fix(infra): GlitchTip profiles + SQL safety + mem_limit (#204 review fixes)

- Add profiles: ["glitchtip"] to glitchtip-web and glitchtip-worker so
  plain `compose up -d` does not start them before secrets/DB are ready
- Fix SQL injection vector: pass password via psql -v variable + format(%L)
  instead of bare shell interpolation in heredoc
- glitchtip-web mem_limit: 256m -> 512m (upstream minimum for Django+gunicorn)
- glitchtip-worker mem_limit: 256m -> 384m (handles CELERY_WORKER_AUTOSCALE)
- Move CELERY_WORKER_AUTOSCALE to worker only (no-op on gunicorn web service)
- Pin image glitchtip/glitchtip:latest -> 6.1.6
- Add healthcheck to glitchtip-web (wget /api/0/)
- bootstrap: use --profile glitchtip for pull/up; add COMPOSE_PROFILES note
- bootstrap: use wget (consistent with compose healthcheck) in wait loop

docker-compose.prod.yml

@@ -122,8 +122,12 @@ services:
     command: ["celery", "-A", "app.workers.celery_app", "beat", "--loglevel=info"]
 
   glitchtip-web:
-    image: glitchtip/glitchtip:latest
+    image: glitchtip/glitchtip:6.1.6
     container_name: glitchtip-web
+    # profiles: ["glitchtip"] keeps this service from starting on plain `compose up -d`.
+    # Bootstrap script activates the profile after DB + secrets are ready.
+    # On subsequent deploys, set COMPOSE_PROFILES=glitchtip in /opt/gendesign/.env.
+    profiles: ["glitchtip"]
     depends_on:
       postgres:
         condition: service_healthy
@@ -139,14 +143,20 @@ services:
       DEFAULT_FROM_EMAIL: errors@gendsgn.ru
       ENABLE_USER_REGISTRATION: "false"
       ENABLE_ORGANIZATION_CREATION: "false"
-      CELERY_WORKER_AUTOSCALE: "1,3"
     restart: always
-    mem_limit: 256m
+    mem_limit: 512m
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://localhost:8080/api/0/"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
     networks: [default]
 
   glitchtip-worker:
-    image: glitchtip/glitchtip:latest
+    image: glitchtip/glitchtip:6.1.6
     container_name: glitchtip-worker
+    profiles: ["glitchtip"]
     depends_on:
       postgres:
         condition: service_healthy
@@ -157,8 +167,9 @@ services:
       DATABASE_URL: postgres://glitchtip:${GLITCHTIP_DB_PASS}@postgres:5432/glitchtip
       REDIS_URL: redis://redis:6379/2
       SECRET_KEY: ${GLITCHTIP_SECRET}
+      CELERY_WORKER_AUTOSCALE: "1,3"
     restart: always
-    mem_limit: 256m
+    mem_limit: 384m
     networks: [default]
 
   caddy:

scripts/bootstrap_glitchtip.sh

@@ -48,19 +48,24 @@ for i in $(seq 1 30); do
 done
 
 # ── Create glitchtip DB + user (idempotent) ────────────────────────────────
+# Password is passed via psql variable -v to avoid SQL injection from special
+# chars (quotes, backslashes) in $GLITCHTIP_DB_PASS.  format('%L', :'gt_pass')
+# properly quotes the value server-side, so the shell never interpolates it
+# into the SQL string.
 echo "==> Creating glitchtip database and user (idempotent)..."
-$COMPOSE exec -T postgres psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" \
+$COMPOSE exec -T postgres \
-    -v ON_ERROR_STOP=on <<SQL
+    psql -U "$POSTGRES_USER" -d "$POSTGRES_DB" \
-DO \$\$
+    -v "gt_pass=$GLITCHTIP_DB_PASS" \
+    -v ON_ERROR_STOP=on <<'SQL'
+DO $$
 BEGIN
     IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'glitchtip') THEN
-        CREATE ROLE glitchtip LOGIN PASSWORD '$GLITCHTIP_DB_PASS';
+        EXECUTE format('CREATE ROLE glitchtip LOGIN PASSWORD %L', :'gt_pass');
         RAISE NOTICE 'Created role glitchtip';
     ELSE
         RAISE NOTICE 'Role glitchtip already exists';
     END IF;
-END
+END$$;
-\$\$;
 
 SELECT 'CREATE DATABASE glitchtip OWNER glitchtip'
 WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'glitchtip')
@@ -68,16 +73,26 @@ WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'glitchtip')
 SQL
 
 # ── Start GlitchTip containers ─────────────────────────────────────────────
+# glitchtip-web and glitchtip-worker carry `profiles: ["glitchtip"]` in compose,
+# so plain `up -d` skips them.  Activate the profile explicitly here.
+# After bootstrap succeeds, add COMPOSE_PROFILES=glitchtip to /opt/gendesign/.env
+# so that future automatic deploys also bring these services up.
 echo "==> Pulling glitchtip image..."
-$COMPOSE pull glitchtip-web glitchtip-worker
+$COMPOSE --profile glitchtip pull glitchtip-web glitchtip-worker
 
 echo "==> Starting glitchtip-web and glitchtip-worker..."
-$COMPOSE up -d glitchtip-web glitchtip-worker
+$COMPOSE --profile glitchtip up -d glitchtip-web glitchtip-worker
+
+echo ""
+echo "NOTE: Add the following line to /opt/gendesign/.env so future deploys"
+echo "      keep GlitchTip running:"
+echo "  COMPOSE_PROFILES=glitchtip"
 
 # ── Wait for glitchtip-web to become healthy ───────────────────────────────
+# Use wget (available in glitchtip image) matching the compose healthcheck probe.
 echo "==> Waiting for glitchtip-web to become healthy (up to 60s)..."
 for i in $(seq 1 30); do
-    if $COMPOSE exec -T glitchtip-web curl -fsS http://localhost:8080/healthz/ >/dev/null 2>&1; then
+    if $COMPOSE exec -T glitchtip-web wget -q --spider http://localhost:8080/api/0/ >/dev/null 2>&1; then
         echo "    glitchtip-web is healthy."
         break
     fi