From 6ebb5729646391d47c9282b160173a2f1b9ed667 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 21 Nov 2025 12:28:25 -0500 Subject: [PATCH 1/4] Remove tenant format specifier from Disk storage config --- config/storage.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/storage.yml b/config/storage.yml index 62fd8b002..c2557ee8f 100644 --- a/config/storage.yml +++ b/config/storage.yml @@ -1,10 +1,10 @@ test: service: Disk - root: <%= Rails.root.join("tmp/storage/%{tenant}") %> + root: <%= Rails.root.join("tmp/storage/files") %> local: service: Disk - root: <%= Rails.root.join("storage", "tenants", Rails.env, "%{tenant}", "files") %> + root: <%= Rails.root.join("storage", Rails.env, "files") %> devminio: service: S3 From a600faa0fc57bb920d007d8772f1399584730e20 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 21 Nov 2025 11:21:19 -0500 Subject: [PATCH 2/4] Update beta deployment and secrets config to use the production database. Note: - no jobs containers are running - we use a single cache db (not a DC-local one) --- .kamal/secrets.beta | 8 +++++++- config/deploy.beta.yml | 30 +++++++++++++++++++++++------- 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/.kamal/secrets.beta b/.kamal/secrets.beta index 9d9a33d9f..87583b01f 100644 --- a/.kamal/secrets.beta +++ b/.kamal/secrets.beta @@ -1,6 +1,12 @@ -SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Deployments/DASH_BASIC_AUTH_SECRET Beta/RAILS_MASTER_KEY) +SECRETS=$(kamal secrets fetch --adapter 1password --account basecamp --from Deploy/Fizzy Deployments/BASECAMP_REGISTRY_PASSWORD Deployments/DASH_BASIC_AUTH_SECRET Beta/RAILS_MASTER_KEY Beta/MYSQL_ALTER_PASSWORD Beta/MYSQL_ALTER_USER Beta/MYSQL_APP_PASSWORD Beta/MYSQL_APP_USER Beta/MYSQL_READONLY_PASSWORD Beta/MYSQL_READONLY_USER) GITHUB_TOKEN=$(gh config get -h github.com oauth_token) BASECAMP_REGISTRY_PASSWORD=$(kamal secrets extract BASECAMP_REGISTRY_PASSWORD $SECRETS) DASH_BASIC_AUTH_SECRET=$(kamal secrets extract DASH_BASIC_AUTH_SECRET $SECRETS) RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS) +MYSQL_ALTER_PASSWORD=$(kamal secrets extract MYSQL_ALTER_PASSWORD $SECRETS) +MYSQL_ALTER_USER=$(kamal secrets extract MYSQL_ALTER_USER $SECRETS) +MYSQL_APP_PASSWORD=$(kamal secrets extract MYSQL_APP_PASSWORD $SECRETS) +MYSQL_APP_USER=$(kamal secrets extract MYSQL_APP_USER $SECRETS) +MYSQL_READONLY_PASSWORD=$(kamal secrets extract MYSQL_READONLY_PASSWORD $SECRETS) +MYSQL_READONLY_USER=$(kamal secrets extract MYSQL_READONLY_USER $SECRETS) diff --git a/config/deploy.beta.yml b/config/deploy.beta.yml index f1db401c7..efce5f28b 100644 --- a/config/deploy.beta.yml +++ b/config/deploy.beta.yml @@ -1,16 +1,14 @@ servers: web: hosts: - - fizzy-beta-app-01.sc-chi-int.37signals.com - - fizzy-beta-app-101.df-iad-int.37signals.com - labels: - otel_scrape_enabled: true - jobs: - hosts: - - fizzy-beta-app-01.sc-chi-int.37signals.com + - fizzy-beta-app-01.sc-chi-int.37signals.com: sc_chi + - fizzy-beta-app-101.df-iad-int.37signals.com: df_iad labels: otel_scrape_enabled: true +# we don't run the jobs role in beta +allow_empty_roles: true + proxy: ssl: false @@ -20,6 +18,24 @@ ssh: env: clear: RAILS_ENV: beta + MYSQL_DATABASE_HOST: fizzy-mysql-primary + MYSQL_DATABASE_REPLICA_HOST: fizzy-mysql-replica + MYSQL_SOLID_CABLE_HOST: fizzy-mysql-primary + MYSQL_SOLID_QUEUE_HOST: fizzy-mysql-primary + MYSQL_SOLID_CACHE_HOST: fizzy-beta-solidcache-db-101 + secret: + - RAILS_MASTER_KEY + - MYSQL_ALTER_PASSWORD + - MYSQL_ALTER_USER + - MYSQL_APP_PASSWORD + - MYSQL_APP_USER + - MYSQL_READONLY_PASSWORD + - MYSQL_READONLY_USER + tags: + sc_chi: {} + df_iad: + PRIMARY_DATACENTER: true + df_ams: {} accessories: load-balancer: From 2a88e8aaccb97a46ec879c7b806fce45943861ee Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 21 Nov 2025 11:48:43 -0500 Subject: [PATCH 3/4] Configure beta load balancer including otel config --- config/deploy.beta.yml | 4 ++++ script/configure-lb-beta.sh | 15 +++++++++++++++ 2 files changed, 19 insertions(+) create mode 100755 script/configure-lb-beta.sh diff --git a/config/deploy.beta.yml b/config/deploy.beta.yml index efce5f28b..4c4c323f6 100644 --- a/config/deploy.beta.yml +++ b/config/deploy.beta.yml @@ -41,6 +41,10 @@ accessories: load-balancer: image: basecamp/kamal-proxy:lb host: fizzy-beta-lb-01.sc-chi-int.37signals.com + labels: + otel_role: load-balancer + otel_service: fizzy-load-balancer + otel_scrape_enabled: true options: publish: - 80:80 diff --git a/script/configure-lb-beta.sh b/script/configure-lb-beta.sh new file mode 100755 index 000000000..73844ee2b --- /dev/null +++ b/script/configure-lb-beta.sh @@ -0,0 +1,15 @@ +#!/usr/bin/env bash + +set -e + +# fizzy-beta-lb-01.sc-chi-int.37signals.com +# +ssh app@fizzy-beta-lb-01.sc-chi-int.37signals.com \ + docker exec fizzy-load-balancer \ + kamal-proxy deploy fizzy \ + --force \ + --tls \ + --host=fizzy-beta.37signals.com \ + --writer-affinity-timeout=0 \ + --target=fizzy-beta-app-101.df-iad-int.37signals.com \ + --read-target=fizzy-beta-app-01.sc-chi-int.37signals.com From 44f1d19f9acf233cdd5b8fc434ee9cf96a086af3 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 21 Nov 2025 12:28:28 -0500 Subject: [PATCH 4/4] Configure beta to use production blob store --- config/credentials/beta.yml.enc | 2 +- config/environments/beta.rb | 3 --- config/storage.yml | 3 ++- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/config/credentials/beta.yml.enc b/config/credentials/beta.yml.enc index 5b5f616ab..0fa2c3d57 100644 --- a/config/credentials/beta.yml.enc +++ b/config/credentials/beta.yml.enc @@ -1 +1 @@ -SlqumuYcQYbvuwMZNdQf54cXZ4zBavRLDyl6eiWzEYe/nGlGOlzAYpsPs3ZUA4bJC9tVm8c29E0FzmmG5X6b18ShCB8y6qMiSMEU8CeyMCIlvi0+CeWQPMbujA8ro5P6eE8deZ4+nN1pEqCpK8XCx+HFypx5sLpZ9G2uAPOBNPtOqX9KGXvWfe6RyHvR6+mk+a0jpPs50y2sQvA+/l77h6VnT/uoaa7P6q0YkZWmCWwsPT5ikgP5w+Ur+yn/VfWWS70CIqVSZhZJrzq96OV6GxKLLFdE/2im83Gg2vKODbu10FiQAdjwyubietv4PHLagtXux/mGRtBAzvwt2mKJpOxZFbUYr3u4luplTAxwMMvGMoEvxXs8ujTHjcWL8BCd3TjjOvuB82+/hYI/ds28GwMxDmurKlP0TfQXEUmrx27+mF5Bi/BNyaGwD3EMpP5f71HWxTgdTI2SVbM1pVHS3wnnnhvI4r9TcApt4oasZ2HcUJ1tqYvxDGShFnlsjB0XfJYQg5IM7/6PBr2FMi+7czz7gSaCiUJ/ew5HuTzXzS1NdNKaP407SIMjB8yKGmOTPlIf2Pe/i5kj6CVVV/ALPantfTddqpEXDjfSCYv+UwY5dKGKZXFzcbtQa9/LB+q1tPTi8Xo94CnxrSeJIzUJ6P3VXM9ihQn72GWrMz5Mt58VTf6yQve3gTq0gOIpLpMhOwwsWJ0tvOu5/4ma95qG4WTb7XKJIwmT6p0T7dBm8CJgigZckkme+Qob5nxUzg9pc1YQ9t5a3r0E1wCEdEeqXzBHgLfjjrF2ohYJwGWyw0zUqRxVYgrThpsIA9x4DqzFOAMRP76IV7WTCNTCoGslteV0hSFctBp1dAPUnN9bmvoWs4VS6n/tOxruYwEKLKGXzfo897LSMK6lEa1YF5r7BJIwSC1LxQ/60zuW8JYFV/4gyR3e7J2u0apExCZyohCDHgA/5Ol2mANuXIScFo6ikBJBKDWEN1GBjEA6aw0G0cY34JXJ73oN3JH8PRDmDAmd5RA3S97lyadPZxmvssN4pvncA6wj6ow3u27+TS+yDVYhtiri5Ce661Ps5sU9ih1EvxDvaoPTQnsWsvZ4/A3ybO0aNGDwlDcziNWV7+DZ6dDO6MHC93M6REYtDIjvtfSmnGC+8GNwoaa5rDCtrtbs4dSCYe3CIn9oLS03GgoTFdTpPKPNucwjN3yDIWGQ/HNJt2eCZvdVuljDWOiHR+1/rZZR/JNVvfhQRJdr+jT0gom0b9o/K3xh6N7VCPZMxalQHgELCkNa/+9WZ28L+6gpi7lEKy8dXdIoNlNE5Mpre/PiOHJViQi1ZquIM6h8fT09hv5bnT3s6zumdL7piUljRr00buCqWGF6UYNf3/3e6WeYPCKgxcDfVvi49AL4zrPKeEeW2KUwIAC0Vz0gbdh1bAAmdtjuQd4bXMMohcend69KV1nLByuLksmnyfHMXNnYmj0YHQI=--d+g/vj0Xg+A57CDr--GutJH+N6jhC1+wTQ52DuCA== \ No newline at end of file +6Ciuxv75imDwiIXYs8lVxsDClQq+76RRr9gvVSxbDNpQhhuETHtMZZPiK2yfHtnFwwm/CrkpWhIRy+ZUt+9bQjnz3J3dMwPmsHdmKTnxUeiKuj+7k5QPKDHc0G1kfpxRANsB10WEcjt5IeoNcNxTrXYbja3NX2OhHYOFWMW/jLpGIXRPnBw0+JgQElKQI42vm1APix/9DRwqrM7TmgjXjJw4q4C7WeSgc4Y7+sHF5T2wJrtkdmExgD7X+9BTI7FOHkpwmQIYEWe34P1/BSFgFcy6tgwI/5U74QUcsj/dEgtKADukLQK9eMPLbfbJS4X7WUD1bDrOnmix5WQy0kdERq4NGSzdvumOhOY4LKYqS3otnPuTIZObbduLxPY9mgd8VFXfev8EjCrrVcVLVNUvtqTz+ri4fYAaHGTRQXttV2oOKtAik8JAggSrY3W5zZGWPEknDD704jyzi4ZRhJ2goMf+vvNZeH6pcQeWlLrIBxrfghGDrhDiHYFqaub2+2qeHhhkenOGtsttHiG4lpfcgmEa2Sr6ADdcxcmOi9qMt17LFmvplw2jR13aIUfglw4K2mzaikCUkDbgKRPqjKpbwkKbdJOaGFx69Oa4ZtiXX+ecKSgGhxhyIOyg7c8NtGeUNAZbjVEzdG8jqj+WBPLzozvpE+3y/dHgQ8MXegf5fsoov/2cpO2HK9tAepgjPyfAU7Rl5nzLrbGPsvgZ1/VRWr/Li6baZBVKrdZnWrjqLLfgqT28deVIHfwrlspifKq2wtm0eIyNGDs3Sm9wIYc1H2QMBe0zVly9rpQBnD8f901CzFQ4PN9ZIn1ZxdoNsdPdc/26mNHwa1UvVyPxgfLMBhlofRRpLNXLh1HOEzBYxuoHtJ3f86G0UwcxkhG7dTxbm8ujQ8RmYfHfgOEBJET/P7rILflXEtRsKPfkNjZqHIt0AeEjpnA5ZmSYZrpsjAQ8FnblgCj32/QfKBsW7MIvJ18w2AOap+z7v9RyJTB9Pq93KdR232xXg7U9sX/qUMI3j6+Gx0URrTFlWCDXpq8QYK+BN/vqUfe39rSxKh/qy+JCbk1B/Ftd52Cn+gsG/fHnVaKyCK04UZSrYllqg82gMrl6A39v8PAiD/x1VFxiZzSm/oi8rBAVI9elOzxXzSr0lDUr+w0iXmiJUzSzLkgtd6nf74cjEmitZQqRRgo9/YANJQkh2HiABHuevHsBgcebw+FOM4VO9y4lljY/Ex98echppRjZs4DgJYK2/R4uQBOMBTlxuqdwuSGodYSlmI5kW43bZGTTA5KJa7w1DRmpVhQfoReWg5EDxifXh2sUkFqTMOejOauQm5fjN9RxnXA1c7b7mxpvBgkepUEI+o+AcbzNlAXG/orcm9zlt2sC8YoDR1T01blYEhoAM6IwqXCXt6ODxKEgMGQ/S3EhDWQQ989lR2gmoMjjbkwxU75pT/SDWJi/A2kFBC+e952Al+iybFxaUM9VpNfPrLB2iNIOO5McQJCH/EjD8+/ZfhhSin5fAl0GFFZyyk0Shd0+TWkuJk0mtAf3ev1sohzGFieCcB5Shj4oNcqWTvPisb4DCoO2AOnEo3adNPA3zCDRvSWv+rwsXEzqW2w2Wav4cAV8VqyKj/6NYIbvwbjwD3ojnpB41705+OekhFubgTLLCnk3+tbNgaLlBcnUawuHW4akZezmUCUoOYoLRzGEQwxCGMG6Hn9lNDw46Uyv7VsggpaNVORTeYGX1Om25QcDM+OBoYQynD24gg==--UIlvvCt/ukIZVxPZ--en6RIr54eZ9nuOvN+prX4w== \ No newline at end of file diff --git a/config/environments/beta.rb b/config/environments/beta.rb index b81ca9b90..11025f141 100644 --- a/config/environments/beta.rb +++ b/config/environments/beta.rb @@ -5,7 +5,4 @@ Rails.application.configure do config.action_mailer.smtp_settings[:address] = "smtp-outbound-staging" config.action_mailer.default_url_options = { host: "fizzy-beta.37signals.com", protocol: "https" } config.action_controller.default_url_options = { host: "fizzy-beta.37signals.com", protocol: "https" } - - # Let's keep beta on local disk. See https://github.com/basecamp/fizzy/pull/557 for context. - config.active_storage.service = :local end diff --git a/config/storage.yml b/config/storage.yml index c2557ee8f..ca2b64633 100644 --- a/config/storage.yml +++ b/config/storage.yml @@ -19,9 +19,10 @@ devminio: # We have "development", "staging", and "production" buckets configured. Note that we don't have a # "beta" bucket. (As of 2025-06-01.) +<% pure_env = Rails.env.beta? ? "production" : Rails.env %> purestorage: service: S3 - bucket: fizzy-<%= Rails.env %>-activestorage + bucket: fizzy-<%= pure_env %>-activestorage endpoint: "https://storage.basecamp.com" ssl_verify_peer: false # FIXME: using self-signed cert internally force_path_style: true