8986b21270 wrote the patch expression from the OTRS convention, looking for
`$Self->{'DatabasePw'} = '...';`. The file does not use that form. Now that
kix_kix_config persists, the line can be read instead of guessed:
01main:13: 'DatabasePw' => 'oo4ca3...',
A perl hash entry, the same shape friendica's php array uses, so the expression
becomes friendica's with a different key and terminator.
The wrong expression surfaced because of 2c4e0e18b, on its first run: the deploy
stopped with
FAILED: no line in 01main matches the patch expression
Before that commit the same deploy would have printed PATCHED and gone green while
01main kept its pre-rotation password -- which is exactly how friendica looked fixed
for months.
Checked against the real line rather than a sample: sed -E with the new expression
returns `'DatabasePw' => 'NEWPW',` and rc 0, and grep finds DatabasePw on that
line only.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
compose gave up on `dependency failed to start: container kix-backend is unhealthy`,
and the backend's own log names the reason:
psql -q -h postgres -p 5432 -U kix kix -c 'CREATE EXTENSION ...' -> succeeds
/opt/kix/bin/kix.Console.pl Maint::Config::Rebuild --allow-root -> FATAL:
password authentication failed for user "kix"
Two calls in a row, one working and one not, with the same database. psql takes its
password from PGPASSWORD; the perl layer takes it from /opt/kix/config/01main, and the
entrypoint's own `[ ! -f /opt/kix/config/01main ]` test reports that file missing on
every start.
/opt/kix/config was on no volume. Every recreated container therefore loses 01main,
re-enters the first-install path, and runs it against a database that is already
installed. The credential rotation between the sync and the async pass is only what
made the container get recreated; any redeploy does this.
Everything else was ruled out from the run rather than assumed: the ALTER USER landed
(changed: true, 22:18:44), the rendered env carried the same value (22:18:57), there is
exactly one postgres container and 192.168.200.2 is its address, and it stayed up and
healthy across the whole window.
Persisting the directory alone would trade one failure for another: the entrypoint runs
`ln -s '/opt/kix/conf.d/*' /opt/kix/config/` on every start, unquoted-glob-style but with
the glob quoted, so it creates a single dangling link named `*` -- and the second start
would find it there. The link points at a path with a literal asterisk and nothing reads
it, so clear_stale_conf_link.yml removes it on every node before the stack comes up.
The password patch declaration follows the friendica pattern and needs 2c4e0e18b to work
at all: its groups are extended-regex, which basic-regex sed rejected outright.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5