ops: paivana and caddy config refresh

scripts/caddy/merge-notes-site.sh

@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Merge silverbullet.hacktivism.ch into live /etc/caddy/Caddyfile + ACME http list.
+# Run on koopa as root AFTER podman is up on :9028:
+#   sudo bash /home/hernani/koopa-admin-log/scripts/caddy/merge-notes-site.sh
+# Then:
+#   sudo bash /home/hernani/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh
+set -euo pipefail
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  echo "ERROR: run as root:  sudo bash $0" >&2
+  exit 1
+fi
+
+CADDY=/etc/caddy/Caddyfile
+SNIPPET=/home/hernani/koopa-admin-log/configs/caddy/silverbullet.hacktivism.ch.caddy
+SITE=silverbullet.hacktivism.ch
+# Prior hostnames to rename into SITE (order: newest leftovers first)
+OLD_SITES="freenotes.hacktivism.ch notes.hacktivism.ch"
+
+[[ -f "$CADDY" ]] || { echo "ERROR: missing $CADDY" >&2; exit 1; }
+[[ -f "$SNIPPET" ]] || { echo "ERROR: missing $SNIPPET" >&2; exit 1; }
+command -v caddy >/dev/null || { echo "ERROR: caddy not in PATH" >&2; exit 1; }
+
+ts=$(date +%Y%m%d-%H%M%S)
+cp -a "$CADDY" "${CADDY}.bak-silverbullet-merge-${ts}"
+echo "backup ${CADDY}.bak-silverbullet-merge-${ts}"
+
+python3 - "$CADDY" "$SNIPPET" "$SITE" $OLD_SITES <<'PY'
+import sys
+from pathlib import Path
+
+caddy = Path(sys.argv[1])
+snippet_path = Path(sys.argv[2])
+site = sys.argv[3]
+old_sites = sys.argv[4:]
+text = caddy.read_text()
+orig = text
+snip = snippet_path.read_text().rstrip() + "\n\n"
+
+def drop_site_block(text: str, old_site: str) -> str:
+    marker_old = f"{old_site} {{"
+    i = text.find(marker_old)
+    if i < 0:
+        return text
+    j = text.find("\n}", i)
+    if j < 0:
+        return text
+    end = j + 2
+    while end < len(text) and text[end] == "\n":
+        end += 1
+    text = text[:i] + text[end:]
+    text = text.replace(f", http://{old_site}", "").replace(f"http://{old_site}, ", "")
+    text = text.replace(f"http://{old_site}", "")
+    print(f"OK: removed duplicate old block {old_site}")
+    return text
+
+# Rename leftover freenotes/notes.hacktivism.ch → silverbullet.hacktivism.ch
+for old_site in old_sites:
+    if old_site in text and site not in text:
+        text = text.replace(old_site, site)
+        text = text.replace("9028 freenotes", "9028 silverbullet")
+        text = text.replace("9028 notes", "9028 silverbullet")
+        print(f"OK: renamed {old_site} → {site}")
+    elif old_site in text and site in text:
+        text = drop_site_block(text, old_site)
+
+marker = f"{site} {{"
+if marker in text:
+    print(f"OK: site block already present: {site}")
+else:
+    # Insert after decidim block if present, else before ACME http list
+    insert_at = None
+    dec = text.find("decidim.hacktivism.ch {")
+    if dec >= 0:
+        j = text.find("\n}", dec)
+        if j >= 0:
+            insert_at = j + 2  # after closing brace newline
+            while insert_at < len(text) and text[insert_at] == "\n":
+                insert_at += 1
+    if insert_at is None:
+        acme = text.find("http://taler.hacktivism.ch")
+        insert_at = acme if acme >= 0 else len(text)
+    text = text[:insert_at] + snip + text[insert_at:]
+    print(f"OK: inserted site block {site}")
+
+http_tok = f"http://{site}"
+if http_tok in text:
+    print(f"OK: ACME http list already has {http_tok}")
+else:
+    old = "http://decidim.hacktivism.ch {"
+    new = f"http://decidim.hacktivism.ch, {http_tok} {{"
+    if old not in text:
+        # maybe already on a long list without trailing brace-only form
+        raise SystemExit("ERROR: ACME http list marker not found (decidim)")
+    text = text.replace(old, new, 1)
+    print(f"OK: added {http_tok} to ACME http list")
+
+# Comment header line near top ports comment
+for old_hdr, new_hdr in (
+    (
+        "# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9200 forgejo-ssh",
+        "# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9028 silverbullet | 9200 forgejo-ssh",
+    ),
+    (
+        "# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9028 notes | 9200 forgejo-ssh",
+        "# 9020 castopod | 9021 bonfire | 9022 prime | 9023 bt | 9024 forgejo | 9025 paivana | 9026 lemmy | 9027 decidim | 9028 silverbullet | 9200 forgejo-ssh",
+    ),
+):
+    if old_hdr in text:
+        text = text.replace(old_hdr, new_hdr, 1)
+        print("OK: updated ports comment header")
+        break
+
+if text != orig:
+    caddy.write_text(text)
+    print(f"wrote {caddy}")
+else:
+    print("no Caddyfile change")
+PY
+
+echo "== validate =="
+caddy validate --config "$CADDY"
+
+echo "== reload =="
+if systemctl is-active --quiet caddy; then
+  systemctl reload caddy
+else
+  echo "WARN: caddy unit not active — start it yourself" >&2
+fi
+
+echo
+echo "Next: sudo bash /home/hernani/koopa-admin-log/scripts/caddy/apply-notes-basicauth.sh"
+echo "DNS/VeciGate for ${SITE} still separate."