101 lines
4.3 KiB
Bash
101 lines
4.3 KiB
Bash
#!/bin/bash
|
||
# bootstrap.sh — OSVauco VM bootstrap
|
||
# Kjøres på ny VM eller etter serverbytte
|
||
# Bruk: source .env && bash scripts/bootstrap.sh
|
||
|
||
set -euo pipefail
|
||
|
||
PROJECT_ID="${PROJECT_ID:-propane-will-491900-m5}"
|
||
REGION="${REGION:-us-central1}"
|
||
ARTIFACT_REPO="${ARTIFACT_REPO:-osvauco-repo}"
|
||
CLOUD_RUN_SERVICE="${CLOUD_RUN_SERVICE:-osvauco-agent}"
|
||
CLOUD_RUN_URL="https://osvauco-agent-357036551735.us-central1.run.app"
|
||
|
||
echo ""
|
||
echo "╔══════════════════════════════════════════════════╗"
|
||
echo "║ OSVauco VM Bootstrap ║"
|
||
echo "║ Prosjekt: $PROJECT_ID ║"
|
||
echo "╚══════════════════════════════════════════════════╝"
|
||
echo ""
|
||
|
||
# ── Steg 1: Auth-sjekk ─────────────────────────────────────
|
||
echo "[1/4] Auth-sjekk..."
|
||
bash infrastructure/00-authcheck.sh
|
||
|
||
# ── Steg 2: Sjekk at osvauco-base finnes i Artifact Registry ─
|
||
echo ""
|
||
echo "[2/4] Sjekker base Docker-image..."
|
||
|
||
BASE_IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${ARTIFACT_REPO}/osvauco-base"
|
||
|
||
if gcloud artifacts docker images describe "${BASE_IMAGE}:latest" \
|
||
--project="$PROJECT_ID" >/dev/null 2>&1; then
|
||
echo " ✅ osvauco-base:latest finnes — hopper over bygg"
|
||
else
|
||
echo " ⚠️ osvauco-base:latest mangler — bygger nå (~5-10 min)..."
|
||
gcloud builds submit \
|
||
--config=cloudbuild.base.yaml \
|
||
--project="$PROJECT_ID" \
|
||
.
|
||
echo " ✅ osvauco-base bygget og pushet"
|
||
fi
|
||
|
||
# ── Steg 3: Sjekk IAM-bindinger for CI/CD ──────────────────
|
||
echo ""
|
||
echo "[3/4] Sjekker IAM-bindinger for CI/CD..."
|
||
|
||
PROJECT_NUMBER=$(gcloud projects describe "$PROJECT_ID" --format="value(projectNumber)")
|
||
CB_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
|
||
AGENT_SA="osvauco-agent-sa@${PROJECT_ID}.iam.gserviceaccount.com"
|
||
|
||
# Cloud Build SA → iam.serviceAccountUser på agent-SA
|
||
gcloud iam service-accounts add-iam-policy-binding "$AGENT_SA" \
|
||
--member="serviceAccount:${CB_SA}" \
|
||
--role="roles/iam.serviceAccountUser" \
|
||
--project="$PROJECT_ID" \
|
||
--quiet 2>/dev/null && echo " ✅ Cloud Build SA har actAs på agent-SA" || echo " ℹ️ Cloud Build SA binding allerede på plass"
|
||
|
||
# Agent SA → iam.serviceAccountUser på seg selv
|
||
gcloud iam service-accounts add-iam-policy-binding "$AGENT_SA" \
|
||
--member="serviceAccount:${AGENT_SA}" \
|
||
--role="roles/iam.serviceAccountUser" \
|
||
--project="$PROJECT_ID" \
|
||
--quiet 2>/dev/null && echo " ✅ Agent SA har actAs på seg selv" || echo " ℹ️ Self-binding allerede på plass"
|
||
|
||
# ── Steg 4: Test at Cloud Run-agenten svarer ───────────────
|
||
echo ""
|
||
echo "[4/4] Tester Cloud Run-agenten..."
|
||
|
||
TOKEN=$(gcloud auth print-identity-token 2>/dev/null || echo "")
|
||
|
||
if [[ -z "$TOKEN" ]]; then
|
||
echo " ⚠️ Kan ikke hente identity token — er du logget inn med gcloud auth login?"
|
||
else
|
||
HTTP_CODE=$(curl -s -o /tmp/osvauco-test.json -w "%{http_code}" \
|
||
-X POST \
|
||
-H "Authorization: Bearer $TOKEN" \
|
||
-H "Content-Type: application/json" \
|
||
-d '{"user_id":"bootstrap","session_id":"boot-1","message":"Hei"}' \
|
||
"${CLOUD_RUN_URL}/run")
|
||
|
||
if [[ "$HTTP_CODE" == "200" ]]; then
|
||
echo " ✅ Agent svarer (HTTP 200)"
|
||
cat /tmp/osvauco-test.json | python3 -m json.tool 2>/dev/null | head -5
|
||
else
|
||
echo " ⚠️ Agent svarte HTTP $HTTP_CODE"
|
||
cat /tmp/osvauco-test.json
|
||
echo ""
|
||
echo " Vanlige årsaker:"
|
||
echo " - gemini-2.0-flash: kjør 'gcloud run services update ...' med ORCHESTRATOR_MODEL=gemini-2.0-flash-001"
|
||
echo " - 403: ny revisjon ikke deployet ennå — vent 2 min og prøv igjen"
|
||
fi
|
||
fi
|
||
|
||
echo ""
|
||
echo "╔══════════════════════════════════════════════════╗"
|
||
echo "║ Bootstrap ferdig! ║"
|
||
echo "║ Husk: bash infrastructure/03-teardown.sh ║"
|
||
echo "║ ...hver kveld for å unngå 24/7-fakturering ║"
|
||
echo "╚══════════════════════════════════════════════════╝"
|
||
echo ""
|