From acbf144329901b2238b01444073e758e9bd2d3ec Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Thu, 6 Aug 2026 00:12:34 +0200
Subject: [PATCH] fix: dynamic container discovery for verification +
 verify=False for SSL

---
 scripts/deploy.py | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/scripts/deploy.py b/scripts/deploy.py
index 00738da..f613667 100644
--- a/scripts/deploy.py
+++ b/scripts/deploy.py
@@ -564,11 +564,12 @@ def _wait_service_healthy(client: CoolifyClient, service_uuid: str, timeout: int
 
 
 def verify_http_health() -> StepResult:
-    """Verify the API is healthy via HTTP endpoint."""
+    """Verify the API is healthy via HTTP endpoint.
+    Uses verify=False to handle self-signed certs during Let's Encrypt provisioning."""
     print("  Verifying API health via HTTP...")
     url = f"{APP_DOMAIN}/api/v1/health"
     try:
-        resp = httpx.get(url, timeout=30, follow_redirects=True)
+        resp = httpx.get(url, timeout=30, follow_redirects=True, verify=False)
         if resp.status_code == 200:
             body = resp.json() if resp.headers.get("content-type", "").startswith("application/json") else resp.text
             if isinstance(body, dict) and body.get("status", "").lower() in ("healthy", "ok"):
@@ -580,7 +581,8 @@ def verify_http_health() -> StepResult:
 
 
 def verify_login() -> StepResult:
-    """Verify login works by sending a test login request."""
+    """Verify login works by sending a test login request.
+    Uses verify=False to handle self-signed certs during Let's Encrypt provisioning."""
     if not LOGIN_EMAIL or not LOGIN_PASSWORD:
         return StepResult(True, "Login test skipped (no credentials provided)")
     print("  Verifying login...")
@@ -592,6 +594,7 @@ def verify_login() -> StepResult:
             headers={"Origin": APP_DOMAIN},
             timeout=30,
             follow_redirects=True,
+            verify=False,
         )
         if resp.status_code == 200:
             body = resp.json()
@@ -606,16 +609,32 @@ def verify_login() -> StepResult:
         return StepResult(False, f"Login error: {e}")
 
 
-def verify_alembic() -> StepResult:
-    """Verify Alembic migration head via SSH (Coolify API doesn't expose DB internals)."""
-    print("  Verifying Alembic migration head...")
+def _find_pg_container() -> str | None:
+    """Dynamically find the PostgreSQL container name via SSH.
+    Works for both docker-compose stacks (postgres-<uuid>) and standalone services (crm-postgres)."""
     code, output = ssh_run(
-        'docker exec crm-postgres psql -U crm_user -d crm_db -t -c '
+        'docker ps --format "{{.Names}}" 2>/dev/null | grep -iE "postgres" | grep -v "coolify-db" | head -1'
+    )
+    container = output.strip()
+    if container:
+        return container
+    # Fallback: try the old hardcoded name
+    return "crm-postgres"
+
+
+def verify_alembic() -> StepResult:
+    """Verify Alembic migration head via SSH (Coolify API doesn't expose DB internals).
+    Dynamically finds the PostgreSQL container name — works for docker-compose stacks
+    where the container name is postgres-<uuid> (not hardcoded crm-postgres)."""
+    print("  Verifying Alembic migration head...")
+    pg_container = _find_pg_container()
+    code, output = ssh_run(
+        f'docker exec {pg_container} psql -U crm_user -d crm_db -t -c '
         '"SELECT version_num FROM alembic_version" 2>/dev/null'
     )
     version = output.strip()
     if not version:
-        return StepResult(False, "Could not read Alembic version")
+        return StepResult(False, f"Could not read Alembic version (container: {pg_container})")
     version_ok = version >= "0085"
     return StepResult(
         version_ok,
@@ -625,15 +644,18 @@ def verify_alembic() -> StepResult:
 
 
 def verify_rls() -> StepResult:
-    """Verify RLS is active on tenant tables via SSH (read-only check)."""
+    """Verify RLS is active on tenant tables via SSH (read-only check).
+    Dynamically finds the PostgreSQL container name — works for docker-compose stacks
+    where the container name is postgres-<uuid> (not hardcoded crm-postgres)."""
     print("  Verifying RLS tables...")
+    pg_container = _find_pg_container()
     code, output = ssh_run(
-        'docker exec crm-postgres psql -U crm_user -d crm_db -t -c '
+        f'docker exec {pg_container} psql -U crm_user -d crm_db -t -c '
         '"SELECT count(*) FROM pg_class WHERE relrowsecurity=true AND relforcerowsecurity=true" 2>/dev/null'
     )
     rls_count = output.strip()
     if not rls_count.isdigit():
-        return StepResult(False, f"Could not read RLS table count: {output}")
+        return StepResult(False, f"Could not read RLS table count (container: {pg_container}): {output}")
     count = int(rls_count)
     rls_ok = count >= 90
     return StepResult(