entrypoint.sh
bash
sha256:9590cee1e0ccd6c76528f005b95d634d80f5019f0dcb7c371e149adc31d1fb65
refactor: enforce gRPC framing on all MWP wire traffic
Sonnet 4.6
minor
⚠ breaking
156 days ago
| 1 | #!/bin/sh |
| 2 | set -e |
| 3 | |
| 4 | # /tmp/devpkgs is a writable site-packages directory for dev bind-mount installs. |
| 5 | # It's added to PYTHONPATH so packages installed here are importable. |
| 6 | DEVPKGS=/tmp/devpkgs |
| 7 | mkdir -p "$DEVPKGS" |
| 8 | export PYTHONPATH="$DEVPKGS${PYTHONPATH:+:$PYTHONPATH}" |
| 9 | |
| 10 | # Install the muse package if the dev volume mount is present. |
| 11 | # Copy to /tmp first so setuptools can write egg-info without hitting the |
| 12 | # read-only bind-mount. |
| 13 | if [ -f /muse/pyproject.toml ]; then |
| 14 | echo "Muse volume detected — installing muse..." |
| 15 | cp -r /muse /tmp/muse-install |
| 16 | pip install /tmp/muse-install --target "$DEVPKGS" --no-deps --quiet 2>/dev/null || true |
| 17 | rm -rf /tmp/muse-install |
| 18 | fi |
| 19 | |
| 20 | # Install the muse_contracts package if the dev volume mount is present. |
| 21 | # Provides shared cross-repo type contracts (IssueRecord, ProposalRecord, etc.). |
| 22 | # Copy to /tmp first so setuptools can write egg-info without hitting the |
| 23 | # read-only bind-mount. |
| 24 | if [ -f /src/contracts/pyproject.toml ]; then |
| 25 | echo "Contracts volume detected — installing muse_contracts..." |
| 26 | cp -r /src/contracts /tmp/muse-contracts-install |
| 27 | pip install /tmp/muse-contracts-install --target "$DEVPKGS" --no-deps --quiet 2>/dev/null || true |
| 28 | rm -rf /tmp/muse-contracts-install |
| 29 | fi |
| 30 | |
| 31 | # If a command was passed (e.g., "alembic upgrade head" from the deploy script), |
| 32 | # run it directly without starting the server. |
| 33 | if [ $# -gt 0 ]; then |
| 34 | exec "$@" |
| 35 | fi |
| 36 | |
| 37 | # Blue-green deploys run migrations as a one-off before starting the new slot, |
| 38 | # so the new container starts clean without re-running them. |
| 39 | # Set SKIP_MIGRATIONS=1 in the new container to skip this step. |
| 40 | if [ "${SKIP_MIGRATIONS:-0}" = "1" ]; then |
| 41 | echo "SKIP_MIGRATIONS=1 — skipping alembic (already run by deploy script)" |
| 42 | else |
| 43 | echo "Running database migrations..." |
| 44 | alembic upgrade head |
| 45 | fi |
| 46 | |
| 47 | echo "Starting MuseHub..." |
| 48 | # Always use hypercorn — it supports HTTP/2 in both TLS and h2c (cleartext) modes. |
| 49 | # Local dev: TLS cert present → ALPN HTTP/2 (httpx negotiates h2 directly). |
| 50 | # Production: no TLS cert → h2c (HTTP/2 cleartext). nginx uses grpc_pass which |
| 51 | # connects to the backend over h2c, enabling end-to-end HTTP/2 for gRPC proxying. |
| 52 | if [ -f /tls/localhost.crt ] && [ -f /tls/localhost.key ]; then |
| 53 | echo "TLS cert found — starting hypercorn with HTTPS + HTTP/2" |
| 54 | exec hypercorn musehub.main:app \ |
| 55 | --bind "0.0.0.0:1337" \ |
| 56 | --certfile /tls/localhost.crt \ |
| 57 | --keyfile /tls/localhost.key \ |
| 58 | --workers "${UVICORN_WORKERS:-4}" |
| 59 | else |
| 60 | echo "No TLS cert — starting hypercorn with h2c (HTTP/2 cleartext for nginx grpc_pass)" |
| 61 | exec hypercorn musehub.main:app \ |
| 62 | --bind "0.0.0.0:1337" \ |
| 63 | --workers "${UVICORN_WORKERS:-4}" |
| 64 | fi |
File History
1 commit
sha256:9590cee1e0ccd6c76528f005b95d634d80f5019f0dcb7c371e149adc31d1fb65
refactor: enforce gRPC framing on all MWP wire traffic
Sonnet 4.6
minor
⚠
156 days ago