Sam Rolfe
9a89f61d13
n8n 2.x disables n8n-nodes-base.executeCommand by default (nodes.exclude), so the first workflow shape could not activate: 'Unrecognized node type'. Replace the Execute Command node with the SSH node, which is enabled, and keep the restricted trigger key: the server forced command runs exactly scripts/morning-brief.sh. - deploy/n8n-morning-brief.json: schedule + optional manual trigger -> SSH node -> Code check that makes a non-zero exit red (FR-12). - deploy/import-n8n-morning-brief.sh: builds the sshPrivateKey credential from the key (id schoolScanKey, mode-0600 temp, removed after import), imports, publishes, restarts once, and confirms activation in the n8n log. - scripts/morning-brief.sh: default IMAGE 0.6.1-phase8 so the scheduled job uses the deployed image. - docs/phase-7a-n8n-schedule.md, deploy/DEPLOYMENT.md: document the design and the throwaway-n8n rehearsal (activation + success + failure path).
112 lines
4.3 KiB
Bash
Executable File
112 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Phase 7: the morning run (AGENTS.md §4 FR-9, FR-14, §11 Phase 7).
|
|
#
|
|
# This is the bounded command the 6:00am n8n schedule runs:
|
|
# 1. scan Compass for both children (read-only; skipped with --no-scan),
|
|
# 2. build one brief per boy and one combined brief to Jo and Sam,
|
|
# 3. deliver them through the house Apprise API on `.35:8210`,
|
|
# 4. record every delivery in `notifications` and every exit code loudly.
|
|
#
|
|
# A failed scan is never reported as "nothing due" (FR-12): the brief opens with
|
|
# the failure, and this script exits non-zero so the n8n execution is visibly
|
|
# failed.
|
|
#
|
|
# Secrets: no address, phone number or password is passed on the command line.
|
|
# The Apprise configuration key comes from environment.d/school-service.env and
|
|
# is only exported into the container environment.
|
|
#
|
|
# Usage:
|
|
# scripts/morning-brief.sh # scan, then send
|
|
# scripts/morning-brief.sh --no-scan # send from the latest scan
|
|
# scripts/morning-brief.sh --dry-run # build and print, send nothing
|
|
# scripts/morning-brief.sh --channel email # limit the channels
|
|
#
|
|
# Environment overrides:
|
|
# IMAGE image tag (default 0.6.1-phase8)
|
|
# VOLUME SQLite volume (default compass-teams-nhs_compass-teams-nhs-data)
|
|
# ENV_FILE service env file (default environment.d/school-service.env)
|
|
# SCHOOL_TIMEZONE family timezone (default Australia/Sydney)
|
|
# DOCKER_TIMEOUT per docker command timeout (default 600)
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
IMAGE="${IMAGE:-compass-teams-nhs/school:0.6.1-phase8}"
|
|
VOLUME="${VOLUME:-compass-teams-nhs_compass-teams-nhs-data}"
|
|
ENV_FILE="${ENV_FILE:-$REPO_ROOT/environment.d/school-service.env}"
|
|
SCHOOL_TIMEZONE="${SCHOOL_TIMEZONE:-Australia/Sydney}"
|
|
DOCKER_TIMEOUT="${DOCKER_TIMEOUT:-600}"
|
|
|
|
NO_SCAN=0
|
|
NOTIFY_ARGS=()
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--no-scan) NO_SCAN=1; shift ;;
|
|
--dry-run) NOTIFY_ARGS+=(--dry-run); shift ;;
|
|
--channel) NOTIFY_ARGS+=(--channel "$2"); shift 2 ;;
|
|
--only) NOTIFY_ARGS+=(--only "$2"); shift 2 ;;
|
|
*) echo "unknown argument: $1" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
# Take only the notification variables from the service env file, so the
|
|
# service's bcrypt hash (which contains "$$") is never re-expanded here.
|
|
if [[ -f "$ENV_FILE" ]]; then
|
|
while IFS= read -r line; do
|
|
case "$line" in
|
|
SCHOOL_APPRISE_URL=*|SCHOOL_APPRISE_KEY=*|SCHOOL_APPRISE_TOKEN=*|SCHOOL_APPRISE_TIMEOUT=*|\
|
|
SCHOOL_APPRISE_CHANNELS=*|SCHOOL_APPRISE_TAGS=*|SCHOOL_APPRISE_PARENTS=*|SCHOOL_NOTIFY_TOKEN=*)
|
|
key="${line%%=*}"
|
|
val="${line#*=}"
|
|
if [[ -z "${!key:-}" ]]; then
|
|
export "$key=$val"
|
|
fi
|
|
;;
|
|
esac
|
|
done < "$ENV_FILE"
|
|
fi
|
|
|
|
if [[ -z "${SCHOOL_APPRISE_KEY:-}" ]]; then
|
|
echo "SCHOOL_APPRISE_KEY is not set in $ENV_FILE: the briefs cannot be sent" >&2
|
|
exit 2
|
|
fi
|
|
|
|
run_school() {
|
|
timeout "$DOCKER_TIMEOUT" docker run --rm --network host \
|
|
-v "$VOLUME:/data" \
|
|
-e SCHOOL_DB_PATH=/data/school.db \
|
|
-e SCHOOL_TIMEZONE="$SCHOOL_TIMEZONE" \
|
|
-e SCHOOL_APPRISE_URL="${SCHOOL_APPRISE_URL:-}" \
|
|
-e SCHOOL_APPRISE_KEY="${SCHOOL_APPRISE_KEY:-}" \
|
|
-e SCHOOL_APPRISE_TOKEN="${SCHOOL_APPRISE_TOKEN:-}" \
|
|
-e SCHOOL_APPRISE_TIMEOUT="${SCHOOL_APPRISE_TIMEOUT:-}" \
|
|
-e SCHOOL_APPRISE_CHANNELS="${SCHOOL_APPRISE_CHANNELS:-}" \
|
|
-e SCHOOL_APPRISE_TAGS="${SCHOOL_APPRISE_TAGS:-}" \
|
|
-e SCHOOL_APPRISE_PARENTS="${SCHOOL_APPRISE_PARENTS:-}" \
|
|
"$IMAGE" "$@"
|
|
}
|
|
|
|
# 1. Scan both children. A failed scan is already loud in the scan log; keep
|
|
# going so the brief can carry the failure notice instead of silence.
|
|
scan_rc=0
|
|
if [[ "$NO_SCAN" -eq 0 ]]; then
|
|
echo "== scan both children =="
|
|
if ! IMAGE="$IMAGE" VOLUME="$VOLUME" timeout "$DOCKER_TIMEOUT" "$REPO_ROOT/scripts/scan-compass.sh"; then
|
|
scan_rc=$?
|
|
echo "scan reported a failure (exit $scan_rc); the briefs will say so" >&2
|
|
fi
|
|
fi
|
|
|
|
# 2. Build and send the briefs.
|
|
echo "== send the morning briefs =="
|
|
notify_rc=0
|
|
if ! run_school notify run "${NOTIFY_ARGS[@]+"${NOTIFY_ARGS[@]}"}"; then
|
|
notify_rc=$?
|
|
fi
|
|
|
|
if [[ "$scan_rc" -ne 0 || "$notify_rc" -ne 0 ]]; then
|
|
echo "morning brief FAILED: scan_rc=$scan_rc notify_rc=$notify_rc" >&2
|
|
exit 1
|
|
fi
|
|
echo "morning brief complete: both boys + the combined brief to Jo and Sam"
|