrm/build/"
+
+# The server runs from source with tsx and carries its own small manifest;
+# it needs only its code and the engine. Ledgers live outside this tree.
+rsync -az --delete --exclude='/server/node_modules' \
+  --include='/server/***' --include='/src/' --include='/src/lib/' --include='/src/lib/game/***' --include='/src/lib/net/' --include='/src/lib/net/view.ts' \
+  --include='/deploy/' --include='/deploy/wyrm.service' --include='/deploy/wyrm.cron' --include='/deploy/*.sh' --include='/deploy/traffic.py' \
+  --exclude='*' \
+  ./ "root@$HOST:/opt/wyrm/app/"
+
+ssh "root@$HOST" '
+  find /opt/wyrm/build/_app/immutable -type f -mtime +7 -delete
+  chown -R root:caddy /opt/wyrm/build
+  chmod -R g+rX /opt/wyrm/build
+  cd /opt/wyrm/app/server && npm install --no-audit --no-fund
+  chown -R wyrm:wyrm /opt/wyrm/app
+  cp /opt/wyrm/app/deploy/wyrm.service /etc/systemd/system/wyrm.service
+  # The ops scripts run from /usr/local/bin and share traffic.py: install them
+  # on every deploy so the live copies are always the repo copies.
+  install -m 755 /opt/wyrm/app/deploy/wyrm-visitors.sh /usr/local/bin/wyrm-visitors.sh
+  install -m 755 /opt/wyrm/app/deploy/wyrm-pulse.sh /usr/local/bin/wyrm-pulse.sh
+  install -m 755 /opt/wyrm/app/deploy/wyrm-rollup.sh /usr/local/bin/wyrm-rollup.sh
+  install -m 755 /opt/wyrm/app/deploy/wyrm-backup.sh /usr/local/bin/wyrm-backup.sh
+  install -m 755 /opt/wyrm/app/deploy/wyrm-reseat.sh /usr/local/bin/wyrm-reseat.sh
+  install -m 755 /opt/wyrm/app/deploy/wyrm-say.sh /usr/local/bin/wyrm-say.sh
+  # The key to the keeper door: made once, readable by root (the reseat script) and the game user (the server) alone.
+  if [ ! -s /etc/wyrm/keeper.key ]; then
+    install -d -m 750 -o root -g wyrm /etc/wyrm
+    (umask 037; openssl rand -hex 32 > /etc/wyrm/keeper.key)
+    chown root:wyrm /etc/wyrm/keeper.key
+  fi
+  install -m 644 -D /opt/wyrm/app/deploy/traffic.py /usr/local/lib/wyrm/traffic.py
+  # On a host the hall shares, its hall-nightly.sh runs the rollup and backup
+  # of every game and checks in with Sentry once for all; a game on a box of
+  # its own schedules its own.
+  if [ -f /etc/cron.d/gamehall ]; then rm -f /etc/cron.d/wyrm
+  else install -m 644 /opt/wyrm/app/deploy/wyrm.cron /etc/cron.d/wyrm; fi
+  mkdir -p /var/log/wyrm
+  systemctl daemon-reload
+  systemctl enable --now wyrm
+  systemctl restart wyrm
+  systemctl reload caddy
+  # "active" means only that the process started: wait for it to answer HTTP,
+  # so a server that dies loading its code fails the deploy instead of looping.
+  for i in $(seq 20); do
+    if curl -s -o /dev/null http://127.0.0.1:8791/api/rooms/ZZZZ; then
+      systemctl --no-pager -l status wyrm | head -3
+      exit 0
+    fi
+    sleep 1
+  done
+  echo "the game server is not answering:" >&2
+  journalctl -u wyrm -n 25 --no-pager >&2
+  exit 1
+'
+echo "deployed."