how the deployment works

Conversation started Dec 17, 2021 at 3:29.

lyxal

Dec 17, 2021 03:29

@pxeger when you have time and motivation, would you be able to write an explanation of how to setup/maintain the web app deployment/workflow process?

Just in case a) anything ever goes wrong or b) we ever switch away from PA because hypothetical better servers/url

also so I can set up the staging site

pxeger

sure

is it ok if I just tell you here, so if you have further questions you can ask me?

lyxal

of course

pxeger

So when commits are pushed to the production branch, this workflow is triggered, which just sends a POST request to vyxal.pythonanywhere.com/update

so it's essentially a simple webhook

the /update link has a password which needs to be passed in the X-funky-password header

(I can send you the password if you want it)

lyxal

sure, go ahead

pxeger

@lyxal actually I'll post it on the Web Design team on GitHub

lyxal

Dec 17, 2021 03:34

isn't that unsecure?

pxeger

I would argue it's no less secure than email tbh

lyxal

because won't it send as a plaintext email to everyone like it did when I put the site password there?

pxeger

yeah, ok, how else do you suggest doing it?

then the flask app, here, receives the request, validates the password with the sha256 hash), and if correct, executes the funky_upgrade.sh script

that script is inside the Vyxal repo, so it's checkout out on PythonAnywhere at /home/vyxal/mysite/funky_upgrade.sh

and when it's run, it pulls the git repo, upgrades all the pip dependencies, etc: github.com/Vyxal/Vyxal/blob/…

and finally it uses the PythonAnywhere API to restart the web app

lyxal

ah okay that seems simple enough

pxeger

it uses the $API_TOKEN environment variable, which is automatically set by PythonAnywhere if you have an API token set up on your account

Vyxal Bot

Dec 17, 2021 03:38

Lyxal created a repository: Vyxal/secrets

lyxal

that was a private repo

pxeger

lol

lyxal

still is a private repo

pxeger

do you use pgp of any kind? if so, that's the best secure option

e.g. if you have a keybase account

lyxal

I don't

pxeger

Dec 17, 2021 03:40

do you have an SSH key?

lyxal

but the repo vyxal bot so kindly announced should work for sharing among the whole team

pxeger

oh do you want the whole team to see it? ok that's easier then

lyxal

only people on the web-design team should be able to access it I think

pxeger

I don't think so

> All 19 members can access this repository.

lyxal

@pxeger yeah, so that anyone in the team can fix it if something goes wrong

@pxeger hmm changing that means changing perms throughout the rest of the organisation

pxeger

Dec 17, 2021 03:43

@pxeger you have to make sure you manually clone the repository into mysite when you first set it up: cd /home/vyxal; rm -rf mysite; git clone [email protected]:Vyxal/Vyxal.git mysite

and now I think about it, actually, you need to create an SSH key on PythonAnywhere as well

1: run ssh-keygen on PythonAnywhere, and press enter for all the defaults (no password)

2. copy the contents of ~/.ssh/id_rsa.pub (not ~/.ssh/id_rsa, because that's the private key)

3. add the public key as a Deploy Key on GitHub - just paste it into github.com/vyxal/vyxal/settings/keys/new (give it a good name, and don't allow write access)

after you've done that, you should be able to clone the repo

lyxal

That sounds simple enough

Thanks for the explanation!

pxeger

also, in the GitHub Actions workflow, I set environment: production

this means that when the workflow runs successfully, GitHub interprets that to mean that it was deployed to an Environment called production

you can set some settings for environments at github.com/Vyxal/Vyxal/settings/environments/343657709/edit

@pxeger the password is stored as a Repository Secret in GitHub Actions called FUNKY_PASSWORD

I should really change it so that it's a secret only accessible within workflows defined under the production Environment, though

@lyxal wait I just realised I don't have a plaintext version of the password right now, it's only on my desktop at home and I'm on holiday (did you notice my timezone changed?)

I don't think it'd too hard to change though, if you needed to

just change the hash in flask_app.py and update the GitHub secret value

@pxeger when it runs the script, it does it with a slight hack using os.fork() (which doesn't work on Windows, so you can't test it there), because the script needs to run in a separate process detached from the web app

otherwise when PythonAnywhere tries to restart flask, it gets a deadlock because it's waiting for funky_upgrade.sh to stop running, which is waiting for the PythonAnywhere restart API call to finish, which is waiting for the flask app to stop, ...

lyxal

@pxeger I did notice that you're active at a different time than usual :p

pxeger

and I think that's all there is to tell you

Conversation ended Dec 17, 2021 at 3:54.

all rooms

Dec '2117

Vyxal

For discussion about Vyxal. Repo: github.com/Vyxal/Vyxal | Org: ...

context of the conversation
join this room
about this room

Participants

pxeger 65%
lyxal 33%
Vyxal Bot 1%

all times are UTC