From 88de47d1bb84e341d2f05052eb6d1504aeb43f97 Mon Sep 17 00:00:00 2001
From: Niek Otten <not@respellion.nl>
Date: Wed, 24 Jun 2026 11:55:15 +0200
Subject: [PATCH] fix(infra): harden oz-db healthcheck and raise compose-up
 timeout (refs #30)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three root-cause fixes for the oz-init CI failure:

1. Smoke timeout: add --wait-timeout 300 to `docker compose up --wait`
   so CI has 5 minutes instead of the 60-second default in older Compose
   v2 releases (migrations alone take 50 s locally).

2. PostGIS race: the old healthcheck used pg_isready which only checks
   TCP connectivity — it passes before the postgis/postgis init scripts
   have run SELECT PostGIS_Version(). The new check adds a psql probe so
   oz-init does not start until PostGIS is actually available.

3. Remove :z from volume mounts: the SELinux re-label flag is
   Podman/Fedora-specific and a no-op (or unexpected) under Docker on
   ubuntu-latest; plain :ro is correct for both runtimes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Makefile                          |  2 +-
 infra/docker-compose.yml          | 17 ++++++++++-------
 infra/openzaak/docker-compose.yml | 13 +++++++------
 3 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/Makefile b/Makefile
index 49442f5..6e60f21 100644
--- a/Makefile
+++ b/Makefile
@@ -47,7 +47,7 @@ unit:
 
 ## smoke: compose up (wait for healthy), curl /health, then tear down
 smoke:
-	docker compose -f $(COMPOSE) up -d --build --wait
+	docker compose -f $(COMPOSE) up -d --build --wait --wait-timeout 300
 	bash -c 'curl -fsS $(HEALTH_URL); rc=$$?; docker compose -f $(COMPOSE) down --volumes; exit $$rc'
 
 ## down: stop and remove the local stack
diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml
index 1f5ad2a..699813e 100644
--- a/infra/docker-compose.yml
+++ b/infra/docker-compose.yml
@@ -33,10 +33,13 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      # so oz-init migrations can safely start (avoids race on cold container start).
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 3s
-      retries: 10
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -66,7 +69,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./openzaak/setup_configuration:/app/setup_configuration:ro,z
+      - ./openzaak/setup_configuration:/app/setup_configuration:ro
     depends_on:
       oz-db:
         condition: service_healthy
@@ -142,7 +145,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro,z
+      - ./opennotificaties/setup_configuration:/app/setup_configuration:ro
     depends_on:
       nrc-db:
         condition: service_healthy
@@ -191,7 +194,7 @@ services:
     ports:
       - "8180:8080"
     volumes:
-      - ./keycloak/realms:/opt/keycloak/data/import:ro,z
+      - ./keycloak/realms:/opt/keycloak/data/import:ro
     networks: [cg]
 
   # ── Flowable (S-03) ──────────────────────────────────────────────────────
@@ -228,7 +231,7 @@ services:
     image: docker.io/curlimages/curl:latest
     restart: "no"
     volumes:
-      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro,z
+      - ../workflows/registratie.bpmn:/work/registratie.bpmn:ro
     command:
       - sh
       - -c
diff --git a/infra/openzaak/docker-compose.yml b/infra/openzaak/docker-compose.yml
index 6316eaa..b61bfe9 100644
--- a/infra/openzaak/docker-compose.yml
+++ b/infra/openzaak/docker-compose.yml
@@ -18,10 +18,13 @@ services:
     volumes:
       - oz-db:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak"]
+      # pg_isready only checks TCP; the second clause verifies PostGIS is installed
+      # so oz-init migrations can safely start (avoids race on cold container start).
+      test: ["CMD-SHELL", "pg_isready -U openzaak -d openzaak && psql -U openzaak -d openzaak -c 'SELECT PostGIS_Version();' -q 2>/dev/null"]
       interval: 5s
-      timeout: 3s
-      retries: 10
+      timeout: 5s
+      retries: 30
+      start_period: 15s
     networks: [cg]
 
   oz-redis:
@@ -53,9 +56,7 @@ services:
       RUN_SETUP_CONFIG: "true"
     command: /setup_configuration.sh
     volumes:
-      # :z relabels for SELinux; the dir/file must be world-readable for the
-      # container user (rootless Podman uid mapping). See docs/runbooks/openzaak.md.
-      - ./setup_configuration:/app/setup_configuration:ro,z
+      - ./setup_configuration:/app/setup_configuration:ro
     depends_on:
       oz-db:
         condition: service_healthy