From b89491353e8449cb35141628ffe268bf44add592 Mon Sep 17 00:00:00 2001 From: Martin Noble Date: Mon, 22 Jun 2026 15:13:52 +0100 Subject: [PATCH] feat(config): assemble Postgres DB from component env vars Add a component branch to the DB selection in config/settings.py between DATABASE_URL and the SQLite default. When PANDDA_DB_HOST is set, build the Postgres config from PANDDA_DB_* parts so the password arrives as its own env var (a Container App secretRef -> Key Vault reference) instead of being baked into a full-URL secret. Precedence: DATABASE_URL > PANDDA_DB_* > SQLite. Fully backward compatible: desktop/SQLite and DATABASE_URL deploys are unchanged. No new deps (psycopg already present). Document the new vars in docs/CLOUD_DEPLOYMENT.md. Co-Authored-By: Claude Opus 4.8 (1M context) --- config/settings.py | 15 +++++++++++++++ docs/CLOUD_DEPLOYMENT.md | 1 + 2 files changed, 16 insertions(+) diff --git a/config/settings.py b/config/settings.py index 0ec821e..531bac1 100644 --- a/config/settings.py +++ b/config/settings.py @@ -74,6 +74,21 @@ DATABASES["default"] = dj_database_url.parse( _DATABASE_URL, conn_max_age=600 ) +elif os.environ.get("PANDDA_DB_HOST"): + # Cloud Postgres assembled from components, so the password arrives as its + # own env var (a Container App secretRef -> Key Vault reference) rather than + # being baked into a full-URL secret. Precedence: DATABASE_URL > components + # > SQLite. + DATABASES["default"] = { + "ENGINE": "django.db.backends.postgresql", + "HOST": os.environ["PANDDA_DB_HOST"], + "PORT": os.environ.get("PANDDA_DB_PORT", "5432"), + "NAME": os.environ.get("PANDDA_DB_NAME", "reinspect"), + "USER": os.environ["PANDDA_DB_USER"], + "PASSWORD": os.environ.get("PANDDA_DB_PASSWORD", ""), + "CONN_MAX_AGE": 600, + "OPTIONS": {"sslmode": os.environ.get("PANDDA_DB_SSLMODE", "require")}, + } # Where ingested PanDDA project trees live, so the API can stream artifacts. # Per-project ``source_root`` (set at ingest) is the primary resolver; this is diff --git a/docs/CLOUD_DEPLOYMENT.md b/docs/CLOUD_DEPLOYMENT.md index 4a7c53b..54d5b6d 100644 --- a/docs/CLOUD_DEPLOYMENT.md +++ b/docs/CLOUD_DEPLOYMENT.md @@ -206,6 +206,7 @@ boot against an already-migrated DB (the idempotent re-run is a no-op). | `PANDDA_HOST` | bind address — set `0.0.0.0` in a container (default `127.0.0.1`) | | `PANDDA_PORT` | listen port (default `8000`) | | `DATABASE_URL` | `postgres://user:pass@host:5432/db` — the multi-tenant DB. **Unset ⇒ SQLite** at `PANDDA_DB_PATH` (fine for single-replica/demo; mount a volume) | +| `PANDDA_DB_*` | alternative to `DATABASE_URL`: assemble Postgres from components so the password is its own secret (a Container App `secretRef` → Key Vault ref) and no full-URL secret is minted. `PANDDA_DB_HOST` (presence selects this branch), `PANDDA_DB_USER` (both required); `PANDDA_DB_PORT` (5432), `PANDDA_DB_NAME` (`reinspect`), `PANDDA_DB_PASSWORD` (`""`), `PANDDA_DB_SSLMODE` (`require`). Precedence: `DATABASE_URL` > `PANDDA_DB_*` > SQLite | | `PANDDA_DATA_ROOT` / `PANDDA_JOBS_ROOT` | the mounted projects share (e.g. `/mnt/projects`) for artifacts + job/run workdirs | **Auth (opt-in; see §1)** — runtime (backend): `PANDDA_AUTH_BACKEND=ccp4i2`,