shipit-deploy 0.2.0__py3-none-any.whl

shipit/detect.py

@@ -0,0 +1,243 @@
+"""Detect a project's language and generate a Dockerfile for it.
+
+A Dockerfile in the repo always wins, so *any* language works; detection is
+only a convenience for the common cases.
+"""
+from __future__ import annotations
+
+import json
+import re
+import tomllib
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass
+class Detected:
+    lang: str
+    port: int
+    dockerfile: str
+
+
+def _cmd(default: str, start: str | None) -> str:
+    return "CMD " + json.dumps(["sh", "-c", start or default])
+
+
+def _exists(root: Path, *names: str) -> bool:
+    return any((root / n).exists() for n in names)
+
+
+def _glob(root: Path, pattern: str) -> list[Path]:
+    return sorted(root.glob(pattern))
+
+
+def _node(root, port, start):
+    return Detected("node", port, f"""FROM node:22-alpine
+WORKDIR /app
+COPY . .
+RUN if [ -f package-lock.json ]; then npm ci; else npm install; fi
+RUN npm run build --if-present
+ENV PORT={port} NODE_ENV=production
+EXPOSE {port}
+{_cmd("npm start", start)}
+""")
+
+
+_APP_RE = re.compile(r"^(\w+)\s*=\s*(Flask|FastAPI|Starlette|Quart)\(", re.M)
+
+
+def _infer_python(root: Path, port: int) -> tuple[str, str] | None:
+    """Guess (start command, extra pip packages) for Django / FastAPI / Flask projects."""
+    deps = ""
+    for f in ("requirements.txt", "pyproject.toml"):
+        if (root / f).exists():
+            deps += (root / f).read_text(encoding="utf-8", errors="ignore").lower()
+    bind = f"0.0.0.0:{port}"
+    if (root / "manage.py").exists():
+        for wsgi in sorted(root.glob("*/wsgi.py")):
+            return f"gunicorn {wsgi.parent.name}.wsgi:application -b {bind}", "gunicorn"
+    for f in ("main.py", "app.py", "server.py", "api.py"):
+        path = root / f
+        if not path.exists():
+            continue
+        m = _APP_RE.search(path.read_text(encoding="utf-8", errors="ignore"))
+        if not m:
+            continue
+        target = f"{path.stem}:{m.group(1)}"
+        if m.group(2) in ("FastAPI", "Starlette"):
+            return f"uvicorn {target} --host 0.0.0.0 --port {port}", "uvicorn"
+        return f"gunicorn {target} -b {bind}", "gunicorn"
+    return None
+
+
+def _python(root, port, start):
+    extra = ""
+    if start is None:
+        guess = _infer_python(root, port)
+        if guess:
+            start, extra = guess
+        else:
+            for f in ("app.py", "main.py", "server.py"):
+                if (root / f).exists():
+                    start = f"python {f}"
+                    break
+            else:
+                raise ValueError("Python project: set `start` in config (e.g. 'gunicorn app:app -b 0.0.0.0:8000')")
+    pip_extra = f"RUN pip install --no-cache-dir {extra}\n" if extra else ""
+    return Detected("python", port, f"""FROM python:3.12-slim
+WORKDIR /app
+COPY . .
+RUN if [ -f requirements.txt ]; then pip install --no-cache-dir -r requirements.txt; \\
+    elif [ -f pyproject.toml ]; then pip install --no-cache-dir .; fi
+{pip_extra}ENV PORT={port} PYTHONUNBUFFERED=1
+EXPOSE {port}
+{_cmd(start, start)}
+""")
+
+
+def _go(root, port, start):
+    return Detected("go", port, f"""FROM golang:1.23-alpine AS build
+WORKDIR /src
+COPY . .
+RUN CGO_ENABLED=0 go build -o /out/app .
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates
+COPY --from=build /out/app /app
+ENV PORT={port}
+EXPOSE {port}
+{_cmd("/app", start)}
+""")
+
+
+def _rust(root, port, start):
+    name = tomllib.loads((root / "Cargo.toml").read_text(encoding="utf-8")).get("package", {}).get("name")
+    if not name:
+        raise ValueError("Cargo.toml has no [package].name (workspace?) - provide your own Dockerfile")
+    return Detected("rust", port, f"""FROM rust:1-slim AS build
+WORKDIR /src
+COPY . .
+RUN cargo build --release
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/{name} /app
+ENV PORT={port}
+EXPOSE {port}
+{_cmd("/app", start)}
+""")
+
+
+def _java_maven(root, port, start):
+    return Detected("java-maven", port, f"""FROM maven:3-eclipse-temurin-21 AS build
+WORKDIR /src
+COPY . .
+RUN mvn -q -B package -DskipTests
+FROM eclipse-temurin:21-jre
+WORKDIR /app
+COPY --from=build /src/target/*.jar /tmp/jars/
+RUN cp "$(ls /tmp/jars/*.jar | grep -v original | head -1)" /app/app.jar
+ENV PORT={port} SERVER_PORT={port}
+EXPOSE {port}
+{_cmd("java -jar /app/app.jar", start)}
+""")
+
+
+def _java_gradle(root, port, start):
+    return Detected("java-gradle", port, f"""FROM gradle:8-jdk21 AS build
+WORKDIR /src
+COPY . .
+RUN gradle build -x test --no-daemon
+FROM eclipse-temurin:21-jre
+WORKDIR /app
+COPY --from=build /src/build/libs/ /tmp/jars/
+RUN cp "$(ls /tmp/jars/*.jar | grep -v plain | head -1)" /app/app.jar
+ENV PORT={port} SERVER_PORT={port}
+EXPOSE {port}
+{_cmd("java -jar /app/app.jar", start)}
+""")
+
+
+def _php(root, port, start):
+    return Detected("php", 80, """FROM php:8.3-apache
+RUN a2enmod rewrite
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+WORKDIR /var/www/html
+COPY . .
+RUN if [ -f composer.json ]; then composer install --no-dev --no-interaction; fi
+EXPOSE 80
+""")
+
+
+def _ruby(root, port, start):
+    if start is None:
+        if not (root / "config.ru").exists():
+            raise ValueError("Ruby project: set `start` in config")
+        start = f"bundle exec rackup -o 0.0.0.0 -p {port}"
+    return Detected("ruby", port, f"""FROM ruby:3.3-slim
+RUN apt-get update && apt-get install -y --no-install-recommends build-essential && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY . .
+RUN bundle install
+ENV PORT={port}
+EXPOSE {port}
+{_cmd(start, start)}
+""")
+
+
+def _dotnet(root, port, start):
+    proj = (_glob(root, "*.csproj") or _glob(root, "*.fsproj"))[0].stem
+    return Detected("dotnet", port, f"""FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+COPY . .
+RUN dotnet publish -c Release -o /out
+FROM mcr.microsoft.com/dotnet/aspnet:8.0
+WORKDIR /app
+COPY --from=build /out .
+ENV ASPNETCORE_URLS=http://+:{port}
+EXPOSE {port}
+{_cmd(f"dotnet {proj}.dll", start)}
+""")
+
+
+def _elixir(root, port, start):
+    return Detected("elixir", port, f"""FROM elixir:1.17-alpine
+WORKDIR /app
+RUN mix local.hex --force && mix local.rebar --force
+COPY . .
+ENV MIX_ENV=prod PORT={port}
+RUN mix deps.get --only prod && mix compile
+EXPOSE {port}
+{_cmd("mix phx.server", start)}
+""")
+
+
+def _static(root, port, start):
+    return Detected("static", 80, """FROM nginx:alpine
+COPY . /usr/share/nginx/html
+EXPOSE 80
+""")
+
+
+# Order matters: first match wins.
+_RULES = [
+    (lambda r: _exists(r, "package.json"), _node),
+    (lambda r: _exists(r, "go.mod"), _go),
+    (lambda r: _exists(r, "Cargo.toml"), _rust),
+    (lambda r: _exists(r, "pom.xml"), _java_maven),
+    (lambda r: _exists(r, "build.gradle", "build.gradle.kts"), _java_gradle),
+    (lambda r: _exists(r, "composer.json") or _glob(r, "*.php"), _php),
+    (lambda r: _exists(r, "Gemfile"), _ruby),
+    (lambda r: _glob(r, "*.csproj") or _glob(r, "*.fsproj"), _dotnet),
+    (lambda r: _exists(r, "mix.exs"), _elixir),
+    (lambda r: _exists(r, "requirements.txt", "pyproject.toml", "app.py", "main.py"), _python),
+    (lambda r: _exists(r, "index.html"), _static),
+]
+
+
+def detect(root: str | Path, port: int = 8080, start: str | None = None) -> Detected:
+    root = Path(root)
+    for matches, build in _RULES:
+        if matches(root):
+            return build(root, port, start)
+    raise ValueError(
+        f"Could not detect language in {root}. Add a Dockerfile to the repo - any language works with one."
+    )

shipit/doctor.py

@@ -0,0 +1,58 @@
+"""`shipit doctor`: check the host and config before the first deploy."""
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+import urllib.request
+from pathlib import Path
+
+
+def _docker_ok() -> tuple[bool, str]:
+    if not shutil.which("docker"):
+        return False, "docker not found in PATH"
+    r = subprocess.run(["docker", "info"], capture_output=True, text=True)
+    return r.returncode == 0, "daemon reachable" if r.returncode == 0 else "docker daemon not reachable (is it running / do you have access?)"
+
+
+def _caddy_ok(admin: str) -> tuple[bool, str]:
+    try:
+        urllib.request.urlopen(admin.rstrip("/") + "/config/", timeout=3).close()
+        return True, f"admin API reachable at {admin}"
+    except OSError as e:
+        return False, f"cannot reach Caddy admin API at {admin} ({e})"
+
+
+def checks(cfg) -> list[tuple[str, bool, str]]:
+    out: list[tuple[str, bool, str]] = []
+    out.append(("python >= 3.11", sys.version_info >= (3, 11), sys.version.split()[0]))
+    out.append(("git", bool(shutil.which("git")), shutil.which("git") or "not found in PATH"))
+    out.append(("docker", *_docker_ok()))
+    if any(a.domain for a in cfg.apps.values()):
+        out.append(("caddy", *_caddy_ok(cfg.caddy_admin)))
+    ports: dict[int, str] = {}
+    for a in cfg.apps.values():
+        used = [a.host_port] + ([a.host_port + 1] if a.domain else [])
+        for p in used:
+            if p in ports:
+                out.append((f"{a.name}: port {p}", False, f"also used by {ports[p]}"))
+            ports[p] = a.name
+        env = a.secret_env or "SHIPIT_SECRET"
+        out.append((f"{a.name}: webhook secret ${env}", True, "set" if os.environ.get(env) else f"not set; using auto-generated secret in {cfg.state_dir / 'webhook-secret'}"))
+        if a.token_env:
+            out.append((f"{a.name}: git token ${a.token_env}", bool(os.environ.get(a.token_env)), "set" if os.environ.get(a.token_env) else "not set"))
+        if a.env_file:
+            out.append((f"{a.name}: env_file", Path(a.env_file).is_file(), a.env_file))
+        if a.notify_env:
+            out.append((f"{a.name}: notify ${a.notify_env}", bool(os.environ.get(a.notify_env)), "set" if os.environ.get(a.notify_env) else "not set (notifications off)"))
+    return out
+
+
+def run(cfg) -> int:
+    bad = 0
+    for name, ok, detail in checks(cfg):
+        print(f"  [{'ok' if ok else 'FAIL'}] {name}: {detail}")
+        bad += not ok
+    print("all good" if not bad else f"{bad} problem(s) found")
+    return 1 if bad else 0

shipit/easy.py

@@ -0,0 +1,82 @@
+"""Zero-config helpers behind `shipit up`."""
+from __future__ import annotations
+
+import json
+import re
+import secrets
+import socket
+import subprocess
+from pathlib import Path
+
+
+def app_name_from_repo(url: str) -> str:
+    base = url.rstrip("/").rsplit("/", 1)[-1].rsplit(":", 1)[-1]
+    base = base.removesuffix(".git").lower()
+    name = re.sub(r"[^a-z0-9_.-]+", "-", base).strip("-._")
+    return name[:60] or "app"
+
+
+def _port_in_use(port: int) -> bool:
+    with socket.socket() as s:
+        s.settimeout(0.3)
+        if s.connect_ex(("127.0.0.1", port)) == 0:
+            return True
+    with socket.socket() as s:
+        try:
+            s.bind(("0.0.0.0", port))
+        except OSError:
+            return True
+    return False
+
+
+def free_port(taken: set[int], start: int = 8080) -> int:
+    """Lowest port >= start that no configured app uses and nothing is listening on."""
+    port = start
+    while port < 65535:
+        if port not in taken and port + 1 not in taken and not _port_in_use(port) and not _port_in_use(port + 1):
+            return port
+        port += 2
+    raise RuntimeError("no free port found")
+
+
+def default_branch(repo: str) -> str:
+    """Ask the remote which branch HEAD points to (falls back to 'main')."""
+    try:
+        out = subprocess.run(["git", "ls-remote", "--symref", repo, "HEAD"],
+                             capture_output=True, text=True, timeout=30).stdout
+    except (OSError, subprocess.TimeoutExpired):
+        return "main"
+    for line in out.splitlines():
+        if line.startswith("ref: refs/heads/"):
+            return line.split("\t")[0].removeprefix("ref: refs/heads/")
+    return "main"
+
+
+def get_secret(state_dir: Path) -> str:
+    """Webhook secret: auto-generated once and kept in the state dir."""
+    f = state_dir / "webhook-secret"
+    if f.exists():
+        return f.read_text().strip()
+    state_dir.mkdir(parents=True, exist_ok=True)
+    value = secrets.token_hex(20)
+    f.write_text(value)
+    try:
+        f.chmod(0o600)
+    except OSError:
+        pass
+    return value
+
+
+def webhook_secret(app, state_dir: Path) -> str:
+    """Per-app env var wins, then SHIPIT_SECRET, then the auto-generated one."""
+    import os
+    return os.environ.get(app.secret_env or "SHIPIT_SECRET", "") or get_secret(state_dir)
+
+
+def append_app(config_path: Path, fields: dict) -> None:
+    """Append an [[app]] block, creating the config file if needed."""
+    text = config_path.read_text(encoding="utf-8") if config_path.exists() else '[server]\nport = 9000\nstate_dir = ".shipit"\n'
+    if not text.endswith("\n"):
+        text += "\n"
+    block = "\n[[app]]\n" + "".join(f"{k} = {json.dumps(v)}\n" for k, v in fields.items() if v is not None)
+    config_path.write_text(text + block, encoding="utf-8")

shipit/hooks.py

@@ -0,0 +1,53 @@
+"""Register the push webhook on GitHub through the `gh` CLI."""
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+
+_GITHUB = re.compile(
+    r"^(?:https?://(?:[^@/]+@)?github\.com/|git@github\.com:|ssh://git@github\.com/)([^/]+)/([^/]+?)(?:\.git)?/?$"
+)
+
+
+def parse_github_repo(url: str) -> tuple[str, str] | None:
+    m = _GITHUB.match(url.strip())
+    return (m.group(1), m.group(2)) if m else None
+
+
+def hook_url(base: str, app: str) -> str:
+    base = base.rstrip("/")
+    return base if "/hook/" in base else f"{base}/hook/{app}"
+
+
+def payload(url: str, secret: str) -> dict:
+    return {
+        "name": "web",
+        "active": True,
+        "events": ["push"],
+        "config": {"url": url, "content_type": "json", "secret": secret, "insecure_ssl": "0"},
+    }
+
+
+def _gh(method: str, path: str, body: dict | None = None) -> str:
+    """Call the GitHub API via gh. The body goes through stdin so the secret never shows in `ps`."""
+    cmd = ["gh", "api", "--method", method, path] + (["--input", "-"] if body is not None else [])
+    r = subprocess.run(cmd, input=json.dumps(body) if body is not None else None, capture_output=True, text=True)
+    if r.returncode != 0:
+        raise RuntimeError((r.stderr or r.stdout).strip() or f"gh exited with {r.returncode}")
+    return r.stdout
+
+
+def register(repo_url: str, url: str, secret: str) -> str:
+    """Create (or update) the webhook. Returns 'created' or 'updated'."""
+    parsed = parse_github_repo(repo_url)
+    if not parsed:
+        raise ValueError("automatic registration only supports github.com repos; add the webhook manually")
+    owner, repo = parsed
+    base = f"repos/{owner}/{repo}/hooks"
+    for h in json.loads(_gh("GET", base) or "[]"):
+        if h.get("config", {}).get("url") == url:
+            _gh("PATCH", f"{base}/{h['id']}", payload(url, secret))
+            return "updated"
+    _gh("POST", base, payload(url, secret))
+    return "created"

shipit/proxy.py

@@ -0,0 +1,52 @@
+"""Zero-downtime cutover through Caddy's admin API.
+
+Apps that set `domain` run as two slots (blue/green) on 127.0.0.1:<host_port> and
+127.0.0.1:<host_port+1>. Caddy routes the domain to the active slot; a release
+starts the idle slot, health-checks it, flips the Caddy route, then removes the old slot.
+
+shipit owns the Caddy config: every sync POSTs a full config to /load.
+"""
+from __future__ import annotations
+
+import json
+import urllib.request
+
+SLOTS = ("blue", "green")
+
+
+def slot_port(host_port: int, slot: str) -> int:
+    return host_port + SLOTS.index(slot)
+
+
+def build_config(entries: list[tuple[str, int]]) -> dict:
+    """entries: [(domain, upstream_port)] -> Caddy JSON config."""
+    routes = [
+        {
+            "match": [{"host": [domain]}],
+            "handle": [{"handler": "reverse_proxy", "upstreams": [{"dial": f"127.0.0.1:{port}"}]}],
+            "terminal": True,
+        }
+        for domain, port in sorted(entries)
+    ]
+    return {"apps": {"http": {"servers": {"shipit": {"listen": [":443"], "routes": routes}}}}}
+
+
+def apply(admin_url: str, config: dict) -> None:
+    req = urllib.request.Request(
+        admin_url.rstrip("/") + "/load",
+        data=json.dumps(config).encode(),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(req, timeout=15) as r:
+        r.read()
+
+
+def sync(cfg, states: dict[str, dict]) -> None:
+    """Point Caddy at every proxied app's active slot."""
+    entries = []
+    for name, app in cfg.apps.items():
+        port = states.get(name, {}).get("port")
+        if app.domain and port:
+            entries.append((app.domain, port))
+    apply(cfg.caddy_admin, build_config(entries))

shipit/webhook.py

@@ -0,0 +1,98 @@
+"""Webhook server: GitHub (HMAC) and GitLab (token) push events trigger deploys."""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import os
+import queue
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+from .config import Config
+from .deploy import Deployer, log
+from .easy import webhook_secret
+
+MAX_BODY = 5 * 1024 * 1024
+
+
+def verify(secret: str, headers, body: bytes) -> bool:
+    sig = headers.get("X-Hub-Signature-256")
+    if sig:  # GitHub / Gitea / Forgejo
+        want = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
+        return hmac.compare_digest(sig, want)
+    tok = headers.get("X-Gitlab-Token")
+    if tok:  # GitLab
+        return hmac.compare_digest(tok, secret)
+    return False
+
+
+def make_server(source) -> ThreadingHTTPServer:
+    """`source` is a Config or a LiveConfig (anything with .get())."""
+    get = source.get if hasattr(source, "get") else (lambda: source)
+    cfg = get()
+    jobs: queue.Queue[str] = queue.Queue()
+    pending: set[str] = set()
+    lock = threading.Lock()
+
+    def worker():
+        while True:
+            name = jobs.get()
+            with lock:
+                pending.discard(name)
+            try:
+                cfg = get()
+                Deployer(cfg.apps[name], cfg.state_dir, cfg).deploy()
+            except Exception as e:  # keep the worker alive
+                log(f"deploy of {name} crashed: {e}")
+
+    threading.Thread(target=worker, daemon=True).start()
+
+    def enqueue(name: str) -> bool:
+        with lock:
+            if name in pending:
+                return False  # a build is already queued; it will pick up the latest commit
+            pending.add(name)
+        jobs.put(name)
+        return True
+
+    class Handler(BaseHTTPRequestHandler):
+        def _reply(self, code: int, msg: str):
+            body = json.dumps({"message": msg}).encode()
+            self.send_response(code)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        def do_GET(self):
+            self._reply(200, "ok") if self.path == "/healthz" else self._reply(404, "not found")
+
+        def do_POST(self):
+            cfg = get()
+            parts = self.path.strip("/").split("/")
+            if len(parts) != 2 or parts[0] != "hook" or parts[1] not in cfg.apps:
+                return self._reply(404, "not found")
+            app = cfg.apps[parts[1]]
+            secret = webhook_secret(app, cfg.state_dir)
+            if not secret:
+                return self._reply(500, "webhook secret not configured")
+            n = int(self.headers.get("Content-Length") or 0)
+            if n > MAX_BODY:
+                return self._reply(413, "payload too large")
+            body = self.rfile.read(n)
+            if not verify(secret, self.headers, body):
+                return self._reply(401, "bad signature")
+            try:
+                ref = json.loads(body or b"{}").get("ref", "")
+            except ValueError:
+                return self._reply(400, "bad json")
+            if ref and ref != f"refs/heads/{app.branch}":
+                return self._reply(200, f"ignored ref {ref}")
+            queued = enqueue(app.name)
+            self._reply(202, "queued" if queued else "already queued")
+
+        def log_message(self, fmt, *args):
+            log("http " + fmt % args)
+
+    return ThreadingHTTPServer((cfg.listen_host, cfg.listen_port), Handler)