From 79588a8bba1648ea4d396a1d1e9884af54e497e2 Mon Sep 17 00:00:00 2001 From: salmonik Date: Fri, 30 Oct 2026 00:40:10 +0100 Subject: add deploy script with live verification; cache file hashes by size and mtime --- web/README.md | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) (limited to 'web/README.md') diff --git a/web/README.md b/web/README.md index 5de180d..a82c492 100644 --- a/web/README.md +++ b/web/README.md @@ -58,10 +58,34 @@ php -S 127.0.0.1:8899 -t web Then open . +## Deploying + +```sh +./scripts/publish.sh +./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/ +``` + +`deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a +half-written binary, then fetches the live page and every artifact it lists and +compares the downloaded bytes with the local SHA-256. `--verify-only` skips the +upload and only checks the live site. Old versions are left on the server; +prune them by hand. + +A local directory works as a target, which is how the verification itself is +tested: + +```sh +php -S 127.0.0.1:8899 -t /srv/staging +./scripts/deploy.sh /srv/staging http://127.0.0.1:8899/ +``` + ## Notes -- Hashes are computed per request with `hash_file()`. That is fine for a - handful of builds; add an mtime-keyed cache if the directory grows. +- Hashes are cached in a JSON file keyed on size and mtime, so a file is only + read once until it changes. The cache lives in the system temp directory by + default because the web root is often not writable by the PHP user; set + `ZAGAN_HASH_CACHE` to put it elsewhere. If the cache cannot be written, the + page simply hashes every request. - The page lists every build it finds, newest version first, so old releases stay downloadable until you remove them from `bin/`. - The checksum block is in `sha256sum` format, so visitors can save it as -- cgit v1.2.3