persist db

Author: Tsche

.gitignore

@@ -60,6 +60,8 @@ cover/
 local_settings.py
 db.sqlite3
 db.sqlite3-journal
+db/*.sqlite3
+db/*.sqlite3-*
 
 # Flask stuff:
 instance/

README.md

@@ -24,6 +24,11 @@ The secret files must be readable by UID 10001 in the container. Root-owned mode
 `0444` is suitable because Docker bind-mounts them read-only. The application
 configuration itself is committed as `config/sites.toml`.
 
+Production SQLite files are persisted in the checkout's `db/` directory. The
+deployment bind-mounts `/srv/feedback/db` to `/data` in the container, so the
+site databases are `/srv/feedback/db/<site-id>.sqlite3`. They are ignored by
+Git and survive container rebuilds and replacement.
+
 The process is configured with explicit command-line arguments rather than
 environment variables. `python -m feedback --help` lists the config, secret-file,
 listener, proxy-trust, concurrency, and keep-alive options. Docker Compose passes

compose.deploy.yaml

@@ -30,7 +30,7 @@ services:
       - "127.0.0.1:18080:8080"
     volumes:
       - ./config/sites.toml:/run/config/sites.toml:ro
-      - feedback-data:/data
+      - ./db:/data
     secrets:
       - github-app-private-key
       - github-client-secret
@@ -65,6 +65,3 @@ secrets:
     file: ./config/secrets/github-client-secret
   oauth-state-hmac-key:
     file: ./config/secrets/oauth-state-hmac-key
-
-volumes:
-  feedback-data:

config/sites.example.toml

@@ -1,7 +1,7 @@
 [service]
 public_origin = "https://feedback-api.example.com"
 oauth_callback = "https://feedback.example.com/v1/oauth/callback.html"
-data_directory = "/data/sites"
+data_directory = "/data"
 github_app_id = 1
 github_client_id = "replace-with-github-client-id"
 github_concurrency = 2

config/sites.toml

@@ -1,7 +1,7 @@
 [service]
 public_origin = "https://feedback-api.cpp.social"
 oauth_callback = "https://feedback.cpp.social/v1/oauth/callback.html"
-data_directory = "/data/sites"
+data_directory = "/data"
 github_app_id = 4961716
 github_client_id = "Iv23lij7PpR7LjpKa1um"
 github_concurrency = 2

db/.gitkeep

@@ -43,6 +43,8 @@ in
         WorkingDirectory = cfg.repositoryDirectory;
         ExecStartPre = [
           "${pkgs.coreutils}/bin/test -s config/sites.toml"
+          "${pkgs.coreutils}/bin/install -d -o 10001 -g 10001 -m 0750 db"
+          "${pkgs.coreutils}/bin/chown -R 10001:10001 db"
           "${pkgs.coreutils}/bin/test -s config/secrets/github-app-private-key.pem"
           "${pkgs.coreutils}/bin/test -s config/secrets/github-client-secret"
           "${pkgs.coreutils}/bin/test -s config/secrets/oauth-state-hmac-key"