feat(gitops): implement NATS JetStream and TrueNAS staging provisioning (Phase 5)

scripts/staging-sync.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+
+# This script is triggered by the NATS JetStream consumer on the Control Center.
+# It reads a Forgejo webhook JSON payload from STDIN and orchestrates the
+# Staging VM OpenTofu lifecycle.
+
+set -euo pipefail
+
+# Read JSON payload from STDIN
+PAYLOAD=$(cat)
+
+# Extract fields using jq
+ACTION=$(echo "$PAYLOAD" | jq -r '.action // empty')
+PR_NUMBER=$(echo "$PAYLOAD" | jq -r '.pull_request.number // empty')
+
+if [ -z "$ACTION" ] || [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" == "null" ]; then
+    printf "Invalid or missing action/pr_number in payload. Exiting.\n"
+    exit 0
+fi
+
+# We only care about PR events
+if [[ "$ACTION" != "opened" && "$ACTION" != "reopened" && "$ACTION" != "synchronized" && "$ACTION" != "closed" ]]; then
+    printf "Ignoring PR action: %%s\n" "$ACTION"
+    exit 0
+fi
+
+# Ensure workspace directory exists for this PR
+WORKSPACE="/var/lib/hypervisor-gitops/staging-pr-${PR_NUMBER}"
+OPENTOFU_SRC="/var/lib/hypervisor-gitops/nix-config/opentofu/staging-env"
+
+# TrueNAS API variables
+TRUENAS_URL=${TRUENAS_URL:-"https://192.168.0.11"}
+TRUENAS_API_KEY=${TRUENAS_API_KEY:-""}
+ZFS_DATASET=${ZFS_DATASET:-"tank/production"}
+
+get_latest_snapshot() {
+    # Fetch the latest snapshot for the dataset from TrueNAS API
+    # Assumes TRUENAS_API_KEY is exported in the environment by SOPS
+    curl -sS -k -X GET \
+        -H "Authorization: Bearer ${TRUENAS_API_KEY}" \
+        -H "Accept: application/json" \
+        "${TRUENAS_URL}/api/v2.0/zfs/snapshot?id~=${ZFS_DATASET}%%25&limit=1&sort=-creation" | jq -r '.[0].id'
+}
+
+printf "Processing PR #%%s (Action: %%s)\n" "$PR_NUMBER" "$ACTION"
+
+if [[ "$ACTION" == "closed" ]]; then
+    if [ ! -d "$WORKSPACE" ]; then
+        printf "Workspace %%s does not exist. Nothing to destroy.\n" "$WORKSPACE"
+        exit 0
+    fi
+    printf "Destroying Staging Environment for PR #%%s...\n" "$PR_NUMBER"
+    cd "$WORKSPACE"
+    tofu destroy -var="pr_number=${PR_NUMBER}" -auto-approve
+    
+    # Cleanup
+    cd /
+    rm -rf "$WORKSPACE"
+    printf "Staging Environment Destroyed.\n"
+    exit 0
+fi
+
+# Provisioning (opened, reopened, synchronized)
+printf "Setting up Staging Environment for PR #%%s...\n" "$PR_NUMBER"
+
+if [ ! -d "$WORKSPACE" ]; then
+    mkdir -p "$WORKSPACE"
+    cp -r "$OPENTOFU_SRC"/* "$WORKSPACE"/
+fi
+
+cd "$WORKSPACE"
+
+# Fetch latest TrueNAS snapshot dynamically
+LATEST_SNAPSHOT=$(get_latest_snapshot)
+
+if [ -z "$LATEST_SNAPSHOT" ] || [ "$LATEST_SNAPSHOT" == "null" ]; then
+    printf "Failed to retrieve the latest TrueNAS snapshot. Aborting.\n"
+    exit 1
+fi
+
+printf "Latest Snapshot ID: %%s\n" "$LATEST_SNAPSHOT"
+
+# Apply OpenTofu
+tofu init -upgrade
+tofu apply -var="pr_number=${PR_NUMBER}" -var="truenas_snapshot_id=${LATEST_SNAPSHOT}" -auto-approve
+
+printf "Staging Environment Provisioned successfully.\n"