gowalk-cicd 1.0.49 → 1.0.51

package/CLAUDE.md

@@ -108,6 +108,10 @@ node /path/to/gowalk-cicd/bin/cli.mjs
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
+- Domain-backed backend deploys fail closed on certificate issuance and the
+  public HTTPS health probe. `select_certbot_account.sh` chooses one existing
+  Let's Encrypt ACME v2 account deterministically so multi-account hosts stay
+  non-interactive; legacy v1 account directories are not valid candidates.
 - The Android action serves two build systems. `android_config.project_kind()`
   is the only place that decides which; every downstream step branches on the
   `project_kind` output rather than re-sniffing the repo. Flutter wins the tie

package/README.md

@@ -73,6 +73,8 @@ The backend workflow runs on a GitHub-hosted runner and, on a push touching
 it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 `docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+Hosts with several existing Let's Encrypt accounts select one deterministically,
+and a domain deploy fails unless its public HTTPS certificate and health route validate.
 
 Requirements on the consumer repo:
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.49
+1.0.51

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.49
+1.0.51

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.49
+1.0.51

package/backend-action/action.yml

@@ -122,9 +122,12 @@ runs:
           rsync -az -e "$SSH" "$COMPOSE_FILE" \
             "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/docker-compose.yml"
         fi
-        # ship the remote deploy script (kept out of the app checkout)
-        rsync -az -e "$SSH" "${{ github.action_path }}/remote_deploy.sh" \
-          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/.remote_deploy.sh"
+        # Ship remote helpers after the application mirror. Both are package
+        # owned and kept out of the consumer's source tree.
+        rsync -az -e "$SSH" \
+          "${{ github.action_path }}/remote_deploy.sh" \
+          "${{ github.action_path }}/select_certbot_account.sh" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
 
     - name: Deploy on the host
       shell: bash
@@ -140,7 +143,7 @@ runs:
             "umask 077; cat > '$DEST/.runtime.env'"
         fi
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
-          "bash '$DEST/.remote_deploy.sh' \
+          "bash '$DEST/remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
              '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 

package/backend-action/remote_deploy.sh

@@ -10,6 +10,7 @@ HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
+source "$DIR/select_certbot_account.sh"
 
 log() { echo "[deploy $APP] $*"; }
 
@@ -95,16 +96,34 @@ fi
 # ── Let's Encrypt cert (idempotent; certbot skips if current)
 if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
   log "requesting LE cert for $DOMAIN"
-  certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+  CERTBOT_ACCOUNT="$(select_certbot_account)"
+  CERTBOT_ARGS=()
+  if [ -n "$CERTBOT_ACCOUNT" ]; then
+    log "using an existing Let's Encrypt account"
+    CERTBOT_ARGS+=(--account "$CERTBOT_ACCOUNT")
+  fi
+  if ! certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
+    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"; then
+    log "ERROR: certbot failed for $DOMAIN"
+    exit 1
+  fi
 else
   log "cert for $DOMAIN already present"
 fi
 
-# ── public health-check (best effort — cert/DNS may still be propagating)
-if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
-  log "public https://$DOMAIN$HEALTH healthy"
-else
-  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
+# ── public health-check. This validates DNS, the certificate, nginx routing,
+# and the application together; a green deploy must mean the public API works.
+PUBLIC_HEALTHY=""
+for i in $(seq 1 15); do
+  if curl -fsS "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+    log "public https://$DOMAIN$HEALTH healthy (after ${i}x2s)"
+    PUBLIC_HEALTHY=1
+    break
+  fi
+  sleep 2
+done
+if [ -z "$PUBLIC_HEALTHY" ]; then
+  log "ERROR: public https://$DOMAIN$HEALTH failed TLS or health validation"
+  exit 1
 fi
 log "done"

package/backend-action/select_certbot_account.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Print the stable id of one existing Certbot account. Hosts may contain more
+# than one registered account; non-interactive Certbot otherwise stops to ask
+# which account should authorize a new certificate.
+select_certbot_account() {
+  local accounts_dir="${1:-/etc/letsencrypt/accounts}"
+  local server_dir="$accounts_dir/acme-v02.api.letsencrypt.org/directory"
+  local registration
+
+  registration="$(
+    find "$server_dir" -type f -name regr.json -print 2>/dev/null \
+      | LC_ALL=C sort \
+      | head -1
+  )"
+  [ -n "$registration" ] || return 0
+  basename "$(dirname "$registration")"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.49",
+  "version": "1.0.51",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {