From 9b0c0da9cbfd36a3dafa17521bc7df8b5c777048 Mon Sep 17 00:00:00 2001 From: Kunthawat Greethong Date: Tue, 1 Sep 2026 14:31:31 +0700 Subject: [PATCH] deploy: auto-bootstrap first super_admin on startup (ADMIN_* env) With this, a fresh deploy provisions its own first super_admin automatically: after alembic migrations the entrypoint runs scripts/bootstrap_super_admin.py when ADMIN_EMAIL + ADMIN_PASSWORD are set (idempotent, never overwrites an existing password; org name/slug optional). This removes the chicken-egg where login needs a user but no UI/seed could create the very first one. Optionally runs only when both env vars are present, so an existing deployment is unaffected. Verified: bash syntax ok; fresh DB produced org+password+ super_admin; re-run left the existing password unchanged. --- backend/docker_entrypoint.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/backend/docker_entrypoint.sh b/backend/docker_entrypoint.sh index 0f9221c..dfff104 100644 --- a/backend/docker_entrypoint.sh +++ b/backend/docker_entrypoint.sh @@ -32,5 +32,19 @@ echo "[entrypoint] Running database migrations (alembic upgrade head)..." uv run --frozen alembic upgrade head echo "[entrypoint] Migrations complete." +# Idempotent first-admin bootstrap. Only runs when ADMIN_EMAIL and +# ADMIN_PASSWORD are provided; it creates/updates a super_admin user and org +# (never overwrites an existing password). Optional in the image so a deployed +# container can self-provision its first super_admin on startup. +if [[ -n "${ADMIN_EMAIL:-}" && -n "${ADMIN_PASSWORD:-}" ]]; then + echo "[entrypoint] Bootstrapping first super_admin (${ADMIN_EMAIL})..." + uv run --frozen python scripts/bootstrap_super_admin.py \ + --email "${ADMIN_EMAIL}" --password "${ADMIN_PASSWORD}" \ + --org "${ADMIN_ORG_NAME:-Acme}" --slug "${ADMIN_ORG_SLUG:-}" + echo "[entrypoint] super_admin bootstrap complete." +else + echo "[entrypoint] ADMIN_EMAIL/ADMIN_PASSWORD not set; skipping auto bootstrap." +fi + echo "[entrypoint] Starting supervisord (nginx + backend + worker)..." exec /usr/bin/supervisord -n