From d649f9b301e590f15772834e57fdd6a5f8173efe Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Sat, 5 Sep 2026 12:59:53 +0000
Subject: [PATCH] fix(hub): use mcp-server-key secret for opax-mcp auth

---
 deploy_hub.sh | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100755 deploy_hub.sh

diff --git a/deploy_hub.sh b/deploy_hub.sh
new file mode 100755
index 0000000..c3382d5
--- /dev/null
+++ b/deploy_hub.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Build and deploy osvauco-agent locally (bypasses Cloud Build VPC SC)
+
+PROJECT="propane-will-491900-m5"
+REGION="us-central1"
+REPO="osvauco-repo"
+SERVICE="osvauco-agent"
+TAG="v3.6.0"  # or use a unique tag
+FULL_IMAGE="${REGION}-docker.pkg.dev/${PROJECT}/${REPO}/${SERVICE}:${TAG}"
+
+echo "=== 1. Configure Docker auth ==="
+gcloud auth configure-docker ${REGION}-docker.pkg.dev --quiet
+
+echo "=== 2. Build locally ==="
+# Need a Dockerfile for the hub - check if one exists
+if [[ -f Dockerfile ]]; then
+  docker build -t "${FULL_IMAGE}" .
+elif [[ -f agents/mcp_server/Dockerfile ]]; then
+  # Use the MCP server Dockerfile if that's the hub
+  docker build -t "${FULL_IMAGE}" -f agents/mcp_server/Dockerfile .
+else
+  echo "ERROR: No Dockerfile found for osvauco-agent"
+  exit 1
+fi
+
+echo "=== 3. Push image ==="
+docker push "${FULL_IMAGE}"
+
+echo "=== 4. Deploy with pre-built image ==="
+gcloud run deploy "${SERVICE}"   --image="${FULL_IMAGE}"   --region="${REGION}"   --service-account="jason-vauger@${PROJECT}.iam.gserviceaccount.com"   --set-env-vars="GOOGLE_GENAI_USE_VERTEXAI=true,GOOGLE_CLOUD_PROJECT=${PROJECT},GOOGLE_CLOUD_LOCATION=${REGION},SERVICE_URL=https://osvauco-agent-zjbqp3prqq-uc.a.run.app,OPAX_BASE_URL=https://opax.vauco.no"   --set-secrets="MCP_SECRET=mcp-server-key:latest"   --no-allow-unauthenticated   --port=8080   --memory=512Mi   --cpu=1   --min-instances=0   --max-instances=2   --quiet
+
+echo "=== 5. Verify ==="
+SVC_URL=$(gcloud run services describe "${SERVICE}" --region="${REGION}" --format='value(status.url)')
+echo "Service URL: ${SVC_URL}"
+
+echo "=== 6. Health check ==="
+TOKEN=$(gcloud auth print-identity-token --impersonate-service-account=jason-vauger@propane-will-491900-m5.iam.gserviceaccount.com --audiences="${SVC_URL}")
+for i in {1..10}; do
+  if curl -sf -H "Authorization: Bearer $TOKEN" "${SVC_URL}/"; then
+    echo "✅ Deployment successful! Service is healthy."
+    exit 0
+  fi
+  echo "Waiting for service... (${i}/10)"
+  sleep 5
+done
+
+echo "❌ Health check failed after 10 attempts"
+curl -s -H "Authorization: Bearer $TOKEN" "${SVC_URL}/" || true
+exit 1