fix: auto-generate SECRET_KEY_BASE and improve Postgres startup reliability

Remove the hardcoded placeholder SECRET_KEY_BASE from docker-compose.yml
and add an entrypoint script that generates a random one via openssl if
not explicitly set. The entrypoint also retries migrations with backoff
when Postgres isn't fully ready, preventing the cascade of errors that
made the control panel unusable on fresh docker-compose up.

Author: raffaelschneider

Dockerfile

@@ -65,16 +65,17 @@ ENV PHX_SERVER=true
 # Copy the release from the build stage
 COPY --from=builder /app/_build/prod/rel/zentinel_cp ./
 
+# Copy entrypoint script
+COPY entrypoint.sh /app/entrypoint.sh
+
 # Create a non-root user
 RUN groupadd -r zentinel && useradd -r -g zentinel zentinel
-RUN chown -R zentinel:zentinel /app
+RUN chmod +x /app/entrypoint.sh && chown -R zentinel:zentinel /app
 USER zentinel
 
 EXPOSE 4000
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD curl -f http://localhost:4000/health || exit 1
 
-CMD /app/bin/zentinel_cp eval "ZentinelCp.Release.migrate()" && \
-    /app/bin/zentinel_cp eval "ZentinelCp.Release.seed()" && \
-    /app/bin/zentinel_cp start
+ENTRYPOINT ["/app/entrypoint.sh"]

docker-compose.yml

@@ -5,7 +5,8 @@ services:
       - "4000:4000"
     environment:
       DATABASE_URL: "ecto://zentinel:zentinel@postgres:5432/zentinel_cp"
-      SECRET_KEY_BASE: "change-me-in-production-use-mix-phx-gen-secret-to-generate"
+      # SECRET_KEY_BASE is auto-generated if not set. To persist sessions across
+      # restarts, set it explicitly: openssl rand -base64 48
       # PHX_HOST: "your-domain.com"  # Set to your server's domain or IP
       PORT: "4000"
       S3_ENDPOINT: "http://minio:9000"
@@ -24,7 +25,7 @@ services:
       interval: 30s
       timeout: 5s
       retries: 3
-      start_period: 15s
+      start_period: 60s
 
   postgres:
     image: postgres:17-alpine

entrypoint.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -e
+
+# Generate a random SECRET_KEY_BASE if not set
+if [ -z "$SECRET_KEY_BASE" ]; then
+  export SECRET_KEY_BASE=$(openssl rand -base64 48)
+  echo "[entrypoint] Generated random SECRET_KEY_BASE"
+fi
+
+# Wait for the database to accept connections (belt-and-suspenders on top of
+# Docker healthchecks — pg_isready can return 0 before the server is fully
+# ready to handle queries).
+if [ -n "$DATABASE_URL" ]; then
+  echo "[entrypoint] Waiting for database..."
+  retries=0
+  max_retries=30
+  until /app/bin/zentinel_cp eval "ZentinelCp.Release.migrate()" 2>/dev/null; do
+    retries=$((retries + 1))
+    if [ "$retries" -ge "$max_retries" ]; then
+      echo "[entrypoint] Database not ready after ${max_retries} attempts, running migration anyway..."
+      /app/bin/zentinel_cp eval "ZentinelCp.Release.migrate()"
+      break
+    fi
+    echo "[entrypoint] Database not ready (attempt ${retries}/${max_retries}), retrying in 2s..."
+    sleep 2
+  done
+  echo "[entrypoint] Database migrations complete."
+else
+  echo "[entrypoint] Running database migrations..."
+  /app/bin/zentinel_cp eval "ZentinelCp.Release.migrate()"
+fi
+
+# Seed default data
+echo "[entrypoint] Seeding database..."
+/app/bin/zentinel_cp eval "ZentinelCp.Release.seed()"
+
+# Start the application
+echo "[entrypoint] Starting Zentinel Control Plane..."
+exec /app/bin/zentinel_cp start