From a4fb62c86c37f50f794d220e6292382eaf98e302 Mon Sep 17 00:00:00 2001
From: Arnaud <anelissen@solem.fr>
Date: Wed, 1 Jul 2026 16:23:54 +0200
Subject: [PATCH] feat(deploy): auto-run db migrations + seed on stack deploy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a migrator Dockerfile target (drizzle-kit migrate + tier-definitions
seed, both idempotent) and wire it as a one-shot compose service that web
waits on via service_completed_successfully. No more manual exec step
after first deploy — runs safely on every redeploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 Dockerfile              |  6 ++++++
 docker/DEPLOY.md        | 12 +++++-------
 docker/compose.prod.yml | 16 ++++++++++++++--
 3 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 7ffc213..de66a52 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,12 @@ COPY packages/db/package.json packages/db/package.json
 COPY packages/api-types/package.json packages/api-types/package.json
 RUN pnpm install --frozen-lockfile
 
+# ---- migrator: applies drizzle migrations + seeds tier definitions ----
+FROM deps AS migrator
+WORKDIR /repo/packages/db
+COPY packages/db .
+CMD ["sh", "-c", "pnpm migrate && pnpm seed"]
+
 # ---- build ----
 FROM base AS build
 WORKDIR /repo
diff --git a/docker/DEPLOY.md b/docker/DEPLOY.md
index 95f639a..0132f9a 100644
--- a/docker/DEPLOY.md
+++ b/docker/DEPLOY.md
@@ -29,14 +29,12 @@ OPENROUTER_API_KEY=
 5. Deploy the stack. Portainer builds `web` from the repo's root `Dockerfile` (see `build:` in compose.prod.yml) — no separate image push needed.
 6. Enable GitOps updates (webhook or polling) on the stack if you want redeploy-on-push.
 
-## First deploy: run migrations + seed
+## Migrations + seed
 
-Compose does not auto-migrate. After the stack is up, exec into the `web` container once (or run a one-off container against the same network) with `DATABASE_URL` set, then:
-
-```bash
-pnpm db:migrate
-pnpm db:seed   # tier definitions — first deploy only
-```
+Handled automatically. The `migrate` service builds from the `migrator` Dockerfile target,
+runs `drizzle-kit migrate` then the tier-definitions seed, and exits; `web` waits for it to
+complete successfully before starting (`depends_on: migrate: condition: service_completed_successfully`).
+Both are idempotent — safe to re-run on every stack redeploy, not just the first one.
 
 ## Traefik (separate LXC, file provider)
 
diff --git a/docker/compose.prod.yml b/docker/compose.prod.yml
index 64dee0c..71eb78c 100644
--- a/docker/compose.prod.yml
+++ b/docker/compose.prod.yml
@@ -49,6 +49,18 @@ services:
         exit 0;
       "
 
+  migrate:
+    build:
+      context: ..
+      dockerfile: Dockerfile
+      target: migrator
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
   web:
     build:
       context: ..
@@ -73,8 +85,8 @@ services:
       # published on portainer LXC host; traefik (other LXC) routes here via <this-lxc-ip>:${WEB_PORT}
       - "${WEB_PORT:-3000}:3000"
     depends_on:
-      postgres:
-        condition: service_healthy
+      migrate:
+        condition: service_completed_successfully
       redis:
         condition: service_started
       minio: