Skip to content

fix(config): declare kura backend in release configs#55

Merged
Taure merged 5 commits into
mainfrom
fix/kura-v2-backend-config
Jun 25, 2026
Merged

fix(config): declare kura backend in release configs#55
Taure merged 5 commits into
mainfrom
fix/kura-v2-backend-config

Conversation

@Taure

@Taure Taure commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Problem

Self-host users following https://asobi.dev/docs/self-host pull ghcr.io/widgrensit/asobi_lua:latest and the container crashes on startup:

{application_start_failure,kura,
  {bad_return,{{kura_app,start,[normal,[]]},
    {'EXIT',{{no_pool_module_configured,asobi_repo}, ...}}}}}

Postgres stays up and idle because asobi never gets far enough to dial it.

Root cause

kura v2 (adopted in the kura v2 bump) resolves a repo's pool/driver module from its {backend, _} key via kura_app:resolve_backends/0. The release configs baked into the published image lost that key, so kura never sets pool_module and kura_db:get_pool_module/1 errors.

CI is green because it boots the dev config; the bug only existed in the configs baked into the release image.

Fix

  • Add {backend, kura_backend_postgres} to config/prod_sys.config.src and config/dev_sys.config.src (resolves to pool_module => kura_pool_pgo, dialect => kura_dialect_pg).
  • Add asobi_lua_release_config_tests — parses the release configs and asserts the kura repo declares a resolvable backend, closing the gap where prod-config drift shipped without any test exercising it.

After merge the asobi_lua:latest image must be republished so docker compose pull picks up the fix.

Taure added 5 commits June 25, 2026 19:05
kura v2 resolves a repo's pool module from its {backend, _} key. The
release configs baked into the published asobi_lua image lost this key
in the v2 bump, so self-host startup crashes with
{no_pool_module_configured, asobi_repo} before Postgres is ever dialed.

Add {backend, kura_backend_postgres} to dev + prod, plus a guard test
that parses the release configs and asserts the kura repo declares a
resolvable backend. CI only boots the dev config, so prod-config drift
shipped silently.
GHSA-jfc2-q6qh-g5x8 (HIGH, multipart header buffer accumulation) hits
cowboy versions >= 2.0.0, < 2.15.0. asobi_lua was inheriting the stale
2.13.0 pin transitively. Direct-pin cowboy 2.15.0 plus the standard
cowlib/ranch override so rebar3 can resolve the package's "and"-syntax
dep declarations.

rebar3 audit -i GHSA-g2wm-735q-3f56 now reports 0 vulnerabilities (was
1: cowboy 2.13.0 HIGH).
The per-app cowboy override was the wrong layer (and its audit-ignores
broke CI: this repo's erlang-ci pin predates the audit-ignores input).
cowboy/cowlib are owned by nova; bumping nova to 0.14.3 (widgrensit/asobi#130)
brings cowboy 2.15.0 + cowlib 2.17.1 transitively. This PR is now the pure
kura backend config fix; cowboy lands once #130 is on asobi main and this
re-locks.
Picks up the asobi main bump (widgrensit/asobi#130). cowboy 2.15.0 closes
GHSA-jfc2-q6qh-g5x8; cowlib 2.17.1 clears GHSA-g2wm-735q-3f56. rebar3 audit
reports 0 vulnerabilities with no ignores.
@Taure Taure merged commit 456e977 into main Jun 25, 2026
15 checks passed
@Taure Taure deleted the fix/kura-v2-backend-config branch June 25, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant