gabriel / musehub public
feat patch deploy infra/database-phase1-rds-secrets #1 / 1
AI Agent gabriel · 23 hours ago · Sep 9, 2026 · Diff

feat(deploy): wire staging DATABASE_URL through SSM, retire orphaned self-hosted Postgres

Phase 1 of the database migration plan (docs/database-architecture.md):

- deploy/secrets.sh now fetches an optional DATABASE_URL override from SSM (/musehub/<env>/DATABASE_URL). When present it wins verbatim -- this is how staging's managed RDS instance gets wired in. When absent, falls back to constructing the self-hosted URL from DB_PASSWORD, matching setup-ec2*.sh's original pattern. This also fixes a previously-unknown general gap: secrets.sh never wrote DATABASE_URL at all before this change, for either environment -- every working value came only from setup-ec2*.sh's one-time initial .env write and would silently vanish the next time secrets.sh ran.

- Added /musehub/staging/DATABASE_URL as a real SSM SecureString, extracted from the live container and written via a temporary, narrowly-scoped IAM grant on the instance role (revoked immediately after) -- the value never transited a local shell.

- Redeployed staging for real: migrations ran against RDS, schema gate passed (73 tables in sync), health check passed. Verified live via /healthz.

- Removed the now-orphaned musehub_postgres, musehub_runner containers and musehub_postgres_data volume from the staging instance.

- Verified RDS baseline hardening: PubliclyAccessible=false, security group scoped to VPC CIDR only, DeletionProtection=true, 7-day automated backups. Found one real gap: StorageEncrypted=false (can't be fixed in place on an existing instance; tracked as a Phase 1 follow-up, and to be avoided by provisioning production's instance encrypted from the start in Phase 2).

sha256:6b17aab7bbd46a2cde5a226d9d17e4251b8bf85353e899875786626cf000e350 sha
sha256:f437d5c6fe90cdefc4929b99a6c0b52cfd4340deb42efc226ec17ecd2adc86e2 parent
+3 ~3 −1 symbols
2 changed · 1061 in snapshot files
sha256:57cfdde710fa07adb3a8e83ed73c297abfe2b43c24c38f10ba8a361ab9e05adc snapshot
+3
symbols added
~3
symbols modified
−1
symbol removed
2
files changed
1061
files in snapshot
0
dead code introduced
Semantic Changes 7 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ deploy/secrets.sh .sh 2 symbols added
+ DATABASE_URL variable variable DATABASE_URL L136–136
+ DATABASE_URL_OVERRIDE variable variable DATABASE_URL_OVERRIDE L105–105
~ docs/database-architecture.md .md 1 symbol added, 1 symbol removed, 3 symbols modified
− Phase 1 — Formally correct staging's secrets pipeline (small, low risk) section Phase 1 — Formally correct staging's secrets pipeline (small, low risk) L98–113
+ Phase 1 — Formally correct staging's secrets pipeline (small, low risk) — DONE 2026-09-08 section Phase 1 — Formally correct staging's secrets pipeline (small, low risk) — DONE 2026-09-08 L105–138
~ MuseHub Database Architecture — Canonical Source of Truth
~ Current state (as of 2026-09-08) — verified live, not assumed
~ Migration plan — phased, no step skipped
Files Changed
~2
1061 in snapshot
~ deploy/secrets.sh .sh
~ docs/database-architecture.md .md
← Older Oldest on infra/database-phase1-rds-secrets
All commits
Newer → Latest on infra/database-phase1-rds-secrets

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:6b17aab7bbd46a2cde5a226d9d17e4251b8bf85353e899875786626cf000e350 --body "your comment"