12b2f9d43b
Replaces the previous hand-rolled MigrateWithLock + GORM AutoMigrate path,
which had two compounding problems:
- AutoMigrate ran on every pod startup (~5 min over the transatlantic
link) even when no schema changes had landed
- pg_advisory_lock is session-scoped, which silently fails through
Neon's pgbouncer transaction-mode pooler — turns out this is a
known and documented limitation that bites golang-migrate too
Goose was chosen over golang-migrate (the other heavyweight) because:
- Goose wraps each migration file in a transaction by default, so a
failure rolls back cleanly instead of leaving a "dirty" version
state requiring manual force-reset (golang-migrate's known
weakness, per its own issue tracker — see #1001 + Atlas's writeup)
- Goose's locking is opt-in. We don't opt in: migrations run as a
single Kubernetes Job, which IS the singleton process. No advisory
lock needed at all.
Layout:
- migrations/000001_init.sql — schema-only pg_dump of the live Neon
DB at adoption, stripped of psql-only directives that block goose's
bookkeeping insert. Pre-goose hand-numbered migrations 002-022 had
their effects folded into this baseline; deleted from the live tree
but preserved in git history at 58e6997.
- Dockerfile installs `goose v3.22.1` at build time and copies the
binary into the api image. The migrate Job reuses the api image with
command=goose, so no separate image to build/push/version.
- deploy-k3s/manifests/migrate/job.yaml: a one-shot Job that strips
the -pooler segment from DB_HOST (advisory lock won't survive
pgbouncer transaction-mode), runs `goose up`, exits.
- deploy-k3s/scripts/03-deploy.sh: deletes any prior Job, applies the
fresh one, `kubectl wait --for=condition=complete --timeout=10m`,
then proceeds with api/worker rollout. Job failure aborts the deploy
before any new app pod sees a stale schema.
- internal/database/database.go::RequireSchemaApplied checks
goose_db_version on startup. api/worker refuse to boot if the
table is missing or its latest row has is_applied=false — the
fail-fast for "operator forgot to run migrate."
- Makefile: migrate-up / migrate-down / migrate-status / migrate-new
for local workflow.
Production DB was bootstrapped manually:
$ goose -dir migrations postgres "$DSN" version # creates table
$ psql ... -c "INSERT INTO goose_db_version (version_id, is_applied, tstamp) VALUES (1, true, NOW());"
Smoke test against fresh Postgres locally: 50 user tables created in
284ms via `goose up`, version_id=1 + is_applied=t recorded.
Verified the local goose CLI talks to prod successfully:
$ goose ... status
Applied At Migration
=======================================
Mon Apr 27 03:43:55 2026 -- 000001_init.sql
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
176 lines
4.9 KiB
Makefile
176 lines
4.9 KiB
Makefile
.PHONY: build run test contract-test clean deps lint docker-build docker-up docker-down migrate migrate-encrypt migrate-encrypt-dry
|
|
|
|
# Binary names
|
|
API_BINARY=honeydue-api
|
|
WORKER_BINARY=honeydue-worker
|
|
|
|
# Build flags
|
|
LDFLAGS=-ldflags "-s -w"
|
|
|
|
# Default target
|
|
all: build
|
|
|
|
# Install dependencies
|
|
deps:
|
|
go mod download
|
|
go mod tidy
|
|
|
|
# Build the API binary
|
|
build:
|
|
go build $(LDFLAGS) -o bin/$(API_BINARY) ./cmd/api
|
|
|
|
# Build the worker binary
|
|
build-worker:
|
|
go build $(LDFLAGS) -o bin/$(WORKER_BINARY) ./cmd/worker
|
|
|
|
# Build all binaries
|
|
build-all: build build-worker
|
|
|
|
# Run the API server
|
|
run:
|
|
go run ./cmd/api
|
|
|
|
# Run the worker
|
|
run-worker:
|
|
go run ./cmd/worker
|
|
|
|
# Run tests
|
|
test:
|
|
go test -v -race -cover ./...
|
|
|
|
# Run contract validation tests (routes + KMP vs OpenAPI spec)
|
|
contract-test:
|
|
go test -v -run "TestRouteSpecContract|TestKMPSpecContract" ./internal/integration/
|
|
|
|
# Run tests with coverage
|
|
test-coverage:
|
|
go test -v -race -coverprofile=coverage.out ./...
|
|
go tool cover -html=coverage.out -o coverage.html
|
|
|
|
# Run linter
|
|
lint:
|
|
golangci-lint run ./...
|
|
|
|
# Clean build artifacts
|
|
clean:
|
|
rm -rf bin/
|
|
rm -f coverage.out coverage.html
|
|
|
|
# Format code
|
|
fmt:
|
|
go fmt ./...
|
|
|
|
# Vet code
|
|
vet:
|
|
go vet ./...
|
|
|
|
# Docker commands (dev — uses docker-compose.dev.yml)
|
|
docker-build:
|
|
docker compose -f docker-compose.dev.yml build
|
|
|
|
docker-up:
|
|
docker compose -f docker-compose.dev.yml up -d
|
|
|
|
docker-down:
|
|
docker compose -f docker-compose.dev.yml down
|
|
|
|
docker-logs:
|
|
docker compose -f docker-compose.dev.yml logs -f
|
|
|
|
docker-dev:
|
|
docker compose -f docker-compose.dev.yml up --build
|
|
|
|
docker-restart:
|
|
docker compose -f docker-compose.dev.yml down && docker compose -f docker-compose.dev.yml up -d
|
|
|
|
# Docker commands (prod — builds production images)
|
|
docker-build-prod:
|
|
docker build --target api -t $${REGISTRY:-ghcr.io/treytartt}/honeydue-api:$${TAG:-latest} .
|
|
docker build --target worker -t $${REGISTRY:-ghcr.io/treytartt}/honeydue-worker:$${TAG:-latest} .
|
|
docker build --target admin -t $${REGISTRY:-ghcr.io/treytartt}/honeydue-admin:$${TAG:-latest} .
|
|
|
|
# Database migrations (goose)
|
|
#
|
|
# DATABASE_URL must point at the *direct* (non-pooler) Neon endpoint —
|
|
# goose's session-scoped advisory lock won't survive PgBouncer transaction
|
|
# mode. Example:
|
|
# export DATABASE_URL='host=ep-floral-truth-amttbc5a.c-5.us-east-1.aws.neon.tech \
|
|
# user=neondb_owner password=... dbname=honeyDue sslmode=require'
|
|
#
|
|
# Bootstrap (one-time, when adopting goose against an existing DB):
|
|
# make migrate-status # creates goose_db_version
|
|
# psql ... -c "INSERT INTO goose_db_version (version_id, is_applied, tstamp) VALUES (1, true, NOW());"
|
|
#
|
|
# Day-to-day:
|
|
# make migrate-status # show what's pending
|
|
# make migrate-up # apply pending migrations
|
|
# make migrate-down # roll back the latest migration
|
|
# make migrate-new name=add_some_column # scaffold a new SQL migration
|
|
|
|
migrate-up:
|
|
goose -dir migrations postgres "$(DATABASE_URL)" up
|
|
|
|
migrate-down:
|
|
goose -dir migrations postgres "$(DATABASE_URL)" down
|
|
|
|
migrate-status:
|
|
goose -dir migrations postgres "$(DATABASE_URL)" status
|
|
|
|
migrate-new:
|
|
@if [ -z "$(name)" ]; then echo "usage: make migrate-new name=<short_name>"; exit 1; fi
|
|
goose -dir migrations create $(name) sql
|
|
|
|
# Encrypt existing uploads at rest (run after setting STORAGE_ENCRYPTION_KEY)
|
|
migrate-encrypt:
|
|
go run ./cmd/migrate-encrypt
|
|
|
|
migrate-encrypt-dry:
|
|
go run ./cmd/migrate-encrypt --dry-run
|
|
|
|
# Development helpers
|
|
dev: deps run
|
|
|
|
# Generate swagger docs (if using swag)
|
|
swagger:
|
|
swag init -g cmd/api/main.go -o docs/swagger
|
|
|
|
# Help
|
|
help:
|
|
@echo "Casera API Go - Available targets:"
|
|
@echo ""
|
|
@echo "Build:"
|
|
@echo " deps - Install dependencies"
|
|
@echo " build - Build API binary"
|
|
@echo " build-all - Build all binaries (API, Worker)"
|
|
@echo " clean - Clean build artifacts"
|
|
@echo ""
|
|
@echo "Run:"
|
|
@echo " run - Run API server"
|
|
@echo " run-worker - Run background worker"
|
|
@echo ""
|
|
@echo "Test & Lint:"
|
|
@echo " test - Run tests"
|
|
@echo " test-coverage - Run tests with coverage"
|
|
@echo " lint - Run linter"
|
|
@echo " fmt - Format code"
|
|
@echo " vet - Vet code"
|
|
@echo ""
|
|
@echo "Docker (dev):"
|
|
@echo " docker-build - Build dev Docker images"
|
|
@echo " docker-up - Start dev containers (detached)"
|
|
@echo " docker-down - Stop dev containers"
|
|
@echo " docker-logs - View dev container logs"
|
|
@echo " docker-dev - Build and start dev containers (foreground)"
|
|
@echo " docker-restart - Restart dev containers"
|
|
@echo ""
|
|
@echo "Docker (prod):"
|
|
@echo " docker-build-prod - Build production images (api, worker, admin)"
|
|
@echo ""
|
|
@echo "Database:"
|
|
@echo " migrate-up - Run database migrations"
|
|
@echo " migrate-down - Rollback database migrations"
|
|
@echo ""
|
|
@echo "Encryption:"
|
|
@echo " migrate-encrypt - Encrypt existing uploads at rest"
|
|
@echo " migrate-encrypt-dry - Preview encryption migration (dry run)"
|