feat(infra): declare the ingest gateway's Postgres role in the deploy - #972
Merged
Makisuo merged 1 commit intoSep 21, 2026
Merged
Conversation
Planetscale.PostgresRole on prd's main branch, inheriting postgres, feeds its pooled 6432 URL to the fleet's maple-pg-url secret. Its id in the task env turns a replaced role into a rolling deploy before alchemy deletes the old role. MAPLE_INGEST_PG_URL stays only for stages with a fleet and no branch.
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
Makisuo
added this pull request to stack #974
September 21, 2026 22:55
Makisuo
added a commit
that referenced
this pull request
Sep 21, 2026
PR #972 fed the fleet the pooled URL alchemy renders for the new PlanetScale role. alchemy writes it with sslmode=verify-full, and the gateway's tokio-postgres 0.7.18 knows only disable/prefer/require, so every task on revision 9 of the prd task definition exited 1 at boot with 'Key store init error: invalid MAPLE_PG_URL: invalid connection string'. ECS kept the revision 8 tasks serving, and the deploy of 3b300e6 failed on ServiceDidNotStabilize after 28 minutes. Rewrite the mode to require before it reaches the secret. The gateway's rustls connector verifies the chain and the hostname under require anyway, so the wire guarantee is unchanged.
Makisuo
added a commit
that referenced
this pull request
Sep 21, 2026
…se (#979) PR #972 fed the fleet the pooled URL alchemy renders for the new PlanetScale role. alchemy writes it with sslmode=verify-full, and the gateway's tokio-postgres 0.7.18 knows only disable/prefer/require, so every task on revision 9 of the prd task definition exited 1 at boot with 'Key store init error: invalid MAPLE_PG_URL: invalid connection string'. ECS kept the revision 8 tasks serving, and the deploy of 3b300e6 failed on ServiceDidNotStabilize after 28 minutes. Rewrite the mode to require before it reaches the secret. The gateway's rustls connector verifies the chain and the hostname under require anyway, so the wire guarantee is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #970 (retarget to
mainonce it lands). Replaces tonight's hand-made credential rotation with the stock resource.Planetscale.PostgresRole("ingest-gateway", …)on prd'smainbranch, inheritingpostgres, sits next to thePostgresBranchinalchemy.run.ts. The ingest stack takes it asdbRole: its pooled 6432connectionUrlPooledbecomes the fleet'smaple-pg-urlsecret through the existingsecretFromhelper, and its id goes into the task env asMAPLE_PG_ROLE_ID.Why the id is in the env. Changing the role's props is a replace. Alchemy creates the successor first and garbage-collects the old generation after the apply, but ECS tasks read a secret only at start. The id in the env changes the task definition, so the service rolls onto the updated secret inside the same deploy, before the old role goes.
Stage gating. The role exists only where
dbSchemadoes (prd). PR previews deploy a fleet with no database branch and keep readingMAPLE_INGEST_PG_URLfrom Infisical;bun devleaves the PlanetScale provider out, as before.Verified.
tsc -p tsconfig.alchemy.jsonand oxlint. A read-onlyalchemy plan --stage prdwith Infisical prod secrets shows[ingest-gateway] create,[maple-pg-url] update,[ingest-ec2] update; everything else in that plan is the usual per-deploy churn from main.After the first prd deploy: confirm
pg_stat_activityshows the alchemy role, then delete the two hand-minted rolesingest-gateway-2026-09-21(s302if6nn58u) andrailway-2026-06-23(rg068pnctlxw), and dropMAPLE_INGEST_PG_URLfrom Infisical prod only (the dev slug still serves previews).🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is disabled.