Automate immutable production deployments

deploy/scripts/rollback.sh

@@ -25,4 +25,38 @@ fi
 [[ -f "$images_file" ]] ||
   wm_die "Gespeichertes Release nicht gefunden: $images_file"
 
-exec "$WM_DEPLOY_DIR/scripts/deploy.sh" --images-file "$images_file"
+target_revision="$(wm_env_value "$images_file" WATERMAPS_DEPLOY_REVISION)"
+release_directory="$WATERMAPS_DATA_DIR/releases/$target_revision"
+[[ -d "$release_directory" &&
+      -x "$release_directory/deploy/scripts/deploy.sh" ]] ||
+  wm_die "Unveränderliches Release-Bundle fehlt: $release_directory"
+
+install_root="${WATERMAPS_INSTALL_DIR:-/opt/watermaps}"
+wm_require_safe_absolute_dir "$install_root"
+active_images_file="${WATERMAPS_ACTIVE_IMAGES_FILE:-$install_root/deploy/.env.images}"
+
+WATERMAPS_ENV_FILE="$WM_ENV_FILE" \
+WATERMAPS_ACTIVE_IMAGES_FILE="$active_images_file" \
+  "$release_directory/deploy/scripts/deploy.sh" \
+    --images-file "$images_file"
+
+temporary_link="$install_root/.current.rollback.$$.new"
+trap 'rm -f -- "$temporary_link"' EXIT HUP INT TERM
+ln --symbolic "$release_directory" "$temporary_link"
+mv --no-target-directory "$temporary_link" "$install_root/current"
+temporary_link=""
+
+for unit in \
+  watermaps-auto-deploy.service \
+  watermaps-auto-deploy.timer \
+  watermaps-route-update.service \
+  watermaps-route-update.timer \
+  watermaps-certbot-renew.service \
+  watermaps-certbot-renew.timer; do
+  install -m 0644 \
+    "$release_directory/deploy/systemd/$unit" \
+    "/etc/systemd/system/$unit"
+done
+systemctl daemon-reload
+
+wm_log "Rollback auf Commit $target_revision ist geprüft und atomar aktiviert."