Eric Allam
88ca0091a9
🚀 Publish Trigger.dev Docker / units (push) Failing after 11m53s
🚀 Publish Trigger.dev Docker / typecheck (push) Failing after 11m54s
🚀 Publish Trigger.dev Docker / publish-webapp (push) Has been skipped
🚀 Publish Trigger.dev Docker / publish-worker-v4 (push) Has been skipped
🚀 Publish Trigger.dev Docker / scan-webapp (push) Has been skipped
🚀 Publish Trigger.dev Docker / scan-supervisor (push) Has been skipped
🦋 Changesets PR / Create Release PR (push) Has been cancelled
🚀 Publish Trigger.dev Docker / 📣 Dispatch main image (push) Has been cancelled
## Summary
The container entrypoint runs under `set -x`, which echoes every command
to the logs with its variables expanded. Several startup guards
reference full database connection strings, so the DSN (including the
password) was printed to the container logs on every boot. This turns
tracing off around those lines so connection strings are never traced,
while leaving migration behavior and ordinary startup logging unchanged.
## Fix
The leaking lines are the `[ -n "$RUN_OPS_DATABASE_URL" ]` and `[ -n
"$RUN_OPS_LEGACY_DIRECT_URL" ]` guards, and the ClickHouse block (its `[
-n "$CLICKHOUSE_URL" ]` guard plus the lines that build `GOOSE_DBSTRING`
from `CLICKHOUSE_URL`). `set -x` prints each of these with the
credential expanded. Tracing is now disabled around each region and
restored afterward, so non-secret tracing is preserved everywhere else.
The existing legacy-migration subshell already protected its own command
body; this adds the missing protection for the guards and the ClickHouse
block.
```sh
{ set +x; } 2>/dev/null
if [ -n "$RUN_OPS_DATABASE_URL" ]; then
set -x
...
```
## Verification
Built the webapp image and ran it with dummy sentinel connection strings
whose password token is `S3NTINEL_PW_DoNotLog`, then grepped the boot
logs.
Before (unmodified), the token appears in the traced guards:
```
+ [ -n postgresql://user:S3NTINEL_PW_DoNotLog@fake-host:6432/run-ops ]
+ [ -n postgresql://user:S3NTINEL_PW_DoNotLog@fake-host:5432/legacy ]
+ [ -n https://default:S3NTINEL_PW_DoNotLog@fake-host:8443 ]
```
After, `grep S3NTINEL_PW_DoNotLog` on the same run returns nothing, and
the normal "skipping ... migrations" lines still log.
103 lines
3.7 KiB
Bash
Executable File
103 lines
3.7 KiB
Bash
Executable File
#!/bin/sh
|
||
set -xe
|
||
|
||
if [ -n "$DATABASE_HOST" ]; then
|
||
scripts/wait-for-it.sh ${DATABASE_HOST} -- echo "database is up"
|
||
fi
|
||
|
||
if [ "$SKIP_POSTGRES_MIGRATIONS" != "1" ]; then
|
||
echo "Running prisma migrations"
|
||
pnpm --filter @trigger.dev/database db:migrate:deploy
|
||
echo "Prisma migrations done"
|
||
else
|
||
echo "SKIP_POSTGRES_MIGRATIONS=1, skipping Postgres migrations."
|
||
fi
|
||
|
||
# Run-ops split: migrate the dedicated NEW run-ops database only when it is configured. Single-DB
|
||
# installs never set the URL, so this is a no-op there.
|
||
{ set +x; } 2>/dev/null
|
||
if [ -n "$RUN_OPS_DATABASE_URL" ]; then
|
||
set -x
|
||
if [ "$SKIP_RUN_OPS_MIGRATIONS" != "1" ]; then
|
||
echo "Running run-ops migrations"
|
||
pnpm --filter @internal/run-ops-database db:migrate:deploy
|
||
echo "Run-ops migrations done"
|
||
else
|
||
echo "SKIP_RUN_OPS_MIGRATIONS=1, skipping run-ops migrations."
|
||
fi
|
||
else
|
||
set -x
|
||
echo "RUN_OPS_DATABASE_URL not set, skipping run-ops migrations."
|
||
fi
|
||
|
||
# Run-ops split: keep the legacy runs DB's schema current by applying the full @trigger.dev/database
|
||
# migrations to it too, pointed at its direct (non-pooled) URL. Only runs when that URL is configured;
|
||
# installs that never set it skip this entirely.
|
||
{ set +x; } 2>/dev/null
|
||
if [ -n "$RUN_OPS_LEGACY_DIRECT_URL" ]; then
|
||
set -x
|
||
if [ "$SKIP_RUN_OPS_LEGACY_MIGRATIONS" != "1" ]; then
|
||
echo "Running legacy run-ops migrations"
|
||
# Subshell with tracing off so `set -x` does not print the DSN (with credentials) to the logs.
|
||
(set +x; DATABASE_URL="$RUN_OPS_LEGACY_DIRECT_URL" DIRECT_URL="$RUN_OPS_LEGACY_DIRECT_URL" pnpm --filter @trigger.dev/database db:migrate:deploy)
|
||
echo "Legacy run-ops migrations done"
|
||
else
|
||
echo "SKIP_RUN_OPS_LEGACY_MIGRATIONS=1, skipping legacy run-ops migrations."
|
||
fi
|
||
else
|
||
set -x
|
||
echo "RUN_OPS_LEGACY_DIRECT_URL not set, skipping legacy run-ops migrations."
|
||
fi
|
||
|
||
if [ "$SKIP_DASHBOARD_AGENT_MIGRATIONS" != "1" ]; then
|
||
echo "Running dashboard agent migrations"
|
||
pnpm --filter @internal/dashboard-agent-db db:migrate:deploy
|
||
echo "Dashboard agent migrations done"
|
||
else
|
||
echo "SKIP_DASHBOARD_AGENT_MIGRATIONS=1, skipping dashboard agent migrations."
|
||
fi
|
||
|
||
{ set +x; } 2>/dev/null
|
||
if [ -n "$CLICKHOUSE_URL" ] && [ "$SKIP_CLICKHOUSE_MIGRATIONS" != "1" ]; then
|
||
# Run ClickHouse migrations
|
||
echo "Running ClickHouse migrations..."
|
||
export GOOSE_DRIVER=clickhouse
|
||
|
||
# Ensure secure=true is in the connection string
|
||
if echo "$CLICKHOUSE_URL" | grep -q "secure="; then
|
||
# secure parameter already exists, use as is
|
||
export GOOSE_DBSTRING="$CLICKHOUSE_URL"
|
||
elif echo "$CLICKHOUSE_URL" | grep -q "?"; then
|
||
# URL has query parameters, append secure=true
|
||
export GOOSE_DBSTRING="${CLICKHOUSE_URL}&secure=true"
|
||
else
|
||
# URL has no query parameters, add secure=true
|
||
export GOOSE_DBSTRING="${CLICKHOUSE_URL}?secure=true"
|
||
fi
|
||
|
||
export GOOSE_MIGRATION_DIR=/triggerdotdev/internal-packages/clickhouse/schema
|
||
/usr/local/bin/goose up
|
||
echo "ClickHouse migrations complete."
|
||
elif [ "$SKIP_CLICKHOUSE_MIGRATIONS" = "1" ]; then
|
||
echo "SKIP_CLICKHOUSE_MIGRATIONS=1, skipping ClickHouse migrations."
|
||
else
|
||
echo "CLICKHOUSE_URL not set, skipping ClickHouse migrations."
|
||
fi
|
||
set -x
|
||
|
||
# Copy over required prisma files
|
||
cp internal-packages/database/prisma/schema.prisma apps/webapp/prisma/
|
||
cp node_modules/@prisma/engines/*.node apps/webapp/prisma/
|
||
|
||
cd /triggerdotdev/apps/webapp
|
||
|
||
|
||
# Decide how much old-space memory Node should get.
|
||
# Use $NODE_MAX_OLD_SPACE_SIZE if it’s set; otherwise fall back to 8192.
|
||
MAX_OLD_SPACE_SIZE="${NODE_MAX_OLD_SPACE_SIZE:-8192}"
|
||
|
||
echo "Setting max old space size to ${MAX_OLD_SPACE_SIZE}"
|
||
|
||
NODE_PATH='/triggerdotdev/node_modules/.pnpm/node_modules' exec dumb-init node --max-old-space-size=${MAX_OLD_SPACE_SIZE} ./build/server.js
|
||
|