feat: add Docker/OpenTofu deployment and DE/NL routing

2026-07-24 23:10:17 +02:00
parent 57f7b4dedb
commit 12eee8d211
59 changed files with 4452 additions and 148 deletions
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+set -Eeuo pipefail
+
+WM_LOCAL_DEPLOY_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WM_LOCAL_ROOT_DIR="$(cd "$WM_LOCAL_DEPLOY_DIR/.." && pwd)"
+WM_LOCAL_INFRA_DIR="${WATERMAPS_INFRA_DIR:-$WM_LOCAL_ROOT_DIR/infra/opentofu}"
+
+wm_local_die() {
+  printf 'Fehler: %s\n' "$*" >&2
+  exit 1
+}
+
+wm_local_resolve_ssh() {
+  local requested_server="${1:-}"
+  local requested_identity="${2:-}"
+
+  WM_SERVER_IPV4="${requested_server:-${WATERMAPS_SERVER_IPV4:-}}"
+  if [[ -z "$WM_SERVER_IPV4" ]]; then
+    command -v tofu >/dev/null 2>&1 ||
+      wm_local_die "OpenTofu fehlt und WATERMAPS_SERVER_IPV4 wurde nicht gesetzt."
+    [[ -d "$WM_LOCAL_INFRA_DIR" ]] ||
+      wm_local_die "OpenTofu-Verzeichnis fehlt: $WM_LOCAL_INFRA_DIR"
+    WM_SERVER_IPV4="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw server_ipv4)"
+  fi
+  [[ "$WM_SERVER_IPV4" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ||
+    wm_local_die "Ungültige Server-IPv4: $WM_SERVER_IPV4"
+
+  WM_SSH_IDENTITY="${requested_identity:-${WATERMAPS_SSH_KEY:-}}"
+  if [[ -z "$WM_SSH_IDENTITY" ]] && command -v tofu >/dev/null 2>&1 && [[ -d "$WM_LOCAL_INFRA_DIR" ]]; then
+    candidate_identity="$(tofu -chdir="$WM_LOCAL_INFRA_DIR" output -raw ssh_private_key_path 2>/dev/null || true)"
+    if [[ -n "$candidate_identity" && -f "$candidate_identity" ]]; then
+      WM_SSH_IDENTITY="$candidate_identity"
+    fi
+  fi
+  if [[ -n "$WM_SSH_IDENTITY" && ! -f "$WM_SSH_IDENTITY" ]]; then
+    wm_local_die "SSH-Keydatei nicht gefunden: $WM_SSH_IDENTITY"
+  fi
+
+  WM_SSH_USER="${WATERMAPS_SSH_USER:-deploy}"
+  [[ "$WM_SSH_USER" =~ ^[a-z_][a-z0-9_-]{0,30}$ ]] ||
+    wm_local_die "Ungültiger SSH-Benutzer: $WM_SSH_USER"
+  if [[ -n "${WATERMAPS_REMOTE_SUDO+x}" ]]; then
+    WM_REMOTE_SUDO="$WATERMAPS_REMOTE_SUDO"
+  elif [[ "$WM_SSH_USER" == "root" ]]; then
+    WM_REMOTE_SUDO=""
+  else
+    WM_REMOTE_SUDO="sudo"
+  fi
+  case "$WM_REMOTE_SUDO" in
+    ""|sudo) ;;
+    *) wm_local_die "WATERMAPS_REMOTE_SUDO darf nur leer oder 'sudo' sein." ;;
+  esac
+
+  WM_SSH_TARGET="$WM_SSH_USER@$WM_SERVER_IPV4"
+  WM_SSH_OPTIONS=(-o BatchMode=yes -o StrictHostKeyChecking=accept-new)
+  if [[ -n "$WM_SSH_IDENTITY" ]]; then
+    WM_SSH_OPTIONS+=(-i "$WM_SSH_IDENTITY" -o IdentitiesOnly=yes)
+  fi
+}
+
+wm_local_wait_for_ssh() {
+  local timeout_seconds="${WATERMAPS_SSH_WAIT_SECONDS:-600}"
+  local deadline=$((SECONDS + timeout_seconds))
+
+  while ((SECONDS < deadline)); do
+    if ssh "${WM_SSH_OPTIONS[@]}" \
+      -o ConnectTimeout=5 \
+      "$WM_SSH_TARGET" true >/dev/null 2>&1; then
+      return 0
+    fi
+    printf '[watermaps] Warte auf SSH und Cloud-init-Benutzer %s …\n' "$WM_SSH_TARGET"
+    sleep 5
+  done
+
+  wm_local_die "SSH war nach ${timeout_seconds}s nicht erreichbar: $WM_SSH_TARGET"
+}