baiyue-firstleg/deploy/scripts/deploy-blue-green-service.sh

#!/usr/bin/env sh
set -eu

if [ "$#" -ne 7 ]; then
  echo "用法: $0 <环境> <镜像仓库> <镜像标签> <服务> <环境文件> <Compose文件> <项目名>" >&2
  exit 2
fi

DEPLOY_ENV="$1"
IMAGE_REPOSITORY="$2"
IMAGE_TAG="$3"
SERVICE="$4"
ENV_FILE="$5"
COMPOSE_FILE="$6"
BASE_PROJECT="$7"

case "$DEPLOY_ENV" in
  test|production) ;;
  *) echo "蓝绿执行器仅用于 test/production，当前: $DEPLOY_ENV" >&2; exit 2 ;;
esac

for file in "$ENV_FILE" "$COMPOSE_FILE"; do
  [ -f "$file" ] || { echo "必需文件不存在: $file" >&2; exit 2; }
done

case "$SERVICE" in
  *[!A-Za-z0-9_-]*|'') echo "非法服务名: $SERVICE" >&2; exit 2 ;;
esac

env_value() {
  sed -n "s/^$1=//p" "$ENV_FILE" | tail -n 1 | tr -d '\r'
}

service_contract() {
  case "$SERVICE:$COMPOSE_FILE" in
    gateway:*) echo "gateway|9000|9000|gateway|gateway-active" ;;
    auth:*) echo "auth|9100|9100|auth-service|auth" ;;
    iam:*) echo "iam|9201|9201|iam-service|iam" ;;
    firstleg:*) echo "business|9202|9202|firstleg-service|firstleg" ;;
    finance:*) echo "finance|9203|9203|finance-service|finance" ;;
    order:*) echo "order|9204|9204|order-service|order" ;;
    warehouse:*) echo "warehouse|9205|9205|warehouse-service|warehouse" ;;
    file:*) echo "file|9206|9206|file-service|file" ;;
    print:*) echo "print|9207|9207|print-service|print" ;;
    integration-service:*) echo "integration|9210|9210|integration-service|integration-service" ;;
    audit-service:*) echo "audit|9700|9700|audit-service|audit-service" ;;
    gateway-overseas:*) echo "gateway-overseas|9300|9300|gateway-overseas|gateway-overseas-active" ;;
    lastleg-service:*) echo "lastleg|9303|9303|lastleg-service|lastleg-service" ;;
    warehouse-overseas-service:*) echo "warehouse-overseas|9305|9305|warehouse-overseas-service|warehouse-overseas-service" ;;
    event-bridge-service:*overseas*) echo "event-bridge-overseas|9312|9313|event-bridge-overseas|event-bridge-overseas" ;;
    event-bridge-service:*) echo "event-bridge|9312|9312|event-bridge-cn|event-bridge-cn" ;;
    *) echo "不支持蓝绿部署的服务: $SERVICE" >&2; exit 2 ;;
  esac
}

IFS='|' read -r CONTAINER_STEM INTERNAL_PORT BASE_PORT NACOS_SERVICE ROUTING_ALIAS <<EOF
$(service_contract)
EOF

STATE_ROOT="${BLUE_GREEN_STATE_ROOT:-/data/firstleg/deploy/blue-green-state}"
STATE_KEY="${BASE_PROJECT}-${SERVICE}"
STATE_FILE="$STATE_ROOT/$STATE_KEY.active"
ROUTING_NETWORK="${BLUE_GREEN_ROUTING_NETWORK:-firstleg-${DEPLOY_ENV}-routing}"
HEALTH_TIMEOUT="${DEPLOY_HEALTH_TIMEOUT_SECONDS:-240}"
HEALTH_POLL="${DEPLOY_HEALTH_POLL_SECONDS:-5}"
STABILIZATION_SECONDS="${BLUE_GREEN_STABILIZATION_SECONDS:-10}"
DRAIN_SECONDS="${BLUE_GREEN_DRAIN_SECONDS:-30}"
STOP_TIMEOUT="${BLUE_GREEN_STOP_TIMEOUT_SECONDS:-45}"
IMAGE="$IMAGE_REPOSITORY/$SERVICE:$IMAGE_TAG"

for value in "$HEALTH_TIMEOUT" "$HEALTH_POLL" "$STABILIZATION_SECONDS" "$DRAIN_SECONDS" "$STOP_TIMEOUT"; do
  case "$value" in ''|*[!0-9]*) echo "蓝绿时间参数必须为非负整数: $value" >&2; exit 2 ;; esac
done

mkdir -p "$STATE_ROOT"
chmod 750 "$STATE_ROOT"
docker network inspect "$ROUTING_NETWORK" >/dev/null 2>&1 || docker network create "$ROUTING_NETWORK" >/dev/null

legacy_container="firstleg-${DEPLOY_ENV}-${CONTAINER_STEM}"
active_slot=""
active_container=""
active_port=""
active_worker=""
if [ -s "$STATE_FILE" ]; then
  IFS='|' read -r active_slot active_container active_port active_image active_worker < "$STATE_FILE"
elif docker inspect "$legacy_container" >/dev/null 2>&1; then
  active_slot="legacy"
  active_container="$legacy_container"
  active_port="$BASE_PORT"
fi

if [ "$active_slot" = "blue" ]; then
  target_slot="green"
else
  target_slot="blue"
  [ "$active_slot" = "legacy" ] && target_slot="green"
fi

if [ "$target_slot" = "blue" ]; then
  target_port=$((BASE_PORT + 20000))
else
  target_port=$((BASE_PORT + 10000))
fi
candidate="firstleg-${DEPLOY_ENV}-${CONTAINER_STEM}-${target_slot}"
worker_candidate="${candidate}-worker"

if docker inspect "$candidate" >/dev/null 2>&1; then
  if [ "$candidate" = "$active_container" ]; then
    echo "活动槽状态异常，候选容器与活动容器相同: $candidate" >&2
    exit 1
  fi
  docker rm -f "$candidate" >/dev/null
fi

compose() {
  docker compose --project-name "$BASE_PROJECT" --env-file "$ENV_FILE" -f "$COMPOSE_FILE" "$@"
}

container_health() {
  container="$1"
  docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \
    "$container" 2>/dev/null || echo missing
}

cleanup_candidate() {
  docker rm -f "$candidate" >/dev/null 2>&1 || true
}

wait_for_container() {
  container="$1"
  label="$2"
  elapsed=0
  while [ "$elapsed" -lt "$HEALTH_TIMEOUT" ]; do
    state="$(container_health "$container")"
    echo "$label 健康状态: $state（已等待 ${elapsed}s）"
    case "$state" in
      healthy) return 0 ;;
      unhealthy|exited|dead|missing) return 1 ;;
    esac
    sleep "$HEALTH_POLL"
    elapsed=$((elapsed + HEALTH_POLL))
  done
  return 1
}

needs_worker() {
  case "$SERVICE" in
    iam|firstleg|finance|order|event-bridge-service|lastleg-service) return 0 ;;
    file)
      [ "$(env_value FILE_EXPORT_CONSUMER_ENABLED)" = true ] \
        || [ "$(env_value FILE_EXPORT_PUBLISHER_ENABLED)" = true ] \
        || [ "$(env_value FILE_EXPORT_RECONCILER_ENABLED)" = true ] \
        || [ "$(env_value AUDIT_OUTBOX_PUBLISHER_ENABLED)" = true ]
      ;;
    audit-service)
      [ "$(env_value AUDIT_MQ_CONSUMER_ENABLED)" = true ] \
        || [ "$(env_value AUDIT_DLQ_CONSUMER_ENABLED)" = true ] \
        || [ "$(env_value AUDIT_DLQ_COMPENSATION_ENABLED)" = true ]
      ;;
    auth|warehouse|warehouse-overseas-service)
      [ "$(env_value AUDIT_OUTBOX_PUBLISHER_ENABLED)" = true ]
      ;;
    *) return 1 ;;
  esac
}

start_worker_candidate() {
  docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
  echo "启动单例 Worker: $worker_candidate"
  if [ "$SERVICE" = file ]; then
    worker_java_options="-Xms512m -Xmx2g -XX:+ExitOnOutOfMemoryError -Dfile.encoding=UTF-8"
  else
    worker_java_options="-Xms256m -Xmx1g -XX:+ExitOnOutOfMemoryError -Dfile.encoding=UTF-8"
  fi
  if ! compose run -d --no-deps --name "$worker_candidate" \
      -e "NACOS_REGISTER_ENABLED=false" \
      -e "BAIYUE_RUNTIME_SCHEDULING_ENABLED=true" \
      -e "BAIYUE_DEPLOY_SLOT=${target_slot}-worker" \
      -e "JAVA_TOOL_OPTIONS=$worker_java_options" \
      -e "BAIYUE_RELEASE_ID=$IMAGE_TAG" "$SERVICE" >/dev/null; then
    return 1
  fi
  docker network connect "$ROUTING_NETWORK" "$worker_candidate"
  if ! wait_for_container "$worker_candidate" "候选 Worker"; then
    docker logs --tail 200 "$worker_candidate" 2>&1 || true
    docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
    return 1
  fi
  worker_image="$(docker inspect --format '{{.Config.Image}}' "$worker_candidate")"
  [ "$worker_image" = "$IMAGE" ] || return 1
}

connect_routing_aliases() {
  container="$1"
  shift
  docker network inspect "$ROUTING_NETWORK" --format '{{json .Containers}}' | grep -q "\"$container\"" \
    && return 0
  set -- docker network connect $(for alias_name in "$@"; do printf '%s\n' --alias "$alias_name"; done)
  "$@" "$ROUTING_NETWORK" "$container"
}

bootstrap_legacy_routes() {
  for pair in \
    gateway-active,gateway:gateway auth,auth-service:auth iam,iam-service:iam \
    firstleg,firstleg-service:business finance,finance-service:finance order,order-service:order \
    warehouse,warehouse-service:warehouse file,file-service:file print,print-service:print \
    integration-service:integration audit-service:audit \
    gateway-overseas-active,gateway-overseas:gateway-overseas \
    lastleg-service:lastleg warehouse-overseas-service:warehouse-overseas \
    event-bridge-cn:event-bridge event-bridge-overseas:event-bridge-overseas
  do
    aliases="${pair%%:*}"
    stem="${pair#*:}"
    container="firstleg-${DEPLOY_ENV}-${stem}"
    if docker inspect "$container" >/dev/null 2>&1; then
      connect_routing_aliases "$container" $(printf '%s' "$aliases" | tr ',' ' ') || true
    fi
  done
  for container in firstleg-prod-admin-web firstleg-prod-client-web; do
    if docker inspect "$container" >/dev/null 2>&1; then
      connect_routing_aliases "$container" "${container##*-}" || true
    fi
  done
}

switch_gateway_proxy() {
  [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
  if [ "$DEPLOY_ENV" = test ]; then
    echo "测试 Gateway 仍由固定入口承载，不在后端蓝绿执行器中切换" >&2
    return 1
  fi
  if [ "$SERVICE" = "gateway" ]; then required_alias=gateway-active; else required_alias=gateway-overseas-active; fi
  for frontend_service in admin-web client-web; do
    frontend_state="$STATE_ROOT/frontend-$frontend_service.active"
    if [ ! -s "$frontend_state" ]; then
      echo "$frontend_service 尚未完成首次蓝绿迁移，拒绝切换 Gateway" >&2
      return 1
    fi
    IFS='|' read -r frontend_slot frontend frontend_port frontend_image < "$frontend_state"
    if ! docker inspect "$frontend" >/dev/null 2>&1 \
      || ! docker exec "$frontend" nginx -T 2>&1 | grep -q "$required_alias"; then
      echo "$frontend 尚未使用稳定上游 $required_alias，拒绝切换 Gateway" >&2
      return 1
    fi
  done
  route_root="${BLUE_GREEN_ROUTE_CONFIG_ROOT:-/www/server/panel/vhost/nginx}"
  if [ "$SERVICE" = "gateway" ]; then
    config="$route_root/00-blue-green-gateway.conf"
  else
    config="$route_root/00-blue-green-gateway-overseas.conf"
  fi
  if [ -z "$config" ] || [ ! -f "$config" ]; then
    echo "$SERVICE 蓝绿切换要求环境文件配置有效的 Nginx 配置路径" >&2
    return 1
  fi
  backup="$config.blue-green-backup"
  cp -f "$config" "$backup"
  if ! sed -i "s#127\.0\.0\.1:${active_port:-$BASE_PORT}#127.0.0.1:$target_port#g" "$config" \
    || cmp -s "$config" "$backup"; then
    cp -f "$backup" "$config"
    echo "未能在 Nginx 配置中切换 $SERVICE 上游端口" >&2
    return 1
  fi
  if ! nginx -t || ! nginx -s reload; then
    cp -f "$backup" "$config"
    nginx -t && nginx -s reload || true
    return 1
  fi
  rm -f "$backup"
}

reload_frontend_proxies() {
  [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
  [ "$DEPLOY_ENV" = production ] || return 0
  for frontend_service in admin-web client-web; do
    frontend_state="$STATE_ROOT/frontend-$frontend_service.active"
    [ -s "$frontend_state" ] || return 1
    IFS='|' read -r frontend_slot frontend frontend_port frontend_image < "$frontend_state"
    docker inspect "$frontend" >/dev/null 2>&1 || return 1
    docker exec "$frontend" nginx -t
    docker exec "$frontend" nginx -s reload
  done
}

rollback_gateway_proxy() {
  [ "$SERVICE" = "gateway" ] || [ "$SERVICE" = "gateway-overseas" ] || return 0
  [ "$DEPLOY_ENV" = production ] || return 0
  route_root="${BLUE_GREEN_ROUTE_CONFIG_ROOT:-/www/server/panel/vhost/nginx}"
  if [ "$SERVICE" = "gateway" ]; then
    config="$route_root/00-blue-green-gateway.conf"
  else
    config="$route_root/00-blue-green-gateway-overseas.conf"
  fi
  old_port="${active_port:-$BASE_PORT}"
  sed -i "s#127\.0\.0\.1:$target_port#127.0.0.1:$old_port#g" "$config"
  nginx -t && nginx -s reload
}

bootstrap_legacy_routes

export DEPLOY_ENV IMAGE_REPOSITORY IMAGE_TAG
echo "启动候选槽: service=$SERVICE slot=$target_slot port=$target_port image=$IMAGE"
if ! compose run -d --no-deps --name "$candidate" \
    -e "BAIYUE_DEPLOY_SLOT=$target_slot" -e "BAIYUE_RELEASE_ID=$IMAGE_TAG" \
    -e "BAIYUE_RUNTIME_SCHEDULING_ENABLED=false" \
    -e "AUDIT_OUTBOX_PUBLISHER_ENABLED=false" \
    -e "NOTIFICATION_SCHEDULER_ENABLED=false" \
    -e "NOTIFICATION_MQ_CONSUMER_ENABLED=false" \
    -e "FILE_EXPORT_CONSUMER_ENABLED=false" \
    -e "FILE_EXPORT_PUBLISHER_ENABLED=false" \
    -e "FILE_EXPORT_RECONCILER_ENABLED=false" \
    -e "AUDIT_MQ_CONSUMER_ENABLED=false" \
    -e "AUDIT_DLQ_CONSUMER_ENABLED=false" \
    -e "AUDIT_DLQ_COMPENSATION_ENABLED=false" \
    -p "${PUBLISHED_BIND_ADDRESS:-0.0.0.0}:$target_port:$INTERNAL_PORT" "$SERVICE" >/dev/null; then
  cleanup_candidate
  exit 1
fi

if ! wait_for_container "$candidate" "候选 Web 槽 $target_slot"; then
  echo "候选槽未通过健康检查，保留旧实例" >&2
  docker logs --tail 200 "$candidate" 2>&1 || true
  cleanup_candidate
  exit 1
fi

running_image="$(docker inspect --format '{{.Config.Image}}' "$candidate")"
if [ "$running_image" != "$IMAGE" ]; then
  echo "候选镜像不一致: expected=$IMAGE actual=$running_image" >&2
  cleanup_candidate
  exit 1
fi

if [ "$NACOS_SERVICE" = "$ROUTING_ALIAS" ]; then
  connect_routing_aliases "$candidate" "$ROUTING_ALIAS"
else
  connect_routing_aliases "$candidate" "$ROUTING_ALIAS" "$NACOS_SERVICE"
fi

if [ "$STABILIZATION_SECONDS" -gt 0 ]; then
  echo "候选槽稳定观察 ${STABILIZATION_SECONDS}s"
  sleep "$STABILIZATION_SECONDS"
  [ "$(container_health "$candidate")" = "healthy" ] || { cleanup_candidate; exit 1; }
fi

if ! switch_gateway_proxy; then
  cleanup_candidate
  exit 1
fi

worker_required=false
if needs_worker; then worker_required=true; fi

if [ "$worker_required" = true ] && [ "$active_slot" != legacy ]; then
  if [ -n "$active_worker" ] && docker inspect "$active_worker" >/dev/null 2>&1; then
    echo "暂停旧 Worker，避免新旧任务并行: $active_worker"
    docker stop --time "$STOP_TIMEOUT" "$active_worker" >/dev/null
  fi
  if ! start_worker_candidate; then
    [ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
    rollback_gateway_proxy || true
    cleanup_candidate
    exit 1
  fi
fi

old_container_stopped=false
if [ -n "$active_container" ] && docker inspect "$active_container" >/dev/null 2>&1; then
  if [ "$DRAIN_SECONDS" -gt 0 ]; then
    echo "蓝绿切换后连接排空 ${DRAIN_SECONDS}s，旧 Web 实例保持运行: $active_container"
    sleep "$DRAIN_SECONDS"
  fi
  echo "优雅停止旧 Web 实例: $active_container"
  docker stop --time "$STOP_TIMEOUT" "$active_container" >/dev/null
  old_container_stopped=true
fi

if [ "$worker_required" = true ] && [ "$active_slot" = legacy ]; then
  if ! start_worker_candidate; then
    [ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
    rollback_gateway_proxy || true
    cleanup_candidate
    exit 1
  fi
fi

if ! reload_frontend_proxies; then
  [ "$old_container_stopped" = false ] || docker start "$active_container" >/dev/null 2>&1 || true
  if [ "$worker_required" = true ]; then
    docker rm -f "$worker_candidate" >/dev/null 2>&1 || true
    [ -z "$active_worker" ] || docker start "$active_worker" >/dev/null 2>&1 || true
  fi
  rollback_gateway_proxy || true
  cleanup_candidate
  reload_frontend_proxies || true
  exit 1
fi

[ -z "$active_worker" ] || [ "$active_worker" = "$worker_candidate" ] \
  || docker rm "$active_worker" >/dev/null 2>&1 || true
[ "$old_container_stopped" = false ] || docker rm "$active_container" >/dev/null

if [ "$worker_required" = true ]; then
  next_worker="$worker_candidate"
else
  next_worker=""
fi
printf '%s|%s|%s|%s|%s\n' "$target_slot" "$candidate" "$target_port" "$IMAGE" "$next_worker" > "$STATE_FILE.tmp"
chmod 640 "$STATE_FILE.tmp"
mv -f "$STATE_FILE.tmp" "$STATE_FILE"
echo "蓝绿切换完成: service=$SERVICE active=$target_slot container=$candidate port=$target_port"