42 lines
1.2 KiB
Bash
Executable File
42 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Production startup (gunicorn) with a stable SECRET_KEY.
|
|
#
|
|
# Key resolution order:
|
|
# 1. SECRET_KEY environment variable (takes precedence),
|
|
# 2. .secret_key file next to this script (created once on first start),
|
|
# 3. otherwise a random key is generated and saved to .secret_key.
|
|
#
|
|
# A stable key matters: it signs the session cookies, so changing it
|
|
# on every restart would log out all users.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
|
|
SECRET_FILE=".secret_key"
|
|
|
|
if [ -z "${SECRET_KEY:-}" ]; then
|
|
if [ -f "$SECRET_FILE" ]; then
|
|
SECRET_KEY="$(cat "$SECRET_FILE")"
|
|
else
|
|
SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
|
|
printf '%s' "$SECRET_KEY" > "$SECRET_FILE"
|
|
chmod 600 "$SECRET_FILE"
|
|
echo "Generated a new SECRET_KEY, saved to $SECRET_FILE" >&2
|
|
fi
|
|
export SECRET_KEY
|
|
fi
|
|
|
|
# Migrate before starting, so the schema matches the code.
|
|
if [ -x ".venv/bin/alembic" ]; then
|
|
.venv/bin/alembic upgrade head
|
|
elif command -v alembic >/dev/null 2>&1; then
|
|
alembic upgrade head
|
|
fi
|
|
|
|
if [ -x ".venv/bin/gunicorn" ]; then
|
|
GUNICORN=".venv/bin/gunicorn"
|
|
else
|
|
GUNICORN="gunicorn"
|
|
fi
|
|
|
|
exec "$GUNICORN" -c gunicorn.conf.py "app:create_app()"
|