Expand description
Bringing every tenant database to the current schema.
boot() migrates only the global database, and provisioning migrates a
tenant once, at creation. Nothing else ever touched an existing tenant — so
before this module the first tenant-facing migration after launch reached
the global database and newly registered users, and no existing user, ever.
CI stayed green (fresh databases), the deploy stayed green (global
migrates), and each pre-existing user broke at runtime, one feature at a
time.
This runs as its own process, never inside a serving one. boot() is
awaited before either binary serves and a boot error exits, so a fan-out
there would let one unreachable tenant crash-loop web and sshd for every
user.
Reconciliation is against each tenant’s own _sqlx_migrations, via the
ordinary migrator. There is deliberately no central version table: applied
state is already recorded per tenant, a mirror can drift, and under the
shared DDL-only rule its CREATE TABLE would land in every tenant database
anyway.
Structs§
Enums§
- Outcome
- What became of one tenant.