7bc0358278
All checks were successful
PR build (required check) / changes (pull_request) Successful in 7s
secrets-guard / encrypted (pull_request) Successful in 6s
PR build (required check) / build-frontend (pull_request) Has been skipped
shell-lint / shellcheck (pull_request) Successful in 7s
PR build (required check) / validate-observability (pull_request) Has been skipped
PR build (required check) / build-backend (pull_request) Successful in 58s
PR build (required check) / gate (pull_request) Successful in 2s
/healthz accounted for ~47% of prod's daily access log and the internal frontend_ssr->backend content-API hop for another ~32%, each costing a threadpool dispatch + lock + file write on the request path for traffic that isn't meaningful to retain. classify_inbound gains "health" and "internal" categories for these, both excluded from audit.log_access (alongside the existing static/metrics/event exclusions) so they're never dispatched to the logging threadpool at all. The access log's client IP is now truncated to /24 (IPv4) or /48 (IPv6) before being persisted -- coarse geo/abuse signal without keeping a full, joinable address in Loki for the 30-day retention window, matching the privacy page's claim that IPs aren't logged beyond normal request handling. The rate limiter keyed off the same IP (_rate_ok) is untouched and still sees full precision. uvicorn's own --no-access-log now suppresses its duplicate per-request line, since the app's own middleware already writes one.
91 lines
4.2 KiB
Bash
Executable file
91 lines
4.2 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Container entrypoint: load secrets, bring the accounts schema up to head, then serve.
|
|
#
|
|
# Alembic runs before uvicorn so a fresh Postgres volume gets its tables. It is
|
|
# retried because `db` can still be finishing startup even though compose waits on
|
|
# its healthcheck — a cold volume's first connection may race the server becoming
|
|
# ready to accept the migration.
|
|
set -euo pipefail
|
|
|
|
cd /app
|
|
|
|
# --- Swarm secrets shim ------------------------------------------------------
|
|
# The app reads config from os.environ everywhere (users.py falls back to a random
|
|
# per-process AUTH_SECRET if THERMOGRAPH_AUTH_SECRET is unset; push.py mints a new
|
|
# VAPID keypair if the VAPID env vars are unset) — compose delivers config that way
|
|
# today via `environment:`/`env_file`. Swarm `secrets:` instead mount each secret as
|
|
# a FILE under /run/secrets/<name>, which the app would never see: without this shim,
|
|
# moving to Swarm secrets silently re-triggers those exact incidents (every session
|
|
# invalidated, every push subscription broken) on the next restart.
|
|
#
|
|
# Mechanical mapping, so a new THERMOGRAPH_* var never needs an entrypoint edit: a
|
|
# secret file's UPPERCASED name IS the env var it becomes — e.g. a secret named
|
|
# thermograph_auth_secret -> THERMOGRAPH_AUTH_SECRET — skipping anything that
|
|
# doesn't uppercase to a THERMOGRAPH_* name (postgres_password is handled below
|
|
# instead). Never overrides an already-set var (environment:/env_file always wins).
|
|
# Secret names must be valid shell-identifier characters (letters, digits,
|
|
# underscore) to become a var name.
|
|
if [ -d /run/secrets ]; then
|
|
for f in /run/secrets/*; do
|
|
[ -f "$f" ] || continue
|
|
var=$(basename "$f" | tr '[:lower:]' '[:upper:]')
|
|
case "$var" in
|
|
THERMOGRAPH_*)
|
|
if [ -z "${!var:-}" ]; then
|
|
export "$var=$(cat "$f")"
|
|
fi
|
|
;;
|
|
esac
|
|
done
|
|
|
|
# THERMOGRAPH_DATABASE_URL is normally built by compose's own interpolation
|
|
# (POSTGRES_PASSWORD baked into docker-compose.yml's `environment:` block) — Swarm
|
|
# secrets have no interpolation, so build the same URL here from the
|
|
# `postgres_password` secret when the URL isn't already set some other way.
|
|
if [ -z "${THERMOGRAPH_DATABASE_URL:-}" ] && [ -f /run/secrets/postgres_password ]; then
|
|
pg_pw=$(cat /run/secrets/postgres_password)
|
|
export THERMOGRAPH_DATABASE_URL="postgresql+asyncpg://thermograph:${pg_pw}@db:5432/thermograph"
|
|
fi
|
|
fi
|
|
|
|
run_migrations() {
|
|
local max=10 tries=0
|
|
echo "==> Running database migrations (alembic upgrade head)"
|
|
until alembic upgrade head; do
|
|
tries=$((tries + 1))
|
|
if [ "$tries" -ge "$max" ]; then
|
|
echo "!! alembic upgrade head failed after ${max} attempts; giving up" >&2
|
|
exit 1
|
|
fi
|
|
echo " migration attempt ${tries}/${max} failed; retrying in 3s..." >&2
|
|
sleep 3
|
|
done
|
|
}
|
|
|
|
# The lake role serves the ERA5 bucket only — no database, so no migrations: a
|
|
# lake replica must come up (and stay up) even when Postgres is down.
|
|
if [ "${THERMOGRAPH_ROLE:-}" = "lake" ]; then
|
|
echo "==> Starting lake service on 0.0.0.0:${PORT:-8141} with ${WORKERS:-1} worker(s)"
|
|
exec uvicorn lake_app:app --host 0.0.0.0 --port "${PORT:-8141}" --workers "${WORKERS:-1}"
|
|
fi
|
|
|
|
# One-shot migrate mode (`entrypoint.sh migrate`, or THERMOGRAPH_MIGRATE_ONLY=1): run
|
|
# the migration and exit — a one-shot task, so it runs once against the DB rather
|
|
# than racing per web replica.
|
|
if [ "${1:-}" = "migrate" ] || [ "${THERMOGRAPH_MIGRATE_ONLY:-0}" = "1" ]; then
|
|
run_migrations
|
|
exit 0
|
|
fi
|
|
|
|
# RUN_MIGRATIONS=0 skips the inline migrate below — for a deploy that runs the
|
|
# one-shot task above separately and doesn't want every web replica to also race it.
|
|
# Default (unset) keeps today's behavior: every boot brings its own schema to head.
|
|
if [ "${RUN_MIGRATIONS:-1}" != "0" ]; then
|
|
run_migrations
|
|
fi
|
|
|
|
echo "==> Starting uvicorn on 0.0.0.0:${PORT:-8137} with ${WORKERS:-4} worker(s)"
|
|
# --no-access-log: the app's own request-logging middleware (audit.log_access,
|
|
# web/app.py) already writes a structured line per request; uvicorn's own access
|
|
# log just duplicated every one of them for no benefit.
|
|
exec uvicorn app:app --host 0.0.0.0 --port "${PORT:-8137}" --workers "${WORKERS:-4}" --no-access-log
|