Fix backup_hosts migration failing on populated databases

The migration added a NOT NULL backup_host_id column and its foreign
key to backups in a single ALTER while backup_hosts was still empty,
so existing rows defaulted to 0 and violated the constraint. Create
the default backup host first, add the column nullable, backfill,
then tighten to NOT NULL and add the foreign key.

Each DDL step is now guarded so installs left in a partially-applied
state (MySQL DDL is not transactional) can simply re-run migrations;
the backfill also repairs rows stuck at 0. Also drop backup_host_node
before backup_hosts in down(), since its foreign key blocks the drop.

Fixes #2447

database/migrations/2026_01_16_081858_create_backup_hosts_table.php

@@ -13,57 +13,92 @@ return new class extends Migration
      */
     public function up(): void
     {
-        Schema::create('backup_hosts', function (Blueprint $table) {
-            $table->increments('id');
-            $table->string('name');
-            $table->string('schema');
-            $table->json('configuration')->nullable();
-            $table->timestamps();
-        });
-
-        Schema::create('backup_host_node', function (Blueprint $table) {
-            $table->unsignedInteger('node_id');
-            $table->foreign('node_id')->references('id')->on('nodes')->cascadeOnDelete();
-
-            $table->unsignedInteger('backup_host_id');
-            $table->foreign('backup_host_id')->references('id')->on('backup_hosts')->cascadeOnDelete();
-
-            $table->timestamps();
-
-            $table->unique(['node_id']);
-        });
-
-        Schema::table('backups', function (Blueprint $table) {
-            $table->unsignedInteger('backup_host_id')->after('disk');
-            $table->foreign('backup_host_id')->references('id')->on('backup_hosts');
-
-            $table->dropColumn('disk');
-        });
-
-        $oldDriver = env('APP_BACKUP_DRIVER', 'wings');
-
-        $oldConfiguration = null;
-        if ($oldDriver === 's3') {
-            $oldConfiguration = [
-                'region' => env('AWS_DEFAULT_REGION'),
-                'key' => env('AWS_ACCESS_KEY_ID'),
-                'secret' => env('AWS_SECRET_ACCESS_KEY'),
-                'bucket' => env('AWS_BACKUPS_BUCKET'),
-                'prefix' => env('AWS_BACKUPS_BUCKET', ''),
-                'endpoint' => env('AWS_ENDPOINT'),
-                'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
-                'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
-                'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
-            ];
+        if (!Schema::hasTable('backup_hosts')) {
+            Schema::create('backup_hosts', function (Blueprint $table) {
+                $table->increments('id');
+                $table->string('name');
+                $table->string('schema');
+                $table->json('configuration')->nullable();
+                $table->timestamps();
+            });
         }
 
-        $backupHost = BackupHost::create([
-            'name' => $oldDriver === 's3' ? 'Remote' : 'Local',
-            'schema' => $oldDriver,
-            'configuration' => $oldConfiguration,
-        ]);
+        if (!Schema::hasTable('backup_host_node')) {
+            Schema::create('backup_host_node', function (Blueprint $table) {
+                $table->unsignedInteger('node_id');
+                $table->foreign('node_id')->references('id')->on('nodes')->cascadeOnDelete();
 
-        DB::table('backups')->update(['backup_host_id' => $backupHost->id]);
+                $table->unsignedInteger('backup_host_id');
+                $table->foreign('backup_host_id')->references('id')->on('backup_hosts')->cascadeOnDelete();
+
+                $table->timestamps();
+
+                $table->unique(['node_id']);
+            });
+        }
+
+        $backupHost = BackupHost::first();
+        if (!$backupHost) {
+            $oldDriver = env('APP_BACKUP_DRIVER', 'wings');
+
+            $oldConfiguration = null;
+            if ($oldDriver === 's3') {
+                $oldConfiguration = [
+                    'region' => env('AWS_DEFAULT_REGION'),
+                    'key' => env('AWS_ACCESS_KEY_ID'),
+                    'secret' => env('AWS_SECRET_ACCESS_KEY'),
+                    'bucket' => env('AWS_BACKUPS_BUCKET'),
+                    'prefix' => env('AWS_BACKUPS_BUCKET', ''),
+                    'endpoint' => env('AWS_ENDPOINT'),
+                    'use_path_style_endpoint' => env('AWS_USE_PATH_STYLE_ENDPOINT', false),
+                    'use_accelerate_endpoint' => env('AWS_BACKUPS_USE_ACCELERATE', false),
+                    'storage_class' => env('AWS_BACKUPS_STORAGE_CLASS'),
+                ];
+            }
+
+            $backupHost = BackupHost::create([
+                'name' => $oldDriver === 's3' ? 'Remote' : 'Local',
+                'schema' => $oldDriver,
+                'configuration' => $oldConfiguration,
+            ]);
+        }
+
+        // The column must start out nullable: adding it NOT NULL would give existing
+        // rows a value of 0, which the foreign key below would reject.
+        if (!Schema::hasColumn('backups', 'backup_host_id')) {
+            $hasDiskColumn = Schema::hasColumn('backups', 'disk');
+
+            Schema::table('backups', function (Blueprint $table) use ($hasDiskColumn) {
+                $column = $table->unsignedInteger('backup_host_id')->nullable();
+
+                // The disk column may already be gone on installs that were repaired by hand.
+                if ($hasDiskColumn) {
+                    $column->after('disk');
+                }
+            });
+        }
+
+        DB::table('backups')
+            ->whereNull('backup_host_id')
+            ->orWhere('backup_host_id', 0)
+            ->update(['backup_host_id' => $backupHost->id]);
+
+        Schema::table('backups', function (Blueprint $table) {
+            $table->unsignedInteger('backup_host_id')->nullable(false)->change();
+        });
+
+        $foreignKeys = array_column(Schema::getForeignKeys('backups'), 'name');
+        if (!in_array('backups_backup_host_id_foreign', $foreignKeys)) {
+            Schema::table('backups', function (Blueprint $table) {
+                $table->foreign('backup_host_id')->references('id')->on('backup_hosts');
+            });
+        }
+
+        if (Schema::hasColumn('backups', 'disk')) {
+            Schema::table('backups', function (Blueprint $table) {
+                $table->dropColumn('disk');
+            });
+        }
     }
 
     /**
@@ -78,8 +113,8 @@ return new class extends Migration
             $table->dropColumn('backup_host_id');
         });
 
-        Schema::dropIfExists('backup_hosts');
-
         Schema::dropIfExists('backup_host_node');
+
+        Schema::dropIfExists('backup_hosts');
     }
 };

docker/entrypoint.sh

@@ -4,36 +4,19 @@
 # check for .env file or symlink and generate app keys if missing
 if [ -f /pelican-data/.env ]; then
   echo ".env vars exist."
-  # load specific env vars from .env used in the entrypoint if they are not already set
-  for VAR in APP_KEY APP_INSTALLED DB_CONNECTION DB_HOST DB_PORT TRUSTED_PROXIES; do
+  # load specific env vars from .env used in the entrypoint and they are not already set
+  for VAR in "APP_KEY" "APP_INSTALLED" "DB_CONNECTION" "DB_HOST" "DB_PORT" "TRUSTED_PROXIES"; do
     echo "checking for ${VAR}"
-
-    # the container environment takes precedence, matching Laravel's own behavior
-    eval "CURRENT=\${${VAR}:-}"
-    if [ -n "${CURRENT}" ]; then
-      echo "${VAR} already set in environment, skipping"
-      continue
-    fi
-
-    # match only a real assignment at the start of a line, never comments or
-    # other variables that merely contain the name
-    if ! LINE=$(grep -m1 "^${VAR}=" .env); then
-      echo "didn't find variable to set"
-      continue
-    fi
-
     ## skip if it looks like it might try to execute code
-    case "$LINE" in
-      *'$('*|*'`'*)
-        echo "var in .env may be executable, skipping"
-        continue
-        ;;
-    esac
-
-    echo "loading ${VAR} from .env"
-    # strip quotes and carriage returns so values from quoted or
-    # Windows-edited .env files export cleanly
-    export "$(echo "$LINE" | tr -d "\r\"'")"
+    if (grep "${VAR}" .env | grep -qE "\$\(|=\`|\$#"); then echo "var in .env may be executable or a comment, skipping"; continue; fi
+    # if the variable is in .env then set it
+    if (grep -q "${VAR}" .env); then 
+      echo "loading ${VAR} from .env"
+      export "$(grep "${VAR}" .env | sed 's/"//g')"
+      continue
+    fi
+    ## variable wasn't loaded or in the env to set
+    echo "didn't find variable to set"
   done
 else
   echo ".env vars don't exist."
@@ -43,7 +26,7 @@ else
   # manually generate a key because key generate --force fails
   if [ -z "${APP_KEY}" ]; then
     echo "No key set, Generating key."
-    APP_KEY="base64:$(head -c 32 /dev/urandom | base64)"
+    APP_KEY=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 32 | head -n 1)
     echo "APP_KEY=$APP_KEY" > /pelican-data/.env
     echo "Generated app key written to .env file"
   else
@@ -74,13 +57,8 @@ if [ "${APP_INSTALLED}" = "true" ];  then
     echo "using sqlite database"
   fi
   
-  # run migration, unless disabled (e.g. when running multiple replicas
-  # against the same database)
-  if [ "${SKIP_MIGRATIONS:-false}" = "true" ]; then
-    echo "Skipping migrations (SKIP_MIGRATIONS=true)"
-  else
-    php artisan migrate --force
-  fi
+  # run migration
+  php artisan migrate --force
 
   php artisan p:plugin:composer
 fi