Initial import from bf-network-r6.opencode — opencode migration

caddy/deploy.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# TP31 — Caddyfile + DNS-Token in LXC 130 ausrollen.
+#
+# Das Token wird aus ~/.secrets/credentials.env gelesen und direkt in die
+# Container-Env-Datei geschrieben. Es erscheint dabei NIE auf stdout und nie in
+# einer Kommandozeile — dieselbe Regel wie bei `sshpass -e` (s. CLAUDE.md).
+set -euo pipefail
+
+PVE=${PVE:-root@10.40.20.100}
+CTID=${CTID:-130}
+HERE=$(cd "$(dirname "$0")" && pwd)
+
+TOKEN=$(grep -m1 '^CF_DNS_API_TOKEN=' ~/.secrets/credentials.env 2>/dev/null | cut -d= -f2- || true)
+if [ -z "${TOKEN}" ]; then
+  echo "FEHLER: CF_DNS_API_TOKEN fehlt in ~/.secrets/credentials.env" >&2
+  echo "  Anlegen in Cloudflare: My Profile -> API Tokens -> Create Token," >&2
+  echo "  Permission 'Zone : DNS : Edit', Zone Resources auf emsenhuber.net begrenzen." >&2
+  echo "  NICHT das account-weite CF_API_TOKEN wiederverwenden." >&2
+  exit 1
+fi
+
+echo "-> Caddyfile"
+scp -q "${HERE}/Caddyfile" "${PVE}:/tmp/.caddyfile.$$"
+ssh "${PVE}" "pct push ${CTID} /tmp/.caddyfile.\$\$ /etc/caddy/Caddyfile --perms 644 2>/dev/null || pct push ${CTID} /tmp/.caddyfile.$$ /etc/caddy/Caddyfile --perms 644; rm -f /tmp/.caddyfile.$$"
+
+echo "-> Token (maskiert: Laenge ${#TOKEN})"
+printf 'CF_DNS_API_TOKEN=%s\n' "${TOKEN}" | ssh "${PVE}" "cat > /tmp/.cenv.$$ && chmod 600 /tmp/.cenv.$$ && pct push ${CTID} /tmp/.cenv.$$ /etc/caddy/caddy.env --perms 600 && rm -f /tmp/.cenv.$$"
+
+echo "-> validate"
+ssh "${PVE}" "pct exec ${CTID} -- sh -c 'set -a; . /etc/caddy/caddy.env; set +a; /usr/local/bin/caddy validate --config /etc/caddy/Caddyfile' 2>&1 | tail -3"
+
+echo "-> reload/start"
+ssh "${PVE}" "pct exec ${CTID} -- systemctl reload-or-restart caddy && sleep 3 && pct exec ${CTID} -- systemctl is-active caddy"