spb/ka-guardian

1#!/bin/zsh2# ============================================3# KA Guardian — déploiement complet depuis le laptop4#   ./deploy.sh runners        → runners sur M3U96a M3U96b M4M64a M4M64b5#   ./deploy.sh orchestrators  → ka2/ka4/ka6 sur M4M36 (remplace les anciens bots)6#   ./deploy.sh all7# Idempotent. Le token partagé vit dans ~/.ka-guardian.env (laptop) et est8# poussé sur chaque nœud. Les tunnels ngrok existants (www.kaX.bot) sont gardés.9# ============================================10set -e11ROOT="$(cd "$(dirname "$0")/.." && pwd)"12RUNNER_NODES=(M3U96a M3U96b M4M64a M4M64b)13ORCH_NODE=M4M3614PY=/opt/homebrew/bin/python31516# --- token partagé17TOKEN_FILE="$HOME/.ka-guardian.env"18if [[ ! -f $TOKEN_FILE ]]; then19  echo "KA_GUARDIAN_TOKEN=$(openssl rand -hex 24)" > "$TOKEN_FILE"20  echo "token généré → $TOKEN_FILE"21fi22TOKEN_LINE=$(grep KA_GUARDIAN_TOKEN "$TOKEN_FILE")2324deploy_courier() {25  # Courrier zsh sur TOUS les nœuds (orchestrateur + runners): expédie le26  # trafic LAN inter-nœuds via ssh (macOS 26 Local Network Privacy).27  for n in $RUNNER_NODES $ORCH_NODE; do28    echo "=== courrier → $n"29    scp -q "$ROOT/deploy/courier.sh" $n:ka-guardian-courier.sh30    ssh $n 'chmod +x ~/ka-guardian-courier.sh31      cat > ~/Library/LaunchAgents/com.ka.guardian-courier.plist <<PLIST32<?xml version="1.0" encoding="UTF-8"?>33<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">34<plist version="1.0"><dict>35  <key>Label</key><string>com.ka.guardian-courier</string>36  <key>ProgramArguments</key><array>37    <string>/bin/zsh</string>38    <string>/Users/simon-pierreboucher/ka-guardian-courier.sh</string>39  </array>40  <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>41  <key>StandardOutPath</key><string>/Users/simon-pierreboucher/ka-guardian-spool/courier.log</string>42  <key>StandardErrorPath</key><string>/Users/simon-pierreboucher/ka-guardian-spool/courier.log</string>43</dict></plist>44PLIST45      mkdir -p ~/ka-guardian-spool46      launchctl unload ~/Library/LaunchAgents/com.ka.guardian-courier.plist 2>/dev/null || true47      launchctl load ~/Library/LaunchAgents/com.ka.guardian-courier.plist' \48      && echo " ✓ $n courrier ok" || echo " ✗ $n courrier KO"49  done50}5152deploy_runners() {53  for n in $RUNNER_NODES; do54    echo "=== runner → $n"55    ssh $n "mkdir -p ~/ka-guardian-runner/transcripts"56    scp -q "$ROOT/runner/runner.py" $n:ka-guardian-runner/runner.py57    ssh $n "printf '%s\nKA_GUARDIAN_NODE=%s\n' '$TOKEN_LINE' '$n' > ~/.ka-guardian.env58      cd ~/ka-guardian-runner59      [[ -d .venv ]] || $PY -m venv .venv60      ./.venv/bin/pip -q install 'fastapi>=0.110' 'uvicorn>=0.29' 'httpx>=0.27' 'pydantic>=2' >/dev/null61      cat > ~/Library/LaunchAgents/com.ka.guardian-runner.plist <<'PLIST'62<?xml version=\"1.0\" encoding=\"UTF-8\"?>63<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">64<plist version=\"1.0\"><dict>65  <key>Label</key><string>com.ka.guardian-runner</string>66  <key>ProgramArguments</key><array>67    <string>/Users/simon-pierreboucher/ka-guardian-runner/.venv/bin/python</string>68    <string>/Users/simon-pierreboucher/ka-guardian-runner/runner.py</string>69  </array>70  <key>EnvironmentVariables</key><dict>71    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>72  </dict>73  <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>74  <key>StandardOutPath</key><string>/Users/simon-pierreboucher/ka-guardian-runner/runner.log</string>75  <key>StandardErrorPath</key><string>/Users/simon-pierreboucher/ka-guardian-runner/runner.log</string>76</dict></plist>77PLIST78      launchctl unload ~/Library/LaunchAgents/com.ka.guardian-runner.plist 2>/dev/null || true79      launchctl load ~/Library/LaunchAgents/com.ka.guardian-runner.plist"80    sleep 281    ssh $n "curl -sf localhost:7791/health" && echo " ✓ $n runner ok" || echo " ✗ $n runner KO"82  done83}8485deploy_orchestrators() {86  echo "=== orchestrateurs → $ORCH_NODE"87  ssh $ORCH_NODE "printf '%s\n' '$TOKEN_LINE' > ~/.ka-guardian.env; mkdir -p ~/cluster-projects/ka-guardian"88  cd "$ROOT"89  rsync -az --delete --exclude data --exclude .venv --exclude .git --exclude __pycache__ \90    ./ $ORCH_NODE:cluster-projects/ka-guardian/91  # vérification: le fichier déployé DOIT être identique (gotcha rsync silencieux)92  loc=$(md5 -q orchestrator/main.py); rem=$(ssh $ORCH_NODE 'md5 -q ~/cluster-projects/ka-guardian/orchestrator/main.py')93  [[ "$loc" == "$rem" ]] || { echo "✗ rsync n'a pas mis à jour main.py ($loc ≠ $rem)"; exit 1; }94  ssh $ORCH_NODE "cd ~/cluster-projects/ka-guardian95    PY=\$(command -v /opt/homebrew/bin/python3 || command -v /opt/homebrew/bin/python3.13)96    [[ -d .venv ]] || \$PY -m venv .venv97    ./.venv/bin/pip -q install 'fastapi>=0.110' 'uvicorn>=0.29' 'httpx>=0.27' >/dev/null98    mkdir -p data logs99    # retirer les anciens bots (web+bot), garder les tunnels ngrok100    for a in ka2 ka4 ka6; do101      launchctl unload ~/Library/LaunchAgents/com.\$a.web.plist 2>/dev/null || true102      launchctl unload ~/Library/LaunchAgents/com.\$a.bot.plist 2>/dev/null || true103      rm -f ~/Library/LaunchAgents/com.\$a.web.plist ~/Library/LaunchAgents/com.\$a.bot.plist104    done"105  for a in ka2:8799 ka4:8899 ka6:8999; do106    agent=${a%%:*}; port=${a##*:}107    ssh $ORCH_NODE "cat > ~/Library/LaunchAgents/com.$agent.guardian.plist <<PLIST108<?xml version=\"1.0\" encoding=\"UTF-8\"?>109<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">110<plist version=\"1.0\"><dict>111  <key>Label</key><string>com.$agent.guardian</string>112  <key>ProgramArguments</key><array>113    <string>/Users/simon-pierreboucher/cluster-projects/ka-guardian/.venv/bin/python</string>114    <string>/Users/simon-pierreboucher/cluster-projects/ka-guardian/orchestrator/main.py</string>115  </array>116  <key>EnvironmentVariables</key><dict>117    <key>AGENT</key><string>$agent</string>118    <key>KA_GUARDIAN_SELF_IP</key><string>192.168.2.69</string>119    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>120  </dict>121  <key>RunAtLoad</key><true/><key>KeepAlive</key><true/>122  <key>StandardOutPath</key><string>/Users/simon-pierreboucher/cluster-projects/ka-guardian/logs/$agent.log</string>123  <key>StandardErrorPath</key><string>/Users/simon-pierreboucher/cluster-projects/ka-guardian/logs/$agent.log</string>124</dict></plist>125PLIST126      launchctl unload ~/Library/LaunchAgents/com.$agent.guardian.plist 2>/dev/null || true127      launchctl load ~/Library/LaunchAgents/com.$agent.guardian.plist"128    sleep 2129    ssh $ORCH_NODE "curl -sf localhost:$port/health" && echo " ✓ $agent ok (:$port)" || echo " ✗ $agent KO"130  done131}132133case "${1:-all}" in134  courier) deploy_courier ;;135  runners) deploy_runners ;;136  orchestrators) deploy_orchestrators ;;137  all) deploy_courier; deploy_runners; deploy_orchestrators ;;138esac139echo "terminé."140