fix(cd): restart the app containers when SOPS app secrets change #18

Merged

ullrich merged 1 commit from fix/cd-infra-restarts-apps into main

2026-07-26 18:09:07 +00:00

ullrich commented

2026-07-26 18:06:45 +00:00

Owner

Closes #13.

Editing infrastructure/secrets.app.env left the Planner and Journal running with the old values: cd-apps never triggers (it watches only apps/, packages/, pnpm-lock.yaml), and cd-infra copied the new .env to the server but recreated only the infra services. It needed a manual SSH, and nothing went red.

The fix

Include journal planner in cd-infra's compose-up list.

The issue proposed diffing the push for secrets.app.env, but this is better and simpler: up -d only recreates a container whose resolved config differs, and that config includes env from --env-file. So:

app secrets changed → apps' env differs → recreated → new values picked up
infra-only change → apps untouched

That second case is verified, not assumed: in an earlier cd-infra run, postgres kept Up 11 days across the deploy precisely because its config hash was unchanged. It also needs no event-payload shape, and behaves correctly on workflow_dispatch, where there is no diff to take at all.

Documentation that made this hard to spot

docs/deployment.md claimed "cd-apps redeploys the Planner with the new token" — never true. Now names cd-infra and explains why cd-apps cannot trigger on a secret-only change.
Three dead gh workflow run commands (deployment.md ×2, CLAUDE.md ×1) — GitHub Actions is off, so these cannot work. Replaced with the Forgejo dispatch API plus the web-UI path.

Anyone following the rotation procedure previously got stuck twice: once on the silent non-restart, once on a dead command.

Follow-up worth its own change

CLAUDE.md's Git Workflow section still documents gh pr list / gh pr create / gh pr merge --merge --auto and the GitHub merge queue. All of that is now wrong — Forgejo has no merge queue, and main is instead protected with required status checks and signed commits. I left it out to keep this focused, but it is actively misleading for both humans and agents, so it should not wait long.

Closes #13. Editing `infrastructure/secrets.app.env` left the Planner and Journal running with the **old** values: `cd-apps` never triggers (it watches only `apps/`, `packages/`, `pnpm-lock.yaml`), and `cd-infra` copied the new `.env` to the server but recreated only the infra services. It needed a manual SSH, and **nothing went red**. ## The fix Include `journal planner` in cd-infra's compose-up list. The issue proposed diffing the push for `secrets.app.env`, but this is better and simpler: **`up -d` only recreates a container whose resolved config differs**, and that config includes env from `--env-file`. So: - app secrets changed → apps' env differs → recreated → new values picked up - infra-only change → apps untouched That second case is verified, not assumed: in an earlier `cd-infra` run, postgres kept **`Up 11 days`** across the deploy precisely because its config hash was unchanged. It also needs no event-payload shape, and behaves correctly on `workflow_dispatch`, where there is no diff to take at all. ## Documentation that made this hard to spot - **`docs/deployment.md` claimed "cd-apps redeploys the Planner with the new token"** — never true. Now names `cd-infra` and explains why `cd-apps` cannot trigger on a secret-only change. - **Three dead `gh workflow run` commands** (deployment.md ×2, CLAUDE.md ×1) — GitHub Actions is off, so these cannot work. Replaced with the Forgejo dispatch API plus the web-UI path. Anyone following the rotation procedure previously got stuck **twice**: once on the silent non-restart, once on a dead command. ## Follow-up worth its own change `CLAUDE.md`'s Git Workflow section still documents `gh pr list` / `gh pr create` / `gh pr merge --merge --auto` and the GitHub merge queue. All of that is now wrong — Forgejo has no merge queue, and `main` is instead protected with required status checks and signed commits. I left it out to keep this focused, but it is actively misleading for both humans and agents, so it should not wait long.

ullrich added 1 commit

2026-07-26 18:06:46 +00:00

fix(cd): restart the app containers when SOPS app secrets change

CI / Security Scan (pull_request) Successful in 1m46s

Details

CI / Dockerfile Package Check (pull_request) Successful in 25s

Details

CI / Checks (pull_request) Successful in 6m3s

Details

CI / Visual Tests (pull_request) Successful in 3m15s

Details

CI / Journal Image Smoke Test (pull_request) Successful in 11m33s

Details

CI / E2E Tests (pull_request) Successful in 7m58s

Details

c31b61bf64

Editing infrastructure/secrets.app.env left the Planner and Journal running with
the OLD values. cd-apps never triggers (it only watches apps/, packages/,
pnpm-lock.yaml) and cd-infra copied the new .env to the server but recreated only
the infra services, so the app containers kept the stale environment. It needed a
manual SSH to fix, and nothing went red — a silent failure.

Fix: include `journal planner` in cd-infra's compose up list.

This is preferable to diffing the push for secrets.app.env, which the issue
proposed: `up -d` only recreates a container whose resolved config differs, so
an infra-only deploy leaves the apps untouched — verified empirically, postgres
kept 11 days of uptime across exactly such a run. No dependence on event-payload
shape, and it behaves correctly on workflow_dispatch too, where there is no diff
to take.

Also corrects the documentation that made this hard to spot:

- docs/deployment.md claimed "cd-apps redeploys the Planner with the new token",
  which was never true. It now names cd-infra and explains why cd-apps cannot
  trigger on a secret-only change.
- Three `gh workflow run` commands (deployment.md x2, CLAUDE.md x1) could not
  work any more — GitHub Actions is off. Replaced with the Forgejo dispatch API
  plus the web-UI path. Anyone following the rotation procedure previously got
  stuck twice: once on the silent non-restart, once on a dead command.

Closes #13.

ullrich merged commit 2200351826 into main

2026-07-26 18:09:07 +00:00

ullrich deleted branch fix/cd-infra-restarts-apps

2026-07-26 18:09:07 +00:00

ullrich referenced this pull request from a commit

2026-07-26 18:09:08 +00:00

Merge pull request 'fix(cd): restart the app containers when SOPS app secrets change' (#18) from fix/cd-infra-restarts-apps into main