FEAT: Added Database To CMS Serbove

infrastructure/main.go

@@ -95,6 +95,11 @@ type envVar struct {
 // taskRole is optional (nil means no TaskRoleArn is set, i.e. the container
 // gets no AWS identity of its own beyond execRole's pull/logs permissions);
 // extraEnv is appended to the container's environment on top of the DB_* vars.
+// When runMigrations is true, the task also gets a non-essential
+// "<name>-migrate" container running the same image with `command: ["migrate"]`,
+// and the main container depends on it with condition COMPLETE — the ECS
+// equivalent of a Kubernetes init container, ensuring DB migrations finish
+// before the service starts accepting traffic.
 func deployFargateService(
 	ctx *pulumi.Context,
 	name string,
@@ -110,6 +115,7 @@ func deployFargateService(
 	dbAddress pulumi.StringOutput,
 	dbPort pulumi.IntOutput,
 	dbPassword *random.RandomPassword,
+	runMigrations bool,
 ) (*ecr.Repository, *ecs.Service, *lb.LoadBalancer, error) {
 	alb, err := lb.NewLoadBalancer(ctx, name+"-alb", &lb.LoadBalancerArgs{
 		LoadBalancerType: pulumi.String("application"),
@@ -219,37 +225,66 @@ func deployFargateService(
 			dbHost := args[3].(string)
 			dbPort := args[4].(int)
 
-			environment := []map[string]string{
+			dbEnvironment := []map[string]string{
 				{"name": "DB_HOST", "value": dbHost},
 				{"name": "DB_PORT", "value": fmt.Sprintf("%d", dbPort)},
 				{"name": "DB_NAME", "value": name},
 				{"name": "DB_USER", "value": name},
 			}
+			dbSecrets := []map[string]string{
+				{"name": "DB_PASSWORD", "valueFrom": secretArn},
+			}
+
+			environment := append([]map[string]string{}, dbEnvironment...)
 			for i, ev := range extraEnv {
 				environment = append(environment, map[string]string{"name": ev.Name, "value": args[5+i].(string)})
 			}
 
-			def := []map[string]any{
-				{
-					"name":  name,
-					"image": image,
-					"portMappings": []map[string]any{
-						{"containerPort": containerPort, "protocol": "tcp"},
-					},
-					"environment": environment,
-					"secrets": []map[string]string{
-						{"name": "DB_PASSWORD", "valueFrom": secretArn},
+			mainContainer := map[string]any{
+				"name":  name,
+				"image": image,
+				"portMappings": []map[string]any{
+					{"containerPort": containerPort, "protocol": "tcp"},
+				},
+				"environment": environment,
+				"secrets":     dbSecrets,
+				"logConfiguration": map[string]any{
+					"logDriver": "awslogs",
+					"options": map[string]string{
+						"awslogs-group":         logGroupName,
+						"awslogs-region":        awsRegion,
+						"awslogs-stream-prefix": name,
 					},
+				},
+			}
+
+			def := []map[string]any{}
+
+			if runMigrations {
+				migrateContainerName := name + "-migrate"
+				def = append(def, map[string]any{
+					"name":        migrateContainerName,
+					"image":       image,
+					"essential":   false,
+					"command":     []string{"migrate"},
+					"environment": dbEnvironment,
+					"secrets":     dbSecrets,
 					"logConfiguration": map[string]any{
 						"logDriver": "awslogs",
 						"options": map[string]string{
 							"awslogs-group":         logGroupName,
 							"awslogs-region":        awsRegion,
-							"awslogs-stream-prefix": name,
+							"awslogs-stream-prefix": migrateContainerName,
 						},
 					},
-				},
+				})
+				mainContainer["dependsOn"] = []map[string]string{
+					{"containerName": migrateContainerName, "condition": "COMPLETE"},
+				}
 			}
+
+			def = append(def, mainContainer)
+
 			b, err := json.Marshal(def)
 			return string(b), err
 		},
@@ -761,7 +796,7 @@ func main() {
 
 		cmsRepo, cmsService, cmsAlb, err := deployFargateService(ctx, "cms", 8081,
 			cluster, execRole, cmsTaskRole, cmsExtraEnv, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
-			db.Address, db.Port, cmsPassword)
+			db.Address, db.Port, cmsPassword, true)
 		if err != nil {
 			return err
 		}
@@ -788,7 +823,7 @@ func main() {
 
 		discoveryRepo, discoveryService, discoveryAlb, err := deployFargateService(ctx, "discovery", 8080,
 			cluster, execRole, nil, nil, vpc.Id, subnets.Ids, albSecurityGroup, serviceSecurityGroup,
-			db.Address, db.Port, discoveryPassword)
+			db.Address, db.Port, discoveryPassword, false)
 		if err != nil {
 			return err
 		}