chore: CI split dev/prod workflows, archive old plans, new plan docs

update.sh

@@ -7,7 +7,30 @@ echo "========================================="
 
 STATE_FILE=".update-state"
 FORCE_REBUILD=false
-[ "$1" = "--force" ] && FORCE_REBUILD=true
+BACKUP=false
+NO_MIGRATE=false
+
+# Parse command line arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --force)
+            FORCE_REBUILD=true
+            shift
+            ;;
+        --backup)
+            BACKUP=true
+            shift
+            ;;
+        --no-migrate)
+            NO_MIGRATE=true
+            shift
+            ;;
+        *)
+            echo "[!] Unknown option: $1"
+            exit 1
+            ;;
+    esac
+done
 
 # 1. Pastikan file env ada
 if [ ! -f .env ]; then
@@ -54,6 +77,57 @@ if [ "$NEEDS_REBUILD" = true ]; then
     echo "[+] Sourcing environment variables from root .env..."
     set -a && . .env && set +a
 
+    # Volume safety check
+    echo "[+] Checking PostgreSQL volume safety..."
+    if ! docker volume inspect pgdata >/dev/null 2>&1; then
+        echo "[!] WARNING: PostgreSQL volume 'pgdata' not found. It will be created on container startup."
+        echo "[!] If you expect existing data, check your volume configuration."
+    else
+        echo "[+] PostgreSQL volume 'pgdata' found."
+    fi
+
+    # Backup option
+    if [ "$BACKUP" = true ]; then
+        echo "[+] Creating backup of PostgreSQL data..."
+        BACKUP_DIR="./backups"
+        mkdir -p "$BACKUP_DIR"
+        TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+        BACKUP_FILE="$BACKUP_DIR/pgdata_backup_$TIMESTAMP.tar"
+        
+        # Backup the volume using a temporary container
+        if docker run --rm -v pgdata:/data -v "$(pwd)/$BACKUP_DIR":/backup ubuntu tar czf "/backup/pgdata_backup_$TIMESTAMP.tar.gz" -C /data . 2>/dev/null; then
+            echo "[+] Backup created successfully: $BACKUP_FILE.gz"
+        else
+            echo "[!] Backup failed. Continuing without backup."
+        fi
+    fi
+
+    # Password sync if DB_PASSWORD changed
+    echo "[+] Checking for PostgreSQL password synchronization..."
+    # Get current DB_PASSWORD from .env
+    CURRENT_DB_PASSWORD="${DB_PASSWORD:-nexusguard}"
+    
+    # Try to connect to existing postgres container and update password if needed
+    POSTGRES_CONTAINER=$(docker compose ps -q postgres 2>/dev/null)
+    if [ -n "$POSTGRES_CONTAINER" ]; then
+        echo "[+] Found running PostgreSQL container. Checking password..."
+        # Test if current password works
+        if docker exec "$POSTGRES_CONTAINER" pg_isready -U nexusguard -d nexusguard 2>/dev/null; then
+            echo "[+] Current password works. No password update needed."
+        else
+            echo "[!] Current password failed. Attempting to update PostgreSQL password to match .env..."
+            # Try to alter user password (requires superuser or same user)
+            if docker exec -u postgres "$POSTGRES_CONTAINER" psql -c "ALTER USER nexusguard WITH PASSWORD '$CURRENT_DB_PASSWORD';" 2>/dev/null; then
+                echo "[+] PostgreSQL password updated successfully."
+            else
+                echo "[!] Failed to update password. You may need to manually update it or check permissions."
+                echo "[!] Continuing update - authentication may fail if password mismatch."
+            fi
+        fi
+    else
+        echo "[i] No running PostgreSQL container found. Password will be set on container initialization (if data directory is empty)."
+    fi
+
     echo "[+] Stopping existing containers..."
     docker compose down
 
@@ -63,8 +137,12 @@ if [ "$NEEDS_REBUILD" = true ]; then
     echo "[+] Restarting containers..."
     docker compose up -d
 
-    echo "[+] Running automated database migrations..."
-    docker exec nexus-guard-suite-server-core-1 ./server-core -migrate-prod || echo "[!] Migration skipped or failed. It might not be needed."
+    if [ "$NO_MIGRATE" = false ]; then
+        echo "[+] Running automated database migrations..."
+        docker exec nexus-guard-suite-server-core-1 ./server-core -migrate-prod || echo "[!] Migration skipped or failed. It might not be needed."
+    else
+        echo "[+] Skipping database migration (--no-migrate flag used)."
+    fi
 
     echo "[+] Backfilling interface addresses..."
     docker exec nexus-guard-suite-server-core-1 ./server-core -backfill-interface 2>/dev/null || echo "[!] Backfill skipped or not needed."
@@ -79,6 +157,9 @@ if [ "$NEEDS_REBUILD" = true ]; then
     echo " Update & Deployment complete!           "
     echo " Dashboard : http://localhost:${WEB_PORT:-80}"
     echo " API Port  : ${API_PORT:-8080}"
+    if [ "$BACKUP" = true ]; then
+        echo " Backup    : Stored in ./backups/ directory"
+    fi
     echo "========================================="
 else
     echo "========================================="