fix(web-arm): onecli-db-password oneshot — LoadCredential + setup ordering #341

Merged

dominik.polakovics merged 1 commit from lab/20260814-1419 into main

2026-08-14 19:40:46 +02:00

dominik.polakovics commented

2026-08-14 19:39:09 +02:00

Owner

First activation of #339 on web-arm failed: the oneshot runs as User=postgres but the sops secret is root-owned 0400 — cat: /run/secrets/onecli-db-password: Permission denied — so podman-onecli went down with result 'dependency'.

Two changes to the oneshot:

LoadCredential hands the root-owned secret to the service uid (the keycloak module's pattern); the script reads $CREDENTIALS_DIRECTORY/db-password. Changing the unit also means switch-to-configuration restarts it on deploy, so the failed unit heals on its own.
after = postgresql-setup.service added alongside postgresql.target: the target ordering protects a cold boot, but on a live switch the target is already active and the oneshot can race the role creation (PR #339 review CONCERN 1's residual case).

Deploy note: podman-onecli.service itself is unchanged, so after the switch it stays dead until started once — systemctl start podman-onecli (or the next reboot).

Closes #340

First activation of #339 on web-arm failed: the oneshot runs as `User=postgres` but the sops secret is root-owned 0400 — `cat: /run/secrets/onecli-db-password: Permission denied` — so `podman-onecli` went down with `result 'dependency'`. Two changes to the oneshot: - **LoadCredential** hands the root-owned secret to the service uid (the keycloak module's pattern); the script reads `$CREDENTIALS_DIRECTORY/db-password`. Changing the unit also means switch-to-configuration restarts it on deploy, so the failed unit heals on its own. - **`after = postgresql-setup.service`** added alongside `postgresql.target`: the target ordering protects a cold boot, but on a live switch the target is already active and the oneshot can race the role creation (PR #339 review CONCERN 1's residual case). Deploy note: `podman-onecli.service` itself is unchanged, so after the switch it stays dead until started once — `systemctl start podman-onecli` (or the next reboot). Closes #340

dominik.polakovics added 1 commit

2026-08-14 19:39:09 +02:00

fix(web-arm): hand onecli-db-password to the oneshot via LoadCredential e8d5184ad3

The unit runs as postgres but the sops secret is root-owned 0400, so the
first activation died on Permission denied and took podman-onecli down as
a dependency. Also order the oneshot after postgresql-setup.service
explicitly: postgresql.target covers a cold boot, but on a live switch it
is already active and the role-creation race is real.

Closes #340

dominik.polakovics merged commit d5048a2ab6 into main

2026-08-14 19:40:46 +02:00

dominik.polakovics deleted branch lab/20260814-1419

2026-08-14 19:40:46 +02:00

dominik.polakovics referenced this pull request from a commit

2026-08-14 19:40:48 +02:00

Merge pull request 'fix(web-arm): onecli-db-password oneshot — LoadCredential + setup ordering' (#341) from lab/20260814-1419 into main