Add automatic database migrations on deployment

- Create Kubernetes Job to run migrations before deployment
- Update GitLab CI to execute migration job and wait for completion
- Ensures migrations run once per deployment in clustered environment
- Migration job uses PostgreSQL advisory locks to prevent race conditions

.gitlab-ci.yml

@@ -37,6 +37,18 @@ deploy:
   script:
     - kubectl config get-contexts
     - kubectl config use-context graham/towerops:towerops
+    # Run database migrations before deploying new version
+    - |
+      # Create unique job name using commit SHA (truncated to fit k8s naming limits)
+      JOB_NAME="towerops-migrate-${CI_COMMIT_SHORT_SHA}"
+      # Generate job manifest with correct image tag and unique name
+      sed -e "s|IMAGE_TAG|${CI_COMMIT_SHA}|g" \
+          -e "s|towerops-migrate-TIMESTAMP|${JOB_NAME}|g" \
+          k8s/migrate-job.yaml | kubectl apply -f -
+      # Wait for migration to complete (max 5 minutes)
+      kubectl wait --for=condition=complete --timeout=5m job/${JOB_NAME} -n towerops
+      echo "Database migration completed successfully"
+    # Deploy new version
     - kubectl set image deployment/towerops towerops=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n towerops
     - kubectl rollout status deployment/towerops -n towerops --timeout=5m
   environment:

k8s/migrate-job.yaml

@@ -0,0 +1,44 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: towerops-migrate-TIMESTAMP
+  namespace: towerops
+  labels:
+    app: towerops
+    component: migration
+spec:
+  # Clean up completed jobs after 1 hour
+  ttlSecondsAfterFinished: 3600
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app: towerops
+        component: migration
+    spec:
+      restartPolicy: Never
+      imagePullSecrets:
+      - name: gitlab-registry
+      containers:
+      - name: migrate
+        image: registry.gitlab.com/graham/towerops:IMAGE_TAG
+        command: ["/app/bin/towerops", "eval", "Towerops.Release.migrate()"]
+        env:
+        - name: MIX_ENV
+          value: "prod"
+        - name: RELEASE_COOKIE
+          valueFrom:
+            secretKeyRef:
+              name: towerops-secrets
+              key: RELEASE_COOKIE
+        envFrom:
+        - secretRef:
+            name: towerops-db
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "256Mi"
+            cpu: "500m"