upsert-via-api.sh

#!/bin/sh
set -eu

SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
COMPOSE_FILE=${COMPOSE_FILE:-}
ENV_FILE=${ENV_FILE:-"$SCRIPT_DIR/.env"}

: "${COOLIFY_BASE_URL:?set COOLIFY_BASE_URL}"
: "${COOLIFY_API_TOKEN:?set COOLIFY_API_TOKEN}"
: "${PROJECT_UUID:?set PROJECT_UUID}"
: "${ENVIRONMENT_UUID:?set ENVIRONMENT_UUID}"
: "${SERVER_UUID:?set SERVER_UUID}"

COOLIFY_BASE_URL=${COOLIFY_BASE_URL%/}
SERVICE_NAME=${SERVICE_NAME:-litellm-glm5-nvidia-pool}
SERVICE_DESCRIPTION=${SERVICE_DESCRIPTION:-GLM-5 LiteLLM NVIDIA pool}

if [ ! -f "$ENV_FILE" ]; then
  echo "missing env file: $ENV_FILE" >&2
  exit 1
fi

set -a
. "$ENV_FILE"
set +a

key_vars=$(
  awk -F= '
    /^[[:space:]]*NVIDIA_API_KEY_POOL_[0-9]+[[:space:]]*=/ {
      key = $1
      gsub(/^[[:space:]]+|[[:space:]]+$/, "", key)
      print key
    }
  ' "$ENV_FILE" | sort -t_ -k5,5n -u
)

if [ -z "$key_vars" ]; then
  echo "missing required env key: NVIDIA_API_KEY_POOL_1..N" >&2
  exit 1
fi

required_keys='
LITELLM_MASTER_KEY
NVIDIA_API_BASE
'

for key in $required_keys; do
  eval "value=\${$key:-}"
  if [ -z "$value" ]; then
    echo "missing required env key: $key" >&2
    exit 1
  fi
done

for key in $key_vars; do
  eval "value=\${$key:-}"
  if [ -z "$value" ]; then
    echo "missing required env key: $key" >&2
    exit 1
  fi
done

HOST_PORT=${HOST_PORT:-4000}
SSL_CERT_FILE=${SSL_CERT_FILE:-/etc/ssl/certs/ca-certificates.crt}
WAIT_TIMEOUT_SECONDS=${WAIT_TIMEOUT_SECONDS:-180}
WAIT_INTERVAL_SECONDS=${WAIT_INTERVAL_SECONDS:-5}
POST_ACTION_DELAY_SECONDS=${POST_ACTION_DELAY_SECONDS:-5}

tmp_dir=$(mktemp -d)
trap 'rm -rf "$tmp_dir"' EXIT

if [ -n "$COMPOSE_FILE" ]; then
  if [ ! -f "$COMPOSE_FILE" ]; then
    echo "missing compose file: $COMPOSE_FILE" >&2
    exit 1
  fi
else
  COMPOSE_FILE="$tmp_dir/docker-compose.rendered.yml"
  ENV_FILE="$ENV_FILE" "$SCRIPT_DIR/render-compose.sh" > "$COMPOSE_FILE"
fi

api() {
  method=$1
  path=$2
  body_file=${3:-}
  response_file="$tmp_dir/api-response.json"

  if [ -n "$body_file" ]; then
    http_code=$(
      /usr/bin/curl -sS -o "$response_file" -w '%{http_code}' \
      -X "$method" \
      -H "Authorization: Bearer $COOLIFY_API_TOKEN" \
      -H "Accept: application/json" \
      -H "Content-Type: application/json" \
      "$COOLIFY_BASE_URL$path" \
      --data-binary @"$body_file"
    )
  else
    http_code=$(
      /usr/bin/curl -sS -o "$response_file" -w '%{http_code}' \
      -X "$method" \
      -H "Authorization: Bearer $COOLIFY_API_TOKEN" \
      -H "Accept: application/json" \
      -H "Content-Type: application/json" \
      "$COOLIFY_BASE_URL$path"
    )
  fi

  case "$http_code" in
    2*)
      cat "$response_file"
      ;;
    *)
      echo "Coolify API request failed: $method $path -> HTTP $http_code" >&2
      cat "$response_file" >&2
      return 1
      ;;
  esac
}

check_host_port_conflict() {
  api GET /api/v1/services > "$tmp_dir/services.json"
  conflicts_file="$tmp_dir/host-port-conflicts.txt"
  jq -r \
    --arg current_uuid "$service_uuid" \
    --arg host_port "$HOST_PORT" '
      .[] as $service
      | $service
      | select($current_uuid == "" or .uuid != $current_uuid)
      | ($service.applications // [])
      | map(
          select(
            (.ports // "") != ""
            and (
              (.ports | gsub("\\s+"; ""))
              | test("(^|,)" + $host_port + ":")
            )
          )
        )
      | .[]?
      | "\($service.uuid)\t\($service.name)\t\(.name)\t\(.ports)"
    ' "$tmp_dir/services.json" > "$conflicts_file"

  if [ -s "$conflicts_file" ]; then
    echo "HOST_PORT=$HOST_PORT is already used by another Coolify service." >&2
    echo "Set a unique HOST_PORT for a duplicate deployment, or target the existing service via SERVICE_UUID." >&2
    cat "$conflicts_file" >&2
    exit 1
  fi
}

wait_for_service_healthy() {
  deadline=$(($(date +%s) + WAIT_TIMEOUT_SECONDS))

  while :; do
    api GET "/api/v1/services/$service_uuid" > "$tmp_dir/service-status.json"

    if jq -e '
      .status == "running:healthy"
      and ((.applications // []) | length > 0)
      and all(.applications[]?; (.status // "") == "running:healthy")
    ' "$tmp_dir/service-status.json" >/dev/null; then
      return 0
    fi

    if jq -e '
      ((.status // "") | test(":unhealthy$"))
      or any(.applications[]?; ((.status // "") | test(":unhealthy$")))
    ' "$tmp_dir/service-status.json" >/dev/null; then
      echo "service failed to reach a healthy state" >&2
      jq '{uuid,name,status,applications:[.applications[]? | {name,status,ports,image}]}' "$tmp_dir/service-status.json" >&2
      exit 1
    fi

    if [ "$(date +%s)" -ge "$deadline" ]; then
      echo "timed out waiting for service to become healthy after ${WAIT_TIMEOUT_SECONDS}s" >&2
      jq '{uuid,name,status,applications:[.applications[]? | {name,status,ports,image}]}' "$tmp_dir/service-status.json" >&2
      exit 1
    fi

    sleep "$WAIT_INTERVAL_SECONDS"
  done
}

if [ ! -s "$COMPOSE_FILE" ]; then
  echo "rendered compose is empty: $COMPOSE_FILE" >&2
  exit 1
fi

compose_b64=$(base64 < "$COMPOSE_FILE" | tr -d '\n')
service_uuid=${SERVICE_UUID:-}
created=0

if [ -z "$service_uuid" ]; then
  api GET /api/v1/services > "$tmp_dir/services.json"
  matches_file="$tmp_dir/service-matches.txt"
  jq -r --arg name "$SERVICE_NAME" '.[] | select(.name == $name) | .uuid' "$tmp_dir/services.json" > "$matches_file"
  match_count=$(awk 'NF { count += 1 } END { print count + 0 }' "$matches_file")
  case "$match_count" in
    0)
      service_uuid=
      ;;
    1)
      service_uuid=$(cat "$matches_file")
      ;;
    *)
      echo "multiple services matched SERVICE_NAME=$SERVICE_NAME; set SERVICE_UUID explicitly" >&2
      cat "$matches_file" >&2
      exit 1
      ;;
  esac
fi

check_host_port_conflict

if [ -n "$service_uuid" ]; then
  jq -n \
    --arg docker_compose_raw "$compose_b64" \
    '{docker_compose_raw:$docker_compose_raw}' > "$tmp_dir/service-payload.json"
  api PATCH "/api/v1/services/$service_uuid" "$tmp_dir/service-payload.json" > "$tmp_dir/service-response.json"
else
  jq -n \
    --arg name "$SERVICE_NAME" \
    --arg description "$SERVICE_DESCRIPTION" \
    --arg project_uuid "$PROJECT_UUID" \
    --arg environment_uuid "$ENVIRONMENT_UUID" \
    --arg server_uuid "$SERVER_UUID" \
    --arg docker_compose_raw "$compose_b64" \
    '{
      name:$name,
      description:$description,
      project_uuid:$project_uuid,
      environment_uuid:$environment_uuid,
      server_uuid:$server_uuid,
      docker_compose_raw:$docker_compose_raw,
      instant_deploy:false
    }' > "$tmp_dir/service-payload.json"
  api POST /api/v1/services "$tmp_dir/service-payload.json" > "$tmp_dir/service-response.json"
  service_uuid=$(jq -r '.uuid' "$tmp_dir/service-response.json")
  created=1
fi

if [ -z "$service_uuid" ] || [ "$service_uuid" = "null" ]; then
  echo "failed to resolve service uuid" >&2
  exit 1
fi

entries_file="$tmp_dir/env-entries.jsonl"
: > "$entries_file"

add_env_entry() {
  key=$1
  value=$2
  jq -cn --arg key "$key" --arg value "$value" '{key:$key, value:$value}' >> "$entries_file"
}

add_env_entry HOST_PORT "$HOST_PORT"
add_env_entry LITELLM_MASTER_KEY "$LITELLM_MASTER_KEY"
add_env_entry NVIDIA_API_BASE "$NVIDIA_API_BASE"
for key in $key_vars; do
  eval "value=\${$key:-}"
  add_env_entry "$key" "$value"
done
add_env_entry SSL_CERT_FILE "$SSL_CERT_FILE"

jq -s '{data:.}' "$entries_file" > "$tmp_dir/env-payload.json"

api PATCH "/api/v1/services/$service_uuid/envs/bulk" "$tmp_dir/env-payload.json" > "$tmp_dir/env-response.json"

if [ "$created" -eq 1 ]; then
  api POST "/api/v1/services/$service_uuid/start" > "$tmp_dir/action-response.json"
  action=start
else
  api POST "/api/v1/services/$service_uuid/restart" > "$tmp_dir/action-response.json"
  action=restart
fi

sleep "$POST_ACTION_DELAY_SECONDS"
wait_for_service_healthy

printf 'service_uuid=%s\n' "$service_uuid"
printf 'action=%s\n' "$action"