containerization patch

compose.yaml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   db:
     image: postgres:16-alpine
@@ -15,6 +13,30 @@ services:
     networks:
       - elephant_net
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  migration:
+    image: postgres:16-alpine
+    container_name: elephant_migration
+    volumes:
+      - ./server/migrations:/migrations:z
+      - ./server/migrate.sh:/migrate.sh:z
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
+      POSTGRES_DB: ${POSTGRES_DB}
+      POSTGRES_HOST: db
+      POSTGRES_PORT: 5432
+    entrypoint: ["/bin/sh", "/migrate.sh"]
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - elephant_net
 
   server:
     build:
@@ -36,7 +58,8 @@ services:
       - ARGON_ITERATIONS=${ARGON_ITERATIONS}
       - ARGON_PARALLELISM=${ARGON_PARALLELISM}
     depends_on:
-      - db
+      migration:
+        condition: service_completed_successfully
     networks:
       - elephant_net
     restart: unless-stopped

server/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:alpine3.23 AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /app
 
@@ -8,16 +8,18 @@ RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o elephant-server .
 
-FROM alpine:latest
+FROM alpine:3.20
+
 RUN apk --no-cache add ca-certificates tzdata
-WORKDIR /root/
 
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+WORKDIR /app
 
 COPY --from=builder /app/elephant-server .
-COPY --from=builder /app/migrations ./migrations
-COPY entrypoint.sh .
-RUN chmod +x entrypoint.sh
+
+RUN chown -R appuser:appgroup /app
+USER appuser
 
 EXPOSE 3000
 
-CMD ["./entrypoint.sh"]
+CMD ["./elephant-server"]

server/migrate.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -e
+
+DB_URL="postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@${POSTGRES_HOST}:${POSTGRES_PORT}/${POSTGRES_DB}"
+
+echo "Verifying migration registry..."
+psql "${DB_URL}" << 'SQL'
+CREATE TABLE IF NOT EXISTS schema_migrations (
+    filename TEXT PRIMARY KEY,
+    applied_at TIMESTAMPTZ DEFAULT NOW()
+);
+SQL
+
+migration_exists=0
+for f in /migrations/*_up.sql; do
+    [ -e "$f" ] && migration_exists=1 && break
+done
+
+if [ "$migration_exists" = 1 ]; then
+    for migration in /migrations/*_up.sql; do
+        filename=$(basename "$migration")
+        already_applied=$(psql "${DB_URL}" -tAc \
+            "SELECT COUNT(*) FROM schema_migrations WHERE filename = '${filename}'")
+
+        if [ "$already_applied" = "0" ]; then
+            echo "Applying: ${filename}"
+            psql "${DB_URL}" -f "$migration"
+            psql "${DB_URL}" -c "INSERT INTO schema_migrations (filename) VALUES ('${filename}')"
+        else
+            echo "Skipping (Already Applied): ${filename}"
+        fi
+    done
+else
+    echo "No migration files found matching *_up.sql"
+fi
+
+echo "Database migrations updated successfully."