From a0f72cfd43a21aac3fa37964a437aa1e8f6d9f26 Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 18 Feb 2026 10:55:17 -0600
Subject: [PATCH] Run database migrations as init container on each deploy

Adds an init container that runs `bin/migrate` before app pods start,
ensuring migrations are applied on every deployment. Uses the existing
advisory lock in MigrationLock so only one pod runs migrations during
a rolling update.
---
 k8s/deployment.yaml | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 2c2e5f8..c39d3d4 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -29,6 +29,45 @@ spec:
         fsGroup: 1001
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: migrate
+          image: git.mcintire.me/graham/aprs.me:main-0000000000-0000000 # {"$imagepolicy": "flux-system:aprs-me"}
+          imagePullPolicy: IfNotPresent
+          command: ["/app/bin/migrate"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1001
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: MIX_ENV
+              value: "prod"
+            - name: SKIP_DB_CREATE
+              value: "true"
+            - name: RELEASE_COOKIE
+              valueFrom:
+                secretKeyRef:
+                  name: aprs-secrets
+                  key: RELEASE_COOKIE
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: aprs-secrets
+                  key: SECRET_KEY_BASE
+          envFrom:
+            - secretRef:
+                name: aprs-db
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
       containers:
         - name: aprs
           image: git.mcintire.me/graham/aprs.me:main-1771368069-24c01d0 # {"$imagepolicy": "flux-system:aprs-me"}