feat(deploy): run postgres as ff-db container, host 10.0.1.10, fail on git errors

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infrastructure/deploy/deploy.env.example

@@ -9,12 +9,14 @@ GIT_BRANCH=master
 POLL_INTERVAL=300
 
 # --- Host / Ports -----------------------------------------------------------
-HOST_IP=10.0.0.15
+HOST_IP=10.0.1.10
 API_PORT=3005      # HTTP-Port, den die Agenten als server_url nutzen
-HTTPS_PORT=5443    # Web/UI via https://10.0.0.15:5443
+HTTPS_PORT=5443    # Web/UI via https://10.0.1.10:5443
 HTTP_PORT=5080
 
 # --- App secrets ------------------------------------------------------------
-# Wird gegen den externen Postgres auf 10.0.0.15 verwendet (DB "FleetForge").
+# Ohne DATABASE_URL startet der Deployer einen eigenen Postgres-Container ff-db
-DATABASE_URL=postgresql://admin:Start01!@10.0.0.15:5432/FleetForge?schema=public
+# (Volume ff-db-data). DATABASE_URL nur setzen, um eine externe DB zu nutzen.
+DB_PASSWORD=<starkes-db-passwort>
+#DATABASE_URL=postgresql://user:pass@host:5432/FleetForge?schema=public
 JWT_SECRET=<starkes-secret>

infrastructure/deploy/deploy.sh

@@ -13,6 +13,8 @@ set -uo pipefail
 #   <host>/src:/app/src          persistent git checkout + state
 #   ff-certs:/certs              TLS certificates named volume (rw)
 #   ff-nginx-conf:/cfg           shared nginx config named volume (rw)
+# The database runs as container ff-db (postgres, volume ff-db-data) unless an
+# external DATABASE_URL is given.
 #   create: docker volume create ff-certs; docker volume create ff-nginx-conf
 # ============================================================================
 
@@ -25,12 +27,16 @@ GIT_USER="${GIT_USER:-Pepe44DEV}"
 GIT_TOKEN="${GIT_TOKEN:-}"
 GIT_BRANCH="${GIT_BRANCH:-master}"
 POLL_INTERVAL="${POLL_INTERVAL:-300}"
-HOST_IP="${HOST_IP:-10.0.0.15}"
+HOST_IP="${HOST_IP:-10.0.1.10}"
 API_PORT="${API_PORT:-3005}"
 HTTPS_PORT="${HTTPS_PORT:-5443}"
 HTTP_PORT="${HTTP_PORT:-5080}"
 NETWORK="${NETWORK:-fleetforge-net}"
 
+DB_IMAGE="${DB_IMAGE:-postgres:16-alpine}"
+DB_NAME="${DB_NAME:-fleetforge}"
+DB_USER="${DB_USER:-fleetforge}"
+DB_PASSWORD="${DB_PASSWORD:-}"
 DATABASE_URL="${DATABASE_URL:-}"
 JWT_SECRET="${JWT_SECRET:-}"
 
@@ -42,7 +48,13 @@ CERT_DIR=/certs
 
 # Basic checks ----------------------------------------------------------------
 [ -z "$GIT_TOKEN" ] && die "GIT_TOKEN ist nicht gesetzt"
-[ -z "$DATABASE_URL" ] && die "DATABASE_URL ist nicht gesetzt"
+if [ -z "$DATABASE_URL" ]; then
+  [ -z "$DB_PASSWORD" ] && die "DB_PASSWORD (oder DATABASE_URL) ist nicht gesetzt"
+  USE_LOCAL_DB=1
+  DATABASE_URL="postgresql://$DB_USER:$DB_PASSWORD@ff-db:5432/$DB_NAME?schema=public"
+else
+  USE_LOCAL_DB=0
+fi
 [ -z "$JWT_SECRET" ] && die "JWT_SECRET ist nicht gesetzt"
 command -v docker >/dev/null || die "docker CLI fehlt"
 docker info >/dev/null 2>&1 || die "docker socket nicht erreichbar"
@@ -54,11 +66,11 @@ CORS_ORIGINS="https://$HOST_IP:$HTTPS_PORT,http://$HOST_IP:$API_PORT"
 clone_or_pull() {
   if [ ! -d "$SRC/.git" ]; then
     log "initial clone: $GIT_REMOTE ($GIT_BRANCH)"
-    git clone --depth 1 --branch "$GIT_BRANCH" --single-branch "$AUTH_URL" "$SRC"
+    git clone --depth 1 --branch "$GIT_BRANCH" --single-branch "$AUTH_URL" "$SRC" >&2 || return 1
   else
-    git -C "$SRC" fetch origin "$GIT_BRANCH"
+    git -C "$SRC" fetch origin "$GIT_BRANCH" >&2 || return 1
-    git -C "$SRC" reset --hard "origin/$GIT_BRANCH"
+    git -C "$SRC" reset --hard "origin/$GIT_BRANCH" >&2 || return 1
-    git -C "$SRC" clean -fd
+    git -C "$SRC" clean -fd >&2
   fi
   git -C "$SRC" rev-parse "origin/$GIT_BRANCH"
 }
@@ -68,6 +80,26 @@ ensure_network() {
   docker network inspect "$NETWORK" >/dev/null 2>&1 || docker network create "$NETWORK"
 }
 
+ensure_db() {
+  [ "$USE_LOCAL_DB" = 1 ] || return 0
+  docker volume create ff-db-data >/dev/null 2>&1 || true
+  if [ "$(docker inspect -f '{{.State.Running}}' ff-db 2>/dev/null)" != "true" ]; then
+    log "starting database container ff-db ($DB_IMAGE)"
+    docker rm -f ff-db >/dev/null 2>&1 || true
+    docker run -d --name ff-db --restart unless-stopped --network "$NETWORK" \
+      -e "POSTGRES_DB=$DB_NAME" \
+      -e "POSTGRES_USER=$DB_USER" \
+      -e "POSTGRES_PASSWORD=$DB_PASSWORD" \
+      -v ff-db-data:/var/lib/postgresql/data \
+      "$DB_IMAGE" || die "ff-db start failed"
+  fi
+  for i in $(seq 1 30); do
+    docker exec ff-db pg_isready -U "$DB_USER" -d "$DB_NAME" >/dev/null 2>&1 && return 0
+    sleep 2
+  done
+  die "ff-db not ready"
+}
+
 ensure_certs() {
   docker volume create ff-certs >/dev/null 2>&1 || true
   if [ ! -f "$CERT_DIR/fleetforge.pem" ] || [ ! -f "$CERT_DIR/fleetforge-key.pem" ]; then
@@ -92,7 +124,7 @@ build_images() {
   [ $? -eq 0 ] || die "api builder build failed"
 
   log "running migrations + seed"
-  docker run --rm -e "DATABASE_URL=$DATABASE_URL" fleetforge/api:builder \
+  docker run --rm --network "$NETWORK" -e "DATABASE_URL=$DATABASE_URL" fleetforge/api:builder \
     sh -c "cd /app/apps/api && pnpm migrate && pnpm seed"
   [ $? -eq 0 ] || die "migrate/seed failed"
 
@@ -171,8 +203,9 @@ wait_for_health() {
 
 # --- Deploy ----------------------------------------------------------------------
 deploy() {
-  build_images
   ensure_network
+  ensure_db
+  build_images
   ensure_certs
   run_containers
   wait_for_health || return 1