Run DB migrations at startup with advisory locks; seeders become dev-only

[runleveldev]

Summary

Makes the Manager apply its own database migrations at startup (coordinated by a database advisory lock so only one process migrates at a time), and reworks seeders to be development-only. Production data that must always exist is now expressed as migrations.

This removes the deployment's reliance on a one-shot init service to run sequelize db:migrate/db:seed:all, and makes sequelize-cli a dev-only authoring tool.

Changes

Startup migrations + advisory locks (aed1691)

• New utils/migrate.js: a programmatic runner using umzug (the same v2 API sequelize-cli uses internally, so it shares the SequelizeMeta ledger and skips already-applied migrations). The run is wrapped in an engine-appropriate advisory lock:
  • PostgreSQL → pg_advisory_lock / pg_advisory_unlock (held on one dedicated session connection for the whole batch)
  • MySQL → GET_LOCK / RELEASE_LOCK
  • SQLite → no-op (file-locked; dev-only)
• server.js calls runMigrations(sequelize) at the start of main(), before app.listen(). On failure the process exits non-zero (so systemd Restart=on-failure retries) rather than serving an out-of-date schema.
• umzug is now a production dependency; sequelize-cli moved to devDependencies.
• The four production seeders (groups, wazuh/sssd env vars) are converted into idempotent migrations, timestamped to run after all schema migrations (preserving the old "seeders run last" ordering). They stay idempotent so databases that already ran them as seeders are not duplicated.
• The two obsolete push-notification seeders are dropped (their keys are removed by 20260604000002-remove-push-notification-settings).
• images/manager/container-creator-init.service no longer runs db:migrate/db:seed:all; it only provisions the PostgreSQL role/database and writes credentials to /etc/default/container-creator.

dev-bootstrap → dev seeder (ededa0c)

• Converts bin/dev-bootstrap.js into a proper Sequelize seeder (seeders/20260616000000-seed-dev-environment.js) that runs via make dev (npm run db:migrate → sequelize-cli db:seed:all).
• Behavior preserved: idempotently creates a localhost Site, a local-dummy Node (nodeType: dummy), and a localhost ExternalDomain; no-ops if any Site already exists and when NODE_ENV=production.

README cleanup (c6aec84)

• Trims create-a-container/README.md from ~665 → ~120 lines, removing stale/inaccurate manual install, MySQL, and SESSION_SECRET instructions. Development is now just make dev; production points to the OCI image and make deb/rpm/apk packages, deferring to the Installation Guide.

Validation

Verified manually against SQLite (no automated test suite in this component):

• Fresh DB: 59 migrations applied (schema + the 4 converted seed migrations); groups and default_container_env_vars seeded; 0 push-notification keys.
• Idempotent re-run: 0 migrations applied.
• Existing-DB simulation (seeders already applied): the 4 seed migrations re-run with no duplicate rows/keys, and admin-customized env vars are preserved; a third run is a clean no-op.
• Full server.js boot: migrate → "Server running".
• Fail-fast: an unreachable DB causes exit code 1 and the server never listens.
• make dev seeder: creates the local dev environment on a fresh DB, no-ops on re-run and under NODE_ENV=production.

Notes

• Related to the deployment/packaging robustness behind [Bug]: Job Runner requires .env #372 (job-runner/@vscode/sqlite3 in production), though that specific issue is already resolved on main.
• Opened as a draft for review.

[Copilot]

Pull request overview

This PR makes the Manager apply Sequelize migrations automatically at process startup, coordinating concurrent instances via database advisory locks, and shifts seeders to development-only by expressing “always-present” production data as idempotent migrations.

Changes:

• Add a programmatic Umzug-based migration runner with advisory-lock serialization, and run it before the HTTP server starts listening.
• Rework development bootstrap into a Sequelize seeder; remove obsolete push-notification seeders and delete the old bin/dev-bootstrap.js path.
• Update packaging/docs and init service behavior so deployments no longer rely on an init unit to run sequelize-cli db:migrate/db:seed:all.

Reviewed changes

Copilot reviewed 13 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
images/manager/container-creator-init.service	Stops running migrations/seeders in the init unit; only writes DB env to /etc/default/container-creator.
create-a-container/utils/migrate.js	New Umzug-based migration runner with Postgres/MySQL advisory locks.
create-a-container/server.js	Runs migrations at startup and exits non-zero on failure.
create-a-container/seeders/20260616000000-seed-dev-environment.js	New dev-only seeder replacing the old dev bootstrap script.
create-a-container/seeders/20260313000000-push-notification-api-key.js	Removes obsolete seeder.
create-a-container/seeders/20260120165612-push-notification-settings.js	Removes obsolete seeder.
create-a-container/seeders/.gitkeep	Retains seeders directory placeholder.
create-a-container/README.md	Large cleanup; updates dev/prod workflow docs to match new migration/seed behavior.
create-a-container/package.json	Moves sequelize-cli to devDependencies and adds umzug as a production dependency.
create-a-container/package-lock.json	Lockfile update reflecting dependency changes.
create-a-container/migrations/20260616000003-seed-sssd-access-filter-and-user-attrs.js	Updates commentary around seed migration approach.
create-a-container/migrations/20260616000002-seed-sssd-env-vars.js	Comment/doc adjustment for seeded env vars.
create-a-container/migrations/20260616000001-seed-wazuh-env-vars.js	Comment/doc adjustment for seeded env vars.
create-a-container/migrations/20260616000000-seed-groups.js	Minor signature/comment tweaks in seed migration.
create-a-container/Makefile	Removes bin/dev-bootstrap.js from make dev; relies on npm run db:migrate (which seeds).
create-a-container/bin/dev-bootstrap.js	Deletes the old dev bootstrap script.

Files not reviewed (1)

• create-a-container/package-lock.json: Generated file