fix(deploy): reconcile local vector credentials safely

compose.yaml

@@ -1,5 +1,8 @@
 name: thothii
 
+x-smoke-labels: &smoke-labels
+  io.thothii.smoke-owner: "${THOTH_SMOKE_OWNER:-operator}"
+
 services:
   core:
     image: thothii-core:local
@@ -7,6 +10,7 @@ services:
     build:
       context: .
       dockerfile: docker/core.Dockerfile
+    labels: *smoke-labels
     environment:
       AUTH_MODE: "${AUTH_MODE:-none}"
       THOTH_PUBLIC_EXPOSURE: "${THOTH_PUBLIC_EXPOSURE:-false}"
@@ -37,6 +41,7 @@ services:
     build:
       context: .
       dockerfile: docker/frontend.Dockerfile
+    labels: *smoke-labels
     environment:
       BACKEND_BASE_URL: /api
     ports:
@@ -55,6 +60,7 @@ services:
   vector-db:
     image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
     profiles: [local-vector]
+    labels: *smoke-labels
     environment:
       POSTGRES_DB: "${THT_VECTOR_DATABASE:-thoth}"
       POSTGRES_USER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
@@ -69,7 +75,6 @@ services:
       - vector_writer_password
     volumes:
       - vector_data:/var/lib/postgresql/data
-      - ./deploy/vector/init/00-bootstrap.sh:/docker-entrypoint-initdb.d/00-bootstrap.sh:ro
     healthcheck:
       test: [CMD-SHELL, "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]
       interval: 5s
@@ -78,12 +83,38 @@ services:
       start_period: 10s
     restart: unless-stopped
 
+  vector-reconcile:
+    image: pgvector/pgvector:0.8.5-pg16@sha256:1d533553fefe4f12e5d80c7b80622ba0c382abb5758856f52983d8789179f0fb
+    profiles: [local-vector]
+    labels: *smoke-labels
+    environment:
+      PGHOST: vector-db
+      PGPORT: 5432
+      PGDATABASE: "${THT_VECTOR_DATABASE:-thoth}"
+      PGUSER: "${THT_VECTOR_BOOTSTRAP_USER:-postgres}"
+      THT_VECTOR_MIGRATOR_USER: "${THT_VECTOR_MIGRATOR_USER:-thoth_vector_migrator}"
+      THT_VECTOR_READER_USER: "${THT_VECTOR_READER_USER:-thoth_vector_reader}"
+      THT_VECTOR_WRITER_USER: "${THT_VECTOR_WRITER_USER:-thoth_vector_writer}"
+    entrypoint: [/opt/thoth/reconcile-roles.sh]
+    secrets:
+      - vector_bootstrap_password
+      - vector_migrator_password
+      - vector_reader_password
+      - vector_writer_password
+    volumes:
+      - ./deploy/vector/reconcile-roles.sh:/opt/thoth/reconcile-roles.sh:ro
+    depends_on:
+      vector-db:
+        condition: service_healthy
+    restart: "no"
+
   vector-migrate:
     image: thothii-core:local
     profiles: [local-vector]
     build:
       context: .
       dockerfile: docker/core.Dockerfile
+    labels: *smoke-labels
     entrypoint: [sh, -ec]
     command:
       - |
@@ -95,13 +126,19 @@ services:
     secrets:
       - vector_migrator_password
     depends_on:
-      vector-db:
-        condition: service_healthy
+      vector-reconcile:
+        condition: service_completed_successfully
     restart: "no"
 
 volumes:
   thoth_data:
+    labels: *smoke-labels
   vector_data:
+    labels: *smoke-labels
+
+networks:
+  default:
+    labels: *smoke-labels
 
 secrets:
   vector_bootstrap_password: