Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Phase 1: Fix all critical release blockers (B1-B10)

Browse Source 
B1: Remove duplicate get_redis() — singleton no longer overwritten
B2: Plugin routes now enforce activation status via require_active_plugin()
B3: Fix UploadFile ForwardRef error — remove functools.wraps from wrap_plugin_route
B4: DMS upload uses true streaming via save_stream() instead of RAM accumulation
B5: Worker on_startup registers plugin event handlers + webhook dispatcher
B6: Implement send_password_reset_email job, remove raw token logging
B7: Webhook SSRF protection (IP validation, no redirects), secret removed from response
B8: RLS repair migration 0044 + separate crm_runtime DB user (NOSUPERUSER, NOBYPASSRLS)
B9: Fix .env.docker.example AUTH_SECRET → SECRET_KEY
B10: Remove Redis default password, remove exposed DB/Redis ports

Also: add frontend_url to config, add SMTP settings to .env.docker.example,
update prestart.sh to use MIGRATION_DATABASE_URL for alembic.
This commit is contained in:
Agent Zero
2026-07-26 20:45:42 +02:00
parent 7a14973c68
commit 5ec1fc9b05
32 changed files with 1781 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prestart.sh
+29 -4
View File
@@ -3,20 +3,45 @@
# prestart.sh — Container entrypoint for CRM API container
#
# Responsibilities:
# 1. Run Alembic DB migrations (alembic upgrade head).
# 2. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
# 1. Run Alembic DB migrations (alembic upgrade head) using the owner user.
# 2. Set the crm_runtime password (for RLS-enforced app access).
# 3. Start uvicorn as PID 1 (so signals like SIGTERM are forwarded correctly).
#
# Notes:
# - `set -e` ensures the container crashes loudly if migrations fail.
# - The ARQ worker runs in a separate container (see worker.sh / docker-compose).
# - Migrations use MIGRATION_DATABASE_URL (crm_user, owner, can bypass RLS).
# - The app uses DATABASE_URL (crm_runtime, NOSUPERUSER, NOBYPASSRLS).
# =============================================================================
set -e
echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head..."
alembic upgrade head
# Use MIGRATION_DATABASE_URL for alembic (falls back to DATABASE_URL for backwards compat)
export ALEMBIC_DATABASE_URL="${MIGRATION_DATABASE_URL:-$DATABASE_URL}"
# Configure alembic to use the migration database URL
export ALEMBIC_DATABASE_URL
echo "[prestart] $(date -u +%Y-%m-%dT%H:%M:%SZ) - Running alembic upgrade head (owner user)..."
# Temporarily override DATABASE_URL for alembic
DATABASE_URL="$ALEMBIC_DATABASE_URL" alembic upgrade head
echo "[prestart] DB migrations completed successfully."
# Set crm_runtime password if RUNTIME_DB_PASSWORD is set
if [ -n "$RUNTIME_DB_PASSWORD" ]; then
echo "[prestart] Setting crm_runtime password..."
# Parse the migration DB URL to get psql connection params
PGHOST=postgres
PGUSER="${POSTGRES_USER:-crm_user}"
PGDATABASE="${POSTGRES_DB:-crm_db}"
PGPASSWORD="$POSTGRES_PASSWORD"
export PGHOST PGUSER PGDATABASE PGPASSWORD
psql -c "ALTER ROLE crm_runtime WITH LOGIN PASSWORD '${RUNTIME_DB_PASSWORD}' NOSUPERUSER NOBYPASSRLS;" 2>/dev/null || \
echo "[prestart] WARNING: Could not set crm_runtime password (role may not exist yet)"
unset PGPASSWORD
echo "[prestart] crm_runtime password set."
fi
echo "[prestart] Starting uvicorn on 0.0.0.0:8000 (workers=1)..."
exec uvicorn app.main:app \
--host 0.0.0.0 \