From f2270100bb86cc7ba6f70bce3caee7e04f72764e Mon Sep 17 00:00:00 2001
From: emi <emerytgriffith@gmail.com>
Date: Thu, 23 Jul 2026 04:21:10 +0000
Subject: [PATCH] Stack rehearsal fixes: interpolation, network ownership,
 plain-CMD images (#10)

---
 deploy/stack/deploy-stack.sh       |  5 +++--
 deploy/stack/env-entrypoint.sh     | 11 ++++++++++-
 deploy/stack/thermograph-stack.yml | 10 +++++-----
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/deploy/stack/deploy-stack.sh b/deploy/stack/deploy-stack.sh
index f2df221..cdaa5a0 100755
--- a/deploy/stack/deploy-stack.sh
+++ b/deploy/stack/deploy-stack.sh
@@ -119,8 +119,9 @@ done
 # deploy: the network doesn't exist yet — create it exactly as the stack will
 # (attachable overlay) so the name is adopted, then migrate, then deploy.
 NET="${STACK_NAME}_internal"
-docker network inspect "$NET" >/dev/null 2>&1 \
-  || docker network create --driver overlay --attachable --scope swarm "$NET" >/dev/null
+# Never pre-create $NET: docker stack deploy must own it (a pre-existing
+# unlabeled network makes it fail with "already exists"). On first deploy the
+# migrate runs AFTER stack deploy instead (FIRST_DEPLOY_MIGRATE below).
 if [ "$SERVICE" = "backend" ] || [ "$SERVICE" = "all" ]; then
   if docker service inspect "${STACK_NAME}_db" >/dev/null 2>&1; then
     echo "==> One-shot migrate ($BACKEND_IMAGE)"
diff --git a/deploy/stack/env-entrypoint.sh b/deploy/stack/env-entrypoint.sh
index 7905b01..7af8173 100755
--- a/deploy/stack/env-entrypoint.sh
+++ b/deploy/stack/env-entrypoint.sh
@@ -34,4 +34,13 @@ if [ -f "$ENV_FILE" ]; then
   done < "$ENV_FILE"
 fi
 
-exec /app/deploy/entrypoint.sh "$@"
+# Hand off: the backend image has a real entrypoint script; the frontend
+# image is plain-CMD (docker passes that CMD to us as $@ when the stack
+# overrides the entrypoint) -- exec whichever this image actually is.
+if [ -x /app/deploy/entrypoint.sh ]; then
+  exec /app/deploy/entrypoint.sh "$@"
+elif [ "$#" -gt 0 ]; then
+  exec "$@"
+else
+  exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-8080}"
+fi
diff --git a/deploy/stack/thermograph-stack.yml b/deploy/stack/thermograph-stack.yml
index 5916337..a3b7c22 100644
--- a/deploy/stack/thermograph-stack.yml
+++ b/deploy/stack/thermograph-stack.yml
@@ -36,10 +36,10 @@
 
 services:
   db:
-    image: ${TIMESCALEDB_IMAGE:?set TIMESCALEDB_IMAGE to the exact (digest-pinned) image the volume was created with}
+    image: ${TIMESCALEDB_IMAGE:?required}
     environment:
       POSTGRES_USER: thermograph
-      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?required}
       POSTGRES_DB: thermograph
       DB_MEMORY: ${DB_MEMORY:-16g}
     volumes:
@@ -64,7 +64,7 @@ services:
         condition: on-failure
 
   web:
-    image: ${REGISTRY_HOST:-git.thermograph.org}/${BACKEND_IMAGE_PATH:-emi/thermograph-backend/app}:${BACKEND_IMAGE_TAG:?set BACKEND_IMAGE_TAG}
+    image: ${REGISTRY_HOST:-git.thermograph.org}/${BACKEND_IMAGE_PATH:-emi/thermograph-backend/app}:${BACKEND_IMAGE_TAG:?required}
     entrypoint: ["/host/env-entrypoint.sh"]
     environment:
       THERMOGRAPH_DATABASE_URL: postgresql+asyncpg://thermograph:${POSTGRES_PASSWORD}@db:5432/thermograph
@@ -105,7 +105,7 @@ services:
         failure_action: rollback
 
   worker:
-    image: ${REGISTRY_HOST:-git.thermograph.org}/${BACKEND_IMAGE_PATH:-emi/thermograph-backend/app}:${BACKEND_IMAGE_TAG:?set BACKEND_IMAGE_TAG}
+    image: ${REGISTRY_HOST:-git.thermograph.org}/${BACKEND_IMAGE_PATH:-emi/thermograph-backend/app}:${BACKEND_IMAGE_TAG:?required}
     entrypoint: ["/host/env-entrypoint.sh"]
     environment:
       THERMOGRAPH_DATABASE_URL: postgresql+asyncpg://thermograph:${POSTGRES_PASSWORD}@db:5432/thermograph
@@ -139,7 +139,7 @@ services:
         condition: on-failure
 
   frontend:
-    image: ${REGISTRY_HOST:-git.thermograph.org}/${FRONTEND_IMAGE_PATH:-emi/thermograph-frontend/app}:${FRONTEND_IMAGE_TAG:?set FRONTEND_IMAGE_TAG}
+    image: ${REGISTRY_HOST:-git.thermograph.org}/${FRONTEND_IMAGE_PATH:-emi/thermograph-frontend/app}:${FRONTEND_IMAGE_TAG:?required}
     entrypoint: ["/host/env-entrypoint.sh"]
     environment:
       THERMOGRAPH_BASE: /