Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 3 Projects Releases Packages Wiki Activity Actions

Add entrypoint one-shot migrate mode and a Swarm secrets shim (#231)

Browse source 
Two changes to deploy/entrypoint.sh, both needed before the app can run
under Docker Swarm without re-triggering known incidents:

One-shot migrate mode: `entrypoint.sh migrate` (or THERMOGRAPH_MIGRATE_ONLY=1)
runs the Alembic migration and exits, for a Swarm one-shot task that brings
the schema to head once rather than racing it across every web replica's
boot. RUN_MIGRATIONS=0 skips the inline migrate for a deploy that runs the
one-shot task separately. Default (unset) keeps today's behavior unchanged:
every boot migrates itself before serving.

Secrets shim: the app reads config from os.environ everywhere (an unset
THERMOGRAPH_AUTH_SECRET falls back to a random per-process value; an unset
VAPID key pair is freshly minted) - Swarm `secrets:` mount each secret as a
FILE under /run/secrets/ instead, which the app would never see. Before
alembic/uvicorn, mechanically export each /run/secrets/<name> whose
uppercased name is a THERMOGRAPH_* var, unless already set in the process
env; THERMOGRAPH_DATABASE_URL is built from a postgres_password secret the
same way compose's own interpolation builds it today.

Verified against fake alembic/uvicorn binaries in a throwaway container:
default boot, migrate-only mode (both trigger forms), RUN_MIGRATIONS=0,
secrets populating unset vars, an existing env var beating its secret file,
and no /run/secrets present at all (today's plain compose path, unaffected).
shellcheck clean.
This commit is contained in:
Emi Griffith 2026-07-20 17:18:05 -07:00 committed by GitHub
parent 86a6e0aaac
commit 4e0a6cfdcb
1 changed files with 67 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

79
deploy/entrypoint.sh
View file

@ -1,5 +1,5 @@
#!/usr/bin/env bash
# Container entrypoint: bring the accounts schema up to head, then serve.
# Container entrypoint: load secrets, bring the accounts schema up to head, then serve.
#
# Alembic runs before uvicorn so a fresh Postgres volume gets its tables. It is
# retried because `db` can still be finishing startup even though compose waits on
@ -9,18 +9,73 @@ set -euo pipefail
cd /app/backend
max=10
tries=0
echo "==> Running database migrations (alembic upgrade head)"
until alembic upgrade head; do
tries=$((tries + 1))
if [ "$tries" -ge "$max" ]; then
echo "!! alembic upgrade head failed after ${max} attempts; giving up" >&2
exit 1
# --- Swarm secrets shim ------------------------------------------------------
# The app reads config from os.environ everywhere (users.py falls back to a random
# per-process AUTH_SECRET if THERMOGRAPH_AUTH_SECRET is unset; push.py mints a new
# VAPID keypair if the VAPID env vars are unset) — compose delivers config that way
# today via `environment:`/`env_file`. Swarm `secrets:` instead mount each secret as
# a FILE under /run/secrets/<name>, which the app would never see: without this shim,
# moving to Swarm secrets silently re-triggers those exact incidents (every session
# invalidated, every push subscription broken) on the next restart.
#
# Mechanical mapping, so a new THERMOGRAPH_* var never needs an entrypoint edit: a
# secret file's UPPERCASED name IS the env var it becomes — e.g. a secret named
# thermograph_auth_secret -> THERMOGRAPH_AUTH_SECRET — skipping anything that
# doesn't uppercase to a THERMOGRAPH_* name (postgres_password is handled below
# instead). Never overrides an already-set var (environment:/env_file always wins).
# Secret names must be valid shell-identifier characters (letters, digits,
# underscore) to become a var name.
if [ -d /run/secrets ]; then
for f in /run/secrets/*; do
[ -f "$f" ] || continue
var=$(basename "$f" | tr '[:lower:]' '[:upper:]')
case "$var" in
THERMOGRAPH_*)
if [ -z "${!var:-}" ]; then
export "$var=$(cat "$f")"
fi
;;
esac
done
# THERMOGRAPH_DATABASE_URL is normally built by compose's own interpolation
# (POSTGRES_PASSWORD baked into docker-compose.yml's `environment:` block) — Swarm
# secrets have no interpolation, so build the same URL here from the
# `postgres_password` secret when the URL isn't already set some other way.
if [ -z "${THERMOGRAPH_DATABASE_URL:-}" ] && [ -f /run/secrets/postgres_password ]; then
pg_pw=$(cat /run/secrets/postgres_password)
export THERMOGRAPH_DATABASE_URL="postgresql+asyncpg://thermograph:${pg_pw}@db:5432/thermograph"
fi
echo " migration attempt ${tries}/${max} failed; retrying in 3s..." >&2
sleep 3
done
fi
run_migrations() {
local max=10 tries=0
echo "==> Running database migrations (alembic upgrade head)"
until alembic upgrade head; do
tries=$((tries + 1))
if [ "$tries" -ge "$max" ]; then
echo "!! alembic upgrade head failed after ${max} attempts; giving up" >&2
exit 1
fi
echo " migration attempt ${tries}/${max} failed; retrying in 3s..." >&2
sleep 3
done
}
# One-shot migrate mode (`entrypoint.sh migrate`, or THERMOGRAPH_MIGRATE_ONLY=1): run
# the migration and exit — the Swarm one-shot task from the hop-1 cutover runbook, so
# it runs once against the DB rather than racing per web replica.
if [ "${1:-}" = "migrate" ] || [ "${THERMOGRAPH_MIGRATE_ONLY:-0}" = "1" ]; then
run_migrations
exit 0
fi
# RUN_MIGRATIONS=0 skips the inline migrate below — for a deploy that runs the
# one-shot task above separately and doesn't want every web replica to also race it.
# Default (unset) keeps today's behavior: every boot brings its own schema to head.
if [ "${RUN_MIGRATIONS:-1}" != "0" ]; then
run_migrations
fi
echo "==> Starting uvicorn on 0.0.0.0:${PORT:-8137} with ${WORKERS:-4} worker(s)"
exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-8137}" --workers "${WORKERS:-4}"