Deploy script

Try it by hand with two empty directories:

root@lab:~/scripts# mkdir -p /tmp/swap/a /tmp/swap/b && cd /tmp/swap
root@lab:/tmp/swap# ln -s /tmp/swap/a current
root@lab:/tmp/swap# ln -sfn /tmp/swap/b current.new
root@lab:/tmp/swap# mv -T current.new current
root@lab:/tmp/swap# readlink current
/tmp/swap/b
root@lab:/tmp/swap# ls
a  b  current
root@lab:/tmp/swap# cd ~/scripts

Without -T, mv current.new current would follow current to the directory a and move the new link inside it as a/current.new, leaving the live link unchanged.

In the script this becomes a small function:

switch_to() {
  local release=$1
  ln -sfn "$release" "$base/current.new"
  mv -T "$base/current.new" "$base/current"
  log "current -> $release"
}

check_site() {
  local index="$base/current/index.html" body
  if [[ ! -f $index ]]; then
    log "check failed: no index.html"
    return 1
  fi
  if ! grep -qF -- "$marker" "$index"; then
    log "check failed: index.html does not contain '$marker'"
    return 1
  fi
  if [[ -n $check_url ]]; then
    if ! body=$(curl -fsS --max-time 5 "$check_url"); then
      log "check failed: could not fetch $check_url"
      return 1
    fi
    if [[ $body != *"$marker"* ]]; then
      log "check failed: $check_url does not contain '$marker'"
      return 1
    fi
  fi
  log "check passed"
}

curl -f makes an HTTP error such as 404 a failure, rather than printing the error page and exiting 0. --max-time stops a hung server from hanging the deploy.

The check runs after the switch, so a broken release is live for a moment before the rollback. Checking the release directory before switching as well catches most problems with no visible effect; the check after the switch catches the rest, such as a server that cannot read the new files.

This is the whole script, deploy.sh:

#!/bin/bash
# Releases a static site into a timestamped directory, switches to it
# with a symlink, checks it, and rolls back if the check fails.
# Exits 0 on success, 1 on a failed deploy or rollback, 2 on a usage error.
set -euo pipefail

readonly SCRIPT_NAME=${0##*/}

base=/srv/site
keep=5
marker='deploy-check'
check_url=""

usage() {
  cat <<USAGE
Usage: $SCRIPT_NAME [options] SOURCE_DIR
       $SCRIPT_NAME [options] --rollback
  -r, --rollback  switch back to the release before the current one
  -b DIR          base directory (default $base)
  -k N            number of releases to keep (default $keep)
  -m TEXT         text index.html must contain (default '$marker')
  -u URL          also fetch URL with curl and look for the text there
  -h, --help      show this help
USAGE
}

log() {
  printf '%s %s\n' "$(date '+%F %T')" "$*"
}

die() {
  printf '%s ERROR: %s\n' "$(date '+%F %T')" "$*" >&2
  exit 1
}

# Points current at a release in one step: build the new link beside
# the old one, then rename it over the old one.
switch_to() {
  local release=$1
  ln -sfn "$release" "$base/current.new"
  mv -T "$base/current.new" "$base/current"
  log "current -> $release"
}

current_release() {
  readlink "$base/current" || true
}

# Fills the array named by $1 with release directories, oldest first.
list_releases() {
  local -n out=$1
  out=()
  local dir
  for dir in "$base"/releases/*/; do
    [[ -d $dir ]] && out+=("${dir%/}")
  done
}

check_site() {
  local index="$base/current/index.html" body
  if [[ ! -f $index ]]; then
    log "check failed: no index.html"
    return 1
  fi
  if ! grep -qF -- "$marker" "$index"; then
    log "check failed: index.html does not contain '$marker'"
    return 1
  fi
  if [[ -n $check_url ]]; then
    if ! body=$(curl -fsS --max-time 5 "$check_url"); then
      log "check failed: could not fetch $check_url"
      return 1
    fi
    if [[ $body != *"$marker"* ]]; then
      log "check failed: $check_url does not contain '$marker'"
      return 1
    fi
  fi
  log "check passed"
}

prune() {
  local releases=() current i
  list_releases releases
  current=$(current_release)
  for (( i = 0; i < ${#releases[@]} - keep; i++ )); do
    [[ ${releases[i]} == "$current" ]] && continue
    rm -rf -- "${releases[i]}"
    log "removed old release ${releases[i]##*/}"
  done
}

deploy() {
  local source=$1 release previous
  [[ -f $source/index.html ]] || die "$source has no index.html"

  release="$base/releases/$(date '+%Y%m%d-%H%M%S')"
  [[ -e $release ]] && die "$release already exists; wait a second and try again"
  previous=$(current_release)

  # Copy into a temporary name first, so a half-copied release never
  # looks like a real one. The trap removes it if the copy fails.
  trap 'rm -rf -- "$release.tmp"' EXIT
  mkdir -p "$release.tmp"
  cp -R -- "$source/." "$release.tmp/"
  mv -- "$release.tmp" "$release"
  trap - EXIT
  log "copied $source to $release"

  switch_to "$release"
  if check_site; then
    prune
    log "deploy of ${release##*/} finished"
    return 0
  fi

  if [[ -n $previous ]]; then
    log "rolling back to ${previous##*/}"
    switch_to "$previous"
  else
    rm -f -- "$base/current"
    log "no earlier release to roll back to; removed current"
  fi
  rm -rf -- "$release"
  log "removed failed release ${release##*/}"
  return 1
}

rollback() {
  local releases=() current i
  list_releases releases
  current=$(current_release)
  [[ -n $current ]] || die "nothing is deployed yet"
  for (( i = ${#releases[@]} - 1; i > 0; i-- )); do
    if [[ ${releases[i]} == "$current" ]]; then
      switch_to "${releases[i - 1]}"
      check_site || log "warning: the release you rolled back to fails its check"
      return 0
    fi
  done
  die "no release older than ${current##*/}"
}

main() {
  # getopts only knows short options, so turn the long ones into short ones first.
  local arg args=()
  for arg in "$@"; do
    case $arg in
      --rollback) args+=(-r) ;;
      --help)     args+=(-h) ;;
      --?*)       usage >&2; echo "Unknown option $arg" >&2; exit 2 ;;
      *)          args+=("$arg") ;;
    esac
  done
  set -- "${args[@]}"

  local opt mode=deploy
  while getopts ':rb:k:m:u:h' opt; do
    case $opt in
      r) mode=rollback ;;
      b) base=$OPTARG ;;
      k) keep=$OPTARG ;;
      m) marker=$OPTARG ;;
      u) check_url=$OPTARG ;;
      h) usage; exit 0 ;;
      :) usage >&2; echo "Option -$OPTARG needs a value" >&2; exit 2 ;;
      *) usage >&2; echo "Unknown option -$OPTARG" >&2; exit 2 ;;
    esac
  done
  shift $((OPTIND - 1))
  [[ $keep =~ ^[1-9][0-9]*$ ]] || { echo "-k needs a number above 0" >&2; exit 2; }

  if [[ $mode == deploy && $# -ne 1 ]] || [[ $mode == rollback && $# -ne 0 ]]; then
    usage >&2
    exit 2
  fi

  mkdir -p "$base/releases"

  # Hold a lock on file descriptor 9 for as long as the script runs.
  exec 9> "$base/.deploy.lock"
  flock -n 9 || die "another deploy is running"

  if [[ $mode == rollback ]]; then
    rollback
  else
    deploy "$1"
  fi
}

main "$@"

-b exists so you can test against a directory in /tmp without touching /srv. [[ -d $dir ]] in list_releases guards against the glob matching nothing: then the loop gets the pattern itself as a single word, and the test throws it away.

root@lab:~/scripts# chmod +x deploy.sh
root@lab:~/scripts# shellcheck deploy.sh
root@lab:~/scripts#

The first deploy:

root@lab:~/scripts# ./deploy.sh site
2026-10-25 09:18:08 copied site to /srv/site/releases/20261025-091808
2026-10-25 09:18:08 current -> /srv/site/releases/20261025-091808
2026-10-25 09:18:08 check passed
2026-10-25 09:18:08 deploy of 20261025-091808 finished
root@lab:~/scripts# ls -l /srv/site
total 4
lrwxrwxrwx 1 root root   34 Oct 25 09:18 current -> /srv/site/releases/20261025-091808
drwxr-xr-x 3 root root 4096 Oct 25 09:18 releases

Start the web server, change the heading to Version 2 in site/index.html, and deploy with the HTTP check:

root@lab:~/scripts# python3 -m http.server 8080 --directory /srv/site/current > /tmp/http.log 2>&1 &
root@lab:~/scripts# sed -i "s/Version 1/Version 2/" site/index.html
root@lab:~/scripts# ./deploy.sh -u http://localhost:8080/ site
2026-10-25 09:18:10 copied site to /srv/site/releases/20261025-091810
2026-10-25 09:18:10 current -> /srv/site/releases/20261025-091810
2026-10-25 09:18:10 check passed
2026-10-25 09:18:10 deploy of 20261025-091810 finished
root@lab:~/scripts# curl -s http://localhost:8080/ | grep h1
  <h1>Version 2</h1>

Now break it. Change the heading to Version 3 and delete the marker line, as if someone had replaced the page with a half-finished copy:

root@lab:~/scripts# sed -i "s/Version 2/Version 3/; /deploy-check/d" site/index.html
root@lab:~/scripts# ./deploy.sh -u http://localhost:8080/ site; echo "exit $?"
2026-10-25 09:18:11 copied site to /srv/site/releases/20261025-091811
2026-10-25 09:18:11 current -> /srv/site/releases/20261025-091811
2026-10-25 09:18:11 check failed: index.html does not contain 'deploy-check'
2026-10-25 09:18:11 rolling back to 20261025-091810
2026-10-25 09:18:11 current -> /srv/site/releases/20261025-091810
2026-10-25 09:18:11 removed failed release 20261025-091811
exit 1
root@lab:~/scripts# curl -s http://localhost:8080/ | grep h1
  <h1>Version 2</h1>
root@lab:~/scripts# ls /srv/site/releases
20261025-091808
20261025-091810

Version 2 is still live, and the failed release is gone. A manual rollback goes back one more step, to version 1. A second one has nowhere to go:

root@lab:~/scripts# ./deploy.sh --rollback
2026-10-25 09:18:11 current -> /srv/site/releases/20261025-091808
2026-10-25 09:18:11 check passed
root@lab:~/scripts# curl -s http://localhost:8080/ | grep h1
  <h1>Version 1</h1>
root@lab:~/scripts# ./deploy.sh --rollback; echo "exit $?"
2026-10-25 09:18:11 ERROR: no release older than 20261025-091808
exit 1