From 278ecac8cb186bef9e4118f165c7776bfd62e68a Mon Sep 17 00:00:00 2001 From: Codex Date: Fri, 17 Jul 2026 00:08:29 +0200 Subject: [PATCH] fix: separate HWLAB migration database URL --- config/hwlab-node-lanes.yaml | 2 ++ config/platform-db/postgres-nc01.yaml | 17 ++++++++++++++++- scripts/src/hwlab-node-lanes.ts | 4 ++++ scripts/src/hwlab-node/web-probe.ts | 10 +++++++++- 4 files changed, 31 insertions(+), 2 deletions(-) diff --git a/config/hwlab-node-lanes.yaml b/config/hwlab-node-lanes.yaml index dbbb69ef..2b4b89ef 100644 --- a/config/hwlab-node-lanes.yaml +++ b/config/hwlab-node-lanes.yaml @@ -344,6 +344,8 @@ lanes: secretName: hwlab-cloud-api-production-db sourceRef: hwlab/nc01-production-cloud-api-db.env role: hwlab_nc01_production_app + migrationSecretKey: migration-database-url + migrationEnvKey: MIGRATION_DATABASE_URL openfga: secretName: hwlab-production-openfga sourceRef: hwlab/nc01-production-openfga-db.env diff --git a/config/platform-db/postgres-nc01.yaml b/config/platform-db/postgres-nc01.yaml index 41b28439..7afdc46e 100644 --- a/config/platform-db/postgres-nc01.yaml +++ b/config/platform-db/postgres-nc01.yaml @@ -500,7 +500,7 @@ exports: sourceSecretRef: platform-db/hwlab-nc01-production-db.env render: envKey: DATABASE_URL - format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true + format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require variables: PGHOST: 10.42.0.1 writeToSecretSource: @@ -511,6 +511,21 @@ exports: - scope: hwlab-production secret: hwlab-cloud-api-production-db key: DATABASE_URL + - name: hwlab-nc01-production-migration-database-url + sourceSecretRef: platform-db/hwlab-nc01-production-db.env + render: + envKey: MIGRATION_DATABASE_URL + format: postgresql://$(HWLAB_NC01_PRODUCTION_DB_USER):$(HWLAB_NC01_PRODUCTION_DB_PASSWORD)@$(PGHOST):5432/$(HWLAB_NC01_PRODUCTION_DB_NAME)?sslmode=require&uselibpqcompat=true + variables: + PGHOST: 10.42.0.1 + writeToSecretSource: + sourceRef: hwlab/nc01-production-cloud-api-db.env + key: MIGRATION_DATABASE_URL + mode: update-or-insert + consumers: + - scope: hwlab-production + secret: hwlab-cloud-api-production-db + key: MIGRATION_DATABASE_URL - name: hwlab-nc01-production-openfga-datastore-uri sourceSecretRef: platform-db/hwlab-nc01-production-db.env render: diff --git a/scripts/src/hwlab-node-lanes.ts b/scripts/src/hwlab-node-lanes.ts index 394221fc..0e40a317 100644 --- a/scripts/src/hwlab-node-lanes.ts +++ b/scripts/src/hwlab-node-lanes.ts @@ -72,6 +72,8 @@ export interface HwlabRuntimeExternalPostgresComponentSpec { readonly role: string; readonly authnKey?: string; readonly schema?: string; + readonly migrationSecretKey?: string; + readonly migrationEnvKey?: string; } export interface HwlabRuntimeExternalPostgresRuntimeAccessSpec { @@ -1402,6 +1404,8 @@ function externalPostgresComponentConfig(value: unknown, path: string): HwlabRun role: stringField(raw, "role", path), authnKey: optionalStringField(raw, "authnKey", path), schema: optionalStringField(raw, "schema", path), + migrationSecretKey: optionalStringField(raw, "migrationSecretKey", path), + migrationEnvKey: optionalStringField(raw, "migrationEnvKey", path), }; } diff --git a/scripts/src/hwlab-node/web-probe.ts b/scripts/src/hwlab-node/web-probe.ts index 460abc4a..4902fe67 100644 --- a/scripts/src/hwlab-node/web-probe.ts +++ b/scripts/src/hwlab-node/web-probe.ts @@ -548,9 +548,13 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR if (pg === undefined) return null; const secretRoot = externalPostgresSecretSourceRoot(spec); const cloudApi = readSecretSourceValue(secretRoot, pg.cloudApi.sourceRef, pg.cloudApi.envKey); + const migration = pg.cloudApi.migrationEnvKey === undefined + ? null + : readSecretSourceValue(secretRoot, pg.cloudApi.sourceRef, pg.cloudApi.migrationEnvKey); const openfga = readSecretSourceValue(secretRoot, pg.openfga.sourceRef, pg.openfga.envKey); const missing = [ ...(cloudApi.ok ? [] : [`${pg.cloudApi.sourceRef}:${pg.cloudApi.envKey}`]), + ...(migration === null || migration.ok ? [] : [`${pg.cloudApi.sourceRef}:${pg.cloudApi.migrationEnvKey}`]), ...(openfga.ok ? [] : [`${pg.openfga.sourceRef}:${pg.openfga.envKey}`]), ]; if (missing.length > 0) { @@ -598,7 +602,10 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR kind: "Secret", metadata: { name: pg.cloudApi.secretName, namespace: spec.runtimeNamespace }, type: "Opaque", - stringData: { [pg.cloudApi.secretKey]: cloudApi.value }, + stringData: { + [pg.cloudApi.secretKey]: cloudApi.value, + ...(migration === null || pg.cloudApi.migrationSecretKey === undefined ? {} : { [pg.cloudApi.migrationSecretKey]: migration.value }), + }, }, { apiVersion: "v1", @@ -631,6 +638,7 @@ export function syncNodeExternalPostgresSecrets(spec: HwlabRuntimeLaneSpec, dryR sourceRoot: secretRoot, secrets: [ { name: pg.cloudApi.secretName, key: pg.cloudApi.secretKey, sourceRef: pg.cloudApi.sourceRef, envKey: pg.cloudApi.envKey }, + ...(migration === null || pg.cloudApi.migrationSecretKey === undefined ? [] : [{ name: pg.cloudApi.secretName, key: pg.cloudApi.migrationSecretKey, sourceRef: pg.cloudApi.sourceRef, envKey: pg.cloudApi.migrationEnvKey }]), { name: pg.openfga.secretName, key: pg.openfga.secretKey, sourceRef: pg.openfga.sourceRef, envKey: pg.openfga.envKey, authnKey: pg.openfga.authnKey ?? null }, ], setup: compactRuntimeCommand(setup),