Trey t
12b2f9d43b
Replaces the previous hand-rolled MigrateWithLock + GORM AutoMigrate path,
which had two compounding problems:
- AutoMigrate ran on every pod startup (~5 min over the transatlantic
link) even when no schema changes had landed
- pg_advisory_lock is session-scoped, which silently fails through
Neon's pgbouncer transaction-mode pooler — turns out this is a
known and documented limitation that bites golang-migrate too
Goose was chosen over golang-migrate (the other heavyweight) because:
- Goose wraps each migration file in a transaction by default, so a
failure rolls back cleanly instead of leaving a "dirty" version
state requiring manual force-reset (golang-migrate's known
weakness, per its own issue tracker — see #1001 + Atlas's writeup)
- Goose's locking is opt-in. We don't opt in: migrations run as a
single Kubernetes Job, which IS the singleton process. No advisory
lock needed at all.
Layout:
- migrations/000001_init.sql — schema-only pg_dump of the live Neon
DB at adoption, stripped of psql-only directives that block goose's
bookkeeping insert. Pre-goose hand-numbered migrations 002-022 had
their effects folded into this baseline; deleted from the live tree
but preserved in git history at 58e6997.
- Dockerfile installs `goose v3.22.1` at build time and copies the
binary into the api image. The migrate Job reuses the api image with
command=goose, so no separate image to build/push/version.
- deploy-k3s/manifests/migrate/job.yaml: a one-shot Job that strips
the -pooler segment from DB_HOST (advisory lock won't survive
pgbouncer transaction-mode), runs `goose up`, exits.
- deploy-k3s/scripts/03-deploy.sh: deletes any prior Job, applies the
fresh one, `kubectl wait --for=condition=complete --timeout=10m`,
then proceeds with api/worker rollout. Job failure aborts the deploy
before any new app pod sees a stale schema.
- internal/database/database.go::RequireSchemaApplied checks
goose_db_version on startup. api/worker refuse to boot if the
table is missing or its latest row has is_applied=false — the
fail-fast for "operator forgot to run migrate."
- Makefile: migrate-up / migrate-down / migrate-status / migrate-new
for local workflow.
Production DB was bootstrapped manually:
$ goose -dir migrations postgres "$DSN" version # creates table
$ psql ... -c "INSERT INTO goose_db_version (version_id, is_applied, tstamp) VALUES (1, true, NOW());"
Smoke test against fresh Postgres locally: 50 user tables created in
284ms via `goose up`, version_id=1 + is_applied=t recorded.
Verified the local goose CLI talks to prod successfully:
$ goose ... status
Applied At Migration
=======================================
Mon Apr 27 03:43:55 2026 -- 000001_init.sql
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
169 lines
4.4 KiB
Docker
169 lines
4.4 KiB
Docker
# Admin panel build stage
|
|
FROM node:20-alpine AS admin-builder
|
|
|
|
WORKDIR /app
|
|
|
|
# NEXT_PUBLIC_* vars are baked into the client bundle at build time.
|
|
# Pass via `--build-arg NEXT_PUBLIC_API_URL=https://api.myhoneydue.com`.
|
|
ARG NEXT_PUBLIC_API_URL
|
|
ENV NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL}
|
|
|
|
# Copy admin panel files
|
|
COPY admin/package*.json ./
|
|
|
|
# Install dependencies
|
|
RUN npm ci
|
|
|
|
# Copy source
|
|
COPY admin/ .
|
|
|
|
# Strip any committed .env.local that would override the build-time URL
|
|
# with a dev value (e.g. http://localhost:8000).
|
|
RUN rm -f .env.local .env.development.local
|
|
|
|
# Build (standalone mode)
|
|
RUN npm run build
|
|
|
|
# Go build stage
|
|
FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
|
|
ARG TARGETARCH
|
|
|
|
# Install build dependencies
|
|
RUN apk add --no-cache git ca-certificates tzdata
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy go mod files
|
|
COPY go.mod go.sum ./
|
|
|
|
# Download dependencies
|
|
RUN go mod download
|
|
|
|
# Copy source code
|
|
COPY . .
|
|
|
|
# Build the API binary
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags="-w -s" -o /app/api ./cmd/api
|
|
|
|
# Build the worker binary
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build -ldflags="-w -s" -o /app/worker ./cmd/worker
|
|
|
|
# Install goose CLI for production migrations. Pinned to a specific version
|
|
# so an upstream behavioural change can't break a deploy unannounced.
|
|
# Bumping is a deliberate, reviewable diff.
|
|
RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
|
|
go install github.com/pressly/goose/v3/cmd/goose@v3.22.1
|
|
|
|
# Base runtime stage for Go services
|
|
FROM alpine:3.19 AS go-base
|
|
|
|
# Install runtime dependencies
|
|
RUN apk add --no-cache ca-certificates tzdata curl
|
|
|
|
# Create non-root user
|
|
RUN addgroup -g 1000 app && adduser -u 1000 -G app -s /bin/sh -D app
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy all binaries from builder
|
|
COPY --from=builder /app/api /app/api
|
|
COPY --from=builder /app/worker /app/worker
|
|
# goose is the migration runner — same image is reused as the migrate Job
|
|
# entrypoint via `command: ["/usr/local/bin/goose", ...]`.
|
|
COPY --from=builder /go/bin/goose /usr/local/bin/goose
|
|
|
|
# Copy templates directory
|
|
COPY --from=builder /app/templates /app/templates
|
|
|
|
# Copy static landing page files
|
|
COPY --from=builder /app/static /app/static
|
|
|
|
# Copy migrations and seeds for production use
|
|
COPY --from=builder /app/migrations /app/migrations
|
|
COPY --from=builder /app/seeds /app/seeds
|
|
|
|
# Create uploads directory
|
|
RUN mkdir -p /app/uploads && chown -R app:app /app
|
|
|
|
# Switch to non-root user
|
|
USER app
|
|
|
|
# API stage
|
|
FROM go-base AS api
|
|
EXPOSE 8000
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
|
CMD curl -f http://localhost:${PORT:-8000}/api/health/ || exit 1
|
|
CMD ["/app/api"]
|
|
|
|
# Worker stage
|
|
FROM go-base AS worker
|
|
CMD ["/app/worker"]
|
|
|
|
# Admin panel runtime stage
|
|
FROM node:20-alpine AS admin
|
|
|
|
WORKDIR /app
|
|
|
|
# Create non-root user
|
|
RUN addgroup -g 1001 nodejs && adduser -u 1001 -G nodejs -s /bin/sh -D nextjs
|
|
|
|
# Copy standalone build
|
|
COPY --from=admin-builder --chown=nextjs:nodejs /app/.next/standalone ./
|
|
COPY --from=admin-builder --chown=nextjs:nodejs /app/.next/static ./.next/static
|
|
COPY --from=admin-builder --chown=nextjs:nodejs /app/public ./public
|
|
|
|
USER nextjs
|
|
|
|
EXPOSE 3000
|
|
|
|
ENV PORT=3000
|
|
ENV HOSTNAME="0.0.0.0"
|
|
|
|
CMD ["node", "server.js"]
|
|
|
|
# Default production stage (for Dokku - runs API + Admin)
|
|
FROM node:20-alpine AS production
|
|
|
|
# Install runtime dependencies
|
|
RUN apk add --no-cache ca-certificates tzdata curl
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy Go binaries
|
|
COPY --from=builder /app/api /app/api
|
|
COPY --from=builder /app/worker /app/worker
|
|
|
|
# Copy templates directory
|
|
COPY --from=builder /app/templates /app/templates
|
|
|
|
# Copy static landing page files
|
|
COPY --from=builder /app/static /app/static
|
|
|
|
# Copy migrations and seeds
|
|
COPY --from=builder /app/migrations /app/migrations
|
|
COPY --from=builder /app/seeds /app/seeds
|
|
|
|
# Copy push notification certificates
|
|
COPY --from=builder /app/push_certs /app/push_certs
|
|
|
|
# Copy admin panel standalone build (Next.js recommended layout)
|
|
COPY --from=admin-builder /app/.next/standalone/ /app/
|
|
COPY --from=admin-builder /app/public /app/public
|
|
COPY --from=admin-builder /app/.next/static /app/.next/static
|
|
|
|
# Copy start script
|
|
COPY start.sh /app/start.sh
|
|
RUN chmod +x /app/start.sh
|
|
|
|
# Create uploads directory
|
|
RUN mkdir -p /app/uploads
|
|
|
|
EXPOSE 5000
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
|
CMD pgrep -f /app/worker > /dev/null && exit 0 || curl -f http://localhost:${PORT:-5000}/api/health/ || exit 1
|
|
|
|
CMD ["/app/start.sh"]
|