Skip to content

fix(indexer): let box-deploy recover a box whose serving container is down - #130

Merged
aminsammara merged 1 commit into
mainfrom
amin/box-deploy-recover
Nov 5, 2026
Merged

aminsammara merged 1 commit into
mainfrom
amin/box-deploy-recover

Conversation

@aminsammara

Copy link
Copy Markdown
Collaborator

Prod api.stake.aztec.network is down (502). The #129 image swap on atp-indexer-si-v2 failed, because Ponder fingerprints all of src/ and refuses to start on the old schema. The script then left the broken container serving.

A redeploy to atp-indexer-si-v3 rebuilt fine, but died before the flip. The script reads the old schema name from the serving container, which is down. With an empty name the parity psql failed under set -e.

This PR:

  • reads the current schema from docker-compose.override.yml when the container can't answer;
  • restores the previous image when the post-swap /ready check fails;
  • makes psql_count tolerate a missing schema.

After merge, rerun deploy-indexer.yaml for prod from main with new_schema=atp-indexer-si-v3. The script reuses the si-v3 rebuild that already finished, and atp-indexer-si-v2 stays in Postgres as the rollback.

… down

The #129 deploy went out as an in-place image swap on atp-indexer-si-v2. Ponder fingerprints
the whole src/ tree, not just ponder.config.ts, so the new image refused to start on a schema
an older build created. box-deploy.sh then exited without restoring the previous image, which
left the prod API returning 502.

Redeploying with a fresh schema could not fix it either. The si-v3 rebuild completed, but the
script finds the old schema by asking the serving container, and that container was
crash-looping. CURRENT came back empty, psql ran against "".atp_position, the failing command
substitution tripped set -e, and the script died before the flip.

Three changes:
- current_schema falls back to docker-compose.override.yml, which this script writes and
  which records what the box was serving, whenever the container can't answer.
- A failed /ready after an image swap restores the previous image instead of leaving the box
  down.
- psql_count tolerates a schema that doesn't exist. The parity check then compares against 0
  rather than killing the script.
@aminsammara
aminsammara requested a review from a team as a code owner November 5, 2026 11:25
@aminsammara
aminsammara merged commit 9ea3d45 into main Nov 5, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant