Jenkinsfile·scripts/deploy.sh: NAS 배포를 Jenkins로

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Jenkinsfile

@@ -0,0 +1,70 @@
+def isMain() {
+  def branch = env.BRANCH_NAME ?: env.GIT_BRANCH ?: ''
+  return !env.CHANGE_ID && branch in ['main', 'origin/main', 'refs/heads/main']
+}
+
+pipeline {
+  agent any
+
+  environment {
+    SSH_CONFIG_NAME = 'SEJONG-NAS'
+    DEPLOY_DIR = '/volume1/docker/live-rec'
+  }
+
+  options {
+    timestamps()
+    disableConcurrentBuilds()
+    buildDiscarder(logRotator(numToKeepStr: '20'))
+  }
+
+  stages {
+    stage('Validate') {
+      steps {
+        sh '''
+          set -eu
+          [ -f .env ] || : > .env
+          docker compose config -q
+          sh -n scripts/deploy.sh
+        '''
+      }
+    }
+
+    stage('Build') {
+      // main is built by deploy.sh on the NAS; other branches only prove the image builds.
+      when { not { expression { isMain() } } }
+      steps {
+        sh '''
+          set -eu
+          tag="live-rec-ci:$(printf '%s' "$BUILD_TAG" | tr -c 'A-Za-z0-9_.-' '-' | cut -c1-120)"
+          trap 'docker image rm "$tag" >/dev/null 2>&1 || true' EXIT
+          docker build -q -t "$tag" .
+        '''
+      }
+    }
+
+    stage('Deploy') {
+      when { expression { isMain() } }
+      steps {
+        // The NAS checkout is the deployment: fast-forward it to the built commit (refusing local edits),
+        // then deploy.sh rebuilds and restarts the container.
+        sshPublisher(
+          failOnError: true,
+          publishers: [
+            sshPublisherDesc(
+              configName: env.SSH_CONFIG_NAME,
+              verbose: true,
+              transfers: [
+                sshTransfer(
+                  execTimeout: 1800000,
+                  execCommand: """
+                    set -eu; cd "${env.DEPLOY_DIR}"; git diff --quiet HEAD || { echo 'deploy: NAS checkout has local changes' >&2; git status --short >&2; exit 1; }; prev=\$(git rev-parse HEAD); git fetch -q origin main; git merge -q --ff-only "${env.GIT_COMMIT}"; sh scripts/deploy.sh "\$prev"
+                  """.stripIndent().trim()
+                )
+              ]
+            )
+          ]
+        )
+      }
+    }
+  }
+}

scripts/deploy.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+# Apply the current checkout on the NAS: fix folder permissions, rebuild, up -d.
+# Usage: scripts/deploy.sh <previous commit>
+#   The caller fast-forwards the checkout first. If the build or start fails, the checkout is
+#   reset to <previous commit>; a failed build leaves the running container untouched.
+# NAS-only settings (PUID, REC_DIR, OIDC) live in .env next to the compose file.
+set -eu
+
+cd "$(dirname "$0")/.."
+
+D="sudo -n /usr/local/bin/docker"
+prev="${1:?usage: deploy.sh <previous commit>}"
+
+rollback() {
+  trap - EXIT
+  echo "deploy: FAILED, resetting checkout to $(git log -1 --format='%h' "$prev")" >&2
+  git reset -q --hard "$prev"
+  exit 1
+}
+trap rollback EXIT
+
+echo "deploy: $(git log -1 --format='%h %s') (was $(git log -1 --format='%h' "$prev"))"
+
+REC_DIR=$(grep -E '^REC_DIR=' .env | cut -d= -f2-)
+mkdir -p "$REC_DIR" data/cookies
+# A shared-folder ACL inherited by these folders makes them unwritable inside the container.
+for p in data "$REC_DIR"; do /usr/syno/bin/synoacltool -del "$p" >/dev/null 2>&1 || true; done
+chmod 755 data "$REC_DIR"
+chmod 700 data/cookies
+
+$D compose config -q
+$D compose up -d --build 2>&1 | tail -3
+
+trap - EXIT
+echo "deploy: ok"