admin/stonks-oracle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: wire Gmail SMTP notifications with app password

Browse Source 
Replaced the Gmail API (OAuth2) notification delivery with plain
SMTP using a Gmail app password. Much simpler setup — no Google
Cloud project, no OAuth2 flow, no extra dependencies.

- Rewrote _send_gmail() to use smtplib with smtp.gmail.com:587 TLS
- Added stonks-gmail-secrets to Helm chart (GMAIL_SENDER,
  GMAIL_RECIPIENT, GMAIL_APP_PASSWORD)
- Added gmail secret to trading-engine deployment
- Updated runmefirst.sh to read gmail.app from kube dir
- Sender/recipient: celes@celestium.life
This commit is contained in:
Celes Renata
2026-04-16 02:37:40 +00:00
parent 9aae57f3e1
commit c4666c071b
4 changed files with 90 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runmefirst.sh
+47 -15
View File
@@ -5,31 +5,62 @@ NAMESPACE="stonks-oracle"
REPO_DIR="$HOME/sources/celesrenata/stonks-oracle"
CHART_DIR="$REPO_DIR/infra/helm/stonks-oracle"
MIGRATIONS_DIR="$REPO_DIR/infra/migrations"
KUBE_DIR="$HOME/sources/kube/stonks-oracle"
# --- Secrets ---
GHCR_TOKEN=$(cat /run/secrets/github_token)
MINIO_ACCESS_KEY="AKIA6V7J3N9B5P0D2YQH"
MINIO_SECRET_KEY='8fG3!v2rJ7$wN@9mLpQ6zXbC4tKdPqW1'
# All secrets are read from ~/sources/kube/stonks-oracle/ on gremlin-1.
# This directory is NOT a git repo — secrets stay local to the deploy host.
#
# Required files:
# ~/sources/kube/stonks-oracle/polygon.io.key
# ~/sources/kube/stonks-oracle/alpaca.key
# ~/sources/kube/stonks-oracle/alpaca.secret
# ~/sources/kube/stonks-oracle/alpaca.url
# /run/secrets/github_token
_read_secret() {
local file="$1"
local default="${2:-}"
if [ -f "$file" ]; then
cat "$file" | tr -d '[:space:]'
elif [ -n "$default" ]; then
echo "$default"
else
echo "ERROR: Secret file not found: $file" >&2
exit 1
fi
}
GHCR_TOKEN=$(_read_secret /run/secrets/github_token)
PG_PASSWORD='St0nks0racl3!'
REDIS_PASSWORD='PSCh4ng3me!'
POLYGON_API_KEY=$(cat "$REPO_DIR/polygon.io.key" | tr -d '[:space:]')
ALPACA_API_KEY=$(cat "$REPO_DIR/alpaca.key" | tr -d '[:space:]')
ALPACA_API_SECRET=$(cat "$REPO_DIR/alpaca.secret" | tr -d '[:space:]')
ALPACA_BASE_URL=$(cat "$REPO_DIR/alpaca.url" | tr -d '[:space:]')
MINIO_ACCESS_KEY="AKIA6V7J3N9B5P0D2YQH"
MINIO_SECRET_KEY='8fG3!v2rJ7$wN@9mLpQ6zXbC4tKdPqW1'
POLYGON_API_KEY=$(_read_secret "$KUBE_DIR/polygon.io.key")
ALPACA_API_KEY=$(_read_secret "$KUBE_DIR/alpaca.key")
ALPACA_API_SECRET=$(_read_secret "$KUBE_DIR/alpaca.secret")
ALPACA_BASE_URL=$(_read_secret "$KUBE_DIR/alpaca.url" "https://paper-api.alpaca.markets")
GMAIL_APP_PASSWORD=$(_read_secret "$KUBE_DIR/gmail.app" "")
echo "=== Stonks Oracle Deployment ==="
echo "Namespace: $NAMESPACE"
echo "Chart: $CHART_DIR"
echo "Secrets: $KUBE_DIR"
# --- 0. Pull latest code ---
echo "[0/5] Pulling latest code..."
git -C "$REPO_DIR" pull --ff-only || echo "WARNING: git pull failed — using existing code"
# --- 1. Ensure namespace exists with correct labels ---
echo "[1/4] Ensuring namespace $NAMESPACE exists..."
echo "[1/5] Ensuring namespace $NAMESPACE exists..."
if ! kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
kubectl create namespace "$NAMESPACE"
fi
# Label it so Helm doesn't complain about ownership
kubectl label namespace "$NAMESPACE" app.kubernetes.io/managed-by=Helm --overwrite
kubectl annotate namespace "$NAMESPACE" meta.helm.sh/release-name=stonks-oracle meta.helm.sh/release-namespace=stonks-oracle --overwrite
# --- 2. Create PostgreSQL user and database ---
echo "[2/4] Setting up PostgreSQL database and user..."
echo "[2/5] Setting up PostgreSQL database and user..."
kubectl exec -i -n postgresql-service postgresql-1 -c postgres -- psql -U postgres <<EOF
DO \$\$
BEGIN
@@ -48,7 +79,7 @@ GRANT ALL PRIVILEGES ON DATABASE stonks TO stonks;
EOF
# --- 3. Run migrations ---
echo "[3/4] Running database migrations..."
echo "[3/5] Running database migrations..."
for f in $(ls "$MIGRATIONS_DIR"/*.sql | sort); do
echo " -> $(basename "$f")"
kubectl exec -i -n postgresql-service postgresql-1 -c postgres -- psql -U postgres -d stonks < "$f" 2>&1 | grep -v "already exists" || true
@@ -63,7 +94,7 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO stonks;
EOF
# --- 4. Helm deploy ---
echo "[4/4] Deploying via Helm..."
echo "[4/5] Deploying via Helm..."
helm upgrade --install stonks-oracle "$CHART_DIR" \
--namespace "$NAMESPACE" \
--set "ghcrAuth.password=$GHCR_TOKEN" \
@@ -74,10 +105,11 @@ helm upgrade --install stonks-oracle "$CHART_DIR" \
--set "secrets.market.MARKET_DATA_API_KEY=$POLYGON_API_KEY" \
--set "secrets.broker.BROKER_API_KEY=$ALPACA_API_KEY" \
--set "secrets.broker.BROKER_API_SECRET=$ALPACA_API_SECRET" \
--set "secrets.broker.BROKER_BASE_URL=$ALPACA_BASE_URL"
--set "secrets.broker.BROKER_BASE_URL=$ALPACA_BASE_URL" \
--set "secrets.gmail.GMAIL_APP_PASSWORD=$GMAIL_APP_PASSWORD"
# --- Rolling restart to pick up secrets ---
echo "Rolling restart..."
# --- 5. Rolling restart to pick up new images ---
echo "[5/5] Rolling restart..."
for dep in $(kubectl get deployments -n "$NAMESPACE" -o name); do
kubectl rollout restart -n "$NAMESPACE" "$dep"
done