TK-10001: harden deploy-kamatera.sh — pre-drop pg_dump backup (recoverable full-mirror) + WORKER_HEALTH_PORT=9966 in remote .env (worker was defaulting to 9976, colliding with admin)

66c7ded30ec569d92f7c2c5c9845cc152c352414 · 2026-08-11 11:56:18 -0700 · Steve

Files touched

M deploy-kamatera.sh

Diff

commit 66c7ded30ec569d92f7c2c5c9845cc152c352414
Author: Steve <steve@designerwallcoverings.com>
Date:   Tue Aug 11 11:56:18 2026 -0700

    TK-10001: harden deploy-kamatera.sh — pre-drop pg_dump backup (recoverable full-mirror) + WORKER_HEALTH_PORT=9966 in remote .env (worker was defaulting to 9976, colliding with admin)
---
 deploy-kamatera.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/deploy-kamatera.sh b/deploy-kamatera.sh
index 4df50b9e..fb221eed 100755
--- a/deploy-kamatera.sh
+++ b/deploy-kamatera.sh
@@ -24,7 +24,17 @@ chmod 600 "$EK"
 DBPW=$(grep '^HOMESONSPEC_DB_PW='      "$EK" | tail -1 | cut -d= -f2)
 ADMIN_AUTH=$(grep '^HOMESONSPEC_ADMIN_AUTH=' "$EK" | tail -1 | cut -d= -f2-)
 
-echo "──────── 2/6  Postgres role + CLEAN db ────────"
+echo "──────── 2/6  BACKUP existing Kamatera DB, then role + CLEAN db ────────"
+# SAFETY (TK-10001 hardening): back up the live homesonspec DB BEFORE the DROP so the
+# full-mirror overwrite is recoverable. Aborts if a DB exists but its dump is suspiciously
+# small. On a first deploy (no DB yet) it skips gracefully.
+ssh $KH "if sudo -u postgres psql -tAc \"SELECT 1 FROM pg_database WHERE datname='homesonspec'\" | grep -q 1; then
+  mkdir -p /root/backups; TS=\$(date +%Y%m%d-%H%M%S); F=/root/backups/homesonspec-pre-deploy-\$TS.sql.gz
+  sudo -u postgres pg_dump -d homesonspec | gzip > \$F
+  SZ=\$(stat -c%s \$F 2>/dev/null || echo 0); echo \"  backup → \$F (\$SZ bytes)\"
+  if [ \"\$SZ\" -lt 10000 ]; then echo '  ✗ backup suspiciously small — ABORT before DROP.'; exit 1; fi
+  echo '  ✓ pre-drop backup verified (rollback: gunzip <\$F | sudo -u postgres psql -d homesonspec)'
+else echo '  (no existing homesonspec DB — first deploy, nothing to back up)'; fi"
 # Drop+recreate for a faithful mirror (restoring onto an existing DB duplicates rows / fails PKs).
 ssh $KH "sudo -u postgres psql -v ON_ERROR_STOP=1 \
   -c \"DO \\\$\\\$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname='homesonspec') THEN CREATE ROLE homesonspec LOGIN PASSWORD '$DBPW'; ELSE ALTER ROLE homesonspec PASSWORD '$DBPW'; END IF; END \\\$\\\$;\" \
@@ -53,6 +63,7 @@ DATABASE_URL=postgresql://homesonspec:$DBPW@localhost/homesonspec
 BASIC_AUTH=$ADMIN_AUTH
 BUILDER_IMAGES_ENABLED=1
 SNAPSHOT_DIR=$REMOTE/var/snapshots
+WORKER_HEALTH_PORT=9966
 NODE_ENV=production
 EOF
 ln -sf $REMOTE/.env $REMOTE/apps/web/.env

← d4ac2fbd TK-10001: build M/I Homes + Smith Douglas adapters (national · back to Homesonspec · TK-10001: pipeline/verify scripts load root .env via tsx --e 4ee4bf92 →