mirror of
https://github.com/Dispatcharr/Dispatcharr.git
synced 2026-07-18 00:55:50 +00:00
763f42cfff
- Add setup_pg_ssl_env() to export libpq PGSSL* env vars; all child psql/pg_dump/pg_isready commands inherit TLS automatically - Move TLS client key permission fix before external PG connections (was running after, defeating the fix) - Enhance key fix to trigger on ownership mismatch (root-owned 0600 key unreadable by app user) - Extract key fix to shared script (docker/init/00-fix-pg-ssl-key.sh) sourced by both entrypoints - Default POSTGRES_PASSWORD to empty in modular mode (cert-only auth sends no spurious password) - Propagate TLS OPTIONS to backup pg_dump/pg_restore subprocess calls via _get_pg_env() - Pass SSL kwargs to dropdb management command's psycopg2.connect() - Add REDIS_SSL_PARAMS to VOD proxy Redis connections missed in original TLS PR - Add 8-scenario TLS integration test suite (PG mTLS, Redis TLS, verify-full, key fix, Celery, regression) - Add 6 unit tests for _get_pg_env() and dropdb TLS parameter passing
70 lines
2.5 KiB
Bash
70 lines
2.5 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
cd /app
|
|
source /dispatcharrpy/bin/activate
|
|
|
|
# Function to echo with timestamp
|
|
echo_with_timestamp() {
|
|
echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"
|
|
}
|
|
|
|
# Wait for Django secret key (generated by the web container on startup)
|
|
JWT_TIMEOUT=120
|
|
JWT_WAITED=0
|
|
echo 'Waiting for Django secret key...'
|
|
while [ ! -f /data/jwt ]; do
|
|
if [ $JWT_WAITED -ge $JWT_TIMEOUT ]; then
|
|
echo "❌ ERROR: Timed out waiting for /data/jwt after ${JWT_TIMEOUT}s."
|
|
echo " Is the web container running? Does it have the /data volume mounted?"
|
|
exit 1
|
|
fi
|
|
sleep 1
|
|
JWT_WAITED=$((JWT_WAITED + 1))
|
|
done
|
|
export DJANGO_SECRET_KEY="$(tr -d '\r\n' < /data/jwt)"
|
|
|
|
# --- NumPy version switching for legacy hardware ---
|
|
if [ "$USE_LEGACY_NUMPY" = "true" ]; then
|
|
# Check if NumPy was compiled with baseline support
|
|
if "$VIRTUAL_ENV/bin/python" -c "import numpy; numpy.show_config()" 2>&1 | grep -qi "baseline" || [ $? -ne 0 ]; then
|
|
echo_with_timestamp "🔧 Switching to legacy NumPy (no CPU baseline)..."
|
|
uv pip install --python "$VIRTUAL_ENV/bin/python" --no-cache --force-reinstall --no-deps /opt/numpy-*.whl
|
|
echo_with_timestamp "✅ Legacy NumPy installed"
|
|
else
|
|
echo_with_timestamp "✅ Legacy NumPy (no baseline) already installed, skipping reinstallation"
|
|
fi
|
|
fi
|
|
|
|
# Fix TLS client key permissions/ownership for PostgreSQL.
|
|
FIXED_KEY_PATH="/data/.pg-client-celery.key"
|
|
. /app/docker/init/00-fix-pg-ssl-key.sh
|
|
|
|
# Wait for migrations to complete
|
|
# Uses 'migrate --check' which exits 0 only when all migrations are applied,
|
|
# and exits 1 on unapplied migrations OR connection errors (safe either way)
|
|
MIG_TIMEOUT=300
|
|
MIG_WAITED=0
|
|
echo 'Waiting for migrations to complete...'
|
|
until python manage.py migrate --check >/dev/null 2>&1; do
|
|
if [ $MIG_WAITED -ge $MIG_TIMEOUT ]; then
|
|
echo "❌ ERROR: Timed out waiting for migrations after ${MIG_TIMEOUT}s."
|
|
echo " Check web container logs for migration errors."
|
|
exit 1
|
|
fi
|
|
echo_with_timestamp 'Migrations not ready yet, waiting...'
|
|
sleep 2
|
|
MIG_WAITED=$((MIG_WAITED + 2))
|
|
done
|
|
|
|
# Start Celery
|
|
echo 'Migrations complete, starting Celery...'
|
|
celery -A dispatcharr beat -l info &
|
|
|
|
# Default to nice level 5 (lower priority) - safe for unprivileged containers
|
|
# Negative values require SYS_NICE capability
|
|
NICE_LEVEL="${CELERY_NICE_LEVEL:-5}"
|
|
if [ "$NICE_LEVEL" -lt 0 ] 2>/dev/null; then
|
|
echo "Warning: CELERY_NICE_LEVEL=$NICE_LEVEL is negative, requires SYS_NICE capability"
|
|
fi
|
|
nice -n "$NICE_LEVEL" celery -A dispatcharr worker -l info --autoscale=6,1
|