djaploy 1.3.2__tar.gz → 1.4.0__tar.gz

{djaploy-1.3.2 → djaploy-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: djaploy
-Version: 1.3.2
+Version: 1.4.0
 Summary: Modular Django deployment system based on pyinfra
 Author-email: Johanna Mae Dimayuga <johanna@techco.fi>
 License: MIT License
@@ -258,6 +258,52 @@ python manage.py djaploy rollback --env production
 > **Note:** Migrations run during deploy, before traffic switches. Both slots share the same
 > database, so migrations must be **backward-compatible** (expand/contract pattern).
 
+### k3s (`"k3s"`)
+
+The app runs as a container on a [k3s](https://k3s.io) node instead of under
+systemd. Server access works exactly as for the other strategies (SSH key and
+sudo password from the inventory, e.g. `OpSecret`/`OpFilePath`); there is no
+registry and no CI involved.
+
+```python
+HostConfig(
+    "rancor",
+    ssh_hostname=str(OpSecret("/Infra/rancor/IP")),
+    ssh_user="janitor",
+    ssh_key=OpFilePath("/Infra/SSH Key/private key?ssh-format=openssh"),
+    _sudo_password=str(OpSecret("/Infra/rancor/password")),
+    deployment_strategy="k3s",
+    app_name="myapp",                       # namespace + Helm release (or k3s_conf["namespace"])
+    app_hostname="myapp.example.com",
+    manage_py_path="myapp/manage.py",
+    gunicorn_conf={"workers": 3, "timeout": 120, "wsgi_module": "myapp.wsgi:application"},
+    secret_key=OpSecret("/Infra/myapp/secret_key"),
+    data={"mistral_api_key": OpSecret("/Infra/Mistral/credential")},   # → env MISTRAL_API_KEY
+    k3s_conf={
+        "settings_module": "myapp.settings.production",
+        "static_root": "/app/myapp/public/static",
+        "extra_commands": ["seed_data --org acme"],   # after migrate, every deploy
+        "storage_size": "20Gi",
+        "suspended": False,                            # True: scale to zero
+    },
+)
+```
+
+`deploy` builds the image locally from the usual git artifact (the repo needs
+a `Dockerfile`; build args `MANAGE_PY` and `SETTINGS_MODULE`), ships it over
+SSH into k3s (skipped when the node already has that exact image), writes
+`secret_key` and the scalar `data` entries into a Secret, and runs
+`helm upgrade --install` with the bundled `django-app` chart
+(`djaploy/infra/charts/django-app`): gunicorn + nginx in one pod, SQLite and
+media on a local volume, a database snapshot and `migrate` before every
+rollout. It waits for the new pod and fails with its logs if it doesn't come up.
+
+`configure` installs helm on the node and gives the SSH user a kubeconfig;
+`rollback` is `helm rollback` (optionally `--release <revision>`). Only hooks
+registered with `strategies=("k3s",)` run for k3s hosts, so the systemd/nginx
+hooks of the other strategies never touch them. The node needs cert-manager
+with a `letsencrypt-prod` ClusterIssuer for TLS.
+
 ### Server directory layout comparison
 
 For `app_user="myapp-api"`, `app_name="myapp"`:

{djaploy-1.3.2 → djaploy-1.4.0}/README.md

@@ -196,6 +196,52 @@ python manage.py djaploy rollback --env production
 > **Note:** Migrations run during deploy, before traffic switches. Both slots share the same
 > database, so migrations must be **backward-compatible** (expand/contract pattern).
 
+### k3s (`"k3s"`)
+
+The app runs as a container on a [k3s](https://k3s.io) node instead of under
+systemd. Server access works exactly as for the other strategies (SSH key and
+sudo password from the inventory, e.g. `OpSecret`/`OpFilePath`); there is no
+registry and no CI involved.
+
+```python
+HostConfig(
+    "rancor",
+    ssh_hostname=str(OpSecret("/Infra/rancor/IP")),
+    ssh_user="janitor",
+    ssh_key=OpFilePath("/Infra/SSH Key/private key?ssh-format=openssh"),
+    _sudo_password=str(OpSecret("/Infra/rancor/password")),
+    deployment_strategy="k3s",
+    app_name="myapp",                       # namespace + Helm release (or k3s_conf["namespace"])
+    app_hostname="myapp.example.com",
+    manage_py_path="myapp/manage.py",
+    gunicorn_conf={"workers": 3, "timeout": 120, "wsgi_module": "myapp.wsgi:application"},
+    secret_key=OpSecret("/Infra/myapp/secret_key"),
+    data={"mistral_api_key": OpSecret("/Infra/Mistral/credential")},   # → env MISTRAL_API_KEY
+    k3s_conf={
+        "settings_module": "myapp.settings.production",
+        "static_root": "/app/myapp/public/static",
+        "extra_commands": ["seed_data --org acme"],   # after migrate, every deploy
+        "storage_size": "20Gi",
+        "suspended": False,                            # True: scale to zero
+    },
+)
+```
+
+`deploy` builds the image locally from the usual git artifact (the repo needs
+a `Dockerfile`; build args `MANAGE_PY` and `SETTINGS_MODULE`), ships it over
+SSH into k3s (skipped when the node already has that exact image), writes
+`secret_key` and the scalar `data` entries into a Secret, and runs
+`helm upgrade --install` with the bundled `django-app` chart
+(`djaploy/infra/charts/django-app`): gunicorn + nginx in one pod, SQLite and
+media on a local volume, a database snapshot and `migrate` before every
+rollout. It waits for the new pod and fails with its logs if it doesn't come up.
+
+`configure` installs helm on the node and gives the SSH user a kubeconfig;
+`rollback` is `helm rollback` (optionally `--release <revision>`). Only hooks
+registered with `strategies=("k3s",)` run for k3s hosts, so the systemd/nginx
+hooks of the other strategies never touch them. The node needs cert-manager
+with a `letsencrypt-prod` ClusterIssuer for TLS.
+
 ### Server directory layout comparison
 
 For `app_user="myapp-api"`, `app_name="myapp"`:

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/apps/janitor/infra/commands/createjanitoruser.py

@@ -18,7 +18,7 @@ discover_hooks()
 registry = get_registry()
 
 for phase in ("createjanitoruser:pre", "createjanitoruser", "createjanitoruser:post"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data
         )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/builtin_hooks.py

@@ -164,7 +164,12 @@ def _rollback_validate_strategy(context):
     _, data = hosts[0]
     strategy = (data.get("deployment_strategy") if isinstance(data, dict)
                 else getattr(data, "deployment_strategy", "zero_downtime"))
-    if strategy not in ("zero_downtime", "bluegreen"):
+    if strategy not in ("zero_downtime", "bluegreen", "k3s"):
         raise ValueError(
-            "Rollback is only supported with deployment_strategy='zero_downtime' or 'bluegreen'"
+            "Rollback is only supported with deployment_strategy='zero_downtime', 'bluegreen' or 'k3s'"
         )
+
+
+# The k3s strategy's hooks (djaploy/infra/k3s.py). Imported last so its local
+# image build runs after the artifact and release info above.
+import djaploy.infra.k3s  # noqa: E402,F401

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/activate.py

@@ -20,7 +20,7 @@ discover_hooks()
 registry = get_registry()
 
 for phase in ("activate:pre", "activate", "activate:post"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data
         )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/configure.py

@@ -16,7 +16,7 @@ discover_hooks()
 registry = get_registry()
 
 for phase in ("configure:pre", "configure", "configure:post"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data
         )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/deploy.py

@@ -25,7 +25,7 @@ registry = get_registry()
 artifact_path = Path(host.data.artifact_path)
 
 for phase in ("deploy:upload", "deploy:configure", "deploy:pre", "deploy:start"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data, artifact_path
         )
@@ -34,7 +34,7 @@ for phase in ("deploy:upload", "deploy:configure", "deploy:pre", "deploy:start")
 _activate_val = getattr(host.data, "activate", None)
 if _activate_val in (True, "true", "True"):
     for phase in ("activate:pre", "activate", "activate:post"):
-        _hooks = registry.get_remote_hooks(phase)
+        _hooks = registry.get_remote_hooks(phase, host.data)
         print(f"[activate] phase={phase} hooks={[h.function.__name__ for h in _hooks]}")
         for hook in _hooks:
             _deploy_decorator(hook.function.__name__)(hook.function)(

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/restore.py

@@ -33,7 +33,7 @@ if _source_borg:
     restore_opts["source_borg_config"] = _source_borg
 
 for phase in ("restore:pre", "restore", "restore:post"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data, restore_opts
         )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/rollback.py

@@ -20,7 +20,7 @@ release = getattr(host.data, "release", None)
 if release == "None" or release == "":
     release = None
 
-for hook in registry.get_remote_hooks("rollback"):
+for hook in registry.get_remote_hooks("rollback", host.data):
     _deploy_decorator(hook.function.__name__)(hook.function)(
         host.data, release
     )
@@ -30,7 +30,7 @@ for hook in registry.get_remote_hooks("rollback"):
 from djaploy.infra.utils import is_bluegreen
 if is_bluegreen(host.data):
     for phase in ("activate:post",):
-        for hook in registry.get_remote_hooks(phase):
+        for hook in registry.get_remote_hooks(phase, host.data):
             _deploy_decorator(hook.function.__name__)(hook.function)(
                 host.data
             )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/commands/sync_certs.py

@@ -18,7 +18,7 @@ registry = get_registry()
 
 # Only run sync_certs-specific hooks, not the full deploy lifecycle.
 for phase in ("sync_certs:pre", "sync_certs", "sync_certs:post"):
-    for hook in registry.get_remote_hooks(phase):
+    for hook in registry.get_remote_hooks(phase, host.data):
         _deploy_decorator(hook.function.__name__)(hook.function)(
             host.data
         )

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/config.py

@@ -171,7 +171,7 @@ class HostConfig(tuple, metaclass=HostConfigMetaclass):
     # Deployment settings
     python_version: str = "3.11"
     python_compile: bool = False  # Compile Python from source
-    deployment_strategy: str = "zero_downtime"  # "in_place" or "zero_downtime"
+    deployment_strategy: str = "zero_downtime"  # "in_place", "zero_downtime", "bluegreen" or "k3s"
     keep_releases: int = 5  # Releases to keep (zero_downtime only)
     manage_py_path: str = "manage.py"  # Relative path to manage.py in the artifact
     db_dir: Optional[str] = None  # External database directory template
@@ -187,6 +187,7 @@ class HostConfig(tuple, metaclass=HostConfigMetaclass):
     notifications_conf: Optional[Dict[str, Any]] = None  # webhook_url, display_name, changelog_generator, etc.
     artifact_conf: Optional[Dict[str, Any]] = None  # extra_files
     http_hook_conf: Optional[Dict[str, Any]] = None  # webroot_path
+    k3s_conf: Optional[Dict[str, Any]] = None  # namespace, settings_module, static_root, values, ... (djaploy/infra/k3s.py)
 
     def __new__(cls, name: str, **kwargs):
         dict_typing = cls._dict_annotations
@@ -214,10 +215,10 @@ class HostConfig(tuple, metaclass=HostConfigMetaclass):
 
         # Validate deployment_strategy
         strategy = config.get("deployment_strategy", "zero_downtime")
-        if strategy not in ("in_place", "zero_downtime", "bluegreen"):
+        if strategy not in ("in_place", "zero_downtime", "bluegreen", "k3s"):
             raise ValueError(
                 f"Invalid deployment_strategy: {strategy!r}. "
-                f"Must be 'in_place', 'zero_downtime', or 'bluegreen'"
+                f"Must be 'in_place', 'zero_downtime', 'bluegreen' or 'k3s'"
             )
 
         # Expand SSH key path if provided

{djaploy-1.3.2 → djaploy-1.4.0}/djaploy/hooks.py

@@ -23,6 +23,16 @@ warning::
         # This replaces djaploy's built-in deploy_nginx
         ...
 
+Deployment strategies:
+
+Remote hooks run for the classic strategies (in_place, zero_downtime,
+bluegreen) unless they say otherwise.  Hosts with ``deployment_strategy="k3s"``
+only run hooks that opt in::
+
+    @deploy_hook("deploy:start", strategies=("k3s",))
+    def helm_upgrade(host_data, artifact_path):
+        ...
+
 Ordering is controlled by assigning hooks to the correct phase.  Each
 command file calls phases in a fixed sequence (e.g. ``deploy:pre`` →
 ``deploy`` → ``deploy:post``).  Within a single phase hooks run in
@@ -38,10 +48,17 @@ from typing import Any, Callable, Dict, List, Optional
 log = logging.getLogger(__name__)
 
 
+CLASSIC_STRATEGIES = ("in_place", "zero_downtime", "bluegreen")
+
+
 @dataclass
 class RemoteFunctionHook:
     """A remote hook backed by a standalone function (from @deploy_hook)."""
     function: object  # Callable
+    strategies: Optional[tuple] = None  # None = the classic strategies
+
+    def applies_to(self, strategy: str) -> bool:
+        return strategy in (self.strategies or CLASSIC_STRATEGIES)
 
 
 class HookRegistry:
@@ -59,7 +76,8 @@ class HookRegistry:
     # Registration
     # ------------------------------------------------------------------
 
-    def register(self, hook_name: str, fn: Callable, *, remote: bool = False, override: bool = False) -> None:
+    def register(self, hook_name: str, fn: Callable, *, remote: bool = False, override: bool = False,
+                 strategies: Optional[tuple] = None) -> None:
         fn_name = fn.__name__
         key = (hook_name, fn_name)
 
@@ -84,7 +102,7 @@ class HookRegistry:
             self._overridden.add(key)
 
         if remote:
-            hooks.append(RemoteFunctionHook(function=fn))
+            hooks.append(RemoteFunctionHook(function=fn, strategies=tuple(strategies) if strategies else None))
         else:
             hooks.append(fn)
 
@@ -101,16 +119,19 @@ class HookRegistry:
             return fn
         return decorator
 
-    def deploy_hook(self, name: str, *, override: bool = False) -> Callable:
+    def deploy_hook(self, name: str, *, override: bool = False,
+                    strategies: Optional[tuple] = None) -> Callable:
         """Decorator for remote hooks (run on target servers via pyinfra).
 
         Args:
             name: Hook phase name (e.g. "deploy:configure")
             override: If True, silently replace a hook with the same
                       function name.  If False (default), log a warning.
+            strategies: Deployment strategies this hook runs for. Default:
+                        the classic strategies (not k3s).
         """
         def decorator(fn: Callable) -> Callable:
-            self.register(name, fn, remote=True, override=override)
+            self.register(name, fn, remote=True, override=override, strategies=strategies)
             return fn
         return decorator
 
@@ -130,9 +151,17 @@ class HookRegistry:
                 results.append(result)
         return results
 
-    def get_remote_hooks(self, hook_name: str) -> List[RemoteFunctionHook]:
-        """Return the list of remote hook functions for *hook_name*."""
-        return list(self._remote_hooks.get(hook_name, []))
+    def get_remote_hooks(self, hook_name: str, host_data=None) -> List[RemoteFunctionHook]:
+        """Return the remote hook functions for *hook_name*.
+
+        With *host_data*, only the hooks that apply to that host's
+        deployment strategy.
+        """
+        hooks = list(self._remote_hooks.get(hook_name, []))
+        if host_data is None:
+            return hooks
+        strategy = getattr(host_data, "deployment_strategy", None) or "zero_downtime"
+        return [h for h in hooks if h.applies_to(strategy)]
 
     # ------------------------------------------------------------------
     # Discovery

djaploy-1.4.0/djaploy/infra/charts/django-app/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: django-app
+description: A Django app the way djaploy ran it (gunicorn + nginx + SQLite/media on local disk), on k3s.
+type: application
+version: 0.2.1

djaploy-1.4.0/djaploy/infra/charts/django-app/templates/_helpers.tpl

@@ -0,0 +1,125 @@
+{{- define "django-app.fullname" -}}
+{{- default .Release.Name .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "django-app.labels" -}}
+app.kubernetes.io/name: django-app
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Values.image.tag | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
+{{- end -}}
+
+{{/* Call with (dict "root" . "component" "web") */}}
+{{- define "django-app.selectorLabels" -}}
+app.kubernetes.io/name: django-app
+app.kubernetes.io/instance: {{ .root.Release.Name }}
+app.kubernetes.io/component: {{ .component }}
+{{- end -}}
+
+{{- define "django-app.image" -}}
+{{ required "image.repository is required" .Values.image.repository }}:{{ required "image.tag is required (the app's CI sets it)" .Values.image.tag }}
+{{- end -}}
+
+{{- define "django-app.primaryHost" -}}
+{{ required "hostnames needs at least one entry" (first .Values.hostnames) }}
+{{- end -}}
+
+{{/*
+The environment contract every app reads (see templates/snippets/settings_env.py and docs/04-chart-reference.md).
+*/}}
+{{- define "django-app.env" -}}
+{{- $origins := list -}}
+{{- range .Values.hostnames }}{{ $origins = append $origins (printf "https://%s" .) }}{{ end -}}
+- name: DJANGO_ALLOWED_HOSTS
+  value: {{ join "," .Values.hostnames | quote }}
+- name: DJANGO_CSRF_TRUSTED_ORIGINS
+  value: {{ join "," $origins | quote }}
+- name: DJANGO_BASE_URL
+  value: {{ printf "https://%s" (include "django-app.primaryHost" .) | quote }}
+- name: DJANGO_DATA_DIR
+  value: /data
+- name: MEDIA_ROOT
+  value: /data/media
+{{- with .Values.django.settingsModule }}
+- name: DJANGO_SETTINGS_MODULE
+  value: {{ . | quote }}
+{{- end }}
+{{- if eq .Values.database.engine "sqlite" }}
+- name: SQLITE_PATH
+  value: {{ .Values.database.sqlite.path | quote }}
+{{- else if eq .Values.database.engine "postgres" }}
+- name: DATABASE_URL
+  valueFrom:
+    secretKeyRef:
+      name: {{ required "database.postgres.secretName is required" .Values.database.postgres.secretName }}
+      key: {{ .Values.database.postgres.secretKey }}
+{{- else }}
+{{- fail "database.engine must be sqlite or postgres" }}
+{{- end }}
+{{- range $name, $value := .Values.django.env }}
+- name: {{ $name }}
+  value: {{ $value | quote }}
+{{- end }}
+{{- range $name, $ref := .Values.onePassword.env }}
+- name: {{ $name }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "django-app.opSecretName" (dict "root" $ "item" (include "django-app.opItem" $ref)) }}
+      key: {{ include "django-app.opField" $ref }}
+{{- end }}
+{{- end -}}
+
+{{/* "<item>/<field>" → item / field. Item titles may themselves contain "/". */}}
+{{- define "django-app.opItem" -}}
+{{- $parts := splitList "/" . -}}
+{{- if lt (len $parts) 2 }}{{ fail (printf "onePassword.env value %q must be \"<item>/<field>\"" .) }}{{ end -}}
+{{- initial $parts | join "/" -}}
+{{- end -}}
+
+{{- define "django-app.opField" -}}
+{{- last (splitList "/" .) -}}
+{{- end -}}
+
+{{/* Secret synced from one 1Password item. Call with (dict "root" . "item" "<title>"). */}}
+{{- define "django-app.opSecretName" -}}
+{{- printf "%s-op-%s" (include "django-app.fullname" .root) (regexReplaceAll "[^a-z0-9]+" (lower .item) "-" | trimAll "-") | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/* env (+ envFrom) for a container, indented by the caller. */}}
+{{- define "django-app.containerEnv" -}}
+env:
+  {{- include "django-app.env" . | nindent 2 }}
+{{- with .Values.envFromSecret }}
+envFrom:
+  - secretRef:
+      name: {{ . }}
+{{- end }}
+{{- end -}}
+
+{{- define "django-app.podCommon" -}}
+{{- if .Values.onePassword.pullSecretItem }}
+imagePullSecrets:
+  - name: ghcr-pull
+{{- end }}
+securityContext:
+  {{- toYaml .Values.podSecurityContext | nindent 2 }}
+{{- end -}}
+
+{{- define "django-app.dataVolume" -}}
+- name: data
+  persistentVolumeClaim:
+    claimName: {{ default (printf "%s-data" (include "django-app.fullname" .)) .Values.storage.existingClaim }}
+{{- end -}}
+
+{{/* Host + X-Forwarded-Proto so ALLOWED_HOSTS and SECURE_SSL_REDIRECT accept the probe. */}}
+{{- define "django-app.probe" -}}
+httpGet:
+  path: {{ .Values.probes.path }}
+  port: gunicorn
+  httpHeaders:
+    - name: Host
+      value: {{ include "django-app.primaryHost" . | quote }}
+    - name: X-Forwarded-Proto
+      value: https
+{{- end -}}

djaploy-1.4.0/djaploy/infra/charts/django-app/templates/configmap.yaml

@@ -0,0 +1,81 @@
+{{- $fullname := include "django-app.fullname" . -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $fullname }}-nginx
+  labels:
+    {{- include "django-app.labels" . | nindent 4 }}
+data:
+  default.conf: |
+    server {
+        listen 8080;
+        server_name _;
+        client_max_body_size {{ .Values.nginx.clientMaxBodySize }};
+
+        # Traefik is the only client: take the real client IP from its X-Forwarded-For,
+        # then hand it to Django as X-Real-IP (allauth rate limiting keys on it).
+        set_real_ip_from 10.42.0.0/16;
+        real_ip_header X-Forwarded-For;
+        real_ip_recursive on;
+
+        location /static/ {
+            alias /static/;
+            expires 30d;
+            add_header Cache-Control "public, immutable";
+        }
+        {{- if .Values.nginx.serveMedia }}
+
+        location /media/ {
+            alias /data/media/;
+            expires 30d;
+        }
+        {{- end }}
+
+        location / {
+            proxy_pass http://127.0.0.1:8000;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            # TLS ends at Traefik; pass its scheme through, not nginx's own (http).
+            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
+            proxy_redirect off;
+            proxy_read_timeout {{ .Values.nginx.proxyReadTimeout }};
+            proxy_send_timeout {{ .Values.nginx.proxyReadTimeout }};
+        }
+    }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ $fullname }}-scripts
+  labels:
+    {{- include "django-app.labels" . | nindent 4 }}
+data:
+  predeploy.sh: |
+    set -eu
+    mkdir -p /data/media /data/backups
+    {{- if and (eq .Values.database.engine "sqlite") .Values.database.sqlite.snapshotBeforeMigrate }}
+    python /scripts/snapshot.py {{ .Values.database.sqlite.keepSnapshots }}
+    {{- end }}
+    python {{ .Values.django.managePy }} migrate --noinput
+    {{- range .Values.migrations.extraCommands }}
+    python {{ $.Values.django.managePy }} {{ . }}
+    {{- end }}
+  snapshot.py: |
+    """Consistent copy of the SQLite DB before migrating (the rollback point)."""
+    import glob, os, sqlite3, sys, time
+
+    src = os.environ["SQLITE_PATH"]
+    keep = int(sys.argv[1]) if len(sys.argv) > 1 else 10
+    if not os.path.exists(src):
+        print("snapshot: no database yet, skipping")
+        sys.exit(0)
+    dst = time.strftime("/data/backups/pre-migrate-%Y%m%d-%H%M%S.sqlite3")
+    source, target = sqlite3.connect(src), sqlite3.connect(dst)
+    source.backup(target)
+    source.close()
+    target.close()
+    print(f"snapshot: {dst}")
+    for old in sorted(glob.glob("/data/backups/pre-migrate-*.sqlite3"))[:-keep]:
+        os.remove(old)
+        print(f"snapshot: removed {old}")

djaploy-1.4.0/djaploy/infra/charts/django-app/templates/cronjobs.yaml

@@ -0,0 +1,36 @@
+{{- $root := . -}}
+{{- range .Values.cronJobs }}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ include "django-app.fullname" $root }}-{{ .name }}
+  labels:
+    {{- include "django-app.labels" $root | nindent 4 }}
+spec:
+  schedule: {{ .schedule | quote }}
+  suspend: {{ $root.Values.suspended }}
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        metadata:
+          labels:
+            {{- include "django-app.selectorLabels" (dict "root" $root "component" (printf "cron-%s" .name)) | nindent 12 }}
+        spec:
+          {{- include "django-app.podCommon" $root | trim | nindent 10 }}
+          restartPolicy: Never
+          containers:
+            - name: {{ .name }}
+              image: {{ include "django-app.image" $root }}
+              imagePullPolicy: {{ $root.Values.image.pullPolicy }}
+              command: {{ toJson .command }}
+              {{- include "django-app.containerEnv" $root | nindent 14 }}
+              volumeMounts:
+                - { name: data, mountPath: /data }
+          volumes:
+            {{- include "django-app.dataVolume" $root | nindent 12 }}
+{{- end }}