From ab4948467ac3ffaec6454eaa088594767d93952d Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Thu, 5 Mar 2026 12:39:01 -0600
Subject: [PATCH] feat: run database migrations on every deploy

- Add init container to run migrations before app starts
- Uses /app/bin/migrate script (runs Towerops.Release.migrate())
- Migrations run once per deployment, before any pods start
- Update CI/CD to set both migrate and towerops container images
- Prevents issues like missing severity column in production
---
 .forgejo/workflows/ci.yml |  7 +++++-
 k8s/deployment.yaml       | 48 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 04994372..86462d91 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -215,9 +215,14 @@ jobs:
           kubectl config use-context towerops/towerops:home-cluster-agent
           DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
           IMAGE_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          IMAGE_TAG="${{ secrets.REGISTRY_URL }}/graham/towerops-web:main-${IMAGE_SHA}"
+
+          # Update both init container (migrate) and main container
           kubectl set image deployment/towerops \
-            towerops=${{ secrets.REGISTRY_URL }}/graham/towerops-web:main-${IMAGE_SHA} \
+            migrate=${IMAGE_TAG} \
+            towerops=${IMAGE_TAG} \
             -n towerops
+
           kubectl set env deployment/towerops \
             DEPLOY_TIMESTAMP=${DEPLOY_TIMESTAMP} \
             -n towerops
diff --git a/k8s/deployment.yaml b/k8s/deployment.yaml
index 2fe58582..9174c491 100644
--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -30,6 +30,54 @@ spec:
         fsGroup: 65534
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: migrate
+          image: git.mcintire.me/graham/towerops-web:main-1772735406-025fa88
+          imagePullPolicy: IfNotPresent
+          command: ["/app/bin/migrate"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: MIX_ENV
+              value: "prod"
+            - name: DATABASE_SSL
+              value: "true"
+            - name: DATABASE_SSL_VERIFY
+              value: "false"
+            - name: RELEASE_COOKIE
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: RELEASE_COOKIE
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: SECRET_KEY_BASE
+            - name: CLOAK_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: CLOAK_KEY
+          envFrom:
+            - secretRef:
+                name: towerops-db
+            - secretRef:
+                name: towerops-aws
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
       containers:
         - name: towerops
           image: git.mcintire.me/graham/towerops-web:main-1772735406-025fa88