fix(infra): inject Garage secrets via env, roll back postgres to 17#20
Open
Islanders-Treasure0969 wants to merge 1 commit into
Open
fix(infra): inject Garage secrets via env, roll back postgres to 17#20Islanders-Treasure0969 wants to merge 1 commit into
Islanders-Treasure0969 wants to merge 1 commit into
Conversation
Two compose-time bugs surfaced when first running `make compose-up`: 1. Garage refused to start with `Invalid RPC secret key`. The `rpc_secret = "REPLACE_ME_AT_BOOTSTRAP_via_env"` placeholder in garage.toml was being read literally — no env override was wired. 2. Postgres 18 changed the on-disk layout (PR docker-library/postgres#1259): it now refuses to mount at /var/lib/postgresql/data and demands a parent-dir mount with versioned subdirs. Three of our four services crashed in lockstep ("PostgreSQL data in /var/lib/postgresql/data (unused mount/volume)"). Fixes: - garage.toml: drop `rpc_secret` / `admin_token` / `metrics_token` lines. Garage reads `GARAGE_RPC_SECRET` etc. from the environment at start. - docker-compose.yml: add `environment:` block on the garage service that pulls GARAGE_{RPC_SECRET,ADMIN_TOKEN} from the host env, with `${VAR:?...}` validation so a missing op-run wrap fails loudly instead of silently using empty values. - docker-compose.yml: revert postgres 18-alpine → 17-alpine (digest pinned). Postgres 17 is supported through 2029; the 18 path-shape change is better solved in a future PR with proper PGDATA + parent-mount layout. - Makefile: `compose-up` and `compose-up-streaming` now go through `$(OP_RUN)` (and depend on `env-check`), so secrets are always injected. Verified locally: postgres / temporal-db / lakekeeper-db / temporal / temporal-ui all healthy. Garage starts cleanly (cluster-layout init is a follow-up). Lakekeeper DB-migration step is also a follow-up (Phase 2). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
最初の
make compose-upで 2 系統のクラッシュが出たので修正。問題 1: Garage が
Invalid RPC secret keyで停止garage.toml内のrpc_secret = "REPLACE_ME_AT_BOOTSTRAP_via_env"が文字列リテラルとしてそのまま読まれていた。env override を期待していたが配線されてなかった。問題 2: Postgres 18 が volume layout 非互換で停止
Postgres 18 で on-disk layout が変わり (docker-library/postgres#1259)、
/var/lib/postgresql/dataへの直接 mount を拒否するようになった。3 つの Postgres コンテナが同じ理由で死亡。Fixes
docker/garage/garage.tomlrpc_secret/admin_token/metrics_token行を削除 (env で渡す)docker/docker-compose.yml(garage)environment:ブロック追加。${VAR:?...}で missing 時の早期失敗docker/docker-compose.yml(postgres x3)Makefilecompose-up/compose-up-streamingを$(OP_RUN)経由にVerified locally
Follow-ups (後続 PR)
scripts/garage-init.shで layout assign + bucket create を自動化