踏み台サーバー経由の2ホップデプロイをNode.js（ssh2）で完全自動化してみた

function resolveAuth() {
  const agentSocket = process.env.SSH_AUTH_SOCK;
  if (agentSocket) {
    return { agent: agentSocket };
  }
  for (const name of ['id_ed25519', 'id_rsa', 'id_ecdsa']) {
    const keyPath = path.join(os.homedir(), '.ssh', name);
    if (fs.existsSync(keyPath)) {
      return { privateKey: fs.readFileSync(keyPath) };
    }
  }
  throw new Error('No SSH auth available');
}

await execFileAsync('tar', [
  '-czf', ARCHIVE_PATH,
  `--exclude=${PROJECT_NAME}/.git`,
  `--exclude=${PROJECT_NAME}/node_modules`,
  `--exclude=${PROJECT_NAME}/.next`,
  `--exclude=${PROJECT_NAME}/backend/.venv`,
  `--exclude=${PROJECT_NAME}/backend/data`,
  `--exclude=${PROJECT_NAME}/.env`,
  `--exclude=${PROJECT_NAME}/.ignore`,
  PROJECT_NAME,
], {
  cwd: PARENT_DIR,
  env: { ...process.env, COPYFILE_DISABLE: '1' },  // macOSの._ファイル抑止
});

function sftpPut(sftp, localPath, remotePath) {
  return new Promise((resolve, reject) => {
    const total = fs.statSync(localPath).size;
    let lastPct = 0;
    sftp.fastPut(localPath, remotePath, {
      step: (transferred) => {
        const pct = Math.floor((transferred / total) * 100);
        if (pct >= lastPct + 10) {
          process.stdout.write(
            `\r  ${pct}% (${(transferred / 1e6).toFixed(1)} / ${(total / 1e6).toFixed(1)} MB)`
          );
          lastPct = pct;
        }
      },
    }, (err) => {
      process.stdout.write('\r  100%\n');
      if (err) reject(err); else resolve();
    });
  });
}

await bastionExec(
  bastion,
  `scp -o StrictHostKeyChecking=no ${bastionDest} ${DEPLOY_USER}@${DEPLOY_HOST}:`
);

function bastionExec(conn, cmd, deployScript) {
  return new Promise((resolve, reject) => {
    conn.exec(cmd, (err, stream) => {
      if (err) return reject(err);
      if (deployScript) {
        stream.write(deployScript);
        stream.end();
      }
      stream.on('data', (d) => process.stdout.write(d));
      stream.stderr.on('data', (d) => process.stderr.write(d));
      stream.on('close', (code) => {
        if (code === 0) resolve();
        else reject(new Error(`Bastion exec exited with code ${code}: ${cmd}`));
      });
    });
  });
}

const deployScript = fs.readFileSync(DEPLOY_SH);
const bashCmd = DEPLOY_ARGS ? `bash -s -- ${DEPLOY_ARGS}` : 'bash -s';

await bastionExec(
  bastion,
  `ssh -o StrictHostKeyChecking=no ${DEPLOY_USER}@${DEPLOY_HOST} ${bashCmd}`,
  deployScript,
);

const LOG_DIR = path.resolve(SCRIPT_DIR, '..', '.ignore', 'deploy-logs');
fs.mkdirSync(LOG_DIR, { recursive: true });
const logFile = path.join(LOG_DIR, `${new Date().toISOString().replace(/[:.]/g, '-')}.log`);
const logStream = fs.createWriteStream(logFile, { flags: 'a' });

const origStdoutWrite = process.stdout.write.bind(process.stdout);
process.stdout.write = (chunk, ...args) => {
  logStream.write(chunk);
  return origStdoutWrite(chunk, ...args);
};

# アップデート時: コンテナ停止 → .env退避
if [[ -f "${DEPLOY_DIR}/docker-compose.yml" ]]; then
  cd "$DEPLOY_DIR" && docker compose down
  cd "$HOME"
  if [[ -f "${DEPLOY_DIR}/.env" ]]; then
    cp "${DEPLOY_DIR}/.env" "$HOME/.env.my-app.bak"
  fi
fi

# 旧ファイル削除 → アーカイブ展開
find "${DEPLOY_DIR}" -mindepth 1 -delete
tar -xzf "$ARCHIVE" --warning=no-unknown-keyword
cp -a "${SOURCE_DIR}/." "$DEPLOY_DIR/"

# .env復元
if [[ -f "$HOME/.env.my-app.bak" ]]; then
  cp "$HOME/.env.my-app.bak" "${DEPLOY_DIR}/.env"
fi

if [[ "$INIT" == true ]]; then
  echo "----------------------------------------------"
  echo " .env が未設定です。次の手順で作成してください:"
  echo ""
  echo "   cp ${DEPLOY_DIR}/.env.example ${DEPLOY_DIR}/.env"
  echo "   vi ${DEPLOY_DIR}/.env"
  echo ""
  echo " 設定後、再度このスクリプトを実行してください:"
  echo "   pnpm deploy --init"
  echo "----------------------------------------------"
  exit 1
fi

docker compose up -d --build
sleep 3
curl -sf http://localhost:40002/v1/healthz && echo "backend OK" \
  || echo "WARNING: backend health check failed"

# docker-compose.yml（ベース）
services:
  backend:
    build:
      context: .
      dockerfile: Dockerfile.backend
    env_file: .env
    restart: unless-stopped

  frontend:
    build:
      context: .
      dockerfile: Dockerfile.frontend
    env_file: .env
    depends_on:
      - backend
    restart: unless-stopped

# docker-compose.override.yml（環境固有のポートマッピング）
services:
  frontend:
    ports:
      - "40001:3000"
  backend:
    ports:
      - "40002:8765"

restart: unless-stopped

const FOLLOW = process.argv.includes('--follow');
const TAIL = process.argv.find((a) => a.startsWith('--tail='))?.split('=')[1] ?? '200';

// サービス名のバリデーション（コマンドインジェクション防止）
const rawService = process.argv.find(
  (a) => !a.startsWith('-') && a !== process.argv[0] && a !== process.argv[1]
) ?? '';
if (rawService && !/^[a-zA-Z0-9_-]+$/.test(rawService)) {
  throw new Error(`Invalid service name: ${rawService}`);
}

const remoteCmd = `ssh -o StrictHostKeyChecking=no ${DEPLOY_USER}@${DEPLOY_HOST} \
  'cd ${DEPLOY_DIR} && docker compose logs --tail=${TAIL}${followFlag} ${service}'`;

pnpm logs                      # 直近200行を表示
pnpm logs -- --follow          # リアルタイムストリーミング
pnpm logs -- --follow backend  # backendコンテナのみ

$ pnpm deploy

=== pack ===
Packing project -> ../my-app.tar.gz
created: ../my-app.tar.gz (12.3 MB)

=== ship: step 1 - local -> bastion ===
Bastion connected.
Uploading to bastion: /home/user/my-app.tar.gz
  100%

=== ship: step 2 - bastion -> target ===
(~12 MB, may take a minute...)
done: my-app.tar.gz -> user@10.xxx.x.xx:~/

=== remote deploy (bastion -> target) ===
=== extract ===
stopping containers...
.env backed up
extracted → /var/www/my-app
.env restored
=== .env ===
.env OK
=== deploy ===
Building backend...
Building frontend...
...
=== done ===
backend OK

log saved: .ignore/deploy-logs/2026-06-19T10-30-00-000Z.log