secret_files.go RawHistoryFolder

1package deployment
2
3import (
4	"context"
5	"errors"
6	"fmt"
7
8	"github.com/bnema/gordon/internal/boundaries/out"
9)
10
11// SweepSecretFiles removes every secret file directory whose container no
12// longer exists, across all apps. It takes no locks: it runs once at
13// startup, before any listener (and so any deploy) exists.
14func (s *Service) SweepSecretFiles(ctx context.Context) error {
15	return s.sweepSecretFiles(ctx, "")
16}
17
18// sweepSecretFiles removes orphaned directories, limited to one app when
19// filter is not empty. Directory names are container names because the
20// files are written before the container ID exists.
21func (s *Service) sweepSecretFiles(ctx context.Context, filter string) error {
22	store := s.deps.SecretFiles
23	if store == nil {
24		return nil
25	}
26	sets, err := store.List(ctx)
27	if err != nil {
28		return fmt.Errorf("deployment: list secret files: %w", err)
29	}
30	if filter != "" {
31		kept := make([]out.SecretFileSet, 0, len(sets))
32		for _, set := range sets {
33			if set.App == filter {
34				kept = append(kept, set)
35			}
36		}
37		sets = kept
38	}
39	if len(sets) == 0 {
40		return nil
41	}
42	containers, err := s.deps.Runtime.ListContainers(ctx, true)
43	if err != nil {
44		return fmt.Errorf("deployment: list containers for secret file sweep: %w", err)
45	}
46	live := make(map[string]struct{}, len(containers))
47	for _, c := range containers {
48		live[c.Name] = struct{}{}
49	}
50	var failures []error
51	for _, set := range sets {
52		if _, ok := live[set.Container]; ok {
53			continue
54		}
55		if err := store.Remove(ctx, set.App, set.Container); err != nil {
56			failures = append(failures, fmt.Errorf("deployment: remove secret files of app %q: %w", set.App, err))
57		}
58	}
59	return errors.Join(failures...)
60}