thermograph/backend/deploy/entrypoint.sh

#!/usr/bin/env bash
# Container entrypoint: load secrets, bring the accounts schema up to head, then serve.
#
# Alembic runs before uvicorn so a fresh Postgres volume gets its tables. It is
# retried because `db` can still be finishing startup even though compose waits on
# its healthcheck — a cold volume's first connection may race the server becoming
# ready to accept the migration.
set -euo pipefail

cd /app

# --- Swarm secrets shim ------------------------------------------------------
# The app reads config from os.environ everywhere (users.py falls back to a random
# per-process AUTH_SECRET if THERMOGRAPH_AUTH_SECRET is unset; push.py mints a new
# VAPID keypair if the VAPID env vars are unset) — compose delivers config that way
# today via `environment:`/`env_file`. Swarm `secrets:` instead mount each secret as
# a FILE under /run/secrets/<name>, which the app would never see: without this shim,
# moving to Swarm secrets silently re-triggers those exact incidents (every session
# invalidated, every push subscription broken) on the next restart.
#
# Mechanical mapping, so a new THERMOGRAPH_* var never needs an entrypoint edit: a
# secret file's UPPERCASED name IS the env var it becomes — e.g. a secret named
# thermograph_auth_secret -> THERMOGRAPH_AUTH_SECRET — skipping anything that
# doesn't uppercase to a THERMOGRAPH_* name (postgres_password is handled below
# instead). Never overrides an already-set var (environment:/env_file always wins).
# Secret names must be valid shell-identifier characters (letters, digits,
# underscore) to become a var name.
if [ -d /run/secrets ]; then
  for f in /run/secrets/*; do
    [ -f "$f" ] || continue
    var=$(basename "$f" | tr '[:lower:]' '[:upper:]')
    case "$var" in
      THERMOGRAPH_*)
        if [ -z "${!var:-}" ]; then
          export "$var=$(cat "$f")"
        fi
        ;;
    esac
  done

  # THERMOGRAPH_DATABASE_URL is normally built by compose's own interpolation
  # (POSTGRES_PASSWORD baked into docker-compose.yml's `environment:` block) — Swarm
  # secrets have no interpolation, so build the same URL here from the
  # `postgres_password` secret when the URL isn't already set some other way.
  if [ -z "${THERMOGRAPH_DATABASE_URL:-}" ] && [ -f /run/secrets/postgres_password ]; then
    pg_pw=$(cat /run/secrets/postgres_password)
    export THERMOGRAPH_DATABASE_URL="postgresql+asyncpg://thermograph:${pg_pw}@db:5432/thermograph"
  fi
fi

run_migrations() {
  local max=10 tries=0
  echo "==> Running database migrations (alembic upgrade head)"
  until alembic upgrade head; do
    tries=$((tries + 1))
    if [ "$tries" -ge "$max" ]; then
      echo "!! alembic upgrade head failed after ${max} attempts; giving up" >&2
      exit 1
    fi
    echo "   migration attempt ${tries}/${max} failed; retrying in 3s..." >&2
    sleep 3
  done
}

# The lake role serves the ERA5 bucket only — no database, so no migrations: a
# lake replica must come up (and stay up) even when Postgres is down.
if [ "${THERMOGRAPH_ROLE:-}" = "lake" ]; then
  echo "==> Starting lake service on 0.0.0.0:${PORT:-8141} with ${WORKERS:-1} worker(s)"
  exec uvicorn lake_app:app --host 0.0.0.0 --port "${PORT:-8141}" --workers "${WORKERS:-1}"
fi

# One-shot migrate mode (`entrypoint.sh migrate`, or THERMOGRAPH_MIGRATE_ONLY=1): run
# the migration and exit — a one-shot task, so it runs once against the DB rather
# than racing per web replica.
if [ "${1:-}" = "migrate" ] || [ "${THERMOGRAPH_MIGRATE_ONLY:-0}" = "1" ]; then
  run_migrations
  exit 0
fi

# RUN_MIGRATIONS=0 skips the inline migrate below — for a deploy that runs the
# one-shot task above separately and doesn't want every web replica to also race it.
# Default (unset) keeps today's behavior: every boot brings its own schema to head.
if [ "${RUN_MIGRATIONS:-1}" != "0" ]; then
  run_migrations
fi

echo "==> Starting uvicorn on 0.0.0.0:${PORT:-8137} with ${WORKERS:-4} worker(s)"
# --no-access-log: the app's own request-logging middleware (audit.log_access,
# web/app.py) already writes a structured line per request; uvicorn's own access
# log just duplicated every one of them for no benefit.
exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-8137}" --workers "${WORKERS:-4}" --no-access-log