Sync the self-hosting stack

2026-10-22 08:56:35 +02:00
parent 6a2b67364b
commit b1fa205ebf
7 changed files with 105 additions and 110 deletions
@@ -2,9 +2,8 @@
 #
 # A JOB, and deliberately neither of the two alternatives:
 #
-#   NOT an initContainer. It would run once per pod — which is exactly the bug this replaces, where
-#   every API container ran `prisma db push` at boot and N replicas raced the same DDL while the
-#   previous generation was still selecting the columns being altered.
+#   NOT an initContainer. It would run once per pod: N replicas would race the same DDL while the
+#   previous generation is still selecting the columns being altered.
 #
 #   NOT a leader election inside the API. A Job is the primitive built for run-once work: it has an
 #   observable status, a bounded number of retries, and a failure that stops the rollout instead of
@@ -89,10 +88,9 @@ spec:
                secretKeyRef:
                  name: jarvis-secrets
                  key: DATABASE_URL
-            # Off, and it should stay off between deliberate acts. `prisma db push` used to run with
-            # `--accept-data-loss` at every boot, which meant an upgrade could destroy a column with
-            # nobody having decided to — survivable on one container, not during a rolling update
-            # where the previous generation is still selecting it.
+            # Off, and it should stay off between deliberate acts. Left on, every upgrade could
+            # destroy a column with nobody having decided to — survivable on one container, not
+            # during a rolling update where the previous generation is still selecting it.
            #
            # Without it a pending migration that drops a table or a column is REFUSED, naming them,
            # and fails the Job — so the rollout stops and nothing is serving a half-migrated schema.