From c98260afc9ea46abd556328fd464af834e84dde4 Mon Sep 17 00:00:00 2001 From: Kevin Veen-Birkenbach Date: Mon, 10 Aug 2026 12:46:56 +0200 Subject: [PATCH] fix(mastodon): distribute the force_ssl override and give migrate its volumes Two independent defects kept mastodon_mastodon from converging; either alone leaves the stack red. meta/volumes.yml declared force_ssl_override as type: bind pointing at a host path, but tasks/01_overrides.yml writes that file with plain file/copy and no delegate_to, so it exists only where the play ran. Every worker placement was refused before container create: Shutdown Rejected invalid mount config for type "bind": bind source path does not exist: .../overrides/zzz_disable_force_ssl.rb type: config is the swarm-distributable form and what svc-dns-unbound, web-app-listmonk, web-app-n8n and web-app-decidim already use for small mounted files, each with mode 0444. Separately, compose.yml.j2 rendered the migrate service as the only one without with_volumes=true -- mastodon and sidekiq both pass it. So migrate never received 00_oidc_http_discovery.rb, ran OIDC discovery over HTTPS at boot and died with "tlsv1 unrecognized name". Fixing only the mount would have unblocked placement and still left the stack short of converged. Co-Authored-By: Claude Opus 5 (1M context) --- roles/web-app-mastodon/meta/volumes.yml | 3 ++- roles/web-app-mastodon/templates/compose.yml.j2 | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/roles/web-app-mastodon/meta/volumes.yml b/roles/web-app-mastodon/meta/volumes.yml index 911eca14db..5d54df25ce 100644 --- a/roles/web-app-mastodon/meta/volumes.yml +++ b/roles/web-app-mastodon/meta/volumes.yml @@ -9,8 +9,9 @@ data: target: /mastodon/public/system force_ssl_override: - type: bind + type: config source: "{{ [lookup('container', 'web-app-mastodon', 'directories.instance'), 'overrides', 'zzz_disable_force_ssl.rb'] | path_join }}" + mode: "0444" mounts: - service: mastodon target: /opt/mastodon/config/initializers/zzz_disable_force_ssl.rb diff --git a/roles/web-app-mastodon/templates/compose.yml.j2 b/roles/web-app-mastodon/templates/compose.yml.j2 index 393b62d5b4..d7dbc899fc 100644 --- a/roles/web-app-mastodon/templates/compose.yml.j2 +++ b/roles/web-app-mastodon/templates/compose.yml.j2 @@ -34,7 +34,7 @@ {{ mastodon_service(MASTODON_SERVICE_NAME, MASTODON_CONTAINER, 'mastodon', 'bash -c "rm -f /mastodon/tmp/pids/server.pid; bundle exec rails s -p 3000"', ports_key='http', with_volumes=true) }} {{ mastodon_service(MASTODON_STREAMING_SERVICE_NAME, MASTODON_STREAMING_CONTAINER, 'streaming', 'node ./streaming', ports_key='websocket') }} {{ mastodon_service(MASTODON_SIDEKIQ_SERVICE_NAME, MASTODON_SIDEKIQ_CONTAINER, 'mastodon', 'bundle exec sidekiq', with_volumes=true) }} -{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', healthcheck=false, after_migrate=false, restart='on-failure') }} +{{ mastodon_service(MASTODON_MIGRATE_SERVICE_NAME, MASTODON_MIGRATE_CONTAINER, 'mastodon', 'bundle exec rails db:prepare', healthcheck=false, after_migrate=false, restart='on-failure', with_volumes=true) }} {{ lookup('compose_volumes', application_id) }} {{ lookup('compose_networks') }}