fix(deploy): isolate local vector compose secrets

2026-07-12 02:56:00 +02:00
parent 6c67235caf
commit 532073d550
8 changed files with 141 additions and 108 deletions
@@ -0,0 +1,23 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+project="thothii-external-lifecycle-$$"
+cleanup() { docker compose --project-name "$project" --profile external down --volumes >/dev/null 2>&1 || true; }
+trap cleanup EXIT HUP INT TERM
+
+unset THT_VECTOR_BOOTSTRAP_PASSWORD_SECRET_FILE THT_VECTOR_MIGRATOR_PASSWORD_SECRET_FILE
+unset THT_VECTOR_READER_PASSWORD_SECRET_FILE THT_VECTOR_WRITER_PASSWORD_SECRET_FILE
+rendered=$(docker compose --project-name "$project" --profile external config)
+if printf '%s' "$rendered" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|vector_.*password'; then
+  echo "external config contains local vector secret references" >&2
+  exit 1
+fi
+docker compose --project-name "$project" --profile external up --build --wait core
+core=$(docker compose --project-name "$project" --profile external ps -q core)
+inspect=$(docker inspect "$core")
+if printf '%s' "$inspect" | grep -q 'THT_VECTOR_.*PASSWORD_FILE\|/run/secrets/vector_.*password'; then
+  echo "external core inspect contains local vector secret references" >&2
+  exit 1
+fi
+echo "external core lifecycle without local vector secrets passed."