feat: add Docker/OpenTofu deployment and DE/NL routing

deploy/scripts/bootstrap-server.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+export DEBIAN_FRONTEND=noninteractive
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  printf 'Dieses Skript muss als root ausgeführt werden.\n' >&2
+  exit 1
+fi
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
+WM_ENV_FILE="${WATERMAPS_ENV_FILE:-$WM_DEPLOY_DIR/.env.production}"
+
+install_docker() {
+  if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
+    return
+  fi
+
+  . /etc/os-release
+  case "${ID:-}" in
+    ubuntu|debian) ;;
+    *)
+      printf 'Nicht unterstützte Distribution für die automatische Docker-Installation: %s\n' "${ID:-unbekannt}" >&2
+      exit 1
+      ;;
+  esac
+
+  apt-get update
+  apt-get install --yes ca-certificates curl gnupg
+  install -m 0755 -d /etc/apt/keyrings
+  curl --fail --silent --show-error --location \
+    "https://download.docker.com/linux/$ID/gpg" \
+    --output /etc/apt/keyrings/docker.asc
+  chmod a+r /etc/apt/keyrings/docker.asc
+
+  architecture="$(dpkg --print-architecture)"
+  codename="${VERSION_CODENAME:?VERSION_CODENAME fehlt in /etc/os-release}"
+  printf 'deb [arch=%s signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/%s %s stable\n' \
+    "$architecture" "$ID" "$codename" \
+    >/etc/apt/sources.list.d/docker.list
+
+  apt-get update
+  apt-get install --yes docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+}
+
+install_docker
+apt-get update
+apt-get install --yes bind9-dnsutils curl jq rsync
+systemctl enable --now docker
+
+if [[ ! -f "$WM_ENV_FILE" ]]; then
+  install -m 0600 "$WM_DEPLOY_DIR/.env.production.example" "$WM_ENV_FILE"
+  printf 'Konfiguration aus Vorlage angelegt: %s\n' "$WM_ENV_FILE"
+fi
+
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+ensure_swap_reserve() {
+  local swap_file="/swapfile"
+  local swap_size_gb="${WATERMAPS_SWAP_SIZE_GB:-4}"
+
+  [[ "$swap_size_gb" =~ ^[1-9][0-9]*$ ]] &&
+    ((swap_size_gb <= 16)) ||
+    wm_die "WATERMAPS_SWAP_SIZE_GB muss eine ganze Zahl zwischen 1 und 16 sein."
+
+  if swapon --show=NAME --noheadings | awk '{$1=$1; print}' | grep -Fxq "$swap_file"; then
+    return
+  fi
+
+  wm_log "Persistente ${swap_size_gb}-GB-Swap-Reserve wird vorbereitet."
+  fallocate --length "${swap_size_gb}G" "$swap_file"
+  chmod 0600 "$swap_file"
+  mkswap --force "$swap_file" >/dev/null
+  if ! grep -Fq "$swap_file none swap sw 0 0" /etc/fstab; then
+    printf '%s\n' "$swap_file none swap sw 0 0" >>/etc/fstab
+  fi
+  swapon "$swap_file"
+}
+
+ensure_swap_reserve
+
+install -d -m 0755 \
+  "$WATERMAPS_DATA_DIR" \
+  "$WATERMAPS_DATA_DIR/geofabrik" \
+  "$WATERMAPS_DATA_DIR/local" \
+  "$WATERMAPS_DATA_DIR/certbot" \
+  "$WATERMAPS_DATA_DIR/certbot/www" \
+  "$WATERMAPS_DATA_DIR/certbot/letsencrypt" \
+  "$WATERMAPS_RUNTIME_DIR" \
+  "$WATERMAPS_RUNTIME_DIR/nginx" \
+  "$WATERMAPS_RUNTIME_DIR/nginx/conf.d" \
+  "$WATERMAPS_RUNTIME_DIR/locks"
+
+if [[ ! -f "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf" ]]; then
+  install -m 0644 \
+    "$WM_DEPLOY_DIR/nginx/bootstrap.conf" \
+    "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf"
+fi
+
+install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-route-update.service" /etc/systemd/system/
+install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-route-update.timer" /etc/systemd/system/
+install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-certbot-renew.service" /etc/systemd/system/
+install -m 0644 "$WM_DEPLOY_DIR/systemd/watermaps-certbot-renew.timer" /etc/systemd/system/
+systemctl daemon-reload
+systemctl enable --now watermaps-route-update.timer watermaps-certbot-renew.timer
+
+wm_log "Server-Bootstrap abgeschlossen."

deploy/scripts/common.sh

@@ -0,0 +1,363 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
+WM_ENV_FILE="${WATERMAPS_ENV_FILE:-$WM_DEPLOY_DIR/.env.production}"
+WM_COMPOSE_FILE="$WM_DEPLOY_DIR/compose.production.yml"
+
+wm_die() {
+  printf 'Fehler: %s\n' "$*" >&2
+  exit 1
+}
+
+wm_log() {
+  printf '[watermaps] %s\n' "$*"
+}
+
+wm_load_env() {
+  if [[ ! -f "$WM_ENV_FILE" ]]; then
+    wm_die "Konfiguration fehlt: $WM_ENV_FILE (Vorlage: deploy/.env.production.example)"
+  fi
+
+  set -a
+  # shellcheck disable=SC1090
+  source "$WM_ENV_FILE"
+  set +a
+
+  WATERMAPS_DATA_DIR="${WATERMAPS_DATA_DIR:-/srv/watermaps-data}"
+  WATERMAPS_RUNTIME_DIR="${WATERMAPS_RUNTIME_DIR:-/srv/watermaps-runtime}"
+  export WATERMAPS_DATA_DIR WATERMAPS_RUNTIME_DIR
+
+  wm_require_safe_absolute_dir "$WATERMAPS_DATA_DIR"
+  wm_require_safe_absolute_dir "$WATERMAPS_RUNTIME_DIR"
+}
+
+wm_require_safe_absolute_dir() {
+  local directory="$1"
+  [[ "$directory" == /* ]] || wm_die "Pfad muss absolut sein: $directory"
+  [[ "$directory" != "/" ]] || wm_die "Das Wurzelverzeichnis darf nicht als Datenpfad verwendet werden."
+  [[ "$directory" != "/srv" ]] || wm_die "Bitte ein Unterverzeichnis von /srv verwenden."
+}
+
+wm_assert_data_mount() {
+  mountpoint --quiet "$WATERMAPS_DATA_DIR" ||
+    wm_die "Persistentes Datenvolume ist nicht unter $WATERMAPS_DATA_DIR eingehängt."
+}
+
+wm_compose() {
+  docker compose \
+    --project-directory "$WM_ROOT_DIR" \
+    --env-file "$WM_ENV_FILE" \
+    --file "$WM_COMPOSE_FILE" \
+    "$@"
+}
+
+wm_route_file() {
+  printf '%s/local/germany-netherlands-fairways.json\n' "$WATERMAPS_DATA_DIR"
+}
+
+wm_route_marker() {
+  printf '%s/local/.germany-netherlands-fairways.ready\n' "$WATERMAPS_DATA_DIR"
+}
+
+wm_acquire_route_lock() {
+  install -d -m 0755 "$WATERMAPS_RUNTIME_DIR/locks"
+  exec 9>"$WATERMAPS_RUNTIME_DIR/locks/route-update.lock"
+  if ! flock --nonblock 9; then
+    wm_log "Ein Routingdaten-Update oder Deployment läuft bereits."
+    return 1
+  fi
+}
+
+wm_assert_route_data() {
+  wm_route_data_ready || wm_die "Routingdaten sind nicht vollständig bereit."
+}
+
+wm_route_data_ready() {
+  wm_route_data_files_ready "$(wm_route_file)" "$(wm_route_marker)"
+}
+
+wm_marker_value() {
+  local marker="$1"
+  local requested_key="$2"
+  awk -F= -v requested_key="$requested_key" '
+    $1 == requested_key {
+      value = substr($0, length($1) + 2)
+      matches += 1
+    }
+    END {
+      if (matches != 1) {
+        exit 1
+      }
+      print value
+    }
+  ' "$marker"
+}
+
+wm_write_route_marker() {
+  local route_file="$1"
+  local marker="$2"
+  local temporary_marker
+
+  [[ -s "$route_file" ]] || return 1
+  chmod 0644 "$route_file"
+  temporary_marker="$(mktemp "$(dirname "$marker")/.routing-ready.XXXXXX")"
+  {
+    printf 'format_version=1\n'
+    printf 'generated_at=%s\n' "$(date --utc +%Y-%m-%dT%H:%M:%SZ)"
+    printf 'route_file_name=%s\n' "$(basename "$route_file")"
+    printf 'size_bytes=%s\n' "$(stat --format=%s "$route_file")"
+    printf 'sha256=%s\n' "$(sha256sum "$route_file" | awk '{ print $1 }')"
+    printf 'generator_version=2\n'
+    printf 'source=germany+netherlands\n'
+  } >"$temporary_marker"
+  chmod 0644 "$temporary_marker"
+  mv -f "$temporary_marker" "$marker"
+}
+
+wm_route_data_files_ready() {
+  local route_file="$1"
+  local marker="$2"
+  local file_mode marker_format marker_file_name marker_size marker_checksum
+  local marker_generator marker_source actual_size actual_checksum
+
+  if [[ ! -s "$route_file" ]]; then
+    wm_log "Routingindex fehlt oder ist leer: $route_file"
+    return 1
+  fi
+  if [[ ! -s "$marker" ]]; then
+    wm_log "Bereitschaftsmarker fehlt: $marker"
+    return 1
+  fi
+  if [[ ! "$marker" -nt "$route_file" ]]; then
+    wm_log "Bereitschaftsmarker ist älter als der Routingindex."
+    return 1
+  fi
+
+  if [[ ! -r "$route_file" ]]; then
+    wm_log "Routingindex ist für den prüfenden Benutzer nicht lesbar: $route_file"
+    return 1
+  fi
+  file_mode="$(stat --format=%a "$route_file")"
+  if (( (8#$file_mode & 4) == 0 )); then
+    wm_log "Routingindex ist für den unprivilegierten App-Container nicht lesbar (Modus $file_mode)."
+    return 1
+  fi
+
+  if ! jq --exit-status '
+    (.version == 1)
+    and (.generatorVersion == 2)
+    and (.source == "germany+netherlands")
+    and (.sources | type == "array" and length == 2)
+    and (([.sources[].region] | sort) == ["germany", "netherlands"])
+    and (([.sources[].file] | sort) == [
+      "germany-latest.osm.pbf",
+      "netherlands-latest.osm.pbf"
+    ])
+    and (all(.sources[];
+      (.checksumMd5 | type == "string" and test("^[0-9a-f]{32}$"))
+      and (.sizeBytes | type == "number" and . > 0)
+    ))
+    and (.ways | type == "array" and length > 0)
+  ' "$route_file" >/dev/null; then
+    wm_log "Routingindex enthält nicht exakt die erwarteten Deutschland-/Niederlande-Quellen."
+    return 1
+  fi
+
+  marker_format="$(wm_marker_value "$marker" format_version 2>/dev/null || true)"
+  marker_file_name="$(wm_marker_value "$marker" route_file_name 2>/dev/null || true)"
+  marker_size="$(wm_marker_value "$marker" size_bytes 2>/dev/null || true)"
+  marker_checksum="$(wm_marker_value "$marker" sha256 2>/dev/null || true)"
+  marker_generator="$(wm_marker_value "$marker" generator_version 2>/dev/null || true)"
+  marker_source="$(wm_marker_value "$marker" source 2>/dev/null || true)"
+  actual_size="$(stat --format=%s "$route_file")"
+  actual_checksum="$(sha256sum "$route_file" | awk '{ print $1 }')"
+
+  if [[ "$marker_format" != "1" ||
+        "$marker_file_name" != "$(basename "$route_file")" ||
+        "$marker_size" != "$actual_size" ||
+        ! "$marker_checksum" =~ ^[0-9a-f]{64}$ ||
+        "$marker_checksum" != "$actual_checksum" ||
+        "$marker_generator" != "2" ||
+        "$marker_source" != "germany+netherlands" ]]; then
+    wm_log "Bereitschaftsmarker stimmt nicht mit dem Routingindex überein: $marker"
+    return 1
+  fi
+  return 0
+}
+
+wm_wait_for_health() {
+  local service="$1"
+  local timeout_seconds="${2:-180}"
+  local container_id status
+  local deadline=$((SECONDS + timeout_seconds))
+
+  container_id="$(wm_compose ps --quiet "$service")"
+  [[ -n "$container_id" ]] || wm_die "Container für $service läuft nicht."
+
+  while ((SECONDS < deadline)); do
+    status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' "$container_id")"
+    case "$status" in
+      healthy|running)
+        wm_log "$service ist bereit."
+        return 0
+        ;;
+      unhealthy|exited|dead)
+        docker inspect --format '{{json .State}}' "$container_id" >&2 || true
+        return 1
+        ;;
+    esac
+    sleep 3
+  done
+
+  wm_log "Timeout beim Warten auf $service."
+  return 1
+}
+
+wm_smoke_test_route() {
+  wm_compose exec --no-TTY watermaps node --input-type=module --eval '
+    const expectedSource = "local-geofabrik-germany+netherlands";
+    const routeChecks = [
+      {
+        name: "Emden–Ditzum",
+        start: { lat: 53.3422, lon: 7.1871 },
+        destination: { lat: 53.465, lon: 7.4734 },
+        minimumAlternatives: 2
+      },
+      {
+        name: "Norddeich–Norderney",
+        start: { lat: 53.6234, lon: 7.1559 },
+        destination: { lat: 53.7023, lon: 7.1658 },
+        minimumAlternatives: 2
+      },
+      {
+        name: "Emden–Delfzijl",
+        start: { lat: 53.3416, lon: 7.186 },
+        destination: { lat: 53.3282, lon: 6.9304 },
+        minimumAlternatives: 0,
+        minimumCoordinates: 30,
+        minimumDistanceNm: 9.5,
+        maximumDistanceNm: 10.5,
+        maximumSegmentNm: 2,
+        maximumLongitude: 7.19,
+        corridorCoordinates: [
+          [7.1848883, 53.3395697],
+          [7.0011017, 53.313849],
+          [6.9427276, 53.3256427]
+        ]
+      },
+      {
+        name: "Weesp–Utrecht",
+        start: { lat: 52.309, lon: 5.0423 },
+        destination: { lat: 52.105, lon: 5.085 },
+        minimumAlternatives: 2
+      },
+      {
+        name: "Lemmer–Sneek",
+        start: { lat: 52.844, lon: 5.71 },
+        destination: { lat: 53.033, lon: 5.66 },
+        minimumAlternatives: 2
+      },
+      {
+        name: "Smal Weesp (Niederlande)",
+        start: { lat: 52.3043984, lon: 5.0210794 },
+        destination: { lat: 52.307897, lon: 5.0330976 },
+        minimumAlternatives: 0
+      }
+    ];
+
+    for (const routeCheck of routeChecks) {
+      const response = await fetch("http://127.0.0.1:5174/api/routes", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          start: routeCheck.start,
+          destination: routeCheck.destination,
+          vesselProfile: { draughtM: 1, safetyReserveM: 0.3 }
+        })
+      });
+      if (!response.ok) {
+        console.error(routeCheck.name, response.status, await response.text());
+        process.exit(1);
+      }
+
+      const route = await response.json();
+      const alternatives = Array.isArray(route.alternatives) ? route.alternatives : [];
+      const routeCoordinates = route.geometry?.coordinates;
+      const distanceNm = (first, second) => {
+        const toRadians = (value) => value * Math.PI / 180;
+        const deltaLat = toRadians(second[1] - first[1]);
+        const deltaLon = toRadians(second[0] - first[0]);
+        const firstLat = toRadians(first[1]);
+        const secondLat = toRadians(second[1]);
+        const haversine =
+          Math.sin(deltaLat / 2) ** 2
+          + Math.cos(firstLat) * Math.cos(secondLat) * Math.sin(deltaLon / 2) ** 2;
+        return 3440.065 * 2 * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine));
+      };
+      const largestSegmentNm = Array.isArray(routeCoordinates)
+        ? routeCoordinates.slice(1).reduce(
+            (largest, coordinate, index) =>
+              Math.max(largest, distanceNm(routeCoordinates[index], coordinate)),
+            0
+          )
+        : Number.POSITIVE_INFINITY;
+      const expectedCorridorCoordinates = routeCheck.corridorCoordinates ?? [];
+      const corridorCoordinatesAreValid =
+        expectedCorridorCoordinates.length === 0 ||
+        (
+          Array.isArray(routeCoordinates) &&
+          expectedCorridorCoordinates.every((expectedCoordinate) =>
+            routeCoordinates.some(
+              (coordinate) => distanceNm(coordinate, expectedCoordinate) <= 0.15
+            )
+          )
+        );
+      const alternativeRoutesAreValid = alternatives.every((alternative) =>
+        alternative.routingMode === "fairway"
+        && Array.isArray(alternative.geometry?.coordinates)
+        && alternative.geometry.coordinates.length >= 2
+        && Array.isArray(alternative.dataSources)
+        && alternative.dataSources.includes(expectedSource)
+      );
+      const routeSignatures = [
+        route.geometry?.coordinates,
+        ...alternatives.map((alternative) => alternative.geometry?.coordinates)
+      ].map((coordinates) => JSON.stringify(coordinates));
+      if (
+        route.routingMode !== "fairway" ||
+        !Array.isArray(routeCoordinates) ||
+        routeCoordinates.length < (routeCheck.minimumCoordinates ?? 2) ||
+        !Array.isArray(route.dataSources) ||
+        !route.dataSources.includes(expectedSource) ||
+        alternatives.length < routeCheck.minimumAlternatives ||
+        route.distanceNm < (routeCheck.minimumDistanceNm ?? 0) ||
+        route.distanceNm > (routeCheck.maximumDistanceNm ?? Number.POSITIVE_INFINITY) ||
+        largestSegmentNm > (routeCheck.maximumSegmentNm ?? Number.POSITIVE_INFINITY) ||
+        routeCoordinates.some(
+          ([lon]) => lon > (routeCheck.maximumLongitude ?? Number.POSITIVE_INFINITY)
+        ) ||
+        !corridorCoordinatesAreValid ||
+        !alternativeRoutesAreValid ||
+        new Set(routeSignatures).size !== routeSignatures.length
+      ) {
+        console.error(
+          `${routeCheck.name}: Routen- oder Alternativenprüfung des lokalen Deutschland-/Niederlande-Index fehlgeschlagen.`,
+          JSON.stringify({
+            routingMode: route.routingMode,
+            dataSources: route.dataSources,
+            distanceNm: route.distanceNm,
+            coordinateCount: routeCoordinates?.length,
+            largestSegmentNm,
+            alternativeCount: alternatives.length,
+            minimumAlternatives: routeCheck.minimumAlternatives,
+            corridorCoordinatesAreValid
+          })
+        );
+        process.exit(1);
+      }
+    }
+  '
+}

deploy/scripts/deploy.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  wm_die "Dieses Skript muss als root ausgeführt werden."
+fi
+
+install -d -m 0755 \
+  "$WATERMAPS_DATA_DIR/geofabrik" \
+  "$WATERMAPS_DATA_DIR/local" \
+  "$WATERMAPS_DATA_DIR/certbot/www" \
+  "$WATERMAPS_DATA_DIR/certbot/letsencrypt" \
+  "$WATERMAPS_RUNTIME_DIR/nginx/conf.d" \
+  "$WATERMAPS_RUNTIME_DIR/locks"
+
+wm_acquire_route_lock ||
+  wm_die "Deployment abgebrochen, weil gerade Routingdaten aktualisiert werden."
+
+if [[ ! -f "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf" ]]; then
+  install -m 0644 \
+    "$WM_DEPLOY_DIR/nginx/bootstrap.conf" \
+    "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf"
+fi
+
+wm_log "Anwendungsimage wird gebaut."
+wm_compose build watermaps
+wm_compose up --detach --remove-orphans watermaps nginx
+
+wm_wait_for_health watermaps 240
+wm_wait_for_health nginx 120
+
+route_rebuild_required=false
+update_args=()
+if [[ "${WATERMAPS_REBUILD_ROUTE_DATA:-false}" == "true" ]]; then
+  route_rebuild_required=true
+  update_args+=(--force)
+elif ! wm_route_data_ready; then
+  route_rebuild_required=true
+fi
+
+if [[ "$route_rebuild_required" == "true" ]]; then
+  wm_log "Deutschland- und Niederlande-Routingdaten werden sicher vorbereitet."
+  WATERMAPS_ROUTE_LOCK_HELD=true \
+    "$WM_DEPLOY_DIR/scripts/update-route-data.sh" "${update_args[@]}"
+fi
+
+wm_assert_route_data
+wm_wait_for_health watermaps 240
+wm_smoke_test_route
+
+wm_log "Deployment ist bereit. Vor dem Livegang liefert Port 80 nur ACME-Challenges und ansonsten HTTP 404."

deploy/scripts/go-live.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  wm_die "Dieses Skript muss als root ausgeführt werden."
+fi
+
+domain="${WATERMAPS_DOMAIN:-}"
+email="${WATERMAPS_ACME_EMAIL:-}"
+expected_ipv4="${1:-${WATERMAPS_EXPECTED_IPV4:-}}"
+
+[[ "$domain" =~ ^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$ ]] ||
+  wm_die "Ungültiger WATERMAPS_DOMAIN: $domain"
+[[ "$email" == *@*.* && "$email" != "admin@example.com" ]] ||
+  wm_die "Bitte WATERMAPS_ACME_EMAIL in deploy/.env.production konfigurieren."
+[[ "$expected_ipv4" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ||
+  wm_die "Erwartete Server-IPv4 fehlt. Als Argument übergeben oder WATERMAPS_EXPECTED_IPV4 setzen."
+
+wm_assert_route_data
+wm_wait_for_health watermaps 120
+wm_wait_for_health nginx 60
+wm_smoke_test_route
+
+mapfile -t resolved_ipv4s < <(dig +short A "$domain" | awk '/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/')
+[[ "${#resolved_ipv4s[@]}" -gt 0 ]] || wm_die "Für $domain ist noch kein A-Record auflösbar."
+
+for resolved_ipv4 in "${resolved_ipv4s[@]}"; do
+  [[ "$resolved_ipv4" == "$expected_ipv4" ]] ||
+    wm_die "$domain zeigt zusätzlich/abweichend auf $resolved_ipv4 statt ausschließlich auf $expected_ipv4."
+done
+
+challenge_name="watermaps-preflight-$$"
+challenge_dir="$WATERMAPS_DATA_DIR/certbot/www/.well-known/acme-challenge"
+challenge_file="$challenge_dir/$challenge_name"
+install -d -m 0755 "$challenge_dir"
+printf 'watermaps-acme-preflight\n' >"$challenge_file"
+trap 'rm -f "$challenge_file"' EXIT
+
+curl --fail --silent --show-error \
+  --header "Host: $domain" \
+  "http://127.0.0.1/.well-known/acme-challenge/$challenge_name" \
+  | grep -qx 'watermaps-acme-preflight' ||
+  wm_die "Nginx stellt den ACME-Webroot nicht korrekt bereit."
+
+certbot_args=(
+  certonly
+  --webroot
+  --webroot-path /var/www/certbot
+  --domain "$domain"
+  --email "$email"
+  --agree-tos
+  --non-interactive
+  --keep-until-expiring
+)
+cert_name="$domain"
+if [[ "${WATERMAPS_CERTBOT_STAGING:-false}" == "true" ]]; then
+  cert_name="${domain}-staging"
+  certbot_args+=(--staging)
+fi
+certbot_args+=(--cert-name "$cert_name")
+
+wm_log "Let's-Encrypt-Zertifikat wird angefordert."
+wm_compose --profile maintenance run --rm certbot "${certbot_args[@]}"
+
+certificate_path="$WATERMAPS_DATA_DIR/certbot/letsencrypt/live/$cert_name/fullchain.pem"
+private_key_path="$WATERMAPS_DATA_DIR/certbot/letsencrypt/live/$cert_name/privkey.pem"
+[[ -s "$certificate_path" && -s "$private_key_path" ]] ||
+  wm_die "Certbot war beendet, aber Zertifikat oder privater Schlüssel fehlen."
+
+candidate="$(mktemp "$WATERMAPS_RUNTIME_DIR/nginx/conf.d/.https.XXXXXX")"
+trap 'rm -f "$challenge_file" "$candidate"' EXIT
+sed \
+  -e "s/__WATERMAPS_DOMAIN__/$domain/g" \
+  -e "s/__WATERMAPS_CERT_NAME__/$cert_name/g" \
+  "$WM_DEPLOY_DIR/nginx/https.conf.template" \
+  >"$candidate"
+
+wm_compose run --rm --no-deps \
+  --volume "$candidate:/etc/nginx/conf.d/default.conf:ro" \
+  nginx nginx -t
+
+active_config="$WATERMAPS_RUNTIME_DIR/nginx/conf.d/default.conf"
+previous_config="$WATERMAPS_RUNTIME_DIR/nginx/conf.d/.default.conf.previous"
+cp --preserve=mode,timestamps "$active_config" "$previous_config"
+install -m 0644 "$candidate" "$active_config"
+
+if ! wm_compose exec --no-TTY nginx nginx -t; then
+  install -m 0644 "$previous_config" "$active_config"
+  wm_compose exec --no-TTY nginx nginx -s reload || true
+  wm_die "HTTPS-Konfiguration war ungültig; Bootstrap-Konfiguration wurde wiederhergestellt."
+fi
+wm_compose exec --no-TTY nginx nginx -s reload
+
+https_curl_args=(--fail --silent --show-error)
+if [[ "${WATERMAPS_CERTBOT_STAGING:-false}" == "true" ]]; then
+  https_curl_args+=(--insecure)
+fi
+if ! curl "${https_curl_args[@]}" \
+  --resolve "$domain:443:$expected_ipv4" \
+  "https://$domain/health" \
+  >/dev/null; then
+  install -m 0644 "$previous_config" "$active_config"
+  wm_compose exec --no-TTY nginx nginx -t
+  wm_compose exec --no-TTY nginx nginx -s reload
+  wm_die "HTTPS-Smoke-Test fehlgeschlagen; vorherige Nginx-Konfiguration wurde wiederhergestellt."
+fi
+
+wm_log "Livegang erfolgreich: https://$domain"

deploy/scripts/prepare-route-data.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+cd /workspace
+
+route_file="${WATERMAPS_LOCAL_FAIRWAYS_PATH:-/workspace/data/local/germany-netherlands-fairways.json}"
+marker_file="${WATERMAPS_ROUTE_MARKER_PATH:-$(dirname "$route_file")/.germany-netherlands-fairways.ready}"
+
+mkdir -p "$(dirname "$route_file")" /workspace/data/geofabrik
+
+if [[ ! -x /workspace/scripts/setup-local-routing.sh ]]; then
+  printf 'Fehler: scripts/setup-local-routing.sh fehlt oder ist nicht ausführbar.\n' >&2
+  exit 1
+fi
+
+/workspace/scripts/setup-local-routing.sh
+
+if [[ ! -s "$route_file" ]]; then
+  printf 'Fehler: Der Routingindex wurde nicht erzeugt: %s\n' "$route_file" >&2
+  exit 1
+fi
+
+chmod 0644 "$route_file"
+temporary_marker="$(mktemp "$(dirname "$marker_file")/.routing-ready.XXXXXX")"
+{
+  printf 'format_version=1\n'
+  printf 'generated_at=%s\n' "$(date --utc +%Y-%m-%dT%H:%M:%SZ)"
+  printf 'route_file_name=%s\n' "$(basename "$route_file")"
+  printf 'size_bytes=%s\n' "$(stat --format=%s "$route_file")"
+  printf 'sha256=%s\n' "$(sha256sum "$route_file" | awk '{ print $1 }')"
+  printf 'generator_version=2\n'
+  printf 'source=germany+netherlands\n'
+} >"$temporary_marker"
+chmod 0644 "$temporary_marker"
+mv -f "$temporary_marker" "$marker_file"
+
+printf 'Routingdaten sind bereit: %s\n' "$route_file"

deploy/scripts/remote-common.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_LOCAL_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_LOCAL_ROOT_DIR="$(cd "$WM_LOCAL_DEPLOY_DIR/.." && pwd)"
+WM_LOCAL_INFRA_DIR="${WATERMAPS_INFRA_DIR:-$WM_LOCAL_ROOT_DIR/infra/opentofu}"
+
+wm_local_die() {
+  printf 'Fehler: %s\n' "$*" >&2
+  exit 1
+}
+
+wm_local_resolve_ssh() {
+  local requested_server="${1:-}"
+  local requested_identity="${2:-}"
+
+  WM_SERVER_IPV4="${requested_server:-${WATERMAPS_SERVER_IPV4:-}}"
+  if [[ -z "$WM_SERVER_IPV4" ]]; then
+    command -v tofu >/dev/null 2>&1 ||
+      wm_local_die "OpenTofu fehlt und WATERMAPS_SERVER_IPV4 wurde nicht gesetzt."
+    [[ -d "$WM_LOCAL_INFRA_DIR" ]] ||
+      wm_local_die "OpenTofu-Verzeichnis fehlt: $WM_LOCAL_INFRA_DIR"
+    WM_SERVER_IPV4="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw server_ipv4)"
+  fi
+  [[ "$WM_SERVER_IPV4" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ||
+    wm_local_die "Ungültige Server-IPv4: $WM_SERVER_IPV4"
+
+  WM_SSH_IDENTITY="${requested_identity:-${WATERMAPS_SSH_KEY:-}}"
+  if [[ -z "$WM_SSH_IDENTITY" ]] && command -v tofu >/dev/null 2>&1 && [[ -d "$WM_LOCAL_INFRA_DIR" ]]; then
+    candidate_identity="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw ssh_private_key_path 2>/dev/null || true)"
+    if [[ -n "$candidate_identity" && -f "$candidate_identity" ]]; then
+      WM_SSH_IDENTITY="$candidate_identity"
+    fi
+  fi
+  if [[ -n "$WM_SSH_IDENTITY" && ! -f "$WM_SSH_IDENTITY" ]]; then
+    wm_local_die "SSH-Keydatei nicht gefunden: $WM_SSH_IDENTITY"
+  fi
+
+  WM_SSH_USER="${WATERMAPS_SSH_USER:-deploy}"
+  [[ "$WM_SSH_USER" =~ ^[a-z_][a-z0-9_-]{0,30}$ ]] ||
+    wm_local_die "Ungültiger SSH-Benutzer: $WM_SSH_USER"
+  if [[ -n "${WATERMAPS_REMOTE_SUDO+x}" ]]; then
+    WM_REMOTE_SUDO="$WATERMAPS_REMOTE_SUDO"
+  elif [[ "$WM_SSH_USER" == "root" ]]; then
+    WM_REMOTE_SUDO=""
+  else
+    WM_REMOTE_SUDO="sudo"
+  fi
+  case "$WM_REMOTE_SUDO" in
+    ""|sudo) ;;
+    *) wm_local_die "WATERMAPS_REMOTE_SUDO darf nur leer oder 'sudo' sein." ;;
+  esac
+
+  WM_SSH_TARGET="$WM_SSH_USER@$WM_SERVER_IPV4"
+  WM_SSH_OPTIONS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+  if [[ -n "$WM_SSH_IDENTITY" ]]; then
+    WM_SSH_OPTIONS+=(-i "$WM_SSH_IDENTITY" -o IdentitiesOnly=yes)
+  fi
+}
+
+wm_local_wait_for_ssh() {
+  local timeout_seconds="${WATERMAPS_SSH_WAIT_SECONDS:-600}"
+  local deadline=$((SECONDS + timeout_seconds))
+
+  while ((SECONDS < deadline)); do
+    if ssh "${WM_SSH_OPTIONS[@]}" \
+      -o ConnectTimeout=5 \
+      "$WM_SSH_TARGET" true >/dev/null 2>&1; then
+      return 0
+    fi
+    printf '[watermaps] Warte auf SSH und Cloud-init-Benutzer %s …\n' "$WM_SSH_TARGET"
+    sleep 5
+  done
+
+  wm_local_die "SSH war nach ${timeout_seconds}s nicht erreichbar: $WM_SSH_TARGET"
+}

deploy/scripts/remote-go-live.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=remote-common.sh
+source "$WM_DEPLOY_DIR/scripts/remote-common.sh"
+
+server_ipv4=""
+identity_file=""
+
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --host)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --host fehlt."
+      server_ipv4="$2"
+      shift 2
+      ;;
+    --identity)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --identity fehlt."
+      identity_file="$2"
+      shift 2
+      ;;
+    --user)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --user fehlt."
+      WATERMAPS_SSH_USER="$2"
+      export WATERMAPS_SSH_USER
+      shift 2
+      ;;
+    -h|--help)
+      printf 'Verwendung: %s [--host IPV4] [--identity DATEI] [--user BENUTZER]\n' "$0"
+      exit 0
+      ;;
+    *)
+      wm_local_die "Unbekannte Option: $1"
+      ;;
+  esac
+done
+
+wm_local_resolve_ssh "$server_ipv4" "$identity_file"
+wm_local_wait_for_ssh
+remote_prefix=""
+if [[ -n "$WM_REMOTE_SUDO" ]]; then
+  remote_prefix="$WM_REMOTE_SUDO "
+fi
+
+ssh "${WM_SSH_OPTIONS[@]}" "$WM_SSH_TARGET" \
+  "${remote_prefix}/opt/watermaps/deploy/scripts/go-live.sh '$WM_SERVER_IPV4'"

deploy/scripts/renew-certificate.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  wm_die "Dieses Skript muss als root ausgeführt werden."
+fi
+
+domain="${WATERMAPS_DOMAIN:-}"
+cert_name="$domain"
+if [[ "${WATERMAPS_CERTBOT_STAGING:-false}" == "true" ]]; then
+  cert_name="${domain}-staging"
+fi
+[[ -s "$WATERMAPS_DATA_DIR/certbot/letsencrypt/live/$cert_name/fullchain.pem" ]] || {
+  wm_log "Noch kein Zertifikat vorhanden; Erneuerung wird übersprungen."
+  exit 0
+}
+
+wm_compose --profile maintenance run --rm certbot \
+  renew \
+  --webroot \
+  --webroot-path /var/www/certbot \
+  --quiet
+
+wm_compose exec --no-TTY nginx nginx -t
+wm_compose exec --no-TTY nginx nginx -s reload
+wm_log "Zertifikatserneuerung geprüft und Nginx neu geladen."

deploy/scripts/tests/route-data-helpers.test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+TEST_DIR="$(mktemp -d)"
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+export WATERMAPS_DATA_DIR="$TEST_DIR/data"
+export WATERMAPS_RUNTIME_DIR="$TEST_DIR/runtime"
+mkdir -p "$WATERMAPS_DATA_DIR/local" "$WATERMAPS_RUNTIME_DIR"
+
+# shellcheck source=../common.sh
+source "$ROOT_DIR/deploy/scripts/common.sh"
+
+route_file="$(wm_route_file)"
+route_marker="$(wm_route_marker)"
+
+write_valid_route() {
+  cat >"$route_file" <<'JSON'
+{
+  "version": 1,
+  "generatorVersion": 2,
+  "source": "germany+netherlands",
+  "sources": [
+    {
+      "region": "germany",
+      "file": "germany-latest.osm.pbf",
+      "checksumMd5": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "sizeBytes": 1
+    },
+    {
+      "region": "netherlands",
+      "file": "netherlands-latest.osm.pbf",
+      "checksumMd5": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "sizeBytes": 1
+    }
+  ],
+  "ways": [{"id": "1"}]
+}
+JSON
+  chmod 0644 "$route_file"
+}
+
+write_valid_route
+wm_write_route_marker "$route_file" "$route_marker"
+wm_route_data_ready
+
+sed -i 's/^size_bytes=.*/size_bytes=1/' "$route_marker"
+if wm_route_data_ready; then
+  printf 'Ungültige Markergröße wurde akzeptiert.\n' >&2
+  exit 1
+fi
+
+wm_write_route_marker "$route_file" "$route_marker"
+jq '.sources = [.sources[0]] | .source = "germany"' \
+  "$route_file" >"$route_file.tmp"
+mv "$route_file.tmp" "$route_file"
+chmod 0644 "$route_file"
+wm_write_route_marker "$route_file" "$route_marker"
+if wm_route_data_ready; then
+  printf 'Deutschland-only-Index wurde akzeptiert.\n' >&2
+  exit 1
+fi
+
+write_valid_route
+wm_write_route_marker "$route_file" "$route_marker"
+chmod 0600 "$route_file"
+if wm_route_data_ready; then
+  printf 'Für den App-Container unlesbarer Index wurde akzeptiert.\n' >&2
+  exit 1
+fi
+
+printf 'Routingdaten- und Markerprüfungen: OK\n'

deploy/scripts/tests/update-route-data.test.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+TEST_DIR="$(mktemp -d)"
+trap 'rm -rf "$TEST_DIR"' EXIT
+
+FAKE_BIN="$TEST_DIR/bin"
+DATA_DIR="$TEST_DIR/data"
+RUNTIME_DIR="$TEST_DIR/runtime"
+ENV_FILE="$TEST_DIR/production.env"
+mkdir -p "$FAKE_BIN" "$DATA_DIR/local" "$RUNTIME_DIR"
+
+cat >"$ENV_FILE" <<EOF
+WATERMAPS_DATA_DIR=$DATA_DIR
+WATERMAPS_RUNTIME_DIR=$RUNTIME_DIR
+EOF
+
+cat >"$FAKE_BIN/id" <<'SH'
+#!/usr/bin/env bash
+if [[ "${1:-}" == "-u" ]]; then
+  printf '0\n'
+else
+  exec /usr/bin/id "$@"
+fi
+SH
+
+cat >"$FAKE_BIN/mountpoint" <<'SH'
+#!/usr/bin/env bash
+exit 0
+SH
+
+cat >"$FAKE_BIN/docker" <<'SH'
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+if [[ "${1:-}" == "inspect" ]]; then
+  printf 'healthy\n'
+  exit 0
+fi
+
+arguments=" $* "
+if [[ "$arguments" == *" ps --quiet watermaps "* ]]; then
+  printf 'watermaps-test-container\n'
+  exit 0
+fi
+
+if [[ "$arguments" == *" run "*" route-data "* ||
+      "$arguments" == *" run "*" route-data" ]]; then
+  route_file="$WATERMAPS_DATA_DIR/local/.germany-netherlands-fairways.candidate.json"
+  marker_file="$WATERMAPS_DATA_DIR/local/.germany-netherlands-fairways.candidate.ready"
+  cat >"$route_file" <<JSON
+{
+  "version": 1,
+  "generatorVersion": 2,
+  "source": "germany+netherlands",
+  "revision": ${FAKE_ROUTE_REVISION:-1},
+  "sources": [
+    {
+      "region": "germany",
+      "file": "germany-latest.osm.pbf",
+      "checksumMd5": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "sizeBytes": 1
+    },
+    {
+      "region": "netherlands",
+      "file": "netherlands-latest.osm.pbf",
+      "checksumMd5": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+      "sizeBytes": 1
+    }
+  ],
+  "ways": [{"id": "1"}]
+}
+JSON
+  # shellcheck source=../common.sh
+  source "$WM_TEST_ROOT/deploy/scripts/common.sh"
+  wm_write_route_marker "$route_file" "$marker_file"
+  exit 0
+fi
+
+if [[ "$arguments" == *" exec --no-TTY watermaps "* ]]; then
+  active_file="$WATERMAPS_DATA_DIR/local/germany-netherlands-fairways.json"
+  active_revision="$(jq --raw-output '.revision // 0' "$active_file" 2>/dev/null || true)"
+  if [[ -n "${FAKE_FAIL_REVISION:-}" && "$active_revision" == "$FAKE_FAIL_REVISION" ]]; then
+    exit 1
+  fi
+  exit 0
+fi
+
+exit 0
+SH
+
+chmod +x "$FAKE_BIN/id" "$FAKE_BIN/mountpoint" "$FAKE_BIN/docker"
+
+export PATH="$FAKE_BIN:$PATH"
+export WATERMAPS_ENV_FILE="$ENV_FILE"
+export WM_TEST_ROOT="$ROOT_DIR"
+
+# A first successful activation creates an active index and a validated marker.
+FAKE_ROUTE_REVISION=1 "$ROOT_DIR/deploy/scripts/update-route-data.sh"
+active_file="$DATA_DIR/local/germany-netherlands-fairways.json"
+active_marker="$DATA_DIR/local/.germany-netherlands-fairways.ready"
+[[ "$(jq --raw-output '.revision' "$active_file")" == "1" ]]
+
+export WATERMAPS_DATA_DIR="$DATA_DIR"
+export WATERMAPS_RUNTIME_DIR="$RUNTIME_DIR"
+# shellcheck source=../common.sh
+source "$ROOT_DIR/deploy/scripts/common.sh"
+wm_route_data_files_ready "$active_file" "$active_marker"
+
+# A candidate that fails its route smoke test must restore and retest revision 1.
+set +e
+FAKE_ROUTE_REVISION=2 FAKE_FAIL_REVISION=2 \
+  "$ROOT_DIR/deploy/scripts/update-route-data.sh"
+update_status=$?
+set -e
+[[ "$update_status" -ne 0 ]]
+[[ "$(jq --raw-output '.revision' "$active_file")" == "1" ]]
+wm_route_data_files_ready "$active_file" "$active_marker"
+[[ ! -e "$RUNTIME_DIR/locks/route-update.transaction" ]]
+
+# A hard-crash marker restores the durable previous index before any new build.
+backup_file="$DATA_DIR/local/.germany-netherlands-fairways.previous.json"
+backup_marker="$DATA_DIR/local/.germany-netherlands-fairways.previous.ready"
+cp "$active_file" "$backup_file"
+wm_write_route_marker "$backup_file" "$backup_marker"
+jq '.revision = 9' "$active_file" >"$active_file.tmp"
+mv "$active_file.tmp" "$active_file"
+chmod 0644 "$active_file"
+wm_write_route_marker "$active_file" "$active_marker"
+printf 'had_previous=true\n' >"$RUNTIME_DIR/locks/route-update.transaction"
+
+FAKE_ROUTE_REVISION=1 "$ROOT_DIR/deploy/scripts/update-route-data.sh"
+[[ "$(jq --raw-output '.revision' "$active_file")" == "1" ]]
+wm_route_data_files_ready "$active_file" "$active_marker"
+[[ ! -e "$RUNTIME_DIR/locks/route-update.transaction" ]]
+
+# Without a previous valid index, a failed first candidate must not stay ready.
+rm -f "$active_file" "$active_marker" \
+  "$DATA_DIR/local/.germany-netherlands-fairways.previous.json" \
+  "$DATA_DIR/local/.germany-netherlands-fairways.previous.ready"
+set +e
+FAKE_ROUTE_REVISION=3 FAKE_FAIL_REVISION=3 \
+  "$ROOT_DIR/deploy/scripts/update-route-data.sh"
+first_update_status=$?
+set -e
+[[ "$first_update_status" -ne 0 ]]
+[[ ! -e "$active_file" ]]
+[[ ! -e "$active_marker" ]]
+[[ ! -e "$RUNTIME_DIR/locks/route-update.transaction" ]]
+
+printf 'Staging-, Rollback- und First-Update-Prüfungen: OK\n'

deploy/scripts/update-route-data.sh

@@ -0,0 +1,207 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=common.sh
+source "$WM_DEPLOY_DIR/scripts/common.sh"
+wm_load_env
+wm_assert_data_mount
+
+if [[ "$(id -u)" -ne 0 ]]; then
+  wm_die "Dieses Skript muss als root ausgeführt werden."
+fi
+
+force_rebuild=false
+if [[ "${1:-}" == "--force" ]]; then
+  force_rebuild=true
+  shift
+fi
+[[ "$#" -eq 0 ]] || wm_die "Unbekannte Argumente für update-route-data.sh."
+
+install -d -m 0755 "$WATERMAPS_RUNTIME_DIR/locks" "$WATERMAPS_DATA_DIR/local"
+if [[ "${WATERMAPS_ROUTE_LOCK_HELD:-false}" != "true" ]]; then
+  if ! wm_acquire_route_lock; then
+    exit 0
+  fi
+fi
+
+route_file="$(wm_route_file)"
+route_marker="$(wm_route_marker)"
+route_dir="$(dirname "$route_file")"
+candidate_file="$route_dir/.germany-netherlands-fairways.candidate.json"
+candidate_marker="$route_dir/.germany-netherlands-fairways.candidate.ready"
+backup_file="$route_dir/.germany-netherlands-fairways.previous.json"
+backup_marker="$route_dir/.germany-netherlands-fairways.previous.ready"
+transaction_file="$WATERMAPS_RUNTIME_DIR/locks/route-update.transaction"
+container_candidate="/workspace/data/local/$(basename "$candidate_file")"
+container_candidate_marker="/workspace/data/local/$(basename "$candidate_marker")"
+
+transaction_active=false
+rollback_restored_previous=false
+
+wm_copy_route_atomically() {
+  local source_file="$1"
+  local destination_file="$2"
+  local temporary_file
+
+  temporary_file="$(mktemp "$(dirname "$destination_file")/.route-copy.XXXXXX")"
+  if ! cp --reflink=auto "$source_file" "$temporary_file"; then
+    rm -f "$temporary_file"
+    return 1
+  fi
+  chmod 0644 "$temporary_file"
+  mv -f "$temporary_file" "$destination_file"
+}
+
+wm_watermaps_is_running() {
+  [[ -n "$(wm_compose ps --quiet watermaps)" ]]
+}
+
+wm_restore_previous_route() {
+  rollback_restored_previous=false
+  if [[ -s "$backup_file" && -s "$backup_marker" ]] &&
+    wm_route_data_files_ready "$backup_file" "$backup_marker"; then
+    if ! wm_copy_route_atomically "$backup_file" "$route_file" ||
+      ! wm_write_route_marker "$route_file" "$route_marker" ||
+      ! wm_route_data_ready; then
+      rm -f "$route_file" "$route_marker"
+      return 1
+    fi
+    rollback_restored_previous=true
+    return 0
+  fi
+
+  rm -f "$route_file" "$route_marker"
+  return 1
+}
+
+wm_restart_after_restore() {
+  if ! wm_watermaps_is_running; then
+    wm_log "Watermaps läuft nicht; wiederhergestellte Routingdaten können noch nicht getestet werden."
+    return 1
+  fi
+
+  wm_compose restart watermaps
+  wm_wait_for_health watermaps 240 || return 1
+  if [[ "$rollback_restored_previous" == "true" ]]; then
+    wm_smoke_test_route
+  fi
+}
+
+wm_rollback_transaction() {
+  local restore_status=0
+
+  if ! wm_restore_previous_route; then
+    restore_status=1
+  fi
+  rm -f "$transaction_file"
+  transaction_active=false
+
+  if ! wm_restart_after_restore; then
+    return 1
+  fi
+  return "$restore_status"
+}
+
+wm_cleanup_on_exit() {
+  local status=$?
+  trap - EXIT HUP INT TERM
+  set +e
+
+  if [[ "$transaction_active" == "true" ]]; then
+    wm_log "Unvollständige Routingaktivierung wird zurückgerollt."
+    wm_rollback_transaction
+  fi
+  rm -f "$candidate_file" "$candidate_marker"
+  exit "$status"
+}
+
+trap wm_cleanup_on_exit EXIT
+trap 'exit 130' HUP INT TERM
+
+# A hard interruption cannot run shell traps. The durable transaction marker
+# makes the next invocation restore the last validated index before proceeding.
+if [[ -e "$transaction_file" ]]; then
+  wm_log "Unterbrochene Routingaktualisierung erkannt; letzter gültiger Stand wird wiederhergestellt."
+  if wm_restore_previous_route; then
+    wm_restart_after_restore ||
+      wm_die "Der wiederhergestellte Routingindex bestand den Routentest nicht."
+  else
+    wm_restart_after_restore ||
+      wm_log "Es existierte noch kein vorheriger Routingindex; aktiver Marker wurde entfernt."
+  fi
+  rm -f "$transaction_file"
+fi
+
+rm -f "$candidate_file" "$candidate_marker"
+previous_ready=false
+if wm_route_data_ready; then
+  previous_ready=true
+  if [[ "$force_rebuild" != "true" ]]; then
+    cp --reflink=auto "$route_file" "$candidate_file"
+    chmod 0644 "$candidate_file"
+  fi
+fi
+
+wm_log "Deutschland-/Niederlande-Routingdaten werden in einer Stagingdatei gebaut."
+if ! wm_compose --profile maintenance run --rm --build \
+  --env "WATERMAPS_LOCAL_FAIRWAYS_PATH=$container_candidate" \
+  --env "WATERMAPS_ROUTE_MARKER_PATH=$container_candidate_marker" \
+  route-data; then
+  wm_die "Der Datenaufbau ist fehlgeschlagen; der aktive Index wurde nicht verändert."
+fi
+
+if ! wm_route_data_files_ready "$candidate_file" "$candidate_marker"; then
+  wm_die "Der neu gebaute Routingindex oder sein Bereitschaftsmarker ist ungültig."
+fi
+
+if [[ "$previous_ready" == "true" ]] && cmp --silent "$candidate_file" "$route_file"; then
+  wm_log "Geofabrik-Snapshots und Routingindex sind unverändert."
+  rm -f "$candidate_file" "$candidate_marker"
+  exit 0
+fi
+
+if [[ "$previous_ready" == "true" ]]; then
+  wm_copy_route_atomically "$route_file" "$backup_file"
+  wm_write_route_marker "$backup_file" "$backup_marker"
+  wm_route_data_files_ready "$backup_file" "$backup_marker" ||
+    wm_die "Der bisherige Routingindex konnte nicht sicher gesichert werden."
+else
+  rm -f "$backup_file" "$backup_marker"
+fi
+
+temporary_transaction="$(mktemp "$WATERMAPS_RUNTIME_DIR/locks/.route-update-transaction.XXXXXX")"
+{
+  printf 'started_at=%s\n' "$(date --utc +%Y-%m-%dT%H:%M:%SZ)"
+  printf 'had_previous=%s\n' "$previous_ready"
+} >"$temporary_transaction"
+chmod 0644 "$temporary_transaction"
+mv -f "$temporary_transaction" "$transaction_file"
+transaction_active=true
+
+mv -f "$candidate_file" "$route_file"
+rm -f "$candidate_marker"
+wm_write_route_marker "$route_file" "$route_marker"
+wm_route_data_ready ||
+  wm_die "Der aktivierte Routingindex besitzt keinen gültigen Bereitschaftsmarker."
+
+wm_compose restart watermaps
+if wm_wait_for_health watermaps 240 && wm_smoke_test_route; then
+  rm -f "$transaction_file"
+  transaction_active=false
+  rm -f "$backup_file" "$backup_marker"
+  wm_log "Routingdaten-Update wurde erfolgreich aktiviert."
+  exit 0
+fi
+
+wm_log "Der neue Routingindex bestand die Routentests nicht; Rollback wird ausgeführt."
+if wm_rollback_transaction; then
+  rm -f "$backup_file" "$backup_marker"
+  wm_die "Neuer Routingindex verworfen; der vorherige, erneut getestete Index ist aktiv."
+fi
+
+if [[ "$rollback_restored_previous" == "true" ]]; then
+  wm_die "Rollback-Dateien wurden wiederhergestellt, bestanden aber den Routentest nicht."
+fi
+wm_die "Neuer Routingindex verworfen; es existierte noch kein vorheriger gültiger Index."

deploy/scripts/upload-and-deploy.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_ROOT_DIR="$(cd "$WM_DEPLOY_DIR/.." && pwd)"
+# shellcheck source=remote-common.sh
+source "$WM_DEPLOY_DIR/scripts/remote-common.sh"
+
+server_ipv4=""
+identity_file=""
+run_go_live=false
+
+usage() {
+  cat <<'USAGE'
+Verwendung:
+  ./deploy/scripts/upload-and-deploy.sh [Optionen]
+
+Optionen:
+  --host IPV4       Server-IP statt `tofu output -raw server_ipv4`
+  --identity DATEI  Privater SSH-Key (alternativ WATERMAPS_SSH_KEY)
+  --user BENUTZER   SSH-Benutzer; Standard: deploy
+  --go-live         Nach dem Deployment sofort den SSL-Livegang versuchen
+  -h, --help        Hilfe anzeigen
+
+Die Datei deploy/.env.production muss lokal vorhanden sein. Sie wird separat
+mit Dateimodus 0600 übertragen. Terraform-State, .terraform, data,
+node_modules, lokale Env-Dateien und Git-Metadaten werden ausgeschlossen.
+USAGE
+}
+
+while [[ "$#" -gt 0 ]]; do
+  case "$1" in
+    --host)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --host fehlt."
+      server_ipv4="$2"
+      shift 2
+      ;;
+    --identity)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --identity fehlt."
+      identity_file="$2"
+      shift 2
+      ;;
+    --user)
+      [[ "$#" -ge 2 ]] || wm_local_die "Wert für --user fehlt."
+      WATERMAPS_SSH_USER="$2"
+      export WATERMAPS_SSH_USER
+      shift 2
+      ;;
+    --go-live)
+      run_go_live=true
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      wm_local_die "Unbekannte Option: $1"
+      ;;
+  esac
+done
+
+command -v rsync >/dev/null 2>&1 || wm_local_die "rsync ist lokal nicht installiert."
+local_env="$WM_DEPLOY_DIR/.env.production"
+[[ -f "$local_env" ]] ||
+  wm_local_die "Bitte zuerst deploy/.env.production aus der Vorlage erstellen und konfigurieren."
+
+wm_local_resolve_ssh "$server_ipv4" "$identity_file"
+wm_local_wait_for_ssh
+
+remote_prefix=""
+rsync_path="rsync"
+if [[ -n "$WM_REMOTE_SUDO" ]]; then
+  remote_prefix="$WM_REMOTE_SUDO "
+  rsync_path="$WM_REMOTE_SUDO rsync"
+fi
+
+printf '[watermaps] Warte auf Cloud-init und das persistente Hetzner-Volume.\n'
+ssh "${WM_SSH_OPTIONS[@]}" "$WM_SSH_TARGET" \
+  "cloud-init status --wait && ${remote_prefix}systemctl start watermaps-volume-setup.service && mountpoint --quiet /srv/watermaps-data"
+
+printf '[watermaps] Übertrage Projekt nach %s:/opt/watermaps\n' "$WM_SSH_TARGET"
+ssh "${WM_SSH_OPTIONS[@]}" "$WM_SSH_TARGET" \
+  "${remote_prefix}install -d -m 0755 /opt/watermaps /opt/watermaps/deploy"
+
+rsync \
+  --archive \
+  --compress \
+  --delete-delay \
+  --human-readable \
+  --rsync-path="$rsync_path" \
+  --exclude='.git/' \
+  --exclude='.terraform/' \
+  --exclude='.terraform.tfstate.lock.info' \
+  --exclude='*.tfvars' \
+  --exclude='*.tfvars.json' \
+  --exclude='*.tfplan' \
+  --exclude='*.tfstate*' \
+  --exclude='crash.log' \
+  --exclude='crash.*.log' \
+  --exclude='/data/' \
+  --exclude='/.tools/' \
+  --exclude='node_modules/' \
+  --exclude='**/.env' \
+  --exclude='**/.env.*' \
+  --exclude='/deploy/.env.production' \
+  -e "ssh ${WM_SSH_OPTIONS[*]@Q}" \
+  "$WM_ROOT_DIR/" \
+  "$WM_SSH_TARGET:/opt/watermaps/"
+
+rsync \
+  --archive \
+  --chmod=F600 \
+  --rsync-path="$rsync_path" \
+  -e "ssh ${WM_SSH_OPTIONS[*]@Q}" \
+  "$local_env" \
+  "$WM_SSH_TARGET:/opt/watermaps/deploy/.env.production"
+
+remote_command="${remote_prefix}chmod +x /opt/watermaps/deploy/scripts/*.sh"
+remote_command+=" && ${remote_prefix}/opt/watermaps/deploy/scripts/bootstrap-server.sh"
+remote_command+=" && ${remote_prefix}/opt/watermaps/deploy/scripts/deploy.sh"
+ssh "${WM_SSH_OPTIONS[@]}" "$WM_SSH_TARGET" "$remote_command"
+
+if [[ "$run_go_live" == "true" ]]; then
+  ssh "${WM_SSH_OPTIONS[@]}" "$WM_SSH_TARGET" \
+    "${remote_prefix}/opt/watermaps/deploy/scripts/go-live.sh '$WM_SERVER_IPV4'"
+else
+  printf '[watermaps] Deployment abgeschlossen. Nach dem DNS-Eintrag:\n'
+  printf '  ./deploy/scripts/remote-go-live.sh --host %s\n' "$WM_SERVER_IPV4"
+fi